www.reversinglabs.com Open in urlscan Pro
2606:2c40::c73c:671f Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
Submission: On August 07 via api (August 7th 2023, 12:42:13 pm UTC) from DE — Scanned from DE

Summary HTTP 152 Redirects Links 25 Behaviour Indicators

Summary

This website contacted 47 IPs in 3 countries across 37 domains to perform 152 HTTP transactions. The main IP is 2606:2c40::c73c:671f, located in United States and belongs to CLOUDFLARESPECTRUM Cloudflare, Inc., US. The main domain is www.reversinglabs.com.
TLS certificate: Issued by GTS CA 1P5 on July 24th 2023. Valid for: 3 months.

This is the only time www.reversinglabs.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
63	2606:2c40::c7... 2606:2c40::c73c:671f	209242 (CLOUDFLAR...) (CLOUDFLARESPECTRUM Cloudflare)
1	151.101.1.181 151.101.1.181	54113 (FASTLY) (FASTLY)
1	2620:1ec:46::45 2620:1ec:46::45	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	2606:4700::68... 2606:4700::6812:cfc9	13335 (CLOUDFLAR...) (CLOUDFLARENET)
9	2606:4700::68... 2606:4700::6812:e0f	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6811:190e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6812:8e65	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a06:98c1:312... 2a06:98c1:3121::3	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	65.9.99.119 65.9.99.119	16509 (AMAZON-02) (AMAZON-02)
1	52.222.139.19 52.222.139.19	16509 (AMAZON-02) (AMAZON-02)
4	2a00:1450:400... 2a00:1450:4001:829::2008	15169 (GOOGLE) (GOOGLE)
4	2a03:2880:f08... 2a03:2880:f083:9:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
2	2a00:1450:400... 2a00:1450:4001:80e::200a	15169 (GOOGLE) (GOOGLE)
1	65.9.95.27 65.9.95.27	16509 (AMAZON-02) (AMAZON-02)
5	2a00:1450:400... 2a00:1450:4001:829::2003	15169 (GOOGLE) (GOOGLE)
2	2001:4860:480... 2001:4860:4802:36::178	15169 (GOOGLE) (GOOGLE)
1	2a02:26f0:780... 2a02:26f0:780::210:a423	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	2a04:4e42:400... 2a04:4e42:400::396	54113 (FASTLY) (FASTLY)
1	2600:9000:212... 2600:9000:2127:9800:9:d7d4:1380:93a1	16509 (AMAZON-02) (AMAZON-02)
1	52.207.107.232 52.207.107.232	14618 (AMAZON-AES) (AMAZON-AES)
3	2a03:2880:f17... 2a03:2880:f176:84:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
1	2606:4700::68... 2606:4700::6810:650c	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	146.75.116.157 146.75.116.157	54113 (FASTLY) (FASTLY)
1	2606:4700::68... 2606:4700::6811:836e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6810:8ace	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6812:18c4	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6810:75be	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2606:4700::68... 2606:4700::6811:6bc7	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6811:64ac	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	2606:4700::68... 2606:4700::6813:9b53	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2606:4700::68... 2606:4700::6811:d2f3	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:806::2002	15169 (GOOGLE) (GOOGLE)
6	2001:4860:480... 2001:4860:4802:34::36	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:400c:c0b::9a	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:810::2003	15169 (GOOGLE) (GOOGLE)
1	151.101.1.140 151.101.1.140	54113 (FASTLY) (FASTLY)
10	2.20.143.57 2.20.143.57	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	2600:9000:212... 2600:9000:2127:b200:2:53b2:240:93a1	16509 (AMAZON-02) (AMAZON-02)
4 4	2620:1ec:21::14 2620:1ec:21::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	13.107.42.14 13.107.42.14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	2606:4700::68... 2606:4700::6811:d6f3	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6811:c9cc	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:82f::2004	15169 (GOOGLE) (GOOGLE)
1	104.244.42.200 104.244.42.200	13414 (TWITTER) (TWITTER)
1	2a02:26f0:ab0... 2a02:26f0:ab00::214:8e70	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	3.33.220.150 3.33.220.150	16509 (AMAZON-02) (AMAZON-02)
1	2606:4700::68... 2606:4700::6813:9a53	13335 (CLOUDFLAR...) (CLOUDFLARENET)
152	47

63 2606:2c40::c73c:671f (United States)

ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US)

www.reversinglabs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.1.181 (United States)

ASN54113 (FASTLY, US)

play.vidyard.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:1ec:46::45 (United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

platform.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:cfc9 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn2.hubspot.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2606:4700::6812:e0f (United States)

ASN13335 (CLOUDFLARENET, US)

3375217.fs1.hubspotusercontent-na1.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:190e (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:8e65 (United States)

ASN13335 (CLOUDFLARENET, US)

static.hsappstatic.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a06:98c1:3121::3 (United States)

ASN13335 (CLOUDFLARENET, US)

cookieinfoscript.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 65.9.99.119 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-65-9-99-119.prg50.r.cloudfront.net

js.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.222.139.19 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-222-139-19.ams50.r.cloudfront.net

static.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:829::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a03:2880:f083:9:face:b00c:0:3 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:80e::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 65.9.95.27 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-65-9-95-27.prg50.r.cloudfront.net

script.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:829::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2001:4860:4802:36::178 (United States)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:780::210:a423 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

snap.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42:400::396 (United States)

ASN54113 (FASTLY, US)

www.redditstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2127:9800:9:d7d4:1380:93a1 (United States)

ASN16509 (AMAZON-02, US)

cdn.metadata.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.207.107.232 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-207-107-232.compute-1.amazonaws.com

q.quora.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a03:2880:f176:84:face:b00c:0:25de (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:650c (United States)

ASN13335 (CLOUDFLARENET, US)

ws.zoominfo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 146.75.116.157 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

platform.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:836e (United States)

ASN13335 (CLOUDFLARENET, US)

js.hsleadflows.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:8ace (United States)

ASN13335 (CLOUDFLARENET, US)

js.hs-analytics.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:18c4 (United States)

ASN13335 (CLOUDFLARENET, US)

js.hs-banner.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:75be (United States)

ASN13335 (CLOUDFLARENET, US)

js.hsadspixel.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6811:6bc7 (United States)

ASN13335 (CLOUDFLARENET, US)

js.hscollectedforms.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
forms.hscollectedforms.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:64ac (United States)

ASN13335 (CLOUDFLARENET, US)

js.usemessages.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2606:4700::6813:9b53 (United States)

ASN13335 (CLOUDFLARENET, US)

app.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
track.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6811:d2f3 (United States)

ASN13335 (CLOUDFLARENET, US)

forms.hsforms.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:806::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2001:4860:4802:34::36 (United States)

ASN15169 (GOOGLE, US)

region1.analytics.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
region1.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c0b::9a (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:810::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.1.140 (United States)

ASN54113 (FASTLY, US)

alb.reddit.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 2.20.143.57 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a2-20-143-57.deploy.static.akamaitechnologies.com

j.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
c.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
b.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:9000:2127:b200:2:53b2:240:93a1 (United States)

ASN16509 (AMAZON-02, US)

cdn.linkedin.oribi.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2620:1ec:21::14 (United States) 4 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.107.42.14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px4.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:d6f3 (United States)

ASN13335 (CLOUDFLARENET, US)

forms-na1.hsforms.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:c9cc (United States)

ASN13335 (CLOUDFLARENET, US)

api.hubapi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82f::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.200 (United States)

ASN13414 (TWITTER, US)

syndication.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:ab00::214:8e70 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

ipv6.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.33.220.150 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: a12b7a488abeaa9e4.awsglobalaccelerator.com

insight.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6813:9a53 (United States)

ASN13335 (CLOUDFLARENET, US)

forms.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
63	reversinglabs.com www.reversinglabs.com	2 MB
11	6sc.co j.6sc.co — Cisco Umbrella Rank: 5439 c.6sc.co — Cisco Umbrella Rank: 8622 ipv6.6sc.co — Cisco Umbrella Rank: 5612 b.6sc.co — Cisco Umbrella Rank: 3549	18 KB
9	hubspotusercontent-na1.net 3375217.fs1.hubspotusercontent-na1.net	213 KB
6	google.com region1.analytics.google.com — Cisco Umbrella Rank: 2577 www.google.com — Cisco Umbrella Rank: 3	884 B
6	linkedin.com 4 redirects platform.linkedin.com — Cisco Umbrella Rank: 3010 px.ads.linkedin.com — Cisco Umbrella Rank: 391 www.linkedin.com — Cisco Umbrella Rank: 539 px4.ads.linkedin.com — Cisco Umbrella Rank: 6039	166 KB
5	hubspot.com app.hubspot.com — Cisco Umbrella Rank: 5177 track.hubspot.com — Cisco Umbrella Rank: 2254 forms.hubspot.com — Cisco Umbrella Rank: 4396	4 KB
5	gstatic.com fonts.gstatic.com	80 KB
4	facebook.net connect.facebook.net — Cisco Umbrella Rank: 170	221 KB
4	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 73	361 KB
3	hsforms.com forms.hsforms.com — Cisco Umbrella Rank: 4156 forms-na1.hsforms.com — Cisco Umbrella Rank: 6801	3 KB
3	twitter.com platform.twitter.com — Cisco Umbrella Rank: 1003 syndication.twitter.com — Cisco Umbrella Rank: 1212	131 KB
3	facebook.com www.facebook.com — Cisco Umbrella Rank: 107	269 B
3	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 55 region1.google-analytics.com — Cisco Umbrella Rank: 1869	21 KB
2	oribi.io cdn.linkedin.oribi.io — Cisco Umbrella Rank: 870	751 B
2	google.de www.google.de — Cisco Umbrella Rank: 5576	562 B
2	doubleclick.net googleads.g.doubleclick.net — Cisco Umbrella Rank: 54 stats.g.doubleclick.net — Cisco Umbrella Rank: 115	2 KB
2	hscollectedforms.net js.hscollectedforms.net — Cisco Umbrella Rank: 4645 forms.hscollectedforms.net — Cisco Umbrella Rank: 4755	26 KB
2	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 77	2 KB
2	hotjar.com static.hotjar.com — Cisco Umbrella Rank: 745 script.hotjar.com — Cisco Umbrella Rank: 967	59 KB
2	adsrvr.org js.adsrvr.org — Cisco Umbrella Rank: 1375 insight.adsrvr.org — Cisco Umbrella Rank: 604	3 KB
1	hubapi.com api.hubapi.com — Cisco Umbrella Rank: 3473	1 KB
1	reddit.com alb.reddit.com — Cisco Umbrella Rank: 1468	637 B
1	usemessages.com js.usemessages.com — Cisco Umbrella Rank: 4789	22 KB
1	hsadspixel.net js.hsadspixel.net — Cisco Umbrella Rank: 3228	3 KB
1	hs-banner.com js.hs-banner.com — Cisco Umbrella Rank: 2192	16 KB
1	hs-analytics.net js.hs-analytics.net — Cisco Umbrella Rank: 2187	21 KB
1	hsleadflows.net js.hsleadflows.net — Cisco Umbrella Rank: 4274	86 KB
1	zoominfo.com ws.zoominfo.com — Cisco Umbrella Rank: 4388	2 KB
1	quora.com q.quora.com — Cisco Umbrella Rank: 3965	422 B
1	metadata.io cdn.metadata.io — Cisco Umbrella Rank: 33170	2 KB
1	redditstatic.com www.redditstatic.com — Cisco Umbrella Rank: 1326	8 KB
1	licdn.com snap.licdn.com — Cisco Umbrella Rank: 783	5 KB
1	cookieinfoscript.com cookieinfoscript.com — Cisco Umbrella Rank: 90872	4 KB
1	hsappstatic.net static.hsappstatic.net — Cisco Umbrella Rank: 5423	5 KB
1	cloudflare.com cdnjs.cloudflare.com — Cisco Umbrella Rank: 257	27 KB
1	hubspot.net cdn2.hubspot.net — Cisco Umbrella Rank: 7970	2 KB
1	vidyard.com play.vidyard.com — Cisco Umbrella Rank: 12467	23 KB
152	37

	Domain	Requested by
63	www.reversinglabs.com	www.reversinglabs.com js.usemessages.com
9	3375217.fs1.hubspotusercontent-na1.net	www.reversinglabs.com
8	b.6sc.co	www.reversinglabs.com
5	region1.analytics.google.com	www.googletagmanager.com
5	fonts.gstatic.com	fonts.googleapis.com
4	connect.facebook.net	www.reversinglabs.com connect.facebook.net
4	www.googletagmanager.com	www.reversinglabs.com www.googletagmanager.com www.google-analytics.com js.hsadspixel.net
3	track.hubspot.com
3	px.ads.linkedin.com	3 redirects
3	www.facebook.com	www.reversinglabs.com
2	cdn.linkedin.oribi.io	snap.licdn.com
2	www.google.de	www.reversinglabs.com
2	forms.hsforms.com	www.reversinglabs.com
2	platform.twitter.com	www.reversinglabs.com platform.twitter.com
2	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com
2	fonts.googleapis.com	www.reversinglabs.com
1	forms.hubspot.com	js.hsleadflows.net
1	insight.adsrvr.org	js.adsrvr.org
1	region1.google-analytics.com	www.googletagmanager.com
1	ipv6.6sc.co	j.6sc.co
1	c.6sc.co	j.6sc.co
1	syndication.twitter.com	platform.twitter.com
1	www.google.com	www.reversinglabs.com
1	forms.hscollectedforms.net	js.hscollectedforms.net
1	api.hubapi.com	js.hsadspixel.net
1	forms-na1.hsforms.com	www.reversinglabs.com
1	px4.ads.linkedin.com	www.reversinglabs.com
1	www.linkedin.com	1 redirects
1	j.6sc.co	www.reversinglabs.com
1	alb.reddit.com	www.reversinglabs.com
1	stats.g.doubleclick.net	www.googletagmanager.com
1	googleads.g.doubleclick.net	www.googletagmanager.com
1	app.hubspot.com	www.reversinglabs.com
1	js.usemessages.com	www.reversinglabs.com
1	js.hscollectedforms.net	www.reversinglabs.com
1	js.hsadspixel.net	www.reversinglabs.com
1	js.hs-banner.com	www.reversinglabs.com
1	js.hs-analytics.net	www.reversinglabs.com
1	js.hsleadflows.net	www.reversinglabs.com
1	ws.zoominfo.com	www.reversinglabs.com
1	q.quora.com	www.reversinglabs.com
1	cdn.metadata.io	www.reversinglabs.com
1	www.redditstatic.com	www.googletagmanager.com
1	snap.licdn.com	www.googletagmanager.com
1	script.hotjar.com	static.hotjar.com
1	static.hotjar.com	www.reversinglabs.com
1	js.adsrvr.org	www.reversinglabs.com
1	cookieinfoscript.com	www.reversinglabs.com
1	static.hsappstatic.net	www.reversinglabs.com
1	cdnjs.cloudflare.com	www.reversinglabs.com
1	cdn2.hubspot.net	www.reversinglabs.com
1	platform.linkedin.com	www.reversinglabs.com
1	play.vidyard.com	www.reversinglabs.com
152	53

This site contains links to these domains. Also see Links.

Domain
register.reversinglabs.com
support.reversinglabs.com
rli.reversinglabs.com
www.secure.software
github.com
docs.python.org
blog.reversinglabs.com
pypi.org
twitter.com
www.linkedin.com
www.youtube.com
www.facebook.com
www.instagram.com
cookieinfoscript.com

Subject Issuer	Validity	Valid
www.reversinglabs.com GTS CA 1P5	`2023-07-24` - `2023-10-22`	3 months	crt.sh
*.vidyard.com GlobalSign Atlas R3 DV TLS CA 2023 Q2	`2023-07-01` - `2024-08-01`	a year	crt.sh
platform.linkedin.com DigiCert SHA2 Secure Server CA	`2023-07-24` - `2024-01-24`	6 months	crt.sh
hubspot.net Cloudflare Inc ECC CA-3	`2023-04-06` - `2024-04-05`	a year	crt.sh
hubspotusercontent-na1.net Cloudflare Inc ECC CA-3	`2023-01-26` - `2024-01-25`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2023-07-03` - `2024-07-02`	a year	crt.sh
hsappstatic.net Cloudflare Inc ECC CA-3	`2023-04-10` - `2024-04-09`	a year	crt.sh
cookieinfoscript.com E1	`2023-06-14` - `2023-09-12`	3 months	crt.sh
*.adsrvr.org GlobalSign GCC R3 DV TLS CA 2020	`2023-04-12` - `2024-05-13`	a year	crt.sh
*.hotjar.com Amazon ECDSA 256 M01	`2023-03-09` - `2024-04-06`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2023-07-10` - `2023-10-02`	3 months	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2023-05-16` - `2023-08-14`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2023-07-10` - `2023-10-02`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2023-07-10` - `2023-10-02`	3 months	crt.sh
snap.licdn.com DigiCert SHA2 Secure Server CA	`2023-02-01` - `2024-01-31`	a year	crt.sh
www.redditstatic.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-04-12` - `2023-10-08`	6 months	crt.sh
*.metadata.io DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2023-01-18` - `2024-01-07`	a year	crt.sh
*.quora.com R3	`2023-07-12` - `2023-10-10`	3 months	crt.sh
zoominfo.com Cloudflare Inc ECC CA-3	`2023-04-04` - `2024-04-03`	a year	crt.sh
*.twimg.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-07-21` - `2024-08-20`	a year	crt.sh
hubspot.com Cloudflare Inc ECC CA-3	`2023-02-05` - `2024-02-05`	a year	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2023-07-10` - `2023-10-02`	3 months	crt.sh
www.google.de GTS CA 1C3	`2023-07-10` - `2023-10-02`	3 months	crt.sh
*.reddit.com DigiCert TLS RSA SHA256 2020 CA1	`2023-04-19` - `2023-10-15`	6 months	crt.sh
6sc.co R3	`2023-05-25` - `2023-08-23`	3 months	crt.sh
linkedin.oribi.io Amazon RSA 2048 M01	`2023-06-08` - `2024-07-07`	a year	crt.sh
hubapi.com Cloudflare Inc ECC CA-3	`2023-04-07` - `2024-04-06`	a year	crt.sh
www.google.com GTS CA 1C3	`2023-07-10` - `2023-10-02`	3 months	crt.sh
syndication.twitter.com DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2023-02-05` - `2024-02-05`	a year	crt.sh

This page contains 4 frames:

Primary Page: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
Frame ID: 0CC40DFC6D8E385A9A4A918C84A3AACD
Requests: 149 HTTP requests in this frame

Frame: https://www.facebook.com/tr/
Frame ID: 80F6F472C96736ED5AA1C00B348B92CB
Requests: 1 HTTP requests in this frame

Frame: https://platform.twitter.com/widgets/widget_iframe.2b2d73daf636805223fb11d48f3e94f7.html?origin=https%3A%2F%2Fwww.reversinglabs.com
Frame ID: D5FB5CC83D722AA469A1B157ED3E525E
Requests: 2 HTTP requests in this frame

Frame: https://insight.adsrvr.org/track/up?adv=7qhctws&ref=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fvmconnect-malicious-pypi-packages-imitate-popular-open-source-modules&upid=8t4axvj&upv=1.1.0
Frame ID: 153E9D153A4430452BE97EB77A136E01
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

VMConnect: Malicious PyPI packages imitate popular open source modules

Detected technologies

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

Hotjar (Analytics) Expand

Overall confidence: 100%
Detected patterns

//static\.hotjar\.com/

HubSpot Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

js\.hs-analytics\.net/analytics

Lightbox (JavaScript Libraries) Expand

Linkedin (Widgets) Expand

Overall confidence: 100%
Detected patterns

//platform\.linkedin\.com/in\.js

Linkedin Insight Tag (Analytics) Expand

Overall confidence: 100%
Detected patterns

snap\.licdn\.com/li\.lms-analytics/insight\.min\.js

Twitter (Widgets) Expand

Overall confidence: 100%
Detected patterns

//platform\.twitter\.com/widgets\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

152
Requests

99 %
HTTPS

77 %
IPv6

37
Domains

53
Subdomains

47
IPs

3
Countries

3511 kB
Transfer

7183 kB
Size

35
Cookies

25 Outgoing links

These are links going to different origins than the main page.

URL: https://register.reversinglabs.com/demo
Title: Demo

Search URL Search Domain Scan URL

URL: https://support.reversinglabs.com/hc/en-us/restricted
Title: Support

Search URL Search Domain Scan URL

URL: https://rli.reversinglabs.com/accounts/login/
Title: Login

Search URL Search Domain Scan URL

URL: https://www.secure.software/
Title: Developer Portal

Search URL Search Domain Scan URL

URL: https://github.com/vmware/pyvmomi
Title: pyVmomi VMware vSphere bindings

Search URL Search Domain Scan URL

URL: https://docs.python.org/3/library/asyncio.html
Title: asyncro

Search URL Search Domain Scan URL

URL: https://blog.reversinglabs.com/hubfs/Blog/vmconnect-blog-figure1-behaviors.png

Search URL Search Domain Scan URL

URL: https://blog.reversinglabs.com/hubfs/Blog/vmconnect-blog-figure2-init.png

Search URL Search Domain Scan URL

URL: https://blog.reversinglabs.com/hubfs/Blog/vmconnect-blog-figure4-loop.png

Search URL Search Domain Scan URL

URL: https://blog.reversinglabs.com/hubfs/Blog/vmconnect-blog-figure5-PyPI_author.png

Search URL Search Domain Scan URL

URL: https://blog.reversinglabs.com/hubfs/Blog/vmconnect-blog-figure6-PyPI_project.png

Search URL Search Domain Scan URL

URL: https://blog.reversinglabs.com/hubfs/Blog/vmconnect-blog-figure7-husky_github.png

Search URL Search Domain Scan URL

URL: https://blog.reversinglabs.com/hubfs/Blog/vmconnect-blog-figure8-init_gihub.png

Search URL Search Domain Scan URL

URL: https://blog.reversinglabs.com/hubfs/Blog/vmconnect-blog-figure9-VMConnect.png

Search URL Search Domain Scan URL

URL: https://blog.reversinglabs.com/hubfs/Blog/vmconnect-blog-figure10-vconnector.png

Search URL Search Domain Scan URL

URL: https://github.com/MarianaCamelia
Title: repository

Search URL Search Domain Scan URL

URL: https://pypi.org/project/eth-tester/#description
Title: eth-tester

Search URL Search Domain Scan URL

URL: https://pypi.org/project/databases/
Title: databases

Search URL Search Domain Scan URL

URL: https://twitter.com/reversinglabs
Title: Twitter

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/reversinglabs
Title: Linkedin

Search URL Search Domain Scan URL

URL: https://www.youtube.com/user/reversinglabs
Title: Youtube play

Search URL Search Domain Scan URL

URL: https://www.facebook.com/reversinglabs
Title: Facebook

Search URL Search Domain Scan URL

URL: https://www.instagram.com/reversinglabs
Title: Instagram

Search URL Search Domain Scan URL

URL: https://blog.reversinglabs.com/blog/rss.xml
Title: RSS

Search URL Search Domain Scan URL

URL: https://cookieinfoscript.com/
Title: cookie script

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 120

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=976924&time=1691412126647&url=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fvmconnect-malicious-pypi-packages-imitate-popular-open-source-modules&tm=gtmv2 HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=976924&time=1691412126647&url=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fvmconnect-malicious-pypi-packages-imitate-popular-open-source-modules&tm=gtmv2&cookiesTest=true HTTP 302
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D976924%26time%3D1691412126647%26url%3Dhttps%253A%252F%252Fwww.reversinglabs.com%252Fblog%252Fvmconnect-malicious-pypi-packages-imitate-popular-open-source-modules%26tm%3Dgtmv2%26cookiesTest%3Dtrue%26liSync%3Dtrue HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=976924&time=1691412126647&url=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fvmconnect-malicious-pypi-packages-imitate-popular-open-source-modules&tm=gtmv2&cookiesTest=true&liSync=true HTTP 302
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=976924&time=1691412126647&url=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fvmconnect-malicious-pypi-packages-imitate-popular-open-source-modules&tm=gtmv2&cookiesTest=true&liSync=true&e_ipv6=AQJqw2EfqqthpgAAAYnQBN9R2MeH0QV0TCWBeDdjOTNqfMxdx_U-gtuizSgsoS10f_ZyEeQ

152 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules Show response
www.reversinglabs.com/blog/ 133 KB
28 KB 169ms
75ms Document
text/html 2606:2c40::c73c:671f
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

d58fcc9b037c7817d2d7565a677f19616b2ca13d2575df0a2c82f4ad60b0ec87

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: no-store, no-cache, must-revalidate
cf-ray: 7f2f98eefd969c04-FRA
content-encoding: br
content-security-policy: upgrade-insecure-requests
content-type: text/html; charset=UTF-8
date: Mon, 07 Aug 2023 12:42:04 GMT
edge-cache-tag: CT-128190968732,CG-3375217,CG-5901382633,P-3375217,L-11118979719,L-11735000539,CW-103636562700,CW-10782554896,CW-11119297579,CW-11395370497,CW-114796045952,CW-115016303498,CW-115021731904,CW-11538883136,CW-23776629869,CW-23799638916,CW-28186900061,CW-36845096476,CW-6520974104,CW-79001037452,CW-80857835930,CW-80864562095,CW-80864563080,CW-80868056874,CW-87757605656,E-10528761402,E-10777459487,E-11119463588,E-11190015046,E-11395370929,E-11395383304,E-11708570900,E-21052151416,E-23712622487,E-28203361861,E-38216899954,E-5951651806,E-6021532803,E-6021916068,E-6519964395,E-70521421874,PGS-ALL,SW-1,B-112999115134,B-5901382633,B-70179327783,B-94488163452,GC-103819429689,GC-115009898400,GC-115015365221,GC-115020232564,GC-25875947801,GC-25876057703,GC-26129507391,GC-28186555742,GC-80858624881,GC-80970810765,GC-80971492144,GC-81200326231,GC-87768577627
etag: W/"fc65ff0bb81ce00ae84caf0244109953"
last-modified: Sun, 06 Aug 2023 04:05:31 GMT
link: </hs/hsstatic/HubspotToolsMenu/static-1.191/js/index.js>; rel=preload; as=script,</hs/hsstatic/cos-i18n/static-1.53/bundles/project.js>; rel=preload; as=script,</_hcms/forms/v2.js>; rel=preload; as=script
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
referrer-policy: no-referrer-when-downgrade
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=XRZn%2FtWzcqTZ5Kxortxvr%2Bk%2FdeYpdpH0aHVdnUFNIIaW09uAXynq%2F%2Bm%2FtRdZTHjmv6EQJwo0zh9LwtKHLiiuWZoyv5JhFX85JwelReUKkcb6KhHhkQoce9HLMpaV8Q3ATYmP%2B1ROesViiE4Ta%2B76bd9rAw%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-hs-cache-config: BrowserCache-5s-EdgeCache-0s
x-hs-cache-control: s-maxage=10800, max-age=0
x-hs-cf-cache-status: HIT
x-hs-content-id: 128190968732
x-hs-https-only: worker
x-hs-hub-id: 3375217
x-hs-prerendered: Sun, 06 Aug 2023 04:05:31 GMT

GET
H2 200 index.js Show response
www.reversinglabs.com/hs/hsstatic/HubspotToolsMenu/static-1.191/js/ 11 KB
5 KB 92ms
87ms Script
application/javascript 2606:2c40::c73c:671f
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reversinglabs.com/hs/hsstatic/HubspotToolsMenu/static-1.191/js/index.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

fd5e0c3a0682f03217f201588e51e77bf778d5506224074918f505423f0e25a2

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:42:04 GMT
strict-transport-security: max-age=31536000
via: 1.1 993c0866e705e48daa4fed5e30627712.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
content-security-policy: upgrade-insecure-requests
age: 9321413
x-amz-cf-pop: FRA56-P2
x-amz-server-side-encryption: AES256
x-amz-version-id: inhS2tX2f2C4tITR3p2haS.uhsvA9eGz
content-encoding: br
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
x-hs-https-only: worker
alt-svc: h3=":443"; ma=86400
last-modified: Fri, 21 Apr 2023 15:17:56 GMT
server: cloudflare
etag: W/"0bbd63c0750f141fd5cec04a9393647e"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ny2XBZpGrab%2BwcNTJcjwuw9E7TiDVXaEurn6%2BW5UXrqKnlQ5rdlHrNm%2F6nEOpJ52K7ZDaku5HaTW5i0veVKecG5ZNbqq6THPYlfhOmF8zoRgA6%2FV1P3pZP%2BMAinEuheEQmpP6VHG8QjxzWVGCsuEikM1gA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: public, max-age=31536000
cf-ray: 7f2f98ef7e849c04-FRA
x-amz-cf-id: kYirOZfoHQXeyAOg4VhVOBcOLxa_7X0NxADbW-vas0QAqsDyQkWkww==
expires: Tue, 06 Aug 2024 12:42:04 GMT

GET
H2 200 project.js Show response
www.reversinglabs.com/hs/hsstatic/cos-i18n/static-1.53/bundles/ 1 KB
1 KB 96ms
91ms Script
application/javascript 2606:2c40::c73c:671f
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reversinglabs.com/hs/hsstatic/cos-i18n/static-1.53/bundles/project.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

8da927b6b1240ffca4323fbb2a12c8e5abb541040965c2bc5b7d09a2eb963b02

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:42:04 GMT
strict-transport-security: max-age=31536000
via: 1.1 f4137273db9ae377298b8f8daf5b93f0.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
content-security-policy: upgrade-insecure-requests
age: 12737609
x-amz-cf-pop: FRA56-P2
x-amz-server-side-encryption: AES256
x-amz-version-id: P9ES7sOpFzrLl1QoRwjEAy5outPo5_GO
content-encoding: br
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
x-hs-https-only: worker
alt-svc: h3=":443"; ma=86400
last-modified: Tue, 09 Nov 2021 16:12:42 GMT
server: cloudflare
etag: W/"61ca66de658cab9587e4636894680d5d"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=BEtg%2F7m4qqlGddwsxon4Vn7Ahtbw9QIIXm6d%2BJAAjZcUrV1CmVzPN%2FgVXrPWbN%2ByPyIZmfeFxCF8eBs7%2Fjus4xluI9D8IeB818BgjKDFdnmMdbhxSs4FiLchpVQrb1sfxBkBe3nI6mZrMbbl%2B530s0%2FKyA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: public, max-age=31536000
cf-ray: 7f2f98ef7e859c04-FRA
x-amz-cf-id: n-wCgFq_tXu75HdwN5yHV7QlFUeiN9b92x8cHfArPXJP-lfFO3xe7Q==
expires: Tue, 06 Aug 2024 12:42:04 GMT

GET
H2 200 v2.js Show response
www.reversinglabs.com/_hcms/forms/ 526 KB
172 KB 151ms
147ms Script
application/javascript 2606:2c40::c73c:671f
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reversinglabs.com/_hcms/forms/v2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

3dcf5ab0268e05f2e26960055d40e37a5ec0cb225dcc9da43f52967710cea56b

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
content-encoding: br
age: 365
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
content-security-policy-report-only: frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=forms-embed/static-1.3512/bundles/project-v2.js&cfRay=7f2f900a63529bbf-FRA
x-amz-replication-status: COMPLETED
x-hs-https-only: worker
x-evy-trace-listener: listener_https
etag: W/"c93e66dd60926c55c794dc765ffe6c1a"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
x-evy-trace-virtual-host: all
cache-control: s-maxage=600, max-age=300
x-hs-target-asset: forms-embed/static-1.3512/bundles/project-v2.js
date: Mon, 07 Aug 2023 12:42:04 GMT
strict-transport-security: max-age=31536000
via: 1.1 16d910967d343c8da7828222a653755e.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-content-type-options: nosniff
x-amz-version-id: ti0_iiw7PITtrft.AIEOPeRnP3ag2uRE
x-amz-cf-pop: IAD12-P3
x-hubspot-correlation-id: db6fa152-47bb-4d2b-b3d5-9ad9a1ee22ad
x-cache: Hit from cloudfront
cache-tag: staticjsapp-forms-embed-v2-web-prod,staticjsapp-prod
x-envoy-upstream-service-time: 1
alt-svc: h3=":443"; ma=86400
x-evy-trace-route-configuration: listener_https/all
x-request-id: db6fa152-47bb-4d2b-b3d5-9ad9a1ee22ad
last-modified: Tue, 01 Aug 2023 10:17:49 UTC
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=XBqPAdlVA%2FzfTywMC%2F5ymU8LRQBE0lZOGs0JvG8f2Ld%2Bsd2acHOd2WP3jYAZ6GcWKDyIKXXnxdWu%2BuglmFOrQRoFFvlUbNfeCILiiJDQr56D7%2FgUps4pQho0%2FXD9nv5bcothd9s4rs8rX0JG9uSRgU1pGw%3D%3D"}],"group":"cf-nel","max_age":604800}
x-hs-cache-status: HIT
x-evy-trace-served-by-pod: iad02/app-td/envoy-proxy-57ff77fcd-h6thn
cf-ray: 7f2f98ef7e889c04-FRA
x-amz-cf-id: aofsfeMJOUDLSPY9pCEun2b78Vb7LrDzMCSqsZU48hrDfWY7B2qv5g==

GET
H2 200 stickybar.min.css
www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/38216899954/1683495050466/Modules/StickyBar/ 4 KB
2 KB 92ms
81ms Stylesheet
text/css 2606:2c40::c73c:671f
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/38216899954/1683495050466/Modules/StickyBar/stickybar.min.css

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

a9ff889aa2badd5dcf9989574fa2006fb183febc1685353d19bf1dd28ed7c1b2

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
content-encoding: br
age: 818
x-amz-request-id: A1EP1F3CR54NCV7Q
x-amz-server-side-encryption: AES256
x-evy-trace-route-service-name: envoyset-translator
x-amz-replication-status: COMPLETED
x-hs-https-only: worker
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 20
x-evy-trace-listener: listener_https
etag: W/"424627ea38e47986af8095e0d67d40e2"
vary: origin, Accept-Encoding
x-amz-meta-created-unix-time-millis: 1683495051068
content-type: text/css
x-evy-trace-virtual-host: all
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 20
date: Mon, 07 Aug 2023 12:42:04 GMT
strict-transport-security: max-age=31536000
via: 1.1 814e6200dbb5865e94b7b0c1ba6129fe.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id: jgLYEQ4EOqvxpqZTyxVIjrm84TepXoQY
x-amz-cf-pop: IAD89-C1
x-hs-alternate-content-type: text/plain
x-cache: RefreshHit from cloudfront
x-amz-storage-class: INTELLIGENT_TIERING
x-envoy-upstream-service-time: 114
alt-svc: h3=":443"; ma=86400
x-amz-id-2: Lc6djJd1ckKCs+aBHkYMonVKhz1sxjFxH09hsCTMR2phNMdXw4mGMkPvk2JbdJkNU/5N8So/Jf8=
x-evy-trace-route-configuration: listener_https/all
x-request-id: 2adbc651-67b9-4ddb-8b5e-19f4d1a74cbf
last-modified: Sun, 07 May 2023 21:30:52 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gDLnb7wqe2nKkAF1kXHccMUj6YcGvNVf4H9bQQT87NuBSBveP6PpPVatrT9Do2bgShRuIEJH4k6XRnwIfRL1mpy1O1JSzFTYzAb3TdrUn3zVl7CDB3NzDLKrXdz1iCK456dU54tlN60hsMaUJ14okvICSw%3D%3D"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/cms-hubfs-td/envoy-proxy-55b7d448b-hlzsf
access-control-allow-credentials: false
cf-ray: 7f2f98ef8ea19c04-FRA
x-amz-cf-id: Xe60HxEZc2yldg7dFlLAwerCj3PHyAGkt5L1BTEeWIilFZDlnvsUIw==

GET
H2 200 site-menu.min.css
www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/11119463588/1690214555806/Redesign_june_2019/Coded_Files/CSS/Components/ 6 KB
2 KB 96ms
85ms Stylesheet
text/css 2606:2c40::c73c:671f
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/11119463588/1690214555806/Redesign_june_2019/Coded_Files/CSS/Components/site-menu.min.css

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

eb8d8c2427fab53f2c4d0c70d9661c7d33d995e486cdb923b0c6d65b6b4fef19

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
content-encoding: br
age: 818
x-amz-request-id: ZNCGH859ZJ43QA1Y
x-amz-server-side-encryption: AES256
x-evy-trace-route-service-name: envoyset-translator
x-amz-replication-status: COMPLETED
x-hs-https-only: worker
x-hs-cf-lambda: us-east-1.EnforceAclForReads 2
x-evy-trace-listener: listener_https
etag: W/"eb32609c5026ffac513b3e81d68d3ded"
vary: origin, Accept-Encoding
x-amz-meta-created-unix-time-millis: 1690214556506
content-type: text/css
x-evy-trace-virtual-host: all
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 2
date: Mon, 07 Aug 2023 12:42:04 GMT
strict-transport-security: max-age=31536000
via: 1.1 b4346add631a498bf6cdbf88cbc5ff12.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id: GKLmHl3sCXmnSkwVBkhk10OG72nsj2BC
x-amz-cf-pop: IAD89-C1
x-hs-alternate-content-type: text/plain
x-hubspot-correlation-id: 850b9dc4-e94f-44ab-8f9e-453a59548e6b
x-cache: RefreshHit from cloudfront
x-amz-storage-class: INTELLIGENT_TIERING
x-envoy-upstream-service-time: 212
alt-svc: h3=":443"; ma=86400
x-amz-id-2: /RHDl8GKbOMBQsxfj8mZiFKJA25WzIa+5TvSVN7jHCsJ2bFGQJEVov6/9S/i2vvam53kcXHxbVo=
x-evy-trace-route-configuration: listener_https/all
x-request-id: 850b9dc4-e94f-44ab-8f9e-453a59548e6b
last-modified: Mon, 24 Jul 2023 16:02:37 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=SOW2K0RmrMkto32mWPif7Qaxz0C6pDCkhtlM3VPY%2FLr6HBg%2F1sOqkdBbzH%2Fr23co5ZZuBVOvqmb1RmpoNYsFLgZOa1KwfA1%2BT0ZrpVwPfGd4KJQ%2FT0WZj%2FITR1Q9FVg%2FOgiXBzvb4GURBpx996uHPB51cw%3D%3D"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/cms-hubfs-td/envoy-proxy-fd8f7bc74-mxtb7
access-control-allow-credentials: false
cf-ray: 7f2f98ef8ea49c04-FRA
x-amz-cf-id: PDTq2iw3fKj-4YIkxpy39-MMuABvHOd6G1A8JrEeVYXLht5g0YONTA==

GET
H2 200 micromodal.min.css
www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/11395383304/1628866683496/Redesign_june_2019/Coded_Files/CSS/Components/ 4 KB
2 KB 97ms
86ms Stylesheet
text/css 2606:2c40::c73c:671f
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/11395383304/1628866683496/Redesign_june_2019/Coded_Files/CSS/Components/micromodal.min.css

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

9e634b615e771259a6dc723ef2cda097c480ad26dc92faa6450c5e4e16e3288a

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:42:04 GMT
strict-transport-security: max-age=31536000
via: 1.1 a7a1b4c19abc42d237405ce4c4069f10.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
content-security-policy: upgrade-insecure-requests
age: 818
x-amz-cf-pop: IAD89-P1
x-amz-server-side-encryption: AES256
x-amz-request-id: F7T6YSF30DXWZAG2
x-hs-alternate-content-type: text/plain
x-cache: Miss from cloudfront
x-amz-version-id: e3VxwMWpNWQvL0ZQahFb1P28o.8Kjgu5
content-encoding: br
x-amz-replication-status: COMPLETED
x-hs-https-only: worker
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 15
alt-svc: h3=":443"; ma=86400
x-amz-id-2: Xtf2D6baLu98TLeXCv0aKHDWc36Shxr9tPBvLyKE+LvljpO3HyQg+IxhhXSP+MNZ2W3gefY3N8w=
last-modified: Fri, 13 Aug 2021 14:58:04 GMT
server: cloudflare
etag: W/"20c2f66e9f10bed15056fd6b975b8a75"
vary: Accept-Encoding
x-amz-meta-created-unix-time-millis: 1628866683533
content-type: text/css
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2BSpARGh23CW%2BoC1Lt7a%2BlYmUdFLr1WM28Vhacf8ZLL81nkqEmybNKvQMzbR2SfGWQX69fOXNguWDWix%2FAzNBE1e3tKLMQVY1ZTZzhso3Be1pwAm4RPLca9a8lXmYXxYFCjtxHJAAa3TO7jQrFbExhfg2IA%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900, s-maxage=31536000, max-age=31536000
access-control-allow-credentials: false
cf-ray: 7f2f98ef8ea69c04-FRA
x-amz-cf-id: Nu0x7-QIiO6na4x-QcC_QhY_src2tmMWn112v4SZp-0cqrE-6ddYfg==
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 15

GET
H2 200 module_11395370497_Redesign_june_2019_Custom_Modules_Site_Search_Input_-_Header_Modal.min.css
www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/module_assets/1563505647497/ 610 B
922 B 103ms
92ms Stylesheet
text/css 2606:2c40::c73c:671f
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/module_assets/1563505647497/module_11395370497_Redesign_june_2019_Custom_Modules_Site_Search_Input_-_Header_Modal.min.css

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

249d08c8fde3e1912f9d6d25ff14eed26f4adea29df815b794933eb133f8ec37

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:42:04 GMT
strict-transport-security: max-age=31536000
via: 1.1 70b043d52df382dd62760368de89949e.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
content-security-policy: upgrade-insecure-requests
age: 818
x-amz-cf-pop: IAD12-P2
x-amz-request-id: Z73Q9JQB6W865QR5
content-encoding: br
x-cache: RefreshHit from cloudfront
x-amz-version-id: n_rdB5Zjo6jQpLlilRmMi5fLWw35sgNj
x-hs-https-only: worker
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 15
alt-svc: h3=":443"; ma=86400
x-amz-id-2: 2vcwEIKfwfogVxwemZ4ZtWQOjCw7lNhHUcHHkjQ6YityfpCMUBwys6TYY7Hn0q/3wsVkOzO5f0A=
last-modified: Fri, 19 Jul 2019 03:07:28 GMT
server: cloudflare
etag: W/"6b50e831aa1329ecfc246611e5b73e07"
vary: origin, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=61wq1Si0sadcRXFu1fkkPxh6FLP6sVq%2Fil3QU5C6qh1vYJXBdRDzQjpr%2BUOLOKdA%2FdOmu8YQTO75RECP9FqPmjloRLac7jGn4rn%2FuAG%2BvqomqbwMSxfmzRSMBzkkztDfJuj%2FpCI4sG0WL6EmUn5iNpSbbg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900, s-maxage=31536000, max-age=31536000
access-control-allow-credentials: false
cf-ray: 7f2f98ef9eac9c04-FRA
x-amz-cf-id: B5ZYFVde9Wf6yBySW8RrWr9HWGVSsucDgv8u214botm5dWxHXR66og==
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 15

GET
H2 200 module_103636562700_Footer_Categories_Text_-_global.min.css
www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/module_assets/103636562700/1677161481432/ 89 B
856 B 130ms
119ms Stylesheet
text/css 2606:2c40::c73c:671f
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/module_assets/103636562700/1677161481432/module_103636562700_Footer_Categories_Text_-_global.min.css

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

350dfd290fcaf704accd61883b7d6dd6e2fcb8d6f10c747ba96707c20bddc000

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
content-encoding: br
age: 457
x-amz-request-id: FG38BH5B0JR6000H
x-amz-server-side-encryption: AES256
x-amz-replication-status: PENDING
x-hs-https-only: worker
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 15
etag: W/"0e24424bd7a91e1adc940105ffcd26d9"
vary: origin, Accept-Encoding
x-amz-meta-created-unix-time-millis: 1677161481432
content-type: text/css
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900, s-maxage=31536000, max-age=31536000
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 15
date: Mon, 07 Aug 2023 12:42:04 GMT
strict-transport-security: max-age=31536000
via: 1.1 3289feb7922c3bed2dd498f7353add3e.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id: S9Og3Ezj9hRyblXN9qKf01bBpHlkGn4t
x-amz-cf-pop: IAD55-P5
x-hs-alternate-content-type: text/plain
x-cache: RefreshHit from cloudfront
x-amz-storage-class: INTELLIGENT_TIERING
alt-svc: h3=":443"; ma=86400
x-amz-id-2: 5f7GIt1aENWESExKfXOaZIfHRR0dnIJh1rB0oCl10zkmfZC1l8fTr1b1ClnCQ6020pjwTAvRNXw=
last-modified: Thu, 23 Feb 2023 14:11:22 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Z%2BjyudEhJBtB%2FLPzow4DtFEKAdvlX2CX62vnw36tLK5SQtVa33Z7rm623ZLc5%2BYm7HxeWosXHT7hLxQK%2FpKJQao0ypv1zwM07Ft6aegGh1M5doSuRLGZnogbQbVTYaoyI%2F7NbTVoKMNEE7RQ279pKyXLbA%3D%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-credentials: false
cf-ray: 7f2f98ef9eae9c04-FRA
x-amz-cf-id: aQjS4s3xlx0H97Xnt4_WEHZiiwekV0lVk8YYzkbG8VATlSKXkmQ-1g==

GET
H2 200 module_87757605656_Footer_Categories_Blog_Listing_-_global.min.css
www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/module_assets/87757605656/1666371595958/ 135 B
1 KB 127ms
116ms Stylesheet
text/css 2606:2c40::c73c:671f
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/module_assets/87757605656/1666371595958/module_87757605656_Footer_Categories_Blog_Listing_-_global.min.css

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

abe603cadd5d178715e8d259697dd4470bf63c6ad1115eb0af8715c778640133

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
content-encoding: br
age: 457
x-amz-request-id: BSHEJJ0J7M0Z406A
x-amz-server-side-encryption: AES256
x-evy-trace-route-service-name: envoyset-translator
x-amz-replication-status: COMPLETED
x-hs-https-only: worker
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 20
x-evy-trace-listener: listener_https
etag: W/"13b7e92cbbf8ac04eec1f7b100347115"
vary: origin, Accept-Encoding
x-amz-meta-created-unix-time-millis: 1666371595958
content-type: text/css
x-evy-trace-virtual-host: all
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 20
date: Mon, 07 Aug 2023 12:42:04 GMT
strict-transport-security: max-age=31536000
via: 1.1 14d757a67b913f1bc93427e69819362c.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id: kLOdiFo6YnWIpiP8BLnJdzSgnAZ9CfEh
x-amz-cf-pop: IAD89-C1
x-hs-alternate-content-type: text/plain
x-cache: RefreshHit from cloudfront
x-amz-storage-class: INTELLIGENT_TIERING
x-envoy-upstream-service-time: 144
alt-svc: h3=":443"; ma=86400
x-amz-id-2: evQ/5MYvkDYpn1vpTO6vk99GU3OCODvH8c3gILDmY4BxuA8xOL4mV8uqTZwUC3GMeEBC8it7H5I=
x-evy-trace-route-configuration: listener_https/all
x-request-id: 19555df2-b004-43ab-b28e-f57dd55085df
last-modified: Fri, 21 Oct 2022 16:59:56 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Ifa1ak%2FfG%2Bmtqy%2F9KLBaPxgNltqcCdSSkvbThX6EtGUMVLvfWHrm8SNUUKG25iNvnZXUbS5Vzh%2Fo2a0sIuOD51JQyqXRy1SxIMutjirgEqzGPol1xP%2FXaE33EO88wpwehSTxELXRoDLY1m8iSsZpVaQeXg%3D%3D"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/cms-hubfs-td/envoy-proxy-55b7d448b-r4k2f
access-control-allow-credentials: false
cf-ray: 7f2f98ef9eaf9c04-FRA
x-amz-cf-id: mP_hBHU0YmCXSC5F2Kax4PpVNlFgecwbWXeLqNDMvOQH0qvcDBxMbw==

GET
H2 200 module_36845096476_Blog_listing_card_grid.min.css
www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/module_assets/36845096476/1683635695217/ 304 B
1 KB 198ms
187ms Stylesheet
text/css 2606:2c40::c73c:671f
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/module_assets/36845096476/1683635695217/module_36845096476_Blog_listing_card_grid.min.css

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

2e0e46665e34d5b09152a1ab9be9e89802f26f40b6e1a29780bf07ae94bc2376

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
content-encoding: br
age: 457
x-amz-request-id: 493BPZ3TQ3W0EMJR
x-amz-server-side-encryption: AES256
x-evy-trace-route-service-name: envoyset-translator
x-amz-replication-status: COMPLETED
x-hs-https-only: worker
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 20
x-evy-trace-listener: listener_https
etag: W/"bfd6c45ad0a0ed80b73460eea867fdb6"
vary: origin, Accept-Encoding
x-amz-meta-created-unix-time-millis: 1683635695217
content-type: text/css
x-evy-trace-virtual-host: all
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 20
date: Mon, 07 Aug 2023 12:42:04 GMT
strict-transport-security: max-age=31536000
via: 1.1 0cba74644cedf83bb6fb7dc90d8b0980.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id: QEtrj8a5Jw.zNpvkZ3KAKAvL2xgpFoi3
x-amz-cf-pop: IAD12-P2
x-hs-alternate-content-type: text/plain
x-cache: RefreshHit from cloudfront
x-amz-storage-class: INTELLIGENT_TIERING
x-envoy-upstream-service-time: 112
alt-svc: h3=":443"; ma=86400
x-amz-id-2: MMxDYlGAKstu6xcv7FF1yOTH82QSEPxgsUHCfDREspFI3X/rVg/KSkoCdSqFHVVi7kUtUPPCOns=
x-evy-trace-route-configuration: listener_https/all
x-request-id: 70a882f2-5814-44ee-a5ae-368b05624550
last-modified: Tue, 09 May 2023 12:34:56 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=GVmCy53zR%2FNUbIBHmVmHqNq86HThuALGc80gSSm6hantKiG3zh7RZZzW9%2BIqRrDNem3pfeAJSk8BzqivAQGes15JIC8Co36ihcvX9wimRSrNR8tfKO8XwL63BSbW4HGgAX638Z92antMKWDp1wOOpp0ovQ%3D%3D"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/cms-hubfs-td/envoy-proxy-55b7d448b-fwhk5
access-control-allow-credentials: false
cf-ray: 7f2f98efbef59c04-FRA
x-amz-cf-id: nFSROtreYfVNhvwYYd0UDd-5eq1Mmw_0_LvzBmqdiBlPGjVMp0yAdw==

GET
H2 200 module_80864562095_Sidebar_Categories_Blog_-_global.min.css
www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/module_assets/80864562095/1659712321004/ 419 B
910 B 143ms
132ms Stylesheet
text/css 2606:2c40::c73c:671f
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/module_assets/80864562095/1659712321004/module_80864562095_Sidebar_Categories_Blog_-_global.min.css

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

c7d36be0a73651297b0f6b15b1aa2e63a204489bb9c552c11e0cf7db771081d4

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
content-encoding: br
age: 457
x-amz-request-id: Y6ZF023Y0W5PRW34
x-amz-server-side-encryption: AES256
x-amz-replication-status: COMPLETED
x-hs-https-only: worker
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 15
etag: W/"d7c0ecedc0f1ad068aa363dbf6f552be"
vary: origin, Accept-Encoding
x-amz-meta-created-unix-time-millis: 1659712321004
content-type: text/css
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900, s-maxage=31536000, max-age=31536000
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 15
date: Mon, 07 Aug 2023 12:42:04 GMT
strict-transport-security: max-age=31536000
via: 1.1 8b1ca38f6b0e2c14ce8c202175f971a6.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id: kytFTmhcx66YfyEHUvgGyzju7VPEYvXs
x-amz-cf-pop: IAD55-P1
x-hs-alternate-content-type: text/plain
x-cache: RefreshHit from cloudfront
x-amz-storage-class: INTELLIGENT_TIERING
alt-svc: h3=":443"; ma=86400
x-amz-id-2: ZuBvhvcqjw9Ovl6Djx242sRAj9g50LvSYYYalRTWKykJfFDXF/2npZqMQuuE6RpkR+5KCVdAmKl9g3xjg6+lKy7SR+biUGJJSGvCsNh/yFU=
last-modified: Fri, 05 Aug 2022 15:12:02 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jddnWqZBxvd%2BLDUL3ztT3Bc4WgF7l2jXw7NpVY2WGEOqu18G4njUptA%2BCxzcEZsQBSJFisMHTmM9CBWUAEsjCd9TF4aogE0BnmPZ9O5DeIHQrXSlaMKoyCAjWJIBdQMYGo2FvE58sVCdRKhaIBy44n9Org%3D%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-credentials: false
cf-ray: 7f2f98efbef89c04-FRA
x-amz-cf-id: YVNuzc1jLPN0XAz5mFowM4wtPHj8OTz9JeWNDi4OZFPwxHYCfT46SQ==

GET
H2 200 module_80868056874_Sidebar_Social_-_global.min.css
www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/module_assets/80868056874/1659702739351/ 298 B
1 KB 188ms
178ms Stylesheet
text/css 2606:2c40::c73c:671f
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/module_assets/80868056874/1659702739351/module_80868056874_Sidebar_Social_-_global.min.css

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

f419ad33d162aefac608940b47d2a524fca46eee0c82f877710a6369e68be33c

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
content-encoding: br
age: 457
x-amz-request-id: 98NB269N0E5B3BGZ
x-amz-server-side-encryption: AES256
x-evy-trace-route-service-name: envoyset-translator
x-amz-replication-status: COMPLETED
x-hs-https-only: worker
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 20
x-evy-trace-listener: listener_https
etag: W/"ea0c94f5b1324d7913f6a18ec1f3fe14"
vary: origin, Accept-Encoding
x-amz-meta-created-unix-time-millis: 1659702739351
content-type: text/css
x-evy-trace-virtual-host: all
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 20
date: Mon, 07 Aug 2023 12:42:04 GMT
strict-transport-security: max-age=31536000
via: 1.1 814e6200dbb5865e94b7b0c1ba6129fe.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id: shmO1QlyhGMyDoImESYiUCU5phlmEXau
x-amz-cf-pop: IAD89-C1
x-hs-alternate-content-type: text/plain
x-cache: RefreshHit from cloudfront
x-amz-storage-class: INTELLIGENT_TIERING
x-envoy-upstream-service-time: 150
alt-svc: h3=":443"; ma=86400
x-amz-id-2: lSaiJ+khQb0Samuok6dlEzLOoqMgHk31Tz8Q4h5JJv1Syr0xvdW/m2ogOiQeZHajxkcO74hExM3rZxDVwerTYQ==
x-evy-trace-route-configuration: listener_https/all
x-request-id: 0c15f3d4-a7fa-4e9a-b20f-75858f20eab8
last-modified: Fri, 05 Aug 2022 12:32:20 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=CUJj5uToqfW%2F3b2mhh707rXWwFDXkF869jUZmPLtuTVkJHGJlu7GgJr6Zw4umNyL8cXEtlHcLwErK99sgbP3lpEb5kZPMXGac4oELVmZSA3jRNWQqEGFlXJw4xk36x1oZJtw1M8tX5IU30srmM0puNPpbw%3D%3D"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/cms-hubfs-td/envoy-proxy-65b9b6b744-w6tv2
access-control-allow-credentials: false
cf-ray: 7f2f98efbef99c04-FRA
x-amz-cf-id: cDzrLZi73IDvRd7UNZ0BJwSZ6N6ZAysj-LArATNoJ0XEeoV-Wa3MqA==

GET
H2 200 module_80857835930_Sidebar_Blog_Subscribe_-_global.min.css
www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/module_assets/80857835930/1659449374148/ 620 B
1 KB 128ms
118ms Stylesheet
text/css 2606:2c40::c73c:671f
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/module_assets/80857835930/1659449374148/module_80857835930_Sidebar_Blog_Subscribe_-_global.min.css

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

e2d14bf82ef15e64d7503eed437a43ad5f26d4f5bcac6745870c32f1ed77a8a6

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
content-encoding: br
age: 457
x-amz-request-id: Y503YMNPT8W0G525
x-amz-server-side-encryption: AES256
x-amz-replication-status: COMPLETED
x-hs-https-only: worker
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 20
etag: W/"058524ab080d84460f7e7c6d2ecb4d89"
vary: origin, Accept-Encoding
x-amz-meta-created-unix-time-millis: 1659449374148
content-type: text/css
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900, s-maxage=31536000, max-age=31536000
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 20
date: Mon, 07 Aug 2023 12:42:04 GMT
strict-transport-security: max-age=31536000
via: 1.1 70b043d52df382dd62760368de89949e.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id: e1cZxYRKfUgD2rKmkLGGtFZUzq.7EtsO
x-amz-cf-pop: IAD12-P2
x-hs-alternate-content-type: text/plain
x-cache: RefreshHit from cloudfront
x-amz-storage-class: INTELLIGENT_TIERING
alt-svc: h3=":443"; ma=86400
x-amz-id-2: 4s0ykmWZ9TCbM1DDnIgnVhh37Ftz0m4fJv2nGHkY6LayJmKYJhv7ERyNc+qC+zLYRdITarXydJ4=
last-modified: Tue, 02 Aug 2022 14:09:35 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=UA3N1Ihs28kWRM0hSjQ%2FTOjZ2ck0G9qEErXIt1pCSBdIOYVBh3HUSGdiqsxUf7KBU%2FAfqTKRXCqpkVvcoTvcXswX0Gn0kEO%2FISIfnKJlsubNh%2F%2BpkI7fGazjCpqY6mti3t0NrRqv0c7SCafMvElPBleJuA%3D%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-credentials: false
cf-ray: 7f2f98efbefb9c04-FRA
x-amz-cf-id: I4DRSkhhC-xlaYSTKums2Y_YfGjYpbIlzOQUhsdXBQOV8_nmWQ4j2Q==

GET
H2 200 module_80864563080_Sidebar_Blog_Favorite_Post_-_global.min.css
www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/module_assets/80864563080/1670427753922/ 581 B
1 KB 144ms
134ms Stylesheet
text/css 2606:2c40::c73c:671f
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/module_assets/80864563080/1670427753922/module_80864563080_Sidebar_Blog_Favorite_Post_-_global.min.css

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

cafcf576874435cca6e41394ae820ab1573b83f8b405d10d3ff8add93614c8fe

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
content-encoding: br
age: 1777
x-amz-request-id: FP6W08Q1SC79GJCB
x-amz-server-side-encryption: AES256
x-amz-replication-status: COMPLETED
x-hs-https-only: worker
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 15
etag: W/"c2bccdea5694cead22c9370560abd5e0"
vary: origin, Accept-Encoding
x-amz-meta-created-unix-time-millis: 1670427753922
content-type: text/css
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900, s-maxage=31536000, max-age=31536000
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 15
date: Mon, 07 Aug 2023 12:42:04 GMT
strict-transport-security: max-age=31536000
via: 1.1 23ad05ed2873837fab42a69bc3e0703a.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id: wr_YakpyxY_udxaEA70Z09_FgvspAnTj
x-amz-cf-pop: IAD12-P2
x-hs-alternate-content-type: text/plain
x-cache: RefreshHit from cloudfront
x-amz-storage-class: INTELLIGENT_TIERING
alt-svc: h3=":443"; ma=86400
x-amz-id-2: d5RsS7eB9D1BF9zW/j0idXwCrduC4kkI8NVgWHt62hOaMw/R177xE48gERBgsLPlwIqejJTpLKc=
last-modified: Wed, 07 Dec 2022 15:42:34 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=a2Aaws%2B7QlwbrWhw4EU8IRJpq3r77lCY3Aco0ST7hWEbUElqvir5tuGn8cmX6qCTgH4UHvPqfL1RROK6MsK1RmSf7e4StDE3Ia3%2FX4lEyBMi4N4MnwwCN24m89KGaysNbxbBPBnYQo18n02nd4zONqKkLg%3D%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-credentials: false
cf-ray: 7f2f98efbefd9c04-FRA
x-amz-cf-id: mcRi_493LJ-rwFviy4DmgaMEyncVippcm2E8ofl6Gf2J65pqYWunFw==

GET
H2 200 module_114796045952_Sidebar_ConversingLabs_Latest_Post_Block_-_global.min.css
www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/module_assets/114796045952/1683726402031/ 449 B
1 KB 143ms
133ms Stylesheet
text/css 2606:2c40::c73c:671f
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/module_assets/114796045952/1683726402031/module_114796045952_Sidebar_ConversingLabs_Latest_Post_Block_-_global.min.css

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

7d6d019be5fdd6ed212ab83345278024e52cb55e59e5a577644a58f1c29ae316

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
content-encoding: br
age: 457
x-amz-request-id: 1ZWPRY4T8RG5FBX9
x-amz-server-side-encryption: AES256
x-evy-trace-route-service-name: envoyset-translator
x-amz-replication-status: COMPLETED
x-hs-https-only: worker
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 20
x-evy-trace-listener: listener_https
etag: W/"8518a5951d9ad4d2295f309cf6fca5e1"
vary: origin, Accept-Encoding
x-amz-meta-created-unix-time-millis: 1683726402031
content-type: text/css
x-evy-trace-virtual-host: all
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 20
date: Mon, 07 Aug 2023 12:42:04 GMT
strict-transport-security: max-age=31536000
via: 1.1 90ac509e6263ee9fa7bb3f1ed1f46118.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id: AQN4k9CjDjzeOb4WGe179iRQS2cuvN7I
x-amz-cf-pop: IAD55-P3
x-hs-alternate-content-type: text/plain
x-cache: RefreshHit from cloudfront
x-amz-storage-class: INTELLIGENT_TIERING
x-envoy-upstream-service-time: 123
alt-svc: h3=":443"; ma=86400
x-amz-id-2: 6K0VBtV/5SlAb1taN90asHPq5fzkTfPUeUwGYp3puajuy/55zsup7qAFUEik9P06pIXqOUgK3CU=
x-evy-trace-route-configuration: listener_https/all
x-request-id: 776cbc17-31d8-444d-a4fa-8237b1225682
last-modified: Wed, 10 May 2023 13:46:43 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ofXJBTncyAKivT%2Bf1XeLpwKsLwbic1eBTLs77Imx4COvtUUu9DSck2UVkQSUP01O%2F23v5jgVQbUhx6D2N9bTitsGl3cCqMrP4wFnNFNlNgqT9dHKlpfrMyBhBx0K8xp9t%2BPu7Sf6VPgpCjgz%2F2y8bKb%2BmQ%3D%3D"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/cms-hubfs-td/envoy-proxy-55b7d448b-hlzsf
access-control-allow-credentials: false
cf-ray: 7f2f98efbefe9c04-FRA
x-amz-cf-id: aCcoQlUlrPmuTAJpQvqlVfR-qxCZTPQFToO94h0EwgY4qOIQY1r2zg==

GET
H2 200 module_115016303498_Sidebar_ReversingGlass_Latest_Post_Block_-_global.min.css
www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/module_assets/115016303498/1683726382481/ 449 B
1 KB 169ms
159ms Stylesheet
text/css 2606:2c40::c73c:671f
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/module_assets/115016303498/1683726382481/module_115016303498_Sidebar_ReversingGlass_Latest_Post_Block_-_global.min.css

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

7d6d019be5fdd6ed212ab83345278024e52cb55e59e5a577644a58f1c29ae316

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
content-encoding: br
age: 457
x-amz-request-id: 0WSX39427J1AS112
x-amz-server-side-encryption: AES256
x-evy-trace-route-service-name: envoyset-translator
x-amz-replication-status: COMPLETED
x-hs-https-only: worker
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 20
x-evy-trace-listener: listener_https
etag: W/"8518a5951d9ad4d2295f309cf6fca5e1"
vary: origin, Accept-Encoding
x-amz-meta-created-unix-time-millis: 1683726382481
content-type: text/css
x-evy-trace-virtual-host: all
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 20
date: Mon, 07 Aug 2023 12:42:04 GMT
strict-transport-security: max-age=31536000
via: 1.1 b64454e3c1123ac098282f1036154740.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id: kE2bMXeYWn_ktJqXj7KUhR8Fu5cHi1x4
x-amz-cf-pop: IAD55-P3
x-hs-alternate-content-type: text/plain
x-cache: RefreshHit from cloudfront
x-amz-storage-class: INTELLIGENT_TIERING
x-envoy-upstream-service-time: 135
alt-svc: h3=":443"; ma=86400
x-amz-id-2: PW5+eWD9+xuuphm0jZbqbs12I5xghMcILTCbUgQxi2xPmBxVBs2q5a6cC6+jJLZGKMXQe6Tng7s=
x-evy-trace-route-configuration: listener_https/all
x-request-id: bf630b5b-dfad-40fb-be66-6907bb0b9973
last-modified: Wed, 10 May 2023 13:46:23 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2FyyhL5v726Yjgid8crUmTTxuxvbL9FgUVVn%2BFUysZ9%2Fhv4f%2FTIYrzrp8lRQCiSSmg3UXv1X5p96NKfnzstaFexcV6anuvBvp8hVIp0wX2GF87%2Bm%2BsTyf64H2vVtN9m4F2Wss8FBST7WgLvRpvI97nYhdXg%3D%3D"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/cms-hubfs-td/envoy-proxy-55b7d448b-fwhk5
access-control-allow-credentials: false
cf-ray: 7f2f98efbf009c04-FRA
x-amz-cf-id: uuvQbsRPHfQRoKUdPc9CdrHq4khVP5eIig2tHSi4wmDEv8XOJo5d4w==

GET
H2 200 module_115021731904_Sidebar_SPD_Latest_Post_Block_-_global.min.css
www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/module_assets/115021731904/1683728917797/ 449 B
1 KB 186ms
176ms Stylesheet
text/css 2606:2c40::c73c:671f
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/module_assets/115021731904/1683728917797/module_115021731904_Sidebar_SPD_Latest_Post_Block_-_global.min.css

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

7d6d019be5fdd6ed212ab83345278024e52cb55e59e5a577644a58f1c29ae316

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
content-encoding: br
age: 457
x-amz-request-id: FZ7AC83PSS98SKD7
x-amz-server-side-encryption: AES256
x-evy-trace-route-service-name: envoyset-translator
x-amz-replication-status: COMPLETED
x-hs-https-only: worker
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 20
x-evy-trace-listener: listener_https
etag: W/"8518a5951d9ad4d2295f309cf6fca5e1"
vary: origin, Accept-Encoding
x-amz-meta-created-unix-time-millis: 1683728917797
content-type: text/css
x-evy-trace-virtual-host: all
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 20
date: Mon, 07 Aug 2023 12:42:04 GMT
strict-transport-security: max-age=31536000
via: 1.1 d4564d6809e10e731bfdfae814a717f8.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id: _NB7Ho2f9mjVTOSpgbcz46QGtgjcNPEf
x-amz-cf-pop: IAD55-P3
x-hs-alternate-content-type: text/plain
x-cache: RefreshHit from cloudfront
x-amz-storage-class: INTELLIGENT_TIERING
x-envoy-upstream-service-time: 134
alt-svc: h3=":443"; ma=86400
x-amz-id-2: VFqhNEo69Eom5zdF27L0BoBqLcEsNE+6NT4gvpsJwKDcqBUCspDQOL27i0/xPUFMy1z6BIDvln4JjkfAEwvByH5rewwErVDf7pCBZOvWyt4=
x-evy-trace-route-configuration: listener_https/all
x-request-id: 48b01650-ff18-4237-a242-538decc54d8d
last-modified: Wed, 10 May 2023 14:28:38 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7NWqYW8bnkpC3dOQwI%2FGgCMhTCdIMS8fiC9Kt9o9Wiy3A%2Foc0z%2B3DDesyI0Zjy6ybo6xBKo8tCCUsMK8JsrOXm9rmMivpATZlBciGJAMllIFncXdDXCWHB6CRBkonW%2FWP5NDNW9ArbcUQCvnnG4oU8oF9A%3D%3D"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/cms-hubfs-td/envoy-proxy-55b7d448b-7hqzq
access-control-allow-credentials: false
cf-ray: 7f2f98efbf029c04-FRA
x-amz-cf-id: ML-o27nR3DM5iAcRNOXPn07RaCZMoZxnkpdGul3CDRqf1SxiLLfAxg==

GET
H2 200 footer-redesign-2019.min.css
www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/10777459487/1628866681200/Redesign_june_2019/Coded_Files/CSS/Components/ 1 KB
1 KB 196ms
187ms Stylesheet
text/css 2606:2c40::c73c:671f
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/10777459487/1628866681200/Redesign_june_2019/Coded_Files/CSS/Components/footer-redesign-2019.min.css

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

27215dede1579d37bcf4ab9ef8fc7d968bd02081c4e61d77837a9bb8f6ca9511

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:42:04 GMT
strict-transport-security: max-age=31536000
via: 1.1 3d65275b81abaf880be10de6f2c71e9a.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
content-security-policy: upgrade-insecure-requests
age: 818
x-amz-cf-pop: IAD89-P1
x-amz-server-side-encryption: AES256
x-amz-request-id: XN17V108TA3Q29ZQ
x-hs-alternate-content-type: text/plain
x-cache: Miss from cloudfront
x-amz-version-id: KkIg9v6XZx4VO697E4AlyOGL9YPPr5d0
content-encoding: br
x-amz-replication-status: COMPLETED
x-hs-https-only: worker
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 15
alt-svc: h3=":443"; ma=86400
x-amz-id-2: DRv9w4ZXSRtlFNqNrW4VenNjzvGWXVTbATZ5us7YbT28izqyACDpnXc+ZuXlTCBeC0lRNQBT60g=
last-modified: Fri, 13 Aug 2021 14:58:02 GMT
server: cloudflare
etag: W/"74345f5a0d3875bb7f758b06d4778849"
vary: Accept-Encoding
x-amz-meta-created-unix-time-millis: 1628866681235
content-type: text/css
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gTZM0gVjbA6aq5mEXFKiFpPy6nqvr6V1kgFoLpxX2Uht5q40w%2Bumgn27a6Ly6kHITicXn06J3fISoMa3PliBKLoRPoGxsUxLYzZFHcaPbEght9bT8YiX0tHFqpzdCAYEYba7s%2BZjFiyqLQ0qmobdltGgug%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900, s-maxage=31536000, max-age=31536000
access-control-allow-credentials: false
cf-ray: 7f2f98efbf039c04-FRA
x-amz-cf-id: Pl3iJdoAcSthxqknOzPki4QRQxA1dA2CZ5vkymSfHtsb-BKUL8dlNQ==
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 15

GET
H2 200 module_10782554896_Footer_-_Redesign_-_2019_-_Global.min.css
www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/module_assets/10782554896/1684325396009/ 126 B
1 KB 198ms
189ms Stylesheet
text/css 2606:2c40::c73c:671f
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/module_assets/10782554896/1684325396009/module_10782554896_Footer_-_Redesign_-_2019_-_Global.min.css

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

04245f85425b7978fbfd092971444a755772b93d9fb41f4c58f388e520403afd

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
content-encoding: br
age: 818
x-amz-request-id: 7X42C64NHK6DKKZ6
x-amz-server-side-encryption: AES256
x-evy-trace-route-service-name: envoyset-translator
x-amz-replication-status: PENDING
x-hs-https-only: worker
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 20
x-evy-trace-listener: listener_https
etag: W/"d5024537c90d258c2752af5a17a95367"
vary: origin, Accept-Encoding
x-amz-meta-created-unix-time-millis: 1684325396009
content-type: text/css
x-evy-trace-virtual-host: all
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 20
date: Mon, 07 Aug 2023 12:42:04 GMT
strict-transport-security: max-age=31536000
via: 1.1 f7c749b4d9ba39d7629c0f2f434dfc76.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id: ojCcsa3Hbm8KsKBjYnw5U.TUyefQWjmM
x-amz-cf-pop: IAD55-P1
x-hs-alternate-content-type: text/plain
x-cache: RefreshHit from cloudfront
x-amz-storage-class: INTELLIGENT_TIERING
x-envoy-upstream-service-time: 117
alt-svc: h3=":443"; ma=86400
x-amz-id-2: jViwf9FZMI3kLz81OlMSSEAWGIfG1h+N5HMjut2XqQyD4f6sd57vNh+/LOTvlzEnwFAGwQi7P7Q=
x-evy-trace-route-configuration: listener_https/all
x-request-id: 68fd99f1-8415-4850-bb85-75eed6f75eaf
last-modified: Wed, 17 May 2023 12:09:57 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qh2M9i7Yr%2BaTbkLI5BinupwKRwAkXtxp5zituEaxRJsino7e1%2B2d7%2F6lsJKIzGVG%2Fki4dC47M9BV3HksddAzsANDjn5GbUnHDD9bNlqU83XHBAHs0%2FvPmrvwflWP067AZjl9WaRnauX56dNklYG%2FEYRH9Q%3D%3D"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/cms-hubfs-td/envoy-proxy-fd8f7bc74-9xkdz
access-control-allow-credentials: false
cf-ray: 7f2f98efbf049c04-FRA
x-amz-cf-id: cAcZtDwXrfRC6DLwng9TElLYRUHOV39lbegzQXaUYO4q4r61QtMLzA==

GET
H2 200 Reversing_Labs_November2018-style.min.css
www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/6519964395/1685359416657/Reversing_Labs_November2018_Theme/Coded_Files/ 143 KB
24 KB 192ms
183ms Stylesheet
text/css 2606:2c40::c73c:671f
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/6519964395/1685359416657/Reversing_Labs_November2018_Theme/Coded_Files/Reversing_Labs_November2018-style.min.css

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

61ce08dbad99d88826d7e7d374b628662137c7893a943d6a541cf4b0455c5067

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
content-encoding: br
age: 3067
x-amz-request-id: 9BY06TDA00GEHJTS
x-amz-server-side-encryption: AES256
x-evy-trace-route-service-name: envoyset-translator
x-amz-replication-status: COMPLETED
x-hs-https-only: worker
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 20
x-evy-trace-listener: listener_https
etag: W/"3d0f457bdc611022c3f48f57eb877977"
vary: origin, Accept-Encoding
x-amz-meta-created-unix-time-millis: 1685359417818
content-type: text/css
x-evy-trace-virtual-host: all
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 20
date: Mon, 07 Aug 2023 12:42:04 GMT
strict-transport-security: max-age=31536000
via: 1.1 6400936fc4525d1c60e3e8fee9d4806e.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id: AcrfIRW95QY88SeuDIXAFoVt.4x1ZQWb
x-amz-cf-pop: IAD12-P2
x-hs-alternate-content-type: text/plain
x-cache: RefreshHit from cloudfront
x-amz-storage-class: INTELLIGENT_TIERING
x-envoy-upstream-service-time: 139
alt-svc: h3=":443"; ma=86400
x-amz-id-2: GkxM6CyUTGG0PBFgMJaDRztxsWFbJcPlZ0/7OioWm4zjLouo3IjGbhgJ83dkKDN715dWTz+6LH0HE9fsUUy+aoo105Uo0mmZotlTj0R0A+k=
x-evy-trace-route-configuration: listener_https/all
x-request-id: 87030c20-b4df-4c9a-a844-9982d6c02ddf
last-modified: Mon, 29 May 2023 11:23:38 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xrlG2wnNei7CoFY5ko%2By4iEfgynsPVopRfaIWifZ%2BL39hH2%2F94ShFxSdXZlMl%2B9RSr9OdnkwWvzy83VtN%2FoRn0FSDkhBSIyuD68GscfJ9FEF9KAW%2BL%2F0B8JL5bIzhtm4nOT4vo%2BWdMjijl7EIzPu7WgTKw%3D%3D"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/cms-hubfs-td/envoy-proxy-fd8f7bc74-9xkdz
access-control-allow-credentials: false
cf-ray: 7f2f98efbf059c04-FRA
x-amz-cf-id: EfnvyHcxkM0r5MgmZNSmpahxHbS44buGtkHilNHaDyIqxvzzMKUqGQ==

GET
H2 200 v4.js Show response
play.vidyard.com/embed/ 70 KB
23 KB 149ms
43ms Script
application/javascript 151.101.1.181
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://play.vidyard.com/embed/v4.js

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.1.181 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

86bc7c25a3bf03fad86ce1733e1a562b1395d60635b29960b7b3f68aefa8bc7a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31557600

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

x-cache-hits: 25
date: Mon, 07 Aug 2023 12:42:05 GMT
content-encoding: gzip
via: 1.1 varnish
strict-transport-security: max-age=31557600
age: 12336
x-amz-server-side-encryption: AES256
x-cache: HIT
content-length: 23020
x-served-by: cache-fra-etou8220069-FRA
x-china: 0
last-modified: Mon, 19 Jun 2023 19:37:16 GMT
etag: "4e2f211a0d5f0f0e82bcf94c1f18d11d"
vary: X-China, accept-language, Accept-Encoding
content-type: application/javascript
cache-control: no-cache, no-store, must-revalidate
accept-ranges: bytes
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 in.js Show response
platform.linkedin.com/ 510 KB
161 KB 1336ms
1210ms Script
text/javascript 2620:1ec:46::45
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://platform.linkedin.com/in.js

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:1ec:46::45 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

57fd9a32cc09b40cc00fd9878fd6149c750c903cbc604237b9f625bfb5895fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:42:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
nel: {"report_to":"network-errors","max_age":1296000,"success_fraction":0.00066,"failure_fraction":1,"include_subdomains":true}
x-cdn: AZUR
x-cdn-client-ip-version: IPV6
x-cache: TCP_MISS
x-cdn-proto: HTTP2
content-length: 163639
x-li-uuid: AAYCVJLdernTYuGXKolHKw==
x-li-pop: prod-lor1-x
vary: Accept-Encoding
report-to: {"group":"network-errors","max_age":2592000,"endpoints":[{"url":"https://www.linkedin.com/li/rep"}],"include_subdomains":true}
x-li-fabric: prod-lor1
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=3600
x-li-proto: http/1.1
x-azure-ref: 20230807T124204Z-zusybp96tx2ut2r4w42gxcb10s00000007t0000000000ef2
accept-ranges: bytes
expires: Mon, 7 Aug 2023 13:42:04 GMT

GET
H2 200 layout.min.css
cdn2.hubspot.net/hub/7052064/hub_generated/template_assets/1691156845456/hubspot/hubspot_default/shared/responsive/ 4 KB
2 KB 159ms
64ms Stylesheet
text/css 2606:4700::6812:cfc9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn2.hubspot.net/hub/7052064/hub_generated/template_assets/1691156845456/hubspot/hubspot_default/shared/responsive/layout.min.css
Requested by: Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:cfc9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 257855f4e23a1e3d382077b15bfc30971c9c261fc23512c88abfdcda05f28bc4

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

content-encoding: br
age: 255222
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
x-amz-replication-status: COMPLETED
x-hs-cf-lambda: us-east-1.EnforceAclForReads 2
x-evy-trace-listener: listener_https
etag: W/"94daf62e7e6df83595c6251fb0c7c055"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: text/css
access-control-allow-origin: *
x-amz-meta-created-unix-time-millis: 1691156846066
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
x-evy-trace-virtual-host: all
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 2
date: Mon, 07 Aug 2023 12:42:04 GMT
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop: IAD89-C1
x-hs-alternate-content-type: text/plain
x-hubspot-correlation-id: 360d3742-4e44-4d59-b9be-9c67e2e8f82b
x-amz-storage-class: INTELLIGENT_TIERING
x-envoy-upstream-service-time: 172
alt-svc: h3=":443"; ma=86400
x-evy-trace-route-configuration: listener_https/all
x-request-id: 360d3742-4e44-4d59-b9be-9c67e2e8f82b
last-modified: Fri, 04 Aug 2023 13:47:27 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2FPLg%2FuyuO616Quv13aQp%2BjGB0SxB83DSC8iB81Gj418gyJH%2FJfgOsa4VKV8swJxl%2Bh6JfnGkZH5AdAnrUppr96mPkBbfqh1P7BaJrJ848RjekthfgydbdhUESsEmMaFOrMxdAtat31nRQESw820%3D"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/cms-cdn2-td/envoy-proxy-8dfbb9f7c-hml5r
cf-ray: 7f2f98f01b709b43-FRA

GET
H2 200 RL-custom.min.css
www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/5951651806/1659964887293/Reversinglabs_July2018_Theme/Coded_Files/ 12 KB
4 KB 199ms
190ms Stylesheet
text/css 2606:2c40::c73c:671f
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/5951651806/1659964887293/Reversinglabs_July2018_Theme/Coded_Files/RL-custom.min.css

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

1a5f6ffeb8930092b29aef8860e2c8ebbe25dd2dcdf70ab4b6b137c4b4592f70

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
content-encoding: br
age: 818
x-amz-request-id: KJVA3T8C05FQVQS7
x-amz-server-side-encryption: AES256
x-amz-replication-status: COMPLETED
x-hs-https-only: worker
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 20
etag: W/"87c5bc53e5805378faf6e71727ae7d28"
vary: origin, Accept-Encoding
x-amz-meta-created-unix-time-millis: 1659964888595
content-type: text/css
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900, s-maxage=31536000, max-age=31536000
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 20
date: Mon, 07 Aug 2023 12:42:04 GMT
strict-transport-security: max-age=31536000
via: 1.1 b26814b9dbe71dc1916d211eeeec7ffc.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id: rddr3nP1mNXXwP_ajL22vN12Zg.dfVCT
x-amz-cf-pop: IAD66-C1
x-hs-alternate-content-type: text/plain
x-cache: Miss from cloudfront
x-amz-storage-class: INTELLIGENT_TIERING
alt-svc: h3=":443"; ma=86400
x-amz-id-2: gpmzJCgpTSh4b1cjRilAWftYbKF5XvB8RyVHN6J3sZGErlMWfrZgyIRbc4NHtVdmuqCH01lEb8g=
last-modified: Mon, 08 Aug 2022 13:21:29 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=MvpXwg7qBePnJ1oR2q0AJd7rjIzU6L%2BZ7x8a4VdF31Wi%2Bu2Uk6x2%2BKsykpaumDUZpquI3c9dLZ8E706SCcFHlHTegL8V0TxXaoIS%2FaRJQgcetCLcb375JdWbLUz3Fat%2B1nReXUstJm0j3SGopAh6koZVAA%3D%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-credentials: false
cf-ray: 7f2f98efbf069c04-FRA
x-amz-cf-id: L7nUqmBM3vzVBbHSBaHxkUde8H6REBKBG6fxxINo6GPLeDvt5P2lcw==

GET
H2 200 site-redesign-june-2019.min.css
www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/10528761402/1689162268961/Redesign_june_2019/Coded_Files/CSS/Modules/ 11 KB
4 KB 199ms
191ms Stylesheet
text/css 2606:2c40::c73c:671f
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/10528761402/1689162268961/Redesign_june_2019/Coded_Files/CSS/Modules/site-redesign-june-2019.min.css

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

c889e86e6c42fc475d139233bc09a8fe599673cfeebe015bd3083cd1ea994e93

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
content-encoding: br
age: 818
x-amz-request-id: C67VNPFCGTB66AF7
x-amz-server-side-encryption: AES256
x-evy-trace-route-service-name: envoyset-translator
x-amz-replication-status: COMPLETED
x-hs-https-only: worker
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 20
x-evy-trace-listener: listener_https
etag: W/"a6b54e2468e63ef91aa2333794289d8a"
vary: origin, Accept-Encoding
x-amz-meta-created-unix-time-millis: 1689162269645
content-type: text/css
x-evy-trace-virtual-host: all
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 20
date: Mon, 07 Aug 2023 12:42:04 GMT
strict-transport-security: max-age=31536000
via: 1.1 99baebf4b5bb631267dcfa82456151cc.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id: cM9nJ1gR34B3YQ2cLQTyj7pejlMLYf.6
x-amz-cf-pop: IAD89-C1
x-hs-alternate-content-type: text/plain
x-hubspot-correlation-id: 1474e339-698f-4678-ac49-46d176a69129
x-cache: Miss from cloudfront
x-amz-storage-class: INTELLIGENT_TIERING
x-envoy-upstream-service-time: 117
alt-svc: h3=":443"; ma=86400
x-amz-id-2: X7RU/r2YFdcytCOlgM3h5/PV30HyOohS2Xaa5t4y75gPm8QMm1r2rhFCkhlXSZA0DcGrag1V4Rt9F5pg0FstSq+Yz90fCNIJHulrHuua1/Q=
x-evy-trace-route-configuration: listener_https/all
x-request-id: 1474e339-698f-4678-ac49-46d176a69129
last-modified: Wed, 12 Jul 2023 11:44:30 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fyJCJlo6OZE2QuM7X9v%2F8sxGukh2YWo2WMzE%2BZ%2Fet30nNZhXTNbjFQw2qf96DDPha9IivNQHwFxul98ylsdA6b4VJIxUBc5d7BRLTkM3Dzd8%2Fzmzg35b0nLwjcfOYXp0h3AtrRSaDUyHMTZp9TkyM9cW%2Fw%3D%3D"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/cms-hubfs-td/envoy-proxy-fd8f7bc74-fhfns
access-control-allow-credentials: false
cf-ray: 7f2f98efbf089c04-FRA
x-amz-cf-id: V1blr6uorwDl5n385W2TrhgZrQ1kZSwtT96BG6jm5T3ARQRqDRqRzw==

GET
H2 200 blog.min.css
www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/23712622487/1628866682579/Coded_files/Modules/ 3 KB
2 KB 212ms
204ms Stylesheet
text/css 2606:2c40::c73c:671f
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/23712622487/1628866682579/Coded_files/Modules/blog.min.css

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

9a612c9ad7bdfdfeb71ed257ea676a5bca9db5694ee8a0f0c1f8a96330429ea3

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:42:04 GMT
strict-transport-security: max-age=31536000
via: 1.1 68fbda872a4e92e0774a97bdd960d43a.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
content-security-policy: upgrade-insecure-requests
age: 457
x-amz-cf-pop: IAD55-P1
x-amz-server-side-encryption: AES256
x-amz-request-id: PVBQ3EHJNVZ3DH5B
x-hs-alternate-content-type: text/plain
x-cache: Miss from cloudfront
x-amz-version-id: Mz.2Pn4CEDs4ZaIeZ_NrZ0_ijfcT5uxW
content-encoding: br
x-amz-replication-status: COMPLETED
x-hs-https-only: worker
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 15
alt-svc: h3=":443"; ma=86400
x-amz-id-2: AdFAJyDDt47mtRTm+i+5mhvXqYtw9R4oSCKHdYAWd98hoxhiv0ezOVUN1dsAJIxIAcj89A31sb0=
last-modified: Fri, 13 Aug 2021 14:58:03 GMT
server: cloudflare
etag: W/"86cceae70fe2cace0184968b3abea7a2"
vary: origin, Accept-Encoding
x-amz-meta-created-unix-time-millis: 1628866682656
content-type: text/css
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zPvzilK4r8TRTMTYg99k9bYmvBy0NEyU9u8HRF97i1mE7N%2Bl4%2BVoTlEeeyV48detPuW%2BSEheqaVhxWfyZs4OwgZP%2F3y8BZ%2B1A6nHGZxYRV6rP44ZaiJgFZZr8wixTuM0scxqWD5hXXa6dI%2BUwvCx9fHjdg%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900, s-maxage=31536000, max-age=31536000
access-control-allow-credentials: false
cf-ray: 7f2f98efbf0a9c04-FRA
x-amz-cf-id: ndNi6dzlnwd484cxdvYO2SvfsrFDtE_lpva3vv_rbCYqMwWHz0nWIQ==
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 15

GET
H2 200 conversing.min.css
www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/70521421874/1671120024586/Redesign_june_2019/Coded_Files/CSS/Modules/ 2 KB
1 KB 216ms
208ms Stylesheet
text/css 2606:2c40::c73c:671f
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/70521421874/1671120024586/Redesign_june_2019/Coded_Files/CSS/Modules/conversing.min.css

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

fc2fab7ad17829305a9146a6a0db45bf46dba8b104548a2777c5583c0aff059d

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
content-encoding: br
age: 457
x-amz-request-id: 3HKDKG6JYC0B1H76
x-amz-server-side-encryption: AES256
x-amz-replication-status: COMPLETED
x-hs-https-only: worker
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 15
etag: W/"03194bf820a8d747a9c4e33f60a3d8a6"
vary: origin, Accept-Encoding
x-amz-meta-created-unix-time-millis: 1671120025512
content-type: text/css
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900, s-maxage=31536000, max-age=31536000
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 15
date: Mon, 07 Aug 2023 12:42:04 GMT
strict-transport-security: max-age=31536000
via: 1.1 663f2425a3138c20ed99538fc8652f3c.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id: ezK3yCXod3kovn6QNb0kvlsgyxcpZGDT
x-amz-cf-pop: IAD12-P2
x-hs-alternate-content-type: text/plain
x-cache: Miss from cloudfront
x-amz-storage-class: INTELLIGENT_TIERING
alt-svc: h3=":443"; ma=86400
x-amz-id-2: 87MU8DBJBMSQHg688XQ17isnPD/kW/kOEAtQo7fIAcv02FP4o+Q9/UnTVolyk4qr4KZoI4FbxBE=
last-modified: Thu, 15 Dec 2022 16:00:26 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=avYQVK%2BS4CqeDEerN0y8Jtxn2TkROsvvrNnNCK1Layhy%2B1H9Svmh%2BtOlt0lrYQQaK7UwZysS0YFuCU%2BfdIeeR0R7Hz1pB26ZF0FRNdEvAMDEXcnYBymVq4EiWZPQl6Y4pqci3CIhHdxcZKSulm38z6uZlw%3D%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-credentials: false
cf-ray: 7f2f98efbf0c9c04-FRA
x-amz-cf-id: kTYzTQ14wow0_-YsFGrEp-on1x0R5rDzyXRz8V2i55dyqNWXmaCbAQ==

GET
H2 200 simplelightbox.min.css
www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/6021532803/1569840493756/Reversinglabs_July2018_Theme/Coded_Files/ 5 KB
2 KB 189ms
181ms Stylesheet
text/css 2606:2c40::c73c:671f
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/6021532803/1569840493756/Reversinglabs_July2018_Theme/Coded_Files/simplelightbox.min.css

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

c44bc92eb78d7b1596789095812e8c24f5c3f9b4835318cf329204d1efc37abb

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:42:04 GMT
strict-transport-security: max-age=31536000
via: 1.1 cea67f5ca1b497624430e599aa6b7c62.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
content-security-policy: upgrade-insecure-requests
age: 457
x-amz-cf-pop: IAD89-P1
x-amz-request-id: WPZ5SBN1S7NMVMA1
content-encoding: br
x-cache: Miss from cloudfront
x-amz-version-id: Y9o3twj1TmNPLtARM7I8GKUA.atzxWnP
x-hs-https-only: worker
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 15
alt-svc: h3=":443"; ma=86400
x-amz-id-2: kQyRDAImdosMo8wT8pgKTpv7tWbjbnIkXjGbn4j9nsZUhG0EF/sM/OJZstvG9qmgqxLzf3lLMBE=
last-modified: Mon, 30 Sep 2019 10:48:14 GMT
server: cloudflare
etag: W/"9c259f55b65931c5838c0f7cd5f58f93"
vary: origin, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RIXnhisI0Lqaz6cnBP6NVbgqMGqEcOsYk5GO2cohYiWkiBQz7JBQ5u4gGSoNu%2B98L%2F85RDht47Qko%2BU85MBnlBSFP34ShAHXic78oJc7DxaNHOTgggxcg70EQwEQXzZcyQ7WpTOq5v6h9Ob%2Fe6h%2BiTWd5A%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900, s-maxage=31536000, max-age=31536000
access-control-allow-credentials: false
cf-ray: 7f2f98efbf0e9c04-FRA
x-amz-cf-id: uo8Gv5YQe4kY1BmDhHk-1_ZCQKnflPaEaQ6XLBDp_kRV3VECkDNowg==
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 15

GET
H2 200 tag-list.min.css
www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/11708570900/1657723424898/Modules/Tag_list_-_inline/ 834 B
1 KB 195ms
188ms Stylesheet
text/css 2606:2c40::c73c:671f
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/11708570900/1657723424898/Modules/Tag_list_-_inline/tag-list.min.css

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

0f631dc190b0572010591fe489a4d434db77ce0ff6156e9e7e9aa745156c095c

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
content-encoding: br
age: 457
x-amz-request-id: MFRA92H8E8ETZ6XJ
x-amz-server-side-encryption: AES256
x-amz-replication-status: COMPLETED
x-hs-https-only: worker
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 15
etag: W/"d0f8005c0d02f9ea2078b355ed1700b3"
vary: origin, Accept-Encoding
x-amz-meta-created-unix-time-millis: 1657723425746
content-type: text/css
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900, s-maxage=31536000, max-age=31536000
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 15
date: Mon, 07 Aug 2023 12:42:04 GMT
strict-transport-security: max-age=31536000
via: 1.1 bf7159e30a38421f642619d6da9a8eb4.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id: R3vEp_hu.nAXB21yRaHK818uFUl.x7KV
x-amz-cf-pop: IAD12-P2
x-hs-alternate-content-type: text/plain
x-cache: RefreshHit from cloudfront
x-amz-storage-class: INTELLIGENT_TIERING
alt-svc: h3=":443"; ma=86400
x-amz-id-2: m5ib0LhCw+2dYRFganUTjiX8vsQoGfI6+8zy0SfMPKfRTt8b8mxy9eCV2BICEuw35bcWIfOS5u8=
last-modified: Wed, 13 Jul 2022 14:43:46 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9YQfrNQmrGqZGI4d95yweoMIHNcuRH9vyb%2Fr%2BUqYq7BM5dw0L8PD3MgzGn004fE0uXtHQeIDnh5EUvksd3gDTUuJkGMUbizSzE5BpGR62UXZnfWplIg9geY%2BY3zvFyo%2FD3qTok68cLrrr%2FVkhLE9hiZotg%3D%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-credentials: false
cf-ray: 7f2f98efbf109c04-FRA
x-amz-cf-id: rnCoR_AexppRbDFNytpqbFilyiAqQNgtdI3Z5vPeotDTahcWxQcn7A==

GET
H3 200 rl-com-logo.svg
www.reversinglabs.com/hubfs/Reversing_Labs_November%202018/Images/ 3 KB
2 KB 116ms
103ms Image
image/svg+xml 2606:2c40::c73c:671f
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.reversinglabs.com/hubfs/Reversing_Labs_November%202018/Images/rl-com-logo.svg

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

4ed697a94ae987ec690170223f411112068b61caf8678788cb4c37347249fd00

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:42:05 GMT
strict-transport-security: max-age=31536000
via: 1.1 5482351e8bcb93be701264b475dd3018.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-meta-cache-tag: F-6517800726,FD-6517800709,P-3375217,FLS-ALL
content-security-policy: upgrade-insecure-requests
age: 252297
x-amz-cf-pop: TLV50-C2
x-amz-request-id: Y6Z201APYHMBA3GA
content-encoding: br
edge-cache-tag: F-6517800726,FD-6517800709,P-3375217,FLS-ALL
cache-tag: F-6517800726,FD-6517800709,P-3375217,FLS-ALL
x-amz-version-id: BUsncvg3SahbgModZfK7dQUIXXLSPFen
x-cache: RefreshHit from cloudfront
x-hs-https-only: worker
x-hs-cf-lambda: us-east-1.EnforceAclForReads 2
alt-svc: h3=":443"; ma=86400
x-amz-id-2: p0oZJA2psZII0vVkNybjTB90mgmD1w98My7yJzLiT8xjn8nwBy8SRTbJrguIn8qJiLZCD/gnqw8=
last-modified: Wed, 14 Nov 2018 07:33:54 GMT
server: cloudflare
etag: W/"86ace497147ac2cd02198f3cde44219e"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: image/svg+xml
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kOWXTKNZ9yVLtkdCiOSdr58mDpIm8p%2BNyCnvCMKeNUcWlGJpnigA8IW2xeqenVcN0uT4SvUxqWQrGsoiVDTctAHExIcEAt1t1Vu7gw%2F3Th%2F3bzK9KYz3HSSie4Hg%2B5YPoDoeZLaCyr2DYdw8JJQ8tj6ccw%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
cf-ray: 7f2f98f8bf033a85-FRA
x-amz-cf-id: IlRcYPKT2bRGXPlHnZtwsOVZlSJnA8Ls71xLpYhnldN-d1f_WzEwmQ==
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 2

GET
H3 200 karlo_zanki.jpg
www.reversinglabs.com/hubfs/Imported_Blog_Media/authors/ 18 KB
19 KB 120ms
106ms Image
image/jpeg 2606:2c40::c73c:671f
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.reversinglabs.com/hubfs/Imported_Blog_Media/authors/karlo_zanki.jpg

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

262c51d03e4bdb5c91511e2df131b608a522b7a96c6a89048ceb90084b3402dc

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
x-amz-meta-cache-tag: F-24367560330,FD-8444884887,P-3375217,FLS-ALL
age: 137315
x-amz-request-id: D2YHCS10FPV0TKGT
edge-cache-tag: F-24367560330,FD-8444884887,P-3375217,FLS-ALL
x-hs-https-only: worker
x-hs-cf-lambda: us-east-1.EnforceAclForReads 2
cf-bgj: imgq:85,h2pri
etag: "c40419dee622f0738b5c1f8a5152db50"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: image/jpeg
access-control-allow-origin: *
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 2
date: Mon, 07 Aug 2023 12:42:05 GMT
strict-transport-security: max-age=31536000
via: 1.1 da749f044be44d389a30372d73356c4e.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id: lfcykLsw0R1YXz10xZ03n4UPI8BPc.OS
x-amz-cf-pop: FRA56-P7
cf-polished: degrade=85, origSize=90381, status=webp_bigger
x-cache: RefreshHit from cloudfront
cache-tag: F-24367560330,FD-8444884887,P-3375217,FLS-ALL
alt-svc: h3=":443"; ma=86400
content-length: 18276
x-amz-id-2: mSBuzIW7J8q2crOtDFkTh8pDCU/KJDgi/0i6oCk36vRJFFNArAR3k80csVexG2I7w6XIjySIRZY=
last-modified: Tue, 14 Jan 2020 16:45:17 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fQ0J2yRv7BlQHNm7ZkGwwcLP0UynpFd7JZ%2FvTdNUhH94LHmedotwKyvyXO%2FYXfZiEDnLI7oudM%2FTRZYm9Bx0N53h3ORir8wup7NP9M83IKCp8UsJW71leIAYsNTyLVi8KQD3fHg%2BM88TNvVKbmdq9s2LnA%3D%3D"}],"group":"cf-nel","max_age":604800}
accept-ranges: bytes
cf-ray: 7f2f98f8bf053a85-FRA
x-amz-cf-id: fYRYj6LHGTak33WOp67P9j--Y4cGO_iiAGl25lIHSXo9vYBXv0AfZA==

GET
H3 200 vmconnect-blog-figure1-behaviors.png
www.reversinglabs.com/hs-fs/hubfs/Blog/ 52 KB
53 KB 193ms
180ms Image
image/webp 2606:2c40::c73c:671f
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.reversinglabs.com/hs-fs/hubfs/Blog/vmconnect-blog-figure1-behaviors.png?width=1455&name=vmconnect-blog-figure1-behaviors.png

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

cebbc0e23f1d58a574eab9a677d14629b3aa59a6fbfb0133feb3e03f0e43f754

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:42:05 GMT
strict-transport-security: max-age=31536000
via: 1.1 b59465a36dda3b4ec573f7a87861306c.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-content-type-options: nosniff
content-security-policy: default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
cache-tag: F-128372092758,FD-11822274822,P-3375217,FLS-ALL
x-hs-https-only: worker
alt-svc: h3=":443"; ma=86400
content-length: 53054
cf-resized: internal=ok/m q=0 n=696+0 c=1+25 v=2023.7.3 l=53054
last-modified: Fri, 04 Aug 2023 12:08:01 GMT
cf-bgj: imgq:100,h2pri
server: cloudflare
etag: "cfufej3QaZimVEgmG-b-ZxJre5GKd00Nl93VqLII45DQ:a0a8e391d1e908289a78165d747c52a3"
vary: Accept, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dtWKBl91ic6kGuVf6B%2F35TdGUzMklDt6e2KFdkh6n7FqlcEuhy%2BGL12cIpIVQAoz4XH2clZRenGWg0cPO2F7mvwauG30w5J%2F4u0%2Fdn1Ivh8G4UrIY6Kaj349prUzgElpSU0vC4zIoC4cnE1x6GHo%2BYZUeQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
access-control-allow-origin: *
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
accept-ranges: bytes
cf-ray: 7f2f98f8bf073a85-FRA

GET
H3 200 vmconnect-blog-figure2-init.png
www.reversinglabs.com/hs-fs/hubfs/Blog/ 22 KB
23 KB 245ms
232ms Image
image/webp 2606:2c40::c73c:671f
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.reversinglabs.com/hs-fs/hubfs/Blog/vmconnect-blog-figure2-init.png?width=1455&name=vmconnect-blog-figure2-init.png

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

b452e67d0f273f9147920b2ec0783838b1ee33727eb9c6fae0a7cff22bf0ac85

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:42:05 GMT
strict-transport-security: max-age=31536000
via: 1.1 8dc3ccc34d68ee81173fff2a80f72bde.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-content-type-options: nosniff
content-security-policy: default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
cache-tag: F-128372335896,FD-11822274822,P-3375217,FLS-ALL
x-hs-https-only: worker
alt-svc: h3=":443"; ma=86400
content-length: 22832
cf-resized: internal=ok/h q=0 n=17+157 c=0+0 v=2023.7.3 l=22832
last-modified: Fri, 04 Aug 2023 12:08:01 GMT
cf-bgj: imgq:100,h2pri
server: cloudflare
etag: "cfFt2DVxVAwJfmRRxOIQy60dx2GKd00Nl93VqLII45DQ:7da2d727a22e07f170b074d37a6a926e"
vary: Accept, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=NZKECklonFedNa1yta8ryv6B3e4xIyr9NBa%2FYShbFPRo32K8hv0oCI600tZXn%2FPqakhoPc2EgegpDwhqHcGDwTb82ZyjG3flpDGAuhghBFnmj08D0k6kziEYRtQRqDalelhBx7ebYdvhVZ7xH8Q2Dkgs8A%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
access-control-allow-origin: *
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
accept-ranges: bytes
cf-ray: 7f2f98f8bf083a85-FRA

GET
H3 200 vmconnect-blog-figure4-loop.png
www.reversinglabs.com/hs-fs/hubfs/Blog/ 17 KB
18 KB 245ms
232ms Image
image/webp 2606:2c40::c73c:671f
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.reversinglabs.com/hs-fs/hubfs/Blog/vmconnect-blog-figure4-loop.png?width=1455&name=vmconnect-blog-figure4-loop.png

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

ddb82c84e1cb4f9ed0e23ada938029f0ac7a79f8a8215eee7bd5177726c02c32

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:42:05 GMT
strict-transport-security: max-age=31536000
via: 1.1 62e7b24ca032b612bb93fa7f3437469c.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-content-type-options: nosniff
content-security-policy: default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
cache-tag: F-128374422914,FD-11822274822,P-3375217,FLS-ALL
x-hs-https-only: worker
alt-svc: h3=":443"; ma=86400
content-length: 17238
cf-resized: internal=ok/h q=0 n=38+104 c=0+0 v=2023.7.3 l=17238
last-modified: Fri, 04 Aug 2023 12:08:01 GMT
cf-bgj: imgq:100,h2pri
server: cloudflare
etag: "cf_SALb2FHaXCWedM222ZRwjYzGKd00Nl93VqLII45DQ:9d3990287e545845bf5381744ab07eff"
vary: Accept, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2BE%2FXbjfKU5TszqGynhvRhvQSGG2FltdKOwFnNF2CF%2FQYl%2BmK1TFMNk0Nt2OsUtKSj6emTGwv794qivKUJz0tLKUDhXi767lfqxZ0kWkW1VV5oh2foiRSX4VHcpRLUm9DPsk9isG%2BljeOiW2FU3PkHgVOrA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
access-control-allow-origin: *
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
accept-ranges: bytes
cf-ray: 7f2f98f8bf093a85-FRA

GET
H3 200 vmconnect-blog-figure5-PyPI_author.png
www.reversinglabs.com/hs-fs/hubfs/Blog/ 41 KB
42 KB 269ms
256ms Image
image/webp 2606:2c40::c73c:671f
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.reversinglabs.com/hs-fs/hubfs/Blog/vmconnect-blog-figure5-PyPI_author.png?width=1455&name=vmconnect-blog-figure5-PyPI_author.png

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

68858bf90cb3efb40b74dc096a0c14d3d7d8df522e30067cbee82f0640af2bab

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:42:05 GMT
strict-transport-security: max-age=31536000
via: 1.1 fde85e7daa13f95cf6b8f5fa09c62ef6.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-content-type-options: nosniff
content-security-policy: default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
cache-tag: F-128341467472,FD-11822274822,P-3375217,FLS-ALL
x-hs-https-only: worker
alt-svc: h3=":443"; ma=86400
content-length: 42454
cf-resized: internal=ok/m q=0 n=845+0 c=2+150 v=2023.7.3 l=42454
last-modified: Fri, 04 Aug 2023 12:08:01 GMT
cf-bgj: imgq:100,h2pri
server: cloudflare
etag: "cf4eAidWT4Kfyr0376G4LYBTEkGKd00Nl93VqLII45DQ:dfca138c459dd0bde26f427b54882fb0"
vary: Accept, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=aYn3bGyDsVlpcCi8v6VWVG7NaPA%2FRiikxgNmEKqA6V7AcOrqrYPTqj91ZpD4yxjwUJFWcilzlYgAe1ax%2Bx7zXalzqPMx1mS%2F50JuGvLtFiKXclh5afTx%2Bcf2OHPNcY63qSdISarnmIggN2hMGj2kTh2IZQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
access-control-allow-origin: *
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
accept-ranges: bytes
cf-ray: 7f2f98f8bf0a3a85-FRA

GET
H3 200 vmconnect-blog-figure6-PyPI_project.png
www.reversinglabs.com/hs-fs/hubfs/Blog/ 186 KB
186 KB 294ms
281ms Image
image/webp 2606:2c40::c73c:671f
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.reversinglabs.com/hs-fs/hubfs/Blog/vmconnect-blog-figure6-PyPI_project.png?width=1455&name=vmconnect-blog-figure6-PyPI_project.png

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

cc3652de6720e88bb9378b09d34a2e807d1706b7a59a2d29903a68fa481759d5

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:42:05 GMT
strict-transport-security: max-age=31536000
via: 1.1 d76db2cbee553c8bb2de7fd88a960646.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-content-type-options: nosniff
content-security-policy: default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
cache-tag: F-128374414403,FD-11822274822,P-3375217,FLS-ALL
x-hs-https-only: worker
alt-svc: h3=":443"; ma=86400
content-length: 189956
cf-resized: internal=ok/h q=0 n=14+103 c=0+0 v=2023.7.3 l=189956
last-modified: Fri, 04 Aug 2023 12:08:01 GMT
cf-bgj: imgq:100,h2pri
server: cloudflare
etag: "cfFfRcqUYlcTr9pFJWgfYd3pdbGKd00Nl93VqLII45DQ:1cfbe751e2673baa5ce60b4c41060984"
vary: Accept, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Fj93jX1t%2FNWgNoOClRbeaJpPKJcPYHPefqFAMRQHmdL%2F41aF410eH3JZNAlVKAEiFPEuPKrrAajSd%2BZLSGoUAsy%2B9E7EvjMEAZEkXAf1dFOtvXBf6e72OQFN6NQZrDqXJIpLSuwWLYj8%2BOrfNZIqXKHtAw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
access-control-allow-origin: *
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
accept-ranges: bytes
cf-ray: 7f2f98f8bf0e3a85-FRA

GET
H3 200 vmconnect-blog-figure7-husky_github.png
www.reversinglabs.com/hs-fs/hubfs/Blog/ 40 KB
41 KB 340ms
327ms Image
image/webp 2606:2c40::c73c:671f
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.reversinglabs.com/hs-fs/hubfs/Blog/vmconnect-blog-figure7-husky_github.png?width=1455&name=vmconnect-blog-figure7-husky_github.png

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

d0f80d27eb235c529b6f87057ab7763ab82f8eb2396e8d40df573eb80e5364ec

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:42:05 GMT
strict-transport-security: max-age=31536000
via: 1.1 099a327961f82798658bf21aa210d4a0.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-content-type-options: nosniff
content-security-policy: default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
cache-tag: F-128372092759,FD-11822274822,P-3375217,FLS-ALL
x-hs-https-only: worker
alt-svc: h3=":443"; ma=86400
content-length: 40814
cf-resized: internal=ok/h q=0 n=35+0 c=4+116 v=2023.7.3 l=40814
last-modified: Fri, 04 Aug 2023 12:08:01 GMT
cf-bgj: imgq:86,h2pri
server: cloudflare
etag: "cf6mRjUQKEMCNe1MHl4G6669OlGKd00Nl93VqLII45DQ:65453383a0255d7d93786baa4e8ea55e"
vary: Accept, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7qrxoMBMDvBA%2BaO0wxxej4rzvjSUknCawp9NFL3p%2FuvIyZPGkl7eB1B6yMHFGY2%2FhrEJUTYK7%2BV%2FSYmkHCJ27Qqrx5PJJHmwlZSFPv%2BU4OOFAsQrCF7NDT0Z5ALSJTefK9wZsnBQlrJDnCU%2F8oJcc%2FLU7A%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
access-control-allow-origin: *
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
accept-ranges: bytes
cf-ray: 7f2f98f8bf0f3a85-FRA

GET
H3 200 vmconnect-blog-figure8-init_gihub.png
www.reversinglabs.com/hs-fs/hubfs/Blog/ 21 KB
21 KB 344ms
330ms Image
image/webp 2606:2c40::c73c:671f
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.reversinglabs.com/hs-fs/hubfs/Blog/vmconnect-blog-figure8-init_gihub.png?width=1455&name=vmconnect-blog-figure8-init_gihub.png

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

4fe6def01e693b4ff7f8a5baa5663c2b2eb7a228d7eb28ca379d255b640df211

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:42:05 GMT
strict-transport-security: max-age=31536000
via: 1.1 0e358bffbd534852f8496b34da6ad3e4.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-content-type-options: nosniff
content-security-policy: default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
cache-tag: F-128373652739,FD-11822274822,P-3375217,FLS-ALL
x-hs-https-only: worker
alt-svc: h3=":443"; ma=86400
content-length: 21010
cf-resized: internal=ok/h q=0 n=14+158 c=0+0 v=2023.7.3 l=21010
last-modified: Fri, 04 Aug 2023 12:08:01 GMT
cf-bgj: imgq:100,h2pri
server: cloudflare
etag: "cfs-ifkdVbVAVeuQWW3EQdNzUMGKd00Nl93VqLII45DQ:cbfb25e399f643ee0577249514d1bb1a"
vary: Accept, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2Fm%2FtfxROphujg6MVYaCX6Xq0LPr1sWqAj0dsEbED6RNFpTUFzUWdYydhPU3zjHV8ACSJIOey1O6It5TcPu52JcNFUD%2BY3vuQJQL7nPva0p3SVmjrhkGPRZecDbIVrDg6oKKFIIi1VWRaY5CzRoGEwjggVQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
access-control-allow-origin: *
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
accept-ranges: bytes
cf-ray: 7f2f98f8bf103a85-FRA

GET
H3 200 vmconnect-blog-figure9-VMConnect.png
www.reversinglabs.com/hs-fs/hubfs/Blog/ 161 KB
162 KB 345ms
331ms Image
image/webp 2606:2c40::c73c:671f
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.reversinglabs.com/hs-fs/hubfs/Blog/vmconnect-blog-figure9-VMConnect.png?width=1455&name=vmconnect-blog-figure9-VMConnect.png

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

d09af97ee06f58b7c0e071433e4f08dcfc244e3786639a601e31d3227418473a

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:42:05 GMT
strict-transport-security: max-age=31536000
via: 1.1 4a0b7683a1d33d6d186965e831f2de96.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-content-type-options: nosniff
content-security-policy: default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
cache-tag: F-128372335897,FD-11822274822,P-3375217,FLS-ALL
x-hs-https-only: worker
alt-svc: h3=":443"; ma=86400
content-length: 165108
cf-resized: internal=ok/h q=0 n=23+107 c=0+0 v=2023.7.3 l=165108
last-modified: Fri, 04 Aug 2023 12:08:01 GMT
cf-bgj: imgq:100,h2pri
server: cloudflare
etag: "cfDtEuFLyHnqiI5u-mEeIjwAyrGKd00Nl93VqLII45DQ:b7c5d069ae16571551aedfc140d1cd44"
vary: Accept, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Dnd0ScElyEW7FCP2nvRccHopotXexQJxASJwDHRCrPacrSqZYcc7Ti4HpxMygTmo0zG0rDrGR%2BSUlMcyq%2BH5C3dPu5QJwfP0ZnSZMJrJszWrUFm2zZUUL30kCS89huE7kaWee8N7kN6B%2BEOPLfH4vSUfmQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
access-control-allow-origin: *
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
accept-ranges: bytes
cf-ray: 7f2f98f8bf123a85-FRA

GET
H3 200 vmconnect-blog-figure10-vconnector.png
www.reversinglabs.com/hs-fs/hubfs/Blog/ 169 KB
170 KB 382ms
369ms Image
image/webp 2606:2c40::c73c:671f
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.reversinglabs.com/hs-fs/hubfs/Blog/vmconnect-blog-figure10-vconnector.png?width=1455&name=vmconnect-blog-figure10-vconnector.png

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

e600901c3822e2410c8113d763d1f8babb08aab7d06aa1c861be265408cdf649

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:42:05 GMT
strict-transport-security: max-age=31536000
via: 1.1 da749f044be44d389a30372d73356c4e.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-content-type-options: nosniff
content-security-policy: default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
cache-tag: F-128371840411,FD-11822274822,P-3375217,FLS-ALL
x-hs-https-only: worker
alt-svc: h3=":443"; ma=86400
content-length: 173076
cf-resized: internal=ok/m q=0 n=848+93 c=0+0 v=2023.7.3 l=173076
last-modified: Fri, 04 Aug 2023 12:08:01 GMT
cf-bgj: imgq:100,h2pri
server: cloudflare
etag: "cftFp7EBIUJYCcv0x9uuWvalXcGKd00Nl93VqLII45DQ:a3fd118096a03f915ee02d3e659ce71b"
vary: Accept, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=IBcHZ9qQPqHm%2BmB8p4bE9Wm40OFhkbN3%2BiwkNHFXjX3T3Qh6HQdDoXWWE7buMMnfV%2BTHWUNQdwS6zrMsVUZMNxKVqsNSh%2FPuKDerdi0fo3KoBQ0HLwUXccOt8%2F3ARoglE2cL4txzfcE9ySvE%2FXoWOgVEJg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
access-control-allow-origin: *
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
accept-ranges: bytes
cf-ray: 7f2f98f8bf133a85-FRA

GET
H2 200 must-see-sessions-black-hat-2023.jpg
3375217.fs1.hubspotusercontent-na1.net/hub/3375217/hubfs/ 38 KB
38 KB 230ms
125ms Image
image/webp 2606:4700::6812:e0f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://3375217.fs1.hubspotusercontent-na1.net/hub/3375217/hubfs/must-see-sessions-black-hat-2023.jpg?width=480&name=must-see-sessions-black-hat-2023.jpg

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:e0f , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7426c1c0d2289ccde69718bb10ae44a1a6602702194410999afb700e1e580d94

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; navigate-to 'none'; form-action 'none'
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:42:05 GMT
via: 1.1 5c91d033409cd7607633594f94b09064.cloudfront.net (CloudFront)
x-content-type-options: nosniff
cf-cache-status: HIT
content-security-policy: default-src 'none'; navigate-to 'none'; form-action 'none'
cache-tag: F-128445232020,P-3375217,FLS-ALL
content-length: 38412
cf-resized: internal=ok/m q=0 n=188+0 c=11+33 v=2023.7.3 l=38412
last-modified: Fri, 04 Aug 2023 17:26:35 GMT
cf-bgj: imgq:86,h2pri
server: cloudflare
etag: "cfYumcyN5h7tB9G9kNrISFMtgNzQG3Dz_JuxJXtzypDQ:c2dafc0f4f9381d2204a0799a5f235ec"
vary: Accept, Accept-Encoding
content-type: image/webp
access-control-allow-origin: *
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
accept-ranges: bytes
cf-ray: 7f2f98f94a275c50-FRA

GET
H2 200 Join-us-at-Bsides%2c-Black-Hat%2c-Def-on.png
3375217.fs1.hubspotusercontent-na1.net/hub/3375217/hubfs/ 21 KB
21 KB 220ms
117ms Image
image/webp 2606:4700::6812:e0f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://3375217.fs1.hubspotusercontent-na1.net/hub/3375217/hubfs/Join-us-at-Bsides%2c-Black-Hat%2c-Def-on.png?width=480&name=Join-us-at-Bsides%2c-Black-Hat%2c-Def-on.png

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:e0f , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

867e2af897e43a15b5cb0cbf905ba563964426f8707d602891643fe039aa2566

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; navigate-to 'none'; form-action 'none'
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:42:05 GMT
via: 1.1 776fbf9a4fc4b393f157f9f75dd29a06.cloudfront.net (CloudFront)
x-content-type-options: nosniff
cf-cache-status: HIT
content-security-policy: default-src 'none'; navigate-to 'none'; form-action 'none'
cache-tag: F-125626784020,P-3375217,FLS-ALL
content-length: 21380
cf-resized: internal=ok/m q=0 n=350+0 c=6+33 v=2023.7.3 l=21380
last-modified: Thu, 20 Jul 2023 15:32:15 GMT
cf-bgj: imgq:86,h2pri
server: cloudflare
etag: "cfKQAtJ6vhYxPAvRVg0GlPAx7QzQG3Dz_JuxJXtzypDQ:b0ec1614a8085e5cb245b7a0f678054a"
vary: Accept, Accept-Encoding
content-type: image/webp
access-control-allow-origin: *
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
accept-ranges: bytes
cf-ray: 7f2f98f94a2b5c50-FRA

GET
H2 200 air-gap-remote-access-kaspersky.jpg
3375217.fs1.hubspotusercontent-na1.net/hub/3375217/hubfs/ 44 KB
45 KB 180ms
77ms Image
image/webp 2606:4700::6812:e0f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://3375217.fs1.hubspotusercontent-na1.net/hub/3375217/hubfs/air-gap-remote-access-kaspersky.jpg?width=480&name=air-gap-remote-access-kaspersky.jpg

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:e0f , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

29d170b4f372603eff8bafec8eedd2dc57712f5e38b276f31c4a5295eeeb9de3

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; navigate-to 'none'; form-action 'none'
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:42:05 GMT
via: 1.1 afd822e99baebd9321fa9aa8f9350e78.cloudfront.net (CloudFront)
x-content-type-options: nosniff
cf-cache-status: HIT
content-security-policy: default-src 'none'; navigate-to 'none'; form-action 'none'
cache-tag: F-128135521287,P-3375217,FLS-ALL
content-length: 45536
cf-resized: internal=ok/m q=0 n=210+0 c=11+34 v=2023.7.3 l=45536
last-modified: Thu, 03 Aug 2023 12:49:14 GMT
cf-bgj: imgq:86,h2pri
server: cloudflare
etag: "cfKtefQyCYdAtrcIkKJuwm6qaCzQG3Dz_JuxJXtzypDQ:24f11135095e0a03c427cb44e068bda0"
vary: Accept, Accept-Encoding
content-type: image/webp
access-control-allow-origin: *
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
accept-ranges: bytes
cf-ray: 7f2f98f94a2d5c50-FRA

GET
H3 200 tag.svg
www.reversinglabs.com/hubfs/ 946 B
2 KB 385ms
374ms Image
image/svg+xml 2606:2c40::c73c:671f
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.reversinglabs.com/hubfs/tag.svg

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

8dc97419c862f91c4279fb9e2d9a0b7b9b63982ae1d3700a351ea1950c46f564

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
content-encoding: br
x-amz-meta-cache-tag: F-79211394341,P-3375217,FLS-ALL
age: 140942
x-amz-request-id: E01Y81VPVHD41TD5
x-amz-server-side-encryption: AES256
edge-cache-tag: F-79211394341,P-3375217,FLS-ALL
x-amz-replication-status: COMPLETED
x-hs-https-only: worker
x-hs-cf-lambda: us-east-1.EnforceAclForReads 2
etag: W/"27594f47645e4d58406fd3cf3d07e0a2"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: image/svg+xml
access-control-allow-origin: *
x-amz-meta-created-unix-time-millis: 1657811796583
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
x-robots-tag: all
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 2
date: Mon, 07 Aug 2023 12:42:05 GMT
strict-transport-security: max-age=31536000
via: 1.1 866cae60a439e812ecd782c40d472308.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id: aRYhGFr8YswkXmWbJnGhRE6TAiUwxgKw
x-amz-cf-pop: FCO50-P3
x-hs-alternate-content-type: text/plain
x-cache: RefreshHit from cloudfront
cache-tag: F-79211394341,P-3375217,FLS-ALL
x-amz-meta-index-tag: all
x-amz-storage-class: INTELLIGENT_TIERING
alt-svc: h3=":443"; ma=86400
x-amz-id-2: W9fWfkyXzVhcsgKPhrOLob4TsO7RFDVainp6spzW/jPNDFITJ0LGEA+GYiP6PyrifYZHYa2mfx8=
last-modified: Thu, 14 Jul 2022 15:16:37 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JA0Cffy4Rn9hFoUDGRgizJ4jLHiW6GfzfnYBS5Dj11tDhjoedwCntTipgT3MV0eFBmYvFPnypwvrgoAhZ9CpZ7kcs26%2BNvzgC6SqWd89SQ6wohQT21On6hDhZBh%2F1PkFcuX%2FChGxHvyUFN8zrzPN3Dw3nw%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 7f2f98f8bf163a85-FRA
x-amz-cf-id: Sclz9bAZtievMm6QFtLEkDIWOfOQHPSQTaFR15nG6R_9UnbdAWC88Q==

GET
H3 200 puzzle.png
www.reversinglabs.com/hs-fs/hubfs/images/ 190 B
1008 B 385ms
374ms Image
image/webp 2606:2c40::c73c:671f
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.reversinglabs.com/hs-fs/hubfs/images/puzzle.png?width=24&name=puzzle.png

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

6ba44383bc980179d0772e2785fdb088c71034b7c54607e739bc56c0e1002250

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:42:05 GMT
strict-transport-security: max-age=31536000
via: 1.1 f1a22cc8d842b0950e4bd5bda60806f2.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-content-type-options: nosniff
content-security-policy: default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
cache-tag: F-80971515058,FD-41794900664,P-3375217,FLS-ALL
x-hs-https-only: worker
alt-svc: h3=":443"; ma=86400
content-length: 190
cf-resized: internal=ok/h q=0 n=35+0 c=0+0 v=2023.7.3 l=190
last-modified: Wed, 03 Aug 2022 11:16:38 GMT
cf-bgj: imgq:100,h2pri
server: cloudflare
etag: "cfTEUp8Ew9ax83YU-aC7YLXg9u1csUNuQbJ8Ycnj_pDQ:e388a2e47cf27a736b1d0bbd369fa3d1"
vary: Accept, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=u49fMjr7qnKAyz%2Fc49MQUQ0JbuQ%2FqNwWdmyGFUiQiZAyuFanPeww5IUGQawISJfyD1m4rSwc5NCHdF6PCSJ65P4pOH8DBj%2BpYXUF14DUiAFiE7zHVwvrCZHbFxfDP%2BpitPcz7XL5%2FrieIpPf09rxmEksvA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
access-control-allow-origin: *
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
accept-ranges: bytes
cf-ray: 7f2f98f8bf193a85-FRA

GET
H3 200 tag-dev-devsec-ops.png
www.reversinglabs.com/hs-fs/hubfs/images/ 170 B
988 B 385ms
375ms Image
image/webp 2606:2c40::c73c:671f
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.reversinglabs.com/hs-fs/hubfs/images/tag-dev-devsec-ops.png?width=24&name=tag-dev-devsec-ops.png

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

94e9a5e460eda83b3532d27cbb92a176ac95f1429ae89f9164d47a29d3370ee2

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:42:05 GMT
strict-transport-security: max-age=31536000
via: 1.1 f49d2048986bda3a0a01d90206147140.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-content-type-options: nosniff
content-security-policy: default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
cache-tag: F-85478930439,FD-41794900664,P-3375217,FLS-ALL
x-hs-https-only: worker
alt-svc: h3=":443"; ma=86400
content-length: 170
cf-resized: internal=ok/h q=0 n=10+0 c=0+0 v=2023.7.3 l=170
last-modified: Tue, 20 Sep 2022 12:31:04 GMT
cf-bgj: imgq:100,h2pri
server: cloudflare
etag: "cfv7c03z3Ffq_nGeIA5yKSc4mh1csUNuQbJ8Ycnj_pDQ:9183b185622ef93c463aaa428f1f5ec1"
vary: Accept, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=XaX%2B2FMyr9h5exSWlVWt%2FM%2B6TYgkgaNmUnLbbEInnMKcZQeHY2KZTlATqBz5%2BMzoxLIiVd0bTU8XN31JiPjLS90tqrOOaSfg6ulh%2BWjDDTs9X8dyisoKXWFL3iJIuVJDXJKGtCaLyq0Dmd5qFlWOe%2BXzeA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
access-control-allow-origin: *
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
accept-ranges: bytes
cf-ray: 7f2f98f8bf1a3a85-FRA

GET
H3 200 ico-threat-research.png
www.reversinglabs.com/hs-fs/hubfs/images/ 292 B
1 KB 386ms
375ms Image
image/webp 2606:2c40::c73c:671f
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.reversinglabs.com/hs-fs/hubfs/images/ico-threat-research.png?width=24&name=ico-threat-research.png

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

7b1ecc91aa14b48acb2f7655cc2f4285d7839ab8d239982d4473b02917cd55db

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:42:05 GMT
strict-transport-security: max-age=31536000
via: 1.1 ade5b31bd02630f0b5fc77309a9d7038.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-content-type-options: nosniff
content-security-policy: default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
cache-tag: F-80135253149,FD-41794900664,P-3375217,FLS-ALL
x-hs-https-only: worker
alt-svc: h3=":443"; ma=86400
content-length: 292
cf-resized: internal=ok/m q=0 n=685+0 c=0+0 v=2023.7.3 l=292
last-modified: Mon, 25 Jul 2022 15:07:22 GMT
cf-bgj: imgq:100,h2pri
server: cloudflare
etag: "cfUSLvJ4c4Cy57IRZiA1hwxqgf1csUNuQbJ8Ycnj_pDQ:e7151140ece53d72171148a7324d4b11"
vary: Accept, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1Ycv5jPA9qS5A%2FYysLIL7ZjCL4N6d1PvdjDOdJN%2BovzyQaA%2FK7MXzMOg2x3C%2BQwYbGkNCfYmWTtWFpWAWmfTQFmCu%2BVx87tg2HleMia90dfoX7U5hsUfvvMprBxfumI0BH4R2THA2Ob3zKJGpJSkIY2%2Fqg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
access-control-allow-origin: *
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
accept-ranges: bytes
cf-ray: 7f2f98f8bf1c3a85-FRA

GET
H3 200 alarm.png
www.reversinglabs.com/hs-fs/hubfs/images/ 224 B
1 KB 386ms
375ms Image
image/webp 2606:2c40::c73c:671f
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.reversinglabs.com/hs-fs/hubfs/images/alarm.png?width=24&name=alarm.png

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

be806513bf84af0e310b27e6d4c7eaa56119e06690c7b0bc50d728b7e82b3c9f

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:42:05 GMT
strict-transport-security: max-age=31536000
via: 1.1 deaad1e568685a25accc9fd26a305f78.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-content-type-options: nosniff
content-security-policy: default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
cache-tag: F-80978517010,FD-41794900664,P-3375217,FLS-ALL
x-hs-https-only: worker
alt-svc: h3=":443"; ma=86400
content-length: 224
cf-resized: internal=ok/h q=0 n=14+0 c=0+0 v=2023.7.3 l=224
last-modified: Wed, 03 Aug 2022 11:17:23 GMT
cf-bgj: imgq:100,h2pri
server: cloudflare
etag: "cf8LPChb5JPnuX8S6grriML_Pq1csUNuQbJ8Ycnj_pDQ:e129885aca10039ee2de1413175bc2d5"
vary: Accept, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Mj7FVIrULR%2BGDtTpbNIbTnLVy%2F%2B7hWWktXoUoqm1DyOqgh71J43SJbOfPz4W%2BIPb%2FtH%2FRgChRX%2FqYbHab69rW0zzAk7i7itL%2FufqZeGeIclp4FOSWmbUQ74xtEFVdDhKLD5W7u5xjN7gOP%2FECaOt3%2BpEvA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
access-control-allow-origin: *
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
accept-ranges: bytes
cf-ray: 7f2f98f8bf1f3a85-FRA

GET
H3 200 terminal.png
www.reversinglabs.com/hs-fs/hubfs/images/ 198 B
1020 B 386ms
375ms Image
image/webp 2606:2c40::c73c:671f
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.reversinglabs.com/hs-fs/hubfs/images/terminal.png?width=24&name=terminal.png

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

4bc7148ba69c82eccc86c4a9b90d4cf456d9129c9503ad143c8005735f3fb8ba

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:42:05 GMT
strict-transport-security: max-age=31536000
via: 1.1 73dc4163c5d709eb7fc618a6b2f07c24.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-content-type-options: nosniff
content-security-policy: default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
cache-tag: F-80972444337,FD-41794900664,P-3375217,FLS-ALL
x-hs-https-only: worker
alt-svc: h3=":443"; ma=86400
content-length: 198
cf-resized: internal=ok/h q=0 n=10+0 c=0+0 v=2023.7.3 l=198
last-modified: Wed, 03 Aug 2022 11:18:30 GMT
cf-bgj: imgq:100,h2pri
server: cloudflare
etag: "cf6bMIImIWOdGtWqvTkruXE1Mt1csUNuQbJ8Ycnj_pDQ:df29f53ad31749ce8ebed7c59dfda5a3"
vary: Accept, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Dvy4DzDRlTiQU%2FbLbOp3a2y28vhZlJ7IO2UroIID3EV6DhXWpoIgQGQs2ow8bNWA4%2Bh19Z1QM0P%2B66x%2BW%2BP%2BZLtmboWqQ%2BZq1h2n6WTYSlt9%2BjkA4sUztqGzBoPGV8MRn6RDd1asfNiGTixo0LiurFO5aA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
access-control-allow-origin: *
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
accept-ranges: bytes
cf-ray: 7f2f98f8bf203a85-FRA

GET
H3 200 calendar-three.png
www.reversinglabs.com/hs-fs/hubfs/images/ 222 B
1 KB 386ms
376ms Image
image/webp 2606:2c40::c73c:671f
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.reversinglabs.com/hs-fs/hubfs/images/calendar-three.png?width=24&name=calendar-three.png

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

09d01a00c23781420e6623249a514a995ea7dd8417159f308ca5391078243928

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:42:05 GMT
strict-transport-security: max-age=31536000
via: 1.1 f3725fc3050adfa31f8eedaa3ab18d9c.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-content-type-options: nosniff
content-security-policy: default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
cache-tag: F-80978517087,FD-41794900664,P-3375217,FLS-ALL
x-hs-https-only: worker
alt-svc: h3=":443"; ma=86400
content-length: 222
cf-resized: internal=ok/h q=0 n=13+0 c=0+0 v=2023.7.3 l=222
last-modified: Wed, 03 Aug 2022 11:19:08 GMT
cf-bgj: imgq:100,h2pri
server: cloudflare
etag: "cfSCUVVewrbUrCezSPDCvLRaq61csUNuQbJ8Ycnj_pDQ:18503effdeb9c9bf3130e4d9c19e5f39"
vary: Accept, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=G8A5%2FUG1RThsmI8RZvsYh6Yn7Roqd4ceKtlf4%2B5r4lG9xaqeee4IPvKcpuUPfly28SA2Yz4iQmRb5xtUmLreoHRFIGQ%2F8b3qMJ6aP0RgWacV1T5YVp%2FmiJ2uGhEy7RrI5zg95tf5I%2FXPaYULK2X4udEawQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
access-control-allow-origin: *
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
accept-ranges: bytes
cf-ray: 7f2f98f8bf213a85-FRA

GET
H3 200 ConversingLabs-S4E10-Creating-the-Standard-for-Supply-Chain-Risk.jpg
www.reversinglabs.com/hubfs/ConversingLabs/ 126 KB
128 KB 387ms
376ms Image
image/webp 2606:2c40::c73c:671f
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.reversinglabs.com/hubfs/ConversingLabs/ConversingLabs-S4E10-Creating-the-Standard-for-Supply-Chain-Risk.jpg

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

d57a29c035e1164e865f08b030edaa603ee2a60d806138df4c2975eac83cb08f

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
x-amz-meta-cache-tag: F-119368537456,FD-69168798251,P-3375217,FLS-ALL
age: 140942
x-amz-request-id: 0PAPW9M00MDEWSJN
x-amz-server-side-encryption: AES256
edge-cache-tag: F-119368537456,FD-69168798251,P-3375217,FLS-ALL
x-amz-replication-status: COMPLETED
x-hs-https-only: worker
content-disposition: inline; filename="ConversingLabs-S4E10-Creating-the-Standard-for-Supply-Chain-Risk.webp"
x-hs-cf-lambda: us-east-1.EnforceAclForReads 2
cf-bgj: imgq:85,h2pri
etag: "8edb1e262542561f086a7d70308044f2"
vary: Accept, Accept-Encoding
access-control-allow-methods: GET
content-type: image/webp
access-control-allow-origin: *
x-amz-meta-created-unix-time-millis: 1686228293352
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
x-robots-tag: all
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 2
date: Mon, 07 Aug 2023 12:42:05 GMT
strict-transport-security: max-age=31536000
via: 1.1 ece8468a6049ed8be98df07c068a0b26.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id: dPT6TZvb.kLAJ9gmDvqn5Ei_fgYVy3Sm
x-amz-cf-pop: FCO50-P3
x-hs-alternate-content-type: text/plain
cf-polished: qual=85, origFmt=jpeg, origSize=252204
x-cache: RefreshHit from cloudfront
cache-tag: F-119368537456,FD-69168798251,P-3375217,FLS-ALL
x-amz-meta-index-tag: all
x-amz-storage-class: INTELLIGENT_TIERING
alt-svc: h3=":443"; ma=86400
content-length: 129440
x-amz-id-2: AwupxXKdSxS8jFo/wDXy7IwlIgJhJcgqlynQ33d/ZUAta8GWkxPadqNtWZH+Lm906HQaQvpCDOdgSQ48hbdFsjtrxafpG4MJ82E8akVO2II=
last-modified: Thu, 08 Jun 2023 12:44:54 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xFHnclSAF1jjPi%2FbdeDtxXbraJwZbylKyxVK%2BApgy0ntY1ybUCBBfAj0pLMzmfdaPZg9w5jT8PjkohsD%2F5oE1rpkbZOnPUPIvR7GAcCy9h2551gbgDPZGO4ck5qCSF96qtZqOYSCoveUxC04rbx2pDvUng%3D%3D"}],"group":"cf-nel","max_age":604800}
accept-ranges: bytes
cf-ray: 7f2f98f8bf243a85-FRA
x-amz-cf-id: lUT9r3NHQfZd_3DeaoTR44xrClIaqe3NgYa3H7dgIuZbUf0p8m-V5w==

GET
H3 200 SSCS%20Vulns%20vs%20Malware%20v2%20%281%29.png
www.reversinglabs.com/hubfs/ 458 KB
459 KB 450ms
439ms Image
image/webp 2606:2c40::c73c:671f
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.reversinglabs.com/hubfs/SSCS%20Vulns%20vs%20Malware%20v2%20%281%29.png

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

ec283af1b220ae388d616832c82a2612f2630ac572784dd39b6d2c5b8e81e7aa

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
x-amz-meta-cache-tag: F-128054183304,P-3375217,FLS-ALL
age: 140942
x-amz-request-id: CYC9KF0CVAQ1P9T5
x-amz-server-side-encryption: AES256
edge-cache-tag: F-128054183304,P-3375217,FLS-ALL
x-amz-replication-status: COMPLETED
x-hs-https-only: worker
content-disposition: inline; filename="SSCS%20Vulns%20vs%20Malware%20v2%20%281%29.webp"
x-hs-cf-lambda: us-east-1.EnforceAclForReads 2
cf-bgj: imgq:85,h2pri
etag: "6fd3531028492e6451288b395ff0aba1"
vary: Accept, Accept-Encoding
access-control-allow-methods: GET
content-type: image/webp
access-control-allow-origin: *
x-amz-meta-created-unix-time-millis: 1691007621369
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
x-robots-tag: all
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 2
date: Mon, 07 Aug 2023 12:42:05 GMT
strict-transport-security: max-age=31536000
via: 1.1 d8832c768c2be4d7c6d530c47c782e0c.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id: 1gITI7UH1lp9vpl7Goz4qSuO9Ek5JrFZ
x-amz-cf-pop: FCO50-P3
x-hs-alternate-content-type: text/plain
cf-polished: origFmt=png, origSize=531429
x-cache: RefreshHit from cloudfront
cache-tag: F-128054183304,P-3375217,FLS-ALL
x-amz-meta-index-tag: all
x-amz-storage-class: INTELLIGENT_TIERING
alt-svc: h3=":443"; ma=86400
content-length: 468664
x-amz-id-2: TXhwwDBzjJP4JIJC7xkFR9K8rMrxYHa7prMpEWq+Q6V0+IL4d7zjD6uKmHzioiJWlqRtU3QwUWgT2Fy2N2r9rKOZYS4jpl7rZmcjbqqXH7Y=
last-modified: Wed, 02 Aug 2023 20:20:22 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=PtFtZJDoV3eTGIWLUd9WBpHgppB3x569WATJNxq89c3jU6aJnKAoiGea9Ll%2BirtQVxStSZfn3%2BakQTZRizl0d0gdzBLt8pD5n2hOWQbVoQ6SsgjCElWGyxeVxTeeo88raY9DynFq4%2B1RiMkwbX%2FRauiZaw%3D%3D"}],"group":"cf-nel","max_age":604800}
accept-ranges: bytes
cf-ray: 7f2f98f8bf253a85-FRA
x-amz-cf-id: BmPuI-17mNR4fFYJobCaQsMN-nqlSZOoCp4duDYn7OJ_cLtkLeD2uQ==

GET
H3 200 Webpage-Banner-Software-Package-Deconstruction-EP07-1400x732.jpg
www.reversinglabs.com/hubfs/ 98 KB
99 KB 557ms
546ms Image
image/webp 2606:2c40::c73c:671f
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.reversinglabs.com/hubfs/Webpage-Banner-Software-Package-Deconstruction-EP07-1400x732.jpg

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

199a07091795dc18d5f648c8ae6ea323b953a6232f814e35c0217925de105a94

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
x-amz-meta-cache-tag: F-127116244143,P-3375217,FLS-ALL
age: 140942
x-amz-request-id: DWBEMC3RPDQCKZRR
x-amz-server-side-encryption: AES256
edge-cache-tag: F-127116244143,P-3375217,FLS-ALL
x-amz-replication-status: COMPLETED
x-hs-https-only: worker
content-disposition: inline; filename="Webpage-Banner-Software-Package-Deconstruction-EP07-1400x732.webp"
x-hs-cf-lambda: us-east-1.EnforceAclForReads 2
cf-bgj: imgq:85,h2pri
etag: "d863474a07d18297d34a6ab8da71a3c8"
vary: Accept, Accept-Encoding
access-control-allow-methods: GET
content-type: image/webp
access-control-allow-origin: *
x-amz-meta-created-unix-time-millis: 1690395688500
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
x-robots-tag: all
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 2
date: Mon, 07 Aug 2023 12:42:05 GMT
strict-transport-security: max-age=31536000
via: 1.1 8f16e80fac736413736d660cb6bff0e0.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id: p9dFM0KI5I.1lHtGTE3Sw.K9.1pZvEwT
x-amz-cf-pop: FCO50-P3
x-hs-alternate-content-type: text/plain
cf-polished: qual=85, origFmt=jpeg, origSize=254194
x-cache: RefreshHit from cloudfront
cache-tag: F-127116244143,P-3375217,FLS-ALL
x-amz-meta-index-tag: all
x-amz-storage-class: INTELLIGENT_TIERING
alt-svc: h3=":443"; ma=86400
content-length: 100108
x-amz-id-2: P5zw/fxtP8pRYoKAfmmT0n12Dob6PEB/oHRFCsIkeoDUFcZFB5ICQH/yZOeDlrdhzE1ayEOhbhw=
last-modified: Wed, 26 Jul 2023 18:21:29 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Hfu0OunP6AVp94vgsADAGAFNuJ6VPuHU8f3SMMZpNkjj6QSj%2BtUTM%2Fduq31Hex1udq9vdb3dhnWOArBnSsiKUG1S3bFQ9Rm7xFgJnyY5PZlMxA5KkPcmv2Imj%2B89JWaOzJcl1TOYdkvHi2wCp5PDp%2FbILg%3D%3D"}],"group":"cf-nel","max_age":604800}
accept-ranges: bytes
cf-ray: 7f2f98f8bf273a85-FRA
x-amz-cf-id: tDtG7HjA5tZa_9CIRMq66QjrcLCo5nskGi7Avj69VkX0Q5CzENRQhg==

GET
H2 200 jquery.min.js Show response
cdnjs.cloudflare.com/ajax/libs/jquery/3.7.0/ 85 KB
27 KB 141ms
53ms Script
application/javascript 2606:4700::6811:190e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/jquery/3.7.0/jquery.min.js

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d8f9afbf492e4c139e9d2bcb9ba6ef7c14921eb509fb703bc7a3f911b774eff8

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Referer
Origin: https://www.reversinglabs.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:42:04 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 331049
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 27437
last-modified: Tue, 01 Aug 2023 17:19:52 GMT
server: cloudflare
cf-cdnjs-via: cfworker/r2
etag: "64c93eb8-6b2d"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=urwWMrn6vQRNPv%2FtynbvLmSbpVEQEjMnsXZtAzyeWac8pDwbhXCvTZIJJ%2Fr8GOb4H0%2F9C9oFKsZLWFwvr%2F6o3nEkgR%2Bw%2B8USvcqevfeGRNXWCgzMUnegBNY9yXWNbCmInyQDFE83CVOakROkzHfYjAAO"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 7f2f98f198ef35f3-FRA
expires: Sat, 27 Jul 2024 12:42:04 GMT

GET
H2 200 embed.js Show response
static.hsappstatic.net/content-cwv-embed/static-1.372/ 12 KB
5 KB 162ms
60ms Script
application/javascript 2606:4700::6812:8e65
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.hsappstatic.net/content-cwv-embed/static-1.372/embed.js

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:8e65 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

48caefba7197eca695349c196a4fb51a5998c8f3bd365988462d71e3c65a4b1d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:42:05 GMT
x-amz-version-id: y7ND9ey1AdjRUW5XrlhHQ1urKE3DE81O
via: 1.1 23776effa8a63b2e2dccd702e73b0c86.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-cf-pop: AMS54-C1
age: 429791
x-amz-server-side-encryption: AES256
content-encoding: br
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
alt-svc: h3=":443"; ma=86400
last-modified: Tue, 01 Aug 2023 20:39:52 GMT
server: cloudflare
etag: W/"fa27a9379786a382617de08f3ae57836"
vary: Origin,Accept-Encoding,Access-Control-Request-Headers,Access-Control-Request-Method
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kcLIvdUgy3VBdOMv5FrxvXilF4pg5qudZviDlNupGzy%2FjMoE%2Fo1j1VlLHezm%2BcyUHTEpKEsjNFkNvNovoof2TxPox9yYOMmyr9XalQo8646PZKsiR6BgkFHoKAxWk6WgKvUV4QLkI6aUeVbN1k2uAqMfCo0%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: public, max-age=31536000
cf-ray: 7f2f98f94e9e3814-FRA
x-amz-cf-id: lyUEhkWhJIGXZDSvrcCz3lUH5f3rhHpK40aIX0-IqdedjXRZt4nJbw==
expires: Tue, 06 Aug 2024 12:42:05 GMT

GET
H3 200 simple-lightbox-min.js Show response
www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/6021916068/1569840500063/Reversinglabs_July2018_Theme/Coded_Files/ 7 KB
3 KB 89ms
88ms Script
application/javascript 2606:2c40::c73c:671f
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/6021916068/1569840500063/Reversinglabs_July2018_Theme/Coded_Files/simple-lightbox-min.js

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

d6dc97993d7e4803aeb35d0e9a24f0393eceb43de5f7ff0f0e437f1b05aea4e2

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:42:04 GMT
strict-transport-security: max-age=31536000
via: 1.1 4a050b98a443ca2d3af477f9b4dc39ae.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
content-security-policy: upgrade-insecure-requests
age: 463
x-amz-cf-pop: IAD89-P1
x-amz-request-id: 7Z8YKTKDXNWP3GQY
content-encoding: br
x-cache: RefreshHit from cloudfront
x-amz-version-id: FsEJuIr7CYCWLWb_isdf3JLdbLwDP7p.
x-hs-https-only: worker
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 15
alt-svc: h3=":443"; ma=86400
x-amz-id-2: TA1nvniMSYF7A0TKv+ddTJ7ltlQ+as5oZ2Ez0zutazwxuEZ70M8PEVY6YtqpbDLZ0aDYjw8yXSM=
last-modified: Mon, 30 Sep 2019 10:48:21 GMT
server: cloudflare
etag: W/"d02c339064b8d2b370bc4e18fa6ae421"
vary: origin, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dDStRgpgEZECFFPmMZkc39EqCqin26DUUXS7py1GAKVUlTDBiUFXg2JVg6VX%2FM%2FLTfdp4oo%2BoQBybZk5LJ%2Bs%2F0rlTqpwTbgfgVplfcU6%2BO6%2BwEIOH0ObFLUQNSykNrVStXwHIdnPPS7%2BrPr7LG4M8DZC2Q%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900, s-maxage=31536000, max-age=31536000
access-control-allow-credentials: false
cf-ray: 7f2f98f1fcf73a85-FRA
x-amz-cf-id: DSP-Osxn4sWzomuZ0ipUBNeN3j_AQO-jcauXiPOrpGupKKZF6g6e7g==
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 15

GET
H3 200 rd-2019-main.min.js Show response
www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/11190015046/1639664698263/Redesign_june_2019/Coded_Files/JS/ 2 KB
2 KB 74ms
73ms Script
application/javascript 2606:2c40::c73c:671f
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/11190015046/1639664698263/Redesign_june_2019/Coded_Files/JS/rd-2019-main.min.js

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

589ec6096d83ed322d2e1cf7b85f978ecfe80dc19aab6ac106ef5e2352e32269

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
content-encoding: br
age: 463
x-amz-request-id: CW0ND36GAHHZPERE
x-amz-server-side-encryption: AES256
x-evy-trace-route-service-name: envoyset-translator
x-amz-replication-status: COMPLETED
x-hs-https-only: worker
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 20
x-evy-trace-listener: listener_https
etag: W/"b2a254916a67659b4df42aa3c333359a"
vary: origin, Accept-Encoding
x-amz-meta-created-unix-time-millis: 1639664698586
content-type: application/javascript; charset=utf-8
x-evy-trace-virtual-host: all
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 20
date: Mon, 07 Aug 2023 12:42:04 GMT
strict-transport-security: max-age=31536000
via: 1.1 50f5f6b4e0025748bb74dce1db44c750.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id: I5.cidQ.vGRls6iGZkmuPTBztEr2IVdj
x-amz-cf-pop: IAD89-C1
x-hs-alternate-content-type: text/plain
x-cache: RefreshHit from cloudfront
x-envoy-upstream-service-time: 133
alt-svc: h3=":443"; ma=86400
x-amz-id-2: h2pTKPKTFlGArXOYiGno1zEVG3E6yNbzI+sJNU4eDPCDnBO28ujxmt5L+/a8x1Yg/LfIKF4RYc0=
x-evy-trace-route-configuration: listener_https/all
x-request-id: 190f7082-188f-45dc-9bfd-b26ccf91f26f
last-modified: Thu, 16 Dec 2021 14:24:59 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=bWejYQPErt%2BE0jtaaZpRyGPCSXYP%2FlwBkTNzHSA2VgkJiB%2BFEr5XzWqsXTfFE56WCt%2F%2BWJk0zgu4rc2nCX0QhSur%2FLLvwCN79hNsJTGsU%2FrTxk1RoO4BKc3arGp3FbKrbKyfwKQWHiAErR1LJ06StUQV6A%3D%3D"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/cms-hubfs-td/envoy-proxy-55b7d448b-7hqzq
access-control-allow-credentials: false
cf-ray: 7f2f98f28dc93a85-FRA
x-amz-cf-id: FOPTCwq3iEwwbHCrnFkkFy10ziP4c3FILCAExIygQAdvzDR_3pfHaw==

GET
H3 200 jscookie.min.js Show response
www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/28203361861/1586494134457/Redesign_june_2019/Coded_Files/JS/ 1 KB
2 KB 78ms
77ms Script
application/javascript 2606:2c40::c73c:671f
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/28203361861/1586494134457/Redesign_june_2019/Coded_Files/JS/jscookie.min.js

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

bc595999f7c46e3f7a293c86fcc256c35467e9947bf0051464628416f1db14f0

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
content-encoding: br
age: 463
x-amz-request-id: QTG7XAAATKNP13C0
x-amz-server-side-encryption: AES256
x-evy-trace-route-service-name: envoyset-translator
x-hs-https-only: worker
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 20
x-evy-trace-listener: listener_https
etag: W/"93c12b195cd05418a85b4eafc15c92fb"
vary: origin, Accept-Encoding
content-type: application/javascript; charset=utf-8
x-evy-trace-virtual-host: all
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 20
date: Mon, 07 Aug 2023 12:42:04 GMT
strict-transport-security: max-age=31536000
via: 1.1 55b6418a8a2f714a67d8e4d292154ef2.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id: _PdfjdMgm8.M2DiCSVpcYFrpWe519SIO
x-amz-cf-pop: IAD89-C1
x-cache: RefreshHit from cloudfront
x-envoy-upstream-service-time: 134
alt-svc: h3=":443"; ma=86400
x-amz-id-2: FkqAqmuuhmhW6hsDVcKx2cDpcWAlfe6lSOJo3XC3pm76f6yqOupJiFJDWSvpdxVCesWtuX+qUvTvIfGrHp7pHBMERbkdwc0mjDcUwwyVGRU=
x-request-id: e9a15e8d-350a-49ee-a4f1-b214cda50bbb
x-evy-trace-route-configuration: listener_https/all
last-modified: Fri, 10 Apr 2020 04:48:55 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RsvWOYMAE%2BdCsF9IEK9RxNie2GPEg%2BBzubYYvybv8C5Vkz0RDD9Lc56ZIOQsPbx43f6OevV3hG%2BruYKpNU21z%2BywveRdPTsGJDk%2FMWiMWNFbmWLvU4NvQaFRKRqlB7aAyCPk0bRjkZpk%2BwttPSyrc9a5ew%3D%3D"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/cms-hubfs-td/envoy-proxy-55b7d448b-hlzsf
access-control-allow-credentials: false
cf-ray: 7f2f98f2fe7d3a85-FRA
x-amz-cf-id: kdjJlGsK3persOy9ZlZ5u-G135OqmaXATF7dHJcCELAll6ZMurC-DQ==

GET
H3 200 tiny-slider.min.js Show response
www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/21052151416/1577281626952/Redesign_june_2019/Custom_Modules/Sliders/JS/ 31 KB
14 KB 125ms
125ms Script
application/javascript 2606:2c40::c73c:671f
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/21052151416/1577281626952/Redesign_june_2019/Custom_Modules/Sliders/JS/tiny-slider.min.js

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

37eae8190baecf55f16575bf754238976116ad37b55f81e27db05743461cd507

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
content-encoding: br
age: 463
x-amz-request-id: CW0SA7RCRQKTECT7
x-evy-trace-route-service-name: envoyset-translator
x-hs-https-only: worker
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 20
x-evy-trace-listener: listener_https
etag: W/"6603e5d1b1eded8b550dc3ef7fbe687d"
vary: origin, Accept-Encoding
content-type: application/javascript; charset=utf-8
x-evy-trace-virtual-host: all
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 20
date: Mon, 07 Aug 2023 12:42:04 GMT
strict-transport-security: max-age=31536000
via: 1.1 263d97c176fc51d1d08116820c013de4.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id: a_gzCem69enGGi103.H.X02BRl8OY0mV
x-amz-cf-pop: IAD89-C1
x-cache: RefreshHit from cloudfront
x-envoy-upstream-service-time: 209
alt-svc: h3=":443"; ma=86400
x-amz-id-2: H0LPHw6/nM6dxB73NxlkuGo9K/i4vMXUotMRa4b62Xe/7Lz0QMiqsbihA9vWRi7nGkn64akE3Sw=
x-request-id: 63765baa-378d-44ea-b6af-07e508a7db31
x-evy-trace-route-configuration: listener_https/all
last-modified: Wed, 25 Dec 2019 13:47:07 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0ZpsWrN5mlcFvqxRrS84a5vq4tH9DrnXFPE1sjFDNaLvzK31sO535SLhyUt6ZWnnrBZ8F0ADzZuOyC2YHvfp0Ngt6J%2BiqX0BWIVRDrYUVSEceesRAno2WwkcDLFawa8RBXTKB7vY0iyJF07q%2FPAEsA8ETQ%3D%3D"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/cms-hubfs-td/envoy-proxy-55b7d448b-fwhk5
access-control-allow-credentials: false
cf-ray: 7f2f98f37f603a85-FRA
x-amz-cf-id: c7NiB9yHTLR86Pfc06owzhrTid5tjgnhdV5kn9xsHKNTYZmfcfiPlA==

GET
H3 200 module_28186900061_StickyBar.min.js Show response
www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/module_assets/28186900061/1683494323317/ 1 KB
2 KB 73ms
73ms Script
application/javascript 2606:2c40::c73c:671f
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/module_assets/28186900061/1683494323317/module_28186900061_StickyBar.min.js

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

f35c317df74c5ceaca83bc620ab17f68e882a21e5378933002f20aae3af0517f

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
content-encoding: br
age: 463
x-amz-request-id: 80GNJQM6FRHN4BA8
x-amz-server-side-encryption: AES256
x-evy-trace-route-service-name: envoyset-translator
x-amz-replication-status: COMPLETED
x-hs-https-only: worker
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 20
x-evy-trace-listener: listener_https
etag: W/"05f529f2d7b3ca476f37bdcf0b96ef7e"
vary: origin, Accept-Encoding
x-amz-meta-created-unix-time-millis: 1683494323317
content-type: application/javascript; charset=utf-8
x-evy-trace-virtual-host: all
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 20
date: Mon, 07 Aug 2023 12:42:04 GMT
strict-transport-security: max-age=31536000
via: 1.1 7a99ed3f39c18af8fe138a695e5f657c.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id: Dj1AN92dBhP0GYrdJYdEZgTGEMSZDLdS
x-amz-cf-pop: IAD89-C1
x-hs-alternate-content-type: text/plain
x-cache: RefreshHit from cloudfront
x-amz-storage-class: INTELLIGENT_TIERING
x-envoy-upstream-service-time: 98
alt-svc: h3=":443"; ma=86400
x-amz-id-2: 1hy2ztk0sACwGhSaHXYGJTePyK2ElHBN6n6KqLJWX/hSVZLtLds/IPQ+WQYqlA9cxxggdjz4BtA=
x-evy-trace-route-configuration: listener_https/all
x-request-id: f572166f-83a7-408e-93ef-ff2c31e30e6d
last-modified: Sun, 07 May 2023 21:18:44 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hOopavUc58BgUnFVugBn0Te2wVOd1KTo5Vod0tYtWj8Ox7Hqu5rmfVfAgO5u%2FaPgoKiG7hE20rPRIjLZmkJzAWQKx5HzB2gGc5LYZjVkTf0FvgCaTmN%2B2aMyyfyyImbqy%2F2RqJ8g4UA1d6BesNDmI1BQgA%3D%3D"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/cms-hubfs-td/envoy-proxy-55b7d448b-rwfnd
access-control-allow-credentials: false
cf-ray: 7f2f98f4891d3a85-FRA
x-amz-cf-id: nXR_gmwXMnT_HcUaEkIukORt9QClCbVkQ6HKo-u93_Kum0m6YhmVKQ==

GET
H3 200 micromodal.js Show response
www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/11395370929/1569840498778/Redesign_june_2019/Coded_Files/JS/ 5 KB
3 KB 74ms
73ms Script
application/javascript 2606:2c40::c73c:671f
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/11395370929/1569840498778/Redesign_june_2019/Coded_Files/JS/micromodal.js

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

c9b277f813652ab4fc3476fe4b9771d2d29e10204caef39416ad8d30e45fc5a2

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:42:04 GMT
strict-transport-security: max-age=31536000
via: 1.1 d0d53eedec01ac540f737b5fafb16436.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
content-security-policy: upgrade-insecure-requests
age: 463
x-amz-cf-pop: IAD12-P3
x-amz-request-id: DH3YHWCBPAWYR0GG
content-encoding: br
x-cache: RefreshHit from cloudfront
x-amz-version-id: 3FilIB6THj7cvPLh93UnKYXf5w_lQZsq
x-hs-https-only: worker
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 15
alt-svc: h3=":443"; ma=86400
x-amz-id-2: H4yVQ47lxBKOsu4E4DcRU082QJyRgJ9mxvqZPQLU3lb2Xg2K5AsKMwMAGWdknf43qY5fAMTvbQSMZzEDLIEAbQ==
last-modified: Mon, 30 Sep 2019 10:48:19 GMT
server: cloudflare
etag: W/"84194eded494d011e2828f00329b15c6"
vary: origin, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=S6X7QgqRuN%2BShp5Xdw7cec1%2BdvCWea91AZStOMI5NZLOINidNOQ5NW6tb4QSbO74y8AZN4z1JtOkbZReXeY%2FU06ND%2BaeT3iJ8zgTNxZWEdi0kjcnmrRaI2NVDJLnsER2Eax5mNjSuhXVhzMziN9eHUrv9Q%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900, s-maxage=31536000, max-age=31536000
access-control-allow-credentials: false
cf-ray: 7f2f98f509b73a85-FRA
x-amz-cf-id: orqWMajDb6ig-xGyklFUIcQ1lLJdn1mqXvNlOmj3HZgusjgthSsETw==
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 15

GET
H3 200 module_11395370497_Redesign_june_2019_Custom_Modules_Site_Search_Input_-_Header_Modal.min.js Show response
www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/module_assets/1563505647431/ 3 KB
2 KB 72ms
72ms Script
application/javascript 2606:2c40::c73c:671f
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/module_assets/1563505647431/module_11395370497_Redesign_june_2019_Custom_Modules_Site_Search_Input_-_Header_Modal.min.js

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

130eb7bbe1dca232b6636767637e6bdc2a35fc2d412db3a601593d79c1d743a5

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
content-encoding: br
age: 464
x-amz-request-id: 66FXCNJZ5WWAP1SK
x-evy-trace-route-service-name: envoyset-translator
x-hs-https-only: worker
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 20
x-evy-trace-listener: listener_https
etag: W/"c27b7b6ea1f66fa47d64742279aee97a"
vary: origin, Accept-Encoding
content-type: application/javascript; charset=utf-8
x-evy-trace-virtual-host: all
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 20
date: Mon, 07 Aug 2023 12:42:05 GMT
strict-transport-security: max-age=31536000
via: 1.1 7f7e359e1c06a914d3d305785359b84c.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id: uYaggxrRRLpm1_Oqgp40jmGQ7KENtM4f
x-amz-cf-pop: IAD89-C1
x-cache: RefreshHit from cloudfront
x-envoy-upstream-service-time: 131
alt-svc: h3=":443"; ma=86400
x-amz-id-2: wp7HP3TuABXpp2KoRuOPboEeeSb3kcKpDwGZTBDqm+EUTPl/WoXuj6COpM4f4uwJbSDbE6lYjG8=
x-request-id: 80731ddb-ef82-427e-afa1-b62a2d39dfb6
x-evy-trace-route-configuration: listener_https/all
last-modified: Fri, 19 Jul 2019 03:07:28 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=p0xer0UKOxM7W5LZzu5%2FRetvV4Odk9BNo49wUoO4dn0VhI76qWVJoKhqENC2XI1stacYZCjufbJYBc63gpWfYZ5LuMfgjM0NJPWjioBGVxcA5%2BI4m2bIxWAW4E%2B2AkbzcKK0vkEnWUJpYnlSSrW7t3bTBg%3D%3D"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/cms-hubfs-td/envoy-proxy-55b7d448b-r4k2f
access-control-allow-credentials: false
cf-ray: 7f2f98f59aa53a85-FRA
x-amz-cf-id: D2u0L8iiFJSMjFRToRKvkKhVO8lxpDheorXf3gRSd7CVH2ZoaLMNWg==

GET
H3 200 module_36845096476_Blog_listing_card_grid.min.js Show response
www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/module_assets/36845096476/1683635694467/ 723 B
2 KB 71ms
70ms Script
application/javascript 2606:2c40::c73c:671f
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/module_assets/36845096476/1683635694467/module_36845096476_Blog_listing_card_grid.min.js

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

96012ea1e665f4555d84592c02ed5ee2ae06ae12e7869c7878a9fb15cf2bd729

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
content-encoding: br
age: 464
x-amz-request-id: 49376P20C5N2Z5NJ
x-amz-server-side-encryption: AES256
x-evy-trace-route-service-name: envoyset-translator
x-amz-replication-status: COMPLETED
x-hs-https-only: worker
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 20
x-evy-trace-listener: listener_https
etag: W/"a26b824a33500d5b24e748588dd1c35a"
vary: origin, Accept-Encoding
x-amz-meta-created-unix-time-millis: 1683635694467
content-type: application/javascript; charset=utf-8
x-evy-trace-virtual-host: all
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 20
date: Mon, 07 Aug 2023 12:42:05 GMT
strict-transport-security: max-age=31536000
via: 1.1 624a1750702d82319b25f17c35c73d04.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id: vX4VGHX7oLkggy1lxnxWYDLA5rVHVqKM
x-amz-cf-pop: IAD89-P2
x-hs-alternate-content-type: text/plain
x-cache: RefreshHit from cloudfront
x-amz-storage-class: INTELLIGENT_TIERING
x-envoy-upstream-service-time: 114
alt-svc: h3=":443"; ma=86400
x-amz-id-2: lIjufGA3ZDty/JYLu572sxuNz17BFUtLeN1DL+Fk3VccVQXeBz49aN972HyHJBYd+XhB3bkzLZg=
x-evy-trace-route-configuration: listener_https/all
x-request-id: 988abf89-8a76-45b9-b1b2-c1393cc5ac83
last-modified: Tue, 09 May 2023 12:34:55 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Kw2cttghnI86WUDwGOwOkqc3XhOrtUXDFAstb5XTl%2FMmFBtdfwXbXxRBXpEXh1cM3YTDkFoC%2FDz96soz4zMPR0%2F47sb2q2Ygs94FZmZQ62rFxppFKobx8uy71378MGbOQfduGjAVAzXxbpIQl27m%2FqP%2Fsg%3D%3D"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/cms-hubfs-td/envoy-proxy-55b7d448b-fwhk5
access-control-allow-credentials: false
cf-ray: 7f2f98f60b563a85-FRA
x-amz-cf-id: p-enmljeQRSm9qto_xg_OQ_4375sVjbuPKBVHvIjeyUn05v21cU0pg==

GET
H3 200 3375217.js Show response
www.reversinglabs.com/hs/scriptloader/ 3 KB
2 KB 561ms
550ms Script
application/javascript 2606:2c40::c73c:671f
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reversinglabs.com/hs/scriptloader/3375217.js

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

0135a1b91a6cbf07bf1a74fba4b90ad8c06421df9f3577701a093b6a6fc9ff9a

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
content-encoding: br
age: 25
x-evy-trace-route-service-name: envoyset-translator
x-hs-https-only: worker
x-evy-trace-listener: listener_https
cf-bgj: minify
vary: origin, Accept-Encoding
content-type: application/javascript;charset=utf-8
access-control-allow-origin: https://www.reversinglabs.com
x-evy-trace-virtual-host: all
cache-control: public, max-age=60
expires: Mon, 07 Aug 2023 12:43:05 GMT
date: Mon, 07 Aug 2023 12:42:05 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-hubspot-correlation-id: 30949554-a17e-44ce-9cfe-625d682d18b3
cf-polished: origSize=2975
x-envoy-upstream-service-time: 11
alt-svc: h3=":443"; ma=86400
x-evy-trace-route-configuration: listener_https/all
x-request-id: 30949554-a17e-44ce-9cfe-625d682d18b3
last-modified: Mon, 07 Aug 2023 12:41:40 GMT
server: cloudflare
x-trace: 2B69CA116B7D39F0D4FFC4ECE51535527A8C46E5EB000000000000000000
access-control-max-age: 3600
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jj8Lvyd81RexjJ0eVYNqrtstqZj9I5mvPl5vwcMcRkbIMaNV0OvPR5HF64HT6dsVJ5RK%2B0GrfJWp%2BMvqlRWIMQkZHUj%2FEVXRUef6x%2Fqz93j1SDV7%2FgNcVUS79la1FDOiJsFySLazz5relLLnZXDrUHHgRA%3D%3D"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/hubapi-td/envoy-proxy-598c95b5b7-jknpv
access-control-allow-credentials: true
cf-ray: 7f2f98f8bf293a85-FRA

GET
H2 200 cookieinfo.min.js Show response
cookieinfoscript.com/js/ 7 KB
4 KB 509ms
47ms Script
application/x-javascript 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cookieinfoscript.com/js/cookieinfo.min.js
Requested by: Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0ab31a97c236988bb6e415187b2197cdbf689664173015dffd6da8eb96b1626f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:42:05 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-request-id: A5GP01A158FK45VJ
age: 5755
x-amz-meta-cb-modifiedtime: Mon, 03 Jul 2023 14:52:01 GMT
alt-svc: h3=":443"; ma=86400
x-amz-id-2: h6dhUYn7Bfp9quQ6EKipcs0ta3StpsrVgmJAslx42UxlhVPEPpWAPVrvpofPMCVCmc9jHDjV+HY=
last-modified: Wed, 05 Jul 2023 10:39:27 GMT
server: cloudflare
etag: W/"d15d93068c1121f63008407d339bd819"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=lOadNgcSWTUbGr4gikn%2FzT%2B4mbFiZi3PNHx6HBnWG4duQYXXf0WIrOffrJCqJzzTHwtYWYynjJtSg3QmdUyDOf8nnTBnrx12ZkW8n904vhFMxxoIsm1n%2BUW2UWj2QkbxQPRXn4eEtCf1WaO72fNOg5L2Gw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/x-javascript
cache-control: max-age=2678400
cf-ray: 7f2f98f96982690a-FRA

GET
H/1.1 200
OK up_loader.1.1.0.js Show response
js.adsrvr.org/ 5 KB
3 KB 137ms
41ms Script
application/x-javascript 65.9.99.119
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://js.adsrvr.org/up_loader.1.1.0.js
Requested by: Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.99.119 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-9-99-119.prg50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 899663bfeab6b11842c974c2417dc0ad88bd79bb7510b1e032384ccf2618dcc1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

Date: Sun, 06 Aug 2023 20:10:51 GMT
Content-Encoding: gzip
Via: 1.1 b031f43146c9801101822eabdc464390.cloudfront.net (CloudFront)
Last-Modified: Tue, 01 Aug 2023 20:10:44 GMT
Server: AmazonS3
X-Amz-Cf-Pop: PRG50-C1
Age: 59475
x-amz-server-side-encryption: AES256
ETag: W/"b7474eac210849250426a8f6a39d00f3"
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Type: application/x-javascript
X-Cache: Hit from cloudfront
Connection: keep-alive
X-Amz-Cf-Id: e9bN19KMDN-VrcOENpkPWYosjZg4Ct_VkxUgVtY7LGRREgOlFmoxQw==

GET
H2 200 hotjar-3176008.js Show response
static.hotjar.com/c/ 10 KB
4 KB 142ms
40ms Script
application/javascript 52.222.139.19
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://static.hotjar.com/c/hotjar-3176008.js?sv=6

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.139.19 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-222-139-19.ams50.r.cloudfront.net

Software

Resource Hash

2e5436b217fb1a7d9d2365cccfcc95e7483fcba03205c3a216d512302e982d4d

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

strict-transport-security: max-age=2592000; includeSubDomains
content-encoding: br
x-content-type-options: nosniff
date: Mon, 07 Aug 2023 12:41:58 GMT
via: 1.1 9463f100725b8b17da2d778617835760.cloudfront.net (CloudFront)
x-amz-cf-pop: AMS50-C1
age: 42
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
etag: W/ea37d1e0bcd47d6c2f7b79a987e66f2b
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
x-cache-hit: 1
cache-control: max-age=60
x-amz-cf-id: FVSznSpU5-xcUf-9hG0mKzonH9rY5Vo28BI9lN6gT56iAHtC2B9B5Q==

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 269 KB
92 KB 157ms
55ms Script
application/javascript 2a00:1450:4001:829::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-MKL9P8B

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

ce0ff3ad5c4fb7d0479d29b749b17455767345431cc73dd776b08b79f52acbbe

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:42:05 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 93761
x-xss-protection: 0
last-modified: Mon, 07 Aug 2023 12:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 07 Aug 2023 12:42:05 GMT

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 172 KB
47 KB 145ms
44ms Script
application/x-javascript 2a03:2880:f083:9:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f083:9:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

9b78354357bc04de9fa52562968bad64ef1311b665cc6ea927d2ec08bcc82cd8

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Mon, 07 Aug 2023 12:42:05 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 47151
x-xss-protection: 0
pragma: public
x-fb-debug: yUQaPBt1WPXib0y2yxUeorL5doVpPfeWKj4yY9b8q+r5lhUZKg2Y0uqv6AwFmkmLXPXZDL6ccv+hV1WuuQB2hA==
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), microphone=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=()
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 css
fonts.googleapis.com/ 16 KB
1 KB 142ms
53ms Stylesheet
text/css 2a00:1450:4001:80e::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:100,300,300i,400,500,700,900&display=swap&subset=latin-ext

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/6519964395/1685359416657/Reversing_Labs_November2018_Theme/Coded_Files/Reversing_Labs_November2018-style.min.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e40c8f9d7a3c7c71ee109b2ae4df7dd9b6e3b0cd287d77f9a98312c53392ae25

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/6519964395/1685359416657/Reversing_Labs_November2018_Theme/Coded_Files/Reversing_Labs_November2018-style.min.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Mon, 07 Aug 2023 12:42:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Mon, 07 Aug 2023 12:35:35 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 07 Aug 2023 12:42:04 GMT

GET
H3 200 Reversing_Labs_November2018-style.min.css
www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/6519964395/1685359416657/Reversing_Labs_November2018_Theme/Coded_Files/ 143 KB
25 KB 155ms
141ms Stylesheet
text/css 2606:2c40::c73c:671f
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/6519964395/1685359416657/Reversing_Labs_November2018_Theme/Coded_Files/Reversing_Labs_November2018-style.min.css

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

61ce08dbad99d88826d7e7d374b628662137c7893a943d6a541cf4b0455c5067

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
content-encoding: br
age: 168
x-amz-request-id: 9BY06TDA00GEHJTS
x-amz-server-side-encryption: AES256
x-evy-trace-route-service-name: envoyset-translator
x-amz-replication-status: COMPLETED
x-hs-https-only: worker
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 20
x-evy-trace-listener: listener_https
etag: W/"3d0f457bdc611022c3f48f57eb877977"
vary: origin, Accept-Encoding
x-amz-meta-created-unix-time-millis: 1685359417818
content-type: text/css
x-evy-trace-virtual-host: all
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 20
date: Mon, 07 Aug 2023 12:42:05 GMT
strict-transport-security: max-age=31536000
via: 1.1 6400936fc4525d1c60e3e8fee9d4806e.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id: AcrfIRW95QY88SeuDIXAFoVt.4x1ZQWb
x-amz-cf-pop: IAD12-P2
x-hs-alternate-content-type: text/plain
x-cache: RefreshHit from cloudfront
x-amz-storage-class: INTELLIGENT_TIERING
x-envoy-upstream-service-time: 139
alt-svc: h3=":443"; ma=86400
x-amz-id-2: GkxM6CyUTGG0PBFgMJaDRztxsWFbJcPlZ0/7OioWm4zjLouo3IjGbhgJ83dkKDN715dWTz+6LH0HE9fsUUy+aoo105Uo0mmZotlTj0R0A+k=
x-evy-trace-route-configuration: listener_https/all
x-request-id: 87030c20-b4df-4c9a-a844-9982d6c02ddf
last-modified: Mon, 29 May 2023 11:23:38 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7A5TD8bg%2Ffp0jGUTslRHQER9kn8Oi8H%2FIl5A4jSC9QBMO09WUAw7KMb0eaGNRfi59Hxv9NKVVvfHgmUeWHj5EggQm64BbWo4CXqU50LiGmFcGL9B1WKRyZzKyxCtee2aYIxy8j5Ncgi6GULvGjKxFYnD3g%3D%3D"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/cms-hubfs-td/envoy-proxy-fd8f7bc74-9xkdz
access-control-allow-credentials: false
cf-ray: 7f2f98f8bf003a85-FRA
x-amz-cf-id: EfnvyHcxkM0r5MgmZNSmpahxHbS44buGtkHilNHaDyIqxvzzMKUqGQ==

GET
H2 200 modules.92ff9978854791af68a7.js Show response
script.hotjar.com/ 223 KB
55 KB 186ms
58ms Script
application/javascript 65.9.95.27
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://script.hotjar.com/modules.92ff9978854791af68a7.js

Requested by

Host: static.hotjar.com
URL: https://static.hotjar.com/c/hotjar-3176008.js?sv=6

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

65.9.95.27 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-65-9-95-27.prg50.r.cloudfront.net

Software

Resource Hash

f827ec383239317deb9387ea204a9a0089594aaa0a763922e3d85222010531e2

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Thu, 03 Aug 2023 15:14:07 GMT
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=2592000; includeSubDomains
via: 1.1 1d04caaed0a43993076e404ebf3738da.cloudfront.net (CloudFront)
x-amz-cf-pop: PRG50-C1
age: 336478
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 55640
last-modified: Thu, 03 Aug 2023 15:13:59 GMT
etag: "9e14d47807cbae60a1fa1410419e20a1"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
x-robots-tag: none
x-amz-cf-id: jRjPc5S7sgoUIUu6IsQ67XQLW4fNw5qo9cnrF6MmY70OJQeHcNDaZA==

GET
H2 200 css
fonts.googleapis.com/ 16 KB
1 KB 53ms
50ms Stylesheet
text/css 2a00:1450:4001:80e::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:100,300,300i,400,500,700,900&display=swap&subset=latin-ext

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e40c8f9d7a3c7c71ee109b2ae4df7dd9b6e3b0cd287d77f9a98312c53392ae25

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/6519964395/1685359416657/Reversing_Labs_November2018_Theme/Coded_Files/Reversing_Labs_November2018-style.min.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Mon, 07 Aug 2023 12:42:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Mon, 07 Aug 2023 12:34:04 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 07 Aug 2023 12:42:05 GMT

GET
H2 200 1076912843267184 Show response
connect.facebook.net/signals/config/ 306 KB
87 KB 45ms
42ms Script
application/x-javascript 2a03:2880:f083:9:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/1076912843267184?v=2.9.121&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f083:9:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

77b1e37a44606f04534b026795250cfb8f06416adbe129533a6d855e9b573f67

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Mon, 07 Aug 2023 12:42:05 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 89044
x-xss-protection: 0
pragma: public
x-fb-debug: 7NY/uCoCccrXdMiXo52etnGHs5ZYcNoqeQzrtOxSc3obnotvWhzH2vEUyY/olO9yXGKujVKEwmkv7D0v7kCJ3Q==
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
origin-agent-cluster: ?0
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), microphone=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=()
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H3 200 hero_bg_small_2019.jpg
www.reversinglabs.com/hubfs/images_redesign_2019/ 21 KB
22 KB 317ms
289ms Image
image/webp 2606:2c40::c73c:671f
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.reversinglabs.com/hubfs/images_redesign_2019/hero_bg_small_2019.jpg

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

716dcc9643502eb35aa1f08b4805ec1f377daad3e67c11f9d00d65c6fc6336cf

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
x-amz-meta-cache-tag: F-11448703956,FD-11023975807,P-3375217,FLS-ALL
age: 194596
x-amz-request-id: QA8X8QDKH7P9XNQQ
edge-cache-tag: F-11448703956,FD-11023975807,P-3375217,FLS-ALL
x-hs-https-only: worker
content-disposition: inline; filename="hero_bg_small_2019.webp"
x-hs-cf-lambda: us-east-1.EnforceAclForReads 2
cf-bgj: imgq:85,h2pri
etag: "1f3df8332048ad0295bff3a1c64cc9a4"
vary: Accept, Accept-Encoding
access-control-allow-methods: GET
content-type: image/webp
access-control-allow-origin: *
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 2
date: Mon, 07 Aug 2023 12:42:05 GMT
strict-transport-security: max-age=31536000
via: 1.1 4d5db5d8b78e0b583e041b582e55cfc6.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id: a5PUnngJgc3ZEsbtfbAJjo5eXZD8MNrM
x-amz-cf-pop: TLV50-C2
cf-polished: qual=85, origFmt=jpeg, origSize=95096
x-cache: RefreshHit from cloudfront
cache-tag: F-11448703956,FD-11023975807,P-3375217,FLS-ALL
alt-svc: h3=":443"; ma=86400
content-length: 21652
x-amz-id-2: bR90yqiBJ7Dh9dAqPm1PCyYRStpPFpC6pAebiUQJjEUv7DMavDut9DMDqJdX/XoowM/Spr2H4uY=
last-modified: Sat, 20 Jul 2019 18:01:05 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2FxEWw%2FlXTyyavxITtn6OCb%2FZq021Y6HacOVAwu1DUCSwnI%2F%2BVmJt2Cuuw3lb6dxKqW21DHwArAJhTZfDLs0ltHMcDzjwPPjY%2FAnMPRJRq%2FuFwrsgnccT6cG9r6qb%2Fgzsu1Z4qaJz32bEyiQYb8744kcpeA%3D%3D"}],"group":"cf-nel","max_age":604800}
accept-ranges: bytes
cf-ray: 7f2f98fa59523a85-FRA
x-amz-cf-id: QaredobiUHNc-IK-dQswNRW1ajt1L5J04P-ymsnBG3qInj-DdX3MRQ==

GET
H2 200 Tungsten-Semibold.woff
3375217.fs1.hubspotusercontent-na1.net/hubfs/3375217/Reversinglabs_July2018/Fonts/ 20 KB
20 KB 222ms
121ms Font
application/font-woff 2606:4700::6812:e0f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://3375217.fs1.hubspotusercontent-na1.net/hubfs/3375217/Reversinglabs_July2018/Fonts/Tungsten-Semibold.woff
Requested by: Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/6519964395/1685359416657/Reversing_Labs_November2018_Theme/Coded_Files/Reversing_Labs_November2018-style.min.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:e0f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8ae4a0865523070959595a6df44d592fd924f6a8503d913a2cbfb81b5df45e62

Request headers

Referer: https://www.reversinglabs.com/
Origin: https://www.reversinglabs.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:42:05 GMT
via: 1.1 a33954238ddc352c152e2314fffad1ae.cloudfront.net (CloudFront)
content-encoding: br
cf-cache-status: HIT
x-amz-meta-cache-tag: F-28202642064,FD-5926386258,P-3375217,FLS-ALL
x-amz-version-id: zHy7ciep2n8U9dRoPSeIZ0ms5UoFs.HW
age: 1129337
x-amz-cf-pop: BRU50-C1
x-amz-server-side-encryption: AES256
x-amz-request-id: 9HES1HN2AB3CW3X4
edge-cache-tag: F-28202642064,FD-5926386258,P-3375217,FLS-ALL
cache-tag: F-28202642064,FD-5926386258,P-3375217,FLS-ALL
x-cache: RefreshHit from cloudfront
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 15
x-amz-id-2: G0rx5jzH1sa0akP/ogiaVC008jTdSMUKBtd+TQzYvdE3eUMlL+H/mOs45mBeWu7B7M/+aTkDvDc=
last-modified: Fri, 10 Apr 2020 04:06:19 GMT
server: cloudflare
etag: W/"c4cba999623da66f241554c075076b87"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/font-woff
access-control-allow-origin: *
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
cf-ray: 7f2f98fada1c90da-FRA
x-amz-cf-id: Fn7k_O19RlZ0V5ETRUKNpXbfRXMi6obelJTULutLXaZ0j12c_n4wqQ==
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 15

GET
H2 200 Tungsten-Book.woff
3375217.fs1.hubspotusercontent-na1.net/hubfs/3375217/Reversinglabs_July2018/Fonts/ 21 KB
22 KB 228ms
128ms Font
application/font-woff 2606:4700::6812:e0f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://3375217.fs1.hubspotusercontent-na1.net/hubfs/3375217/Reversinglabs_July2018/Fonts/Tungsten-Book.woff
Requested by: Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/6519964395/1685359416657/Reversing_Labs_November2018_Theme/Coded_Files/Reversing_Labs_November2018-style.min.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:e0f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1a5131ba88c40e02e211f48163838569b854a383f19817b94db2f4e83f5d044d

Request headers

Referer: https://www.reversinglabs.com/
Origin: https://www.reversinglabs.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:42:05 GMT
via: 1.1 803246727539350977d724c9e4a027c6.cloudfront.net (CloudFront)
content-encoding: br
cf-cache-status: HIT
x-amz-meta-cache-tag: F-11651164052,FD-5926386258,P-3375217,FLS-ALL
x-amz-version-id: DhZpSF_okm4kqA3d5rsX6px.W1gW4AHr
age: 383946
x-amz-cf-pop: FRA56-P4
x-amz-request-id: RG8HX3X62PZHM8CN
edge-cache-tag: F-11651164052,FD-5926386258,P-3375217,FLS-ALL
cache-tag: F-11651164052,FD-5926386258,P-3375217,FLS-ALL
x-cache: RefreshHit from cloudfront
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 20
x-amz-id-2: TyFIgpyp10KkcTyXsymZ1oFAFu8DVWHvxhaQxzR/okrpzKqvjIaSzJCw0J47reCmDXNilueQOds=
last-modified: Sun, 28 Jul 2019 19:57:28 GMT
server: cloudflare
etag: W/"ab8a234e214dd3506e9fada6b6eafdca"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/font-woff
access-control-allow-origin: *
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
cf-ray: 7f2f98faea2390da-FRA
x-amz-cf-id: NidTNyKRAq7Uz5aBhL4CYmDGslcur-o6sJTjfvI4dRA-noJcGGS7Sg==
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 20

GET
H2 200 rl-icons.woff
3375217.fs1.hubspotusercontent-na1.net/hubfs/3375217/Reversing_Labs_November%202018/Font/ 4 KB
5 KB 190ms
90ms Font
application/font-woff 2606:4700::6812:e0f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://3375217.fs1.hubspotusercontent-na1.net/hubfs/3375217/Reversing_Labs_November%202018/Font/rl-icons.woff
Requested by: Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/6519964395/1685359416657/Reversing_Labs_November2018_Theme/Coded_Files/Reversing_Labs_November2018-style.min.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:e0f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9103cd19fa0db417520474c8682d15529708804e7d5dcee981c8a19a7c083875

Request headers

Referer: https://www.reversinglabs.com/
Origin: https://www.reversinglabs.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:42:05 GMT
via: 1.1 6def1f0ddc805dce17407cce01d5b32c.cloudfront.net (CloudFront)
content-encoding: br
cf-cache-status: HIT
x-amz-meta-cache-tag: F-6528836102,FD-6528836052,P-3375217,FLS-ALL
x-amz-version-id: 7Fg3.Df2IKZXcjymNQNOrpeZRI7DlXZ.
age: 438604
x-amz-cf-pop: FRA56-C1
x-amz-server-side-encryption: AES256
x-amz-request-id: 51W62WVMKWF50GNG
edge-cache-tag: F-6528836102,FD-6528836052,P-3375217,FLS-ALL
cache-tag: F-6528836102,FD-6528836052,P-3375217,FLS-ALL
x-cache: RefreshHit from cloudfront
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 15
x-amz-id-2: WLgjmiL27XpT+j4kOlFBZaljkpZAJNdPI8Bm7ptfrmh2AHW2E/WDraOtijG65KAiHDmIQHCPuvY=
last-modified: Fri, 24 Apr 2020 14:40:36 GMT
server: cloudflare
etag: W/"97ca286c0b94878b6b2adf44559b6265"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/font-woff
access-control-allow-origin: *
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
cf-ray: 7f2f98faea2090da-FRA
x-amz-cf-id: u8e8rcWlHJx6_nTmuBrUZpaNrwDlIOhf1ls1xIfBHeWXSkWmhTRDPw==
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 15

GET
H2 200 KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ 16 KB
16 KB 155ms
38ms Font
font/woff2 2a00:1450:4001:829::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:100,300,300i,400,500,700,900&display=swap&subset=latin-ext

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.reversinglabs.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Tue, 01 Aug 2023 17:26:14 GMT
x-content-type-options: nosniff
age: 501351
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15920
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:45 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 31 Jul 2024 17:26:14 GMT

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v30/ 15 KB
15 KB 168ms
51ms Font
font/woff2 2a00:1450:4001:829::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:100,300,300i,400,500,700,900&display=swap&subset=latin-ext

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.reversinglabs.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Fri, 04 Aug 2023 17:49:54 GMT
x-content-type-options: nosniff
age: 240731
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15744
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:48 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 03 Aug 2024 17:49:54 GMT

GET
H2 200 TungstenNarrow-Medium.woff
3375217.fs1.hubspotusercontent-na1.net/hubfs/3375217/Reversinglabs_July2018/Fonts/ 21 KB
21 KB 184ms
91ms Font
application/font-woff 2606:4700::6812:e0f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://3375217.fs1.hubspotusercontent-na1.net/hubfs/3375217/Reversinglabs_July2018/Fonts/TungstenNarrow-Medium.woff
Requested by: Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/6519964395/1685359416657/Reversing_Labs_November2018_Theme/Coded_Files/Reversing_Labs_November2018-style.min.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:e0f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 70d1119d232eb54079a766d9e1564320f2c20e6e71683e31edf766c26e9c678e

Request headers

Referer: https://www.reversinglabs.com/
Origin: https://www.reversinglabs.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:42:05 GMT
via: 1.1 6165dcc1fdf84ac65e8204c05709f1ca.cloudfront.net (CloudFront)
content-encoding: br
cf-cache-status: HIT
x-amz-meta-cache-tag: F-10570558853,FD-5926386258,P-3375217,FLS-ALL
x-amz-version-id: HmXdIK8Bc_0fkfivtLAcWmXE077h5rsG
age: 437751
x-amz-cf-pop: FRA56-C1
x-amz-request-id: G18NB05HDYX1X3AG
edge-cache-tag: F-10570558853,FD-5926386258,P-3375217,FLS-ALL
cache-tag: F-10570558853,FD-5926386258,P-3375217,FLS-ALL
x-cache: RefreshHit from cloudfront
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 15
x-amz-id-2: cJzZtuWSuhlCuoelcssFG4ItqhdQeWN8yfYZfcScmTY//X4/nEs0cDddUu4fMRqcL1ef5cdbl4c=
last-modified: Tue, 18 Jun 2019 15:58:22 GMT
server: cloudflare
etag: W/"650100235aa1598769f1744ec1674c39"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/font-woff
access-control-allow-origin: *
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
cf-ray: 7f2f98faea1e90da-FRA
x-amz-cf-id: wqlmHhz4cw4lQFCQQbttTvLkp1n10kipNB9BgiAMzOCsajNhpaF4tQ==
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 15

GET
H2 200 KFOlCnqEu92Fr1MmSU5fBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ 15 KB
15 KB 190ms
80ms Font
font/woff2 2a00:1450:4001:829::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmSU5fBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:100,300,300i,400,500,700,900&display=swap&subset=latin-ext

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f75911313e1c7802c23345ab57e754d87801581706780c993fb23ff4e0fe62ef

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.reversinglabs.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Sat, 05 Aug 2023 10:18:14 GMT
x-content-type-options: nosniff
age: 181431
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15740
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:56 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 04 Aug 2024 10:18:14 GMT

GET
H2 200 Tungsten-Medium.woff
3375217.fs1.hubspotusercontent-na1.net/hubfs/3375217/Reversinglabs_July2018/Fonts/ 19 KB
20 KB 173ms
80ms Font
application/font-woff 2606:4700::6812:e0f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://3375217.fs1.hubspotusercontent-na1.net/hubfs/3375217/Reversinglabs_July2018/Fonts/Tungsten-Medium.woff
Requested by: Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/6519964395/1685359416657/Reversing_Labs_November2018_Theme/Coded_Files/Reversing_Labs_November2018-style.min.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:e0f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 84240275eed2746f9d66bb0a5f46915d74ba6a7c6e210ba4634a16e03ca54270

Request headers

Referer: https://www.reversinglabs.com/
Origin: https://www.reversinglabs.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:42:05 GMT
via: 1.1 2a3a093b493a82493f3431437cb166ac.cloudfront.net (CloudFront)
content-encoding: br
cf-cache-status: HIT
x-amz-meta-cache-tag: F-10570055973,FD-5926386258,P-3375217,FLS-ALL
x-amz-version-id: 8RS6BKpEUu5kELkbXI3oOka23XcEIvrY
age: 1788960
x-amz-cf-pop: FRA56-C1
x-amz-request-id: B8TFZ3GWMHHNY3YD
edge-cache-tag: F-10570055973,FD-5926386258,P-3375217,FLS-ALL
cache-tag: F-10570055973,FD-5926386258,P-3375217,FLS-ALL
x-cache: RefreshHit from cloudfront
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 15
x-amz-id-2: JnmYFgFQF9+rJsdywJ15OXw3AP47TYa8OwD8iFL5+t2t4EpShOsPfYpqi7BFfqQCeNdV7ydwThY=
last-modified: Tue, 18 Jun 2019 15:58:23 GMT
server: cloudflare
etag: W/"e62b1278f1fdeb9765b266aa18905620"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/font-woff
access-control-allow-origin: *
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
cf-ray: 7f2f98faea2490da-FRA
x-amz-cf-id: kx_5axGUre7U4A6ztW55USTT12iC6xsGEEWjTtUJO2K1dcVdO-HVuQ==
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 15

GET
H2 200 KFOjCnqEu92Fr1Mu51TjASc6CsQ.woff2
fonts.gstatic.com/s/roboto/v30/ 17 KB
17 KB 248ms
139ms Font
font/woff2 2a00:1450:4001:829::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOjCnqEu92Fr1Mu51TjASc6CsQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:100,300,300i,400,500,700,900&display=swap&subset=latin-ext

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bb8007225d94a099cddbade7ea904667c0dd0b68d5e30778e5c6257589ab94d1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.reversinglabs.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Sat, 05 Aug 2023 06:05:35 GMT
x-content-type-options: nosniff
age: 196590
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 17508
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:41 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 04 Aug 2024 06:05:35 GMT

GET
H2 200 KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ 15 KB
16 KB 245ms
136ms Font
font/woff2 2a00:1450:4001:829::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:100,300,300i,400,500,700,900&display=swap&subset=latin-ext

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.reversinglabs.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Sat, 05 Aug 2023 11:08:17 GMT
x-content-type-options: nosniff
age: 178428
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15860
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:42 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 04 Aug 2024 11:08:17 GMT

GET
H2 200 Tungsten-Light.woff
3375217.fs1.hubspotusercontent-na1.net/hubfs/3375217/Reversinglabs_July2018/Fonts/ 21 KB
22 KB 138ms
130ms Font
application/font-woff 2606:4700::6812:e0f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://3375217.fs1.hubspotusercontent-na1.net/hubfs/3375217/Reversinglabs_July2018/Fonts/Tungsten-Light.woff
Requested by: Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/6519964395/1685359416657/Reversing_Labs_November2018_Theme/Coded_Files/Reversing_Labs_November2018-style.min.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:e0f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3ac9f879f23b53c0856f5a719a5d2913f2890b5e06b60a8879945c245080fc52

Request headers

Referer: https://www.reversinglabs.com/
Origin: https://www.reversinglabs.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:42:05 GMT
via: 1.1 0d78cc90106520d13c1b5c5b16dd8246.cloudfront.net (CloudFront)
content-encoding: br
cf-cache-status: HIT
x-amz-meta-cache-tag: F-11651159874,FD-5926386258,P-3375217,FLS-ALL
x-amz-version-id: oZWO71JPrAMaAkHUdMvYTNjF0GR2Ck4O
age: 1165804
x-amz-cf-pop: FRA56-P7
x-amz-request-id: 3JTZ5WHANE0C9EBG
edge-cache-tag: F-11651159874,FD-5926386258,P-3375217,FLS-ALL
cache-tag: F-11651159874,FD-5926386258,P-3375217,FLS-ALL
x-cache: RefreshHit from cloudfront
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 15
x-amz-id-2: x/G5VvN/z2SfUZFCg1LDNMQxr9oXVsnn7aQYavzX+Wk6rq5JpV3bHpjU6TRrk7RO00U1t6H3q2g=
last-modified: Sun, 28 Jul 2019 19:57:28 GMT
server: cloudflare
etag: W/"100aa5d32672286f544f73831e764ee1"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/font-woff
access-control-allow-origin: *
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
cf-ray: 7f2f98faea1d90da-FRA
x-amz-cf-id: TZNApEhWMdnBkfcGYtiJqRK6h57FKJwLu9Pz3eCFa609__XVcIgD0A==
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 15

GET
H3 200 VMConnect-Blog.jpg
www.reversinglabs.com/hs-fs/hubfs/Blog/ 152 KB
153 KB 212ms
207ms Image
image/webp 2606:2c40::c73c:671f
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.reversinglabs.com/hs-fs/hubfs/Blog/VMConnect-Blog.jpg?width=1400&height=732&name=VMConnect-Blog.jpg

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

b99e57a180459ef9973b9bb3f41ce4a28c015ac31ec686c087bf21f42d366608

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:42:05 GMT
strict-transport-security: max-age=31536000
via: 1.1 da749f044be44d389a30372d73356c4e.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-content-type-options: nosniff
content-security-policy: default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
cache-tag: F-127998140035,FD-11822274822,P-3375217,FLS-ALL
x-hs-https-only: worker
alt-svc: h3=":443"; ma=86400
content-length: 155290
cf-resized: internal=ok/m q=0 n=950+0 c=21+116 v=2023.7.3 l=155290
last-modified: Wed, 02 Aug 2023 12:32:32 GMT
cf-bgj: imgq:86,h2pri
server: cloudflare
etag: "cfNOMcKaoDQTmxnUSgND4a2FbXsvDsvdffkG1yWKzcDQ:7a382c8e2e8d51d238303bd14e4a96b4"
vary: Accept, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=YRh0wcNJUW%2BV7Et125fIJ4Bsheec05zk420lrEpI7qtvdSHh79UXlIYu%2BGB%2FXwyAuFfqbqOG3gYl3r%2BAwpaRdeFm6MqNbRYXyChiZxEEM8JJvEWzfP2Dw8E%2FghFbVm8bYp9N9ksRgo3Nydqv%2BYbJqT6%2B3Q%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
access-control-allow-origin: *
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
accept-ranges: bytes
cf-ray: 7f2f98fafa203a85-FRA

GET
H3 200 vmconnect-blog-figure3-config.png
www.reversinglabs.com/hs-fs/hubfs/Blog/ 39 KB
40 KB 242ms
238ms Image
image/webp 2606:2c40::c73c:671f
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.reversinglabs.com/hs-fs/hubfs/Blog/vmconnect-blog-figure3-config.png?width=570&height=226&name=vmconnect-blog-figure3-config.png

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

6e4d408ece6803ecb0c2356f7c16a9e1acdbf01228830ac38274ec1ada687e36

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:42:05 GMT
strict-transport-security: max-age=31536000
via: 1.1 01e7df96c01c9ecdb1cce1b6595ae260.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-content-type-options: nosniff
content-security-policy: default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
cache-tag: F-128372297775,FD-11822274822,P-3375217,FLS-ALL
x-hs-https-only: worker
alt-svc: h3=":443"; ma=86400
content-length: 40172
cf-resized: internal=ok/h q=0 n=86+0 c=0+23 v=2023.7.3 l=40172
last-modified: Fri, 04 Aug 2023 12:08:01 GMT
cf-bgj: imgq:100,h2pri
server: cloudflare
etag: "cfKEFYek-osWhpe5X8gXArZyh18sSmAPwuejBK1TPFDQ:a4db244b42098e0fbad80bc9b9c81d06"
vary: Accept, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=aQOwHh900O6bgnDu0ymG%2FlK3jqPL8ac7fAKAmc4Ydv4aTOq0Aec7vGisqIMXs%2BprobjQ6QQzdX9eMIAW8CPVLibIlKHxj3AlDZ0ffO0HRrGZZz5jepTnnx5j2yb9PZvJM70bHqOmFLmW2z7JhPT60HGGtw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
access-control-allow-origin: *
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
accept-ranges: bytes
cf-ray: 7f2f98fafa223a85-FRA

GET
H3 200 json Show response
www.reversinglabs.com/_hcms/forms/embed/v3/form/3375217/24abef2a-a2f4-4889-8899-dd4026584fa9/ 16 KB
4 KB 215ms
213ms XHR
application/json 2606:2c40::c73c:671f
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reversinglabs.com/_hcms/forms/embed/v3/form/3375217/24abef2a-a2f4-4889-8899-dd4026584fa9/json?hs_static_app=forms-embed&hs_static_app_version=1.3512&X-HubSpot-Static-App-Info=forms-embed-1.3512

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/_hcms/forms/v2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

373f4f92cf1385f8c016b6fd61929484fdcc6a45bbd33250bfe6ecde5bd6543f

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

x-origin-hublet: na1
date: Mon, 07 Aug 2023 12:42:06 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
content-security-policy: upgrade-insecure-requests
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: 0f77c1c6-83fb-4254-85c2-a9c749835ff7
content-encoding: br
x-envoy-upstream-service-time: 16
x-hs-https-only: worker
alt-svc: h3=":443"; ma=86400
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 0f77c1c6-83fb-4254-85c2-a9c749835ff7
server: cloudflare
x-trace: 2B52A4014D012E73CECF02FFA2336FBBCB0B8F4EE3000000000000000000
vary: origin, Accept-Encoding
access-control-allow-methods: OPTIONS, GET
content-type: application/json;charset=utf-8
access-control-max-age: 180
x-evy-trace-served-by-pod: iad02/star-hubspot-td/envoy-proxy-759c64d45c-rgcrk
access-control-expose-headers: X-Origin-Hublet
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: false
x-evy-trace-virtual-host: all
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=O2n63Zs9kD%2FN5G7tr188jUsQtQjqiC8k6unV3syiFgEsDOJHIsf3W0ShhOCmi9aNwyMC2SYbDYCHlpP12VU5E1WrZMXezqaz5H04AfEOrVEVBV13RuF%2FEHBym9fzmUmy740fO0%2FiOIytGuEi94c29Ed4iA%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 7f2f98fbdb6d3a85-FRA
access-control-allow-headers: *
x-robots-tag: none

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 52 KB
21 KB 213ms
95ms Script
text/javascript 2001:4860:4802:36::178
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MKL9P8B

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2001:4860:4802:36::178 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Mon, 07 Aug 2023 11:44:24 GMT
last-modified: Mon, 12 Jun 2023 18:23:07 GMT
server: Golfe2
age: 3462
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20994
expires: Mon, 07 Aug 2023 13:44:24 GMT

GET
H2 200 insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 13 KB
5 KB 197ms
58ms Script
application/x-javascript 2a02:26f0:780::210:a423
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://snap.licdn.com/li.lms-analytics/insight.min.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MKL9P8B

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:780::210:a423 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

fa53fcd8da139d256c0ca83b69cb37473ca627b6052368ed3327c80d9fb61e25

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:42:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 24 Jul 2023 09:07:54 GMT
x-cdn: AKAM
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
content-type: application/x-javascript;charset=utf-8
cache-control: max-age=64302
accept-ranges: bytes
content-length: 4862

GET
H2 200 pixel.js Show response
www.redditstatic.com/ads/ 23 KB
8 KB 172ms
57ms Script
application/javascript 2a04:4e42:400::396
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://www.redditstatic.com/ads/pixel.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MKL9P8B
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:400::396 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: snooserv /
Resource Hash: e803e774c7b59fe74f71ed93acaa875cf9a99947ff8ed7615cd0c93c1667250f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:42:06 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
last-modified: Thu, 15 Jun 2023 20:49:59 GMT
server: snooserv
nel: {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.02, "failure_fraction": 0.02}
etag: "4a205643a240cb95fa82289d62b5af7e"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding,Origin
report-to: {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]}
content-type: application/javascript
cache-control: public, max-age=60
accept-ranges: bytes
content-length: 7409

GET
H2 200 site-script.js Show response
cdn.metadata.io/ 6 KB
2 KB 170ms
60ms Script
application/javascript 2600:9000:2127:9800:9:d7d4:1380:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.metadata.io/site-script.js

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2127:9800:9:d7d4:1380:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

1d4548c03b28521204ab490e46b39179b8fa196998d45215a24602306b662ab5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

x-amz-version-id: FA0kpUmjH6379n6SM2OzYViu4FNXSGFq
content-encoding: gzip
via: 1.1 7df0d6b4ce8f8b155434dd5d830b76be.cloudfront.net (CloudFront)
date: Mon, 07 Aug 2023 00:08:40 GMT
x-content-type-options: nosniff
strict-transport-security: max-age=31536000
x-amz-cf-pop: PRG50-C1
age: 45207
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Fri, 04 Aug 2023 00:07:57 GMT
server: AmazonS3
etag: W/"2963b0a1258588f130235cbdfe809b88"
vary: Accept-Encoding, Origin
x-frame-options: SAMEORIGIN
content-type: application/javascript
x-amz-cf-id: Dw30Z-Y-YGVsTgz1Mlu90VDOyRy6UCrPNTZ7FCI8bxNpA6FRfwXmpA==

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 279 KB
94 KB 51ms
49ms Script
application/javascript 2a00:1450:4001:829::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-JVM9Z1XQPL&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MKL9P8B

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

412210341224fc44fcc8940c5f08af574d564091059a809c0fd0cebba9251dae

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:42:06 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 95842
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Mon, 07 Aug 2023 12:42:06 GMT

GET
H/1.1 200
OK pixel
q.quora.com/_/ad/91aab57be1f94ec2a2ef647592767813/ 43 B
422 B 502ms
120ms Image
image/gif 52.207.107.232
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://q.quora.com/_/ad/91aab57be1f94ec2a2ef647592767813/pixel?tag=ViewContent&i=gtm&u=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fvmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.207.107.232 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-207-107-232.compute-1.amazonaws.com

Software

nginx /

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

Date: Mon, 07 Aug 2023 12:42:06 GMT
Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
Server: nginx
Connection: keep-alive
Content-Length: 43
X-Q-Stat: ,e240fbfad521e2986e49f37c3bd72ec4,10.0.0.106,48270,80.255.7.104,,143260189299,1,1691412126.501,0.002,,.,0,0,0.004,0.004,-,0,0,197,202,101,10,34729,,,,,,-,
Content-Type: image/gif

GET
H2 200 /
www.facebook.com/tr/ 0
185 B 156ms
41ms Image
text/plain 2a03:2880:f176:84:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1076912843267184&ev=Lead&dl=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fvmconnect-malicious-pypi-packages-imitate-popular-open-source-modules&rl=&if=false&ts=1691412126072&sw=1600&sh=1200&v=2.9.121&r=stable&ec=0&o=30&fbp=fb.1.1691412126069.842737840&it=1691412125755&coo=false&exp=a1&rqm=GET

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f176:84:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
date: Mon, 07 Aug 2023 12:42:06 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H2 200 /
www.facebook.com/tr/ 0
31 B 157ms
41ms Image
text/plain 2a03:2880:f176:84:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1076912843267184&ev=PageView&dl=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fvmconnect-malicious-pypi-packages-imitate-popular-open-source-modules&rl=&if=false&ts=1691412126075&sw=1600&sh=1200&v=2.9.121&r=stable&a=tmgoogletagmanager&ec=1&o=30&fbp=fb.1.1691412126069.842737840&it=1691412125755&coo=false&exp=a1&rqm=GET

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f176:84:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
date: Mon, 07 Aug 2023 12:42:06 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H2 200 JrRu3vUM8j33QSR7Bwxw Show response
ws.zoominfo.com/pixel/ 3 KB
2 KB 276ms
189ms Script
text/javascript 2606:4700::6810:650c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ws.zoominfo.com/pixel/JrRu3vUM8j33QSR7Bwxw

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:650c , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

1e1dd2ba3301366a9c3415c59880459342966cc23845e6d980c1605aeda5d3a9

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:42:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
via: 1.1 google
server: cloudflare
x-powered-by: Express
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
access-control-allow-credentials: true
cf-ray: 7f2f98fd99fa18b7-FRA
access-control-allow-headers: Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for, x-ws-collect-type,requestFromZITag,unifiedScriptVerified,_zitok,_vtok
alt-svc: h3=":443"; ma=86400

GET
H3 200 all.js Show response
connect.facebook.net/en_GB/ 3 KB
2 KB 43ms
42ms Script
application/x-javascript 2a03:2880:f083:9:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_GB/all.js

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f083:9:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

415f1b24f09d34ace4333cdd8a1a2ed4c0f74db2f4f6c76967f1a5555e87d0cc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
date: Mon, 07 Aug 2023 12:42:06 GMT
content-md5: DLCVo6WkK1ZtNv/uaQ4nsQ==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 1687
x-fb-debug: oFLu+b+GFRaykMOoC+HuMT7vhouHDN4Cy+VvIan8YA/fn1IQh/XqguYsTk57ddDJ7lYbqBgCdLC6kZkcl27eEw==
x-fb-content-md5: b9ecef98197cb0ee143ebb1d276d6a97
cross-origin-opener-policy: same-origin-allow-popups
etag: "549b037e1884b8c7f4948f0b57aab044"
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: X-FB-Content-MD5
cache-control: public,max-age=1200,stale-while-revalidate=3600
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), microphone=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=()
timing-allow-origin: *
priority: u=3,i
expires: Mon, 07 Aug 2023 12:42:40 GMT

GET
H2 200 widgets.js Show response
platform.twitter.com/ 91 KB
27 KB 147ms
40ms Script
application/javascript 146.75.116.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/widgets.js
Requested by: Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 146.75.116.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 392c9fa9cd1273a2a89d1a83a69cd1f63f21d1d55e7be21e1d8f51f25145668b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:42:06 GMT
content-encoding: gzip
x-amz-server-side-encryption: AES256
x-cache: HIT, HIT
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
content-length: 27630
x-served-by: cache-iad-kcgs7200104-IAD, cache-fra-eddf8230064-FRA
last-modified: Tue, 24 Jan 2023 21:41:51 GMT
etag: "9e99725b7a4cd730a934afba2a438bb5+gzip"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=1800
accept-ranges: bytes
tw-cdn: FT

GET
H2 200 leadflows.js Show response
js.hsleadflows.net/ 540 KB
86 KB 143ms
50ms Script
application/javascript 2606:4700::6811:836e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js.hsleadflows.net/leadflows.js

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/hs/scriptloader/3375217.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:836e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

96ea6b1e986879257e104371bf5f0cb0bf2bb9957a1aa73fa9df8be99aeeb157

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
Origin: https://www.reversinglabs.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

content-encoding: br
age: 71082
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
content-security-policy-report-only: frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=lead-flows-js/static-1.1232/bundle/main/lead-flows-release.js&cfRay=7f28d19928dd9119-FRA
x-amz-replication-status: COMPLETED
x-evy-trace-listener: listener_https
etag: W/"039461df2d1d43031520c7d3a853f79e"
vary: Accept-Encoding,Origin,Access-Control-Request-Headers,Access-Control-Request-Method
access-control-allow-methods: GET
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
x-evy-trace-virtual-host: all
cache-control: s-maxage=86400, max-age=0
x-hs-target-asset: lead-flows-js/static-1.1232/bundle/main/lead-flows-release.js
date: Mon, 07 Aug 2023 12:42:06 GMT
x-amz-version-id: RIqU3aMZg9szNHjfbC8NSxVkuKgO4.TB
via: 1.1 73c5607bdb5db0d651e25c848846d554.cloudfront.net (CloudFront)
x-content-type-options: nosniff
cf-cache-status: HIT
x-amz-cf-pop: IAD12-P3
x-hubspot-correlation-id: c82b3bb0-ba4f-41a2-a350-5216008fa478
x-cache: Hit from cloudfront
cache-tag: staticjsapp-lead-flows-cloudflare-web-prod,staticjsapp-prod
x-envoy-upstream-service-time: 9
x-evy-trace-route-configuration: listener_https/all
x-request-id: c82b3bb0-ba4f-41a2-a350-5216008fa478
last-modified: Thu, 03 Aug 2023 01:17:49 UTC
server: cloudflare
access-control-max-age: 3000
x-hs-cache-status: MISS
x-evy-trace-served-by-pod: iad02/app-td/envoy-proxy-57ff77fcd-xjmf2
cf-ray: 7f2f98fdcdee918e-FRA
x-amz-cf-id: vVWZrsk2VZ1z-r7TL4JFBngtGWmlLloMVSRZxGdojv-rpU0AvtaXrQ==

GET
H2 200 3375217.js Show response
js.hs-analytics.net/analytics/1691412000000/ 66 KB
21 KB 159ms
67ms Script
text/javascript 2606:4700::6810:8ace
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hs-analytics.net/analytics/1691412000000/3375217.js
Requested by: Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/hs/scriptloader/3375217.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:8ace , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ff5b2a04410456da0a8e7d8a4db3eacf62ab980e163a500b81781ea6c5b0a73b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:42:06 GMT
x-amz-version-id: null
content-encoding: br
cf-cache-status: HIT
x-amz-request-id: QYHD1W99PARYDCFK
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
x-hubspot-correlation-id: 5610096f-ac4f-48ca-bcd8-1327ed9ee32f
age: 97
x-envoy-upstream-service-time: 27
x-amz-id-2: 5AKGP20dUAZOOdHqoD7ecD3XSafoSx/2RUj91KFrQiTYQ3Fhk8Eo1ERyY6e9I4/Xfvr6yYDHC9U=
x-evy-trace-listener: listener_https
x-request-id: 5610096f-ac4f-48ca-bcd8-1327ed9ee32f
x-evy-trace-route-configuration: listener_https/all
last-modified: Thu, 20 Jul 2023 15:57:16 GMT
server: cloudflare
etag: W/"a3ab9dab97e068beca49a0d2808f012f"
vary: origin, Accept-Encoding
content-type: text/javascript
x-evy-trace-virtual-host: all
x-evy-trace-served-by-pod: iad02/analytics-js-proxy-td/envoy-proxy-7dbb6c8f49-v9vn7
cache-control: max-age=300,public
access-control-allow-credentials: false
cf-ray: 7f2f98fdcbd52c62-FRA
expires: Mon, 07 Aug 2023 12:45:29 GMT

GET
H2 200 3375217.js Show response
js.hs-banner.com/ 60 KB
16 KB 157ms
67ms Script
text/javascript 2606:4700::6812:18c4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hs-banner.com/3375217.js
Requested by: Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/hs/scriptloader/3375217.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:18c4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3c50dd5c1727efe22037460b8eaa121b22932d39ab13865d1ecf5b8372d2da4d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:42:06 GMT
x-amz-version-id: bw3Z1oFRilBSp2nJoqwzp68d0FJwmW7g
content-encoding: br
cf-cache-status: HIT
x-amz-request-id: YWVMB1TNVGY79DV5
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
age: 163
x-envoy-upstream-service-time: 15
x-amz-id-2: iiBYjJM52iHxww39E9YOYF/kkRzZl5dN8A2edJKFriBwuhprBDUG3uWaOMMTz1M2vGnDTaKpFi8=
x-evy-trace-listener: listener_https
x-request-id: 2be7d2d3-6c4f-4f5c-8146-e59ae302d245
x-evy-trace-route-configuration: listener_https/all
last-modified: Wed, 31 May 2023 09:21:10 GMT
server: cloudflare
etag: W/"4f3650703a78045f1ac9ea0084ff242e"
access-control-max-age: 604800
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: https://www.reversinglabs.com
x-evy-trace-virtual-host: all
access-control-expose-headers: x-last-modified-timestamp, X-HubSpot-NotFound, X-HS-User-Request, Link, Server-Timing
cache-control: max-age=300,public
access-control-allow-credentials: true
x-evy-trace-served-by-pod: iad02/analytics-js-proxy-td/envoy-proxy-7dbb6c8f49-f4w7q
vary: origin, Accept-Encoding
timing-allow-origin: *
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Accept-Charset, Accept-Encoding, X-Override-Internal-Permissions, X-Properties-Source, X-Properties-SourceId, X-Properties-Flag, X-Hubspot-User-Id, X-Hubspot-Trace, X-Hubspot-Callee, X-Hubspot-Offset, X-Hubspot-No-Trace, X-HubSpot-Static-App-Info, X-HubSpot-Messages-Uri, X-HubSpot-Request-Source, X-HubSpot-Request-Reason, Subscription-Billing-Auth-Token, X-App-CSRF, X-Tools-CSRF, Online-Payment-Signing-UUID, X-Source, X-SourceId, X-Origin-UserId, X-Biden-Request-Source, X-HubSpot-CSRF-hubspotapi, X-Force-Cookie-Refresh, X-Force-Cookie-Refresh-No-Cache, X-HS-User-Request, X-Application-Id, X-HS-Referer, X-HubSpot-Correlation-Id
cf-ray: 7f2f98fdcda16937-FRA
expires: Mon, 07 Aug 2023 12:44:23 GMT

GET
H2 200 fb.js Show response
js.hsadspixel.net/ 6 KB
3 KB 142ms
54ms Script
application/javascript 2606:4700::6810:75be
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js.hsadspixel.net/fb.js

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/hs/scriptloader/3375217.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:75be , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e10ce26ead0eca58cd5346843538415611b745bfd29825322efad56424a4c911

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:42:06 GMT
x-amz-version-id: aAzOiTTzU7.XykyGrcpmeR7PTeB2LyLv
via: 1.1 dfc1931cc62ecd4133c2b9bdae1bb476.cloudfront.net (CloudFront)
x-content-type-options: nosniff
cf-cache-status: HIT
x-amz-cf-pop: IAD12-P3
age: 162
x-amz-server-side-encryption: AES256
x-evy-trace-route-service-name: envoyset-translator
content-security-policy-report-only: frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=adsscriptloaderstatic/static-1.387/bundles/pixels-release.js&cfRay=7f2f95072b6a92a1-FRA
x-cache: Hit from cloudfront
x-hubspot-correlation-id: 6d901185-5d61-4545-bfef-d3590c4bb619
cache-tag: staticjsapp-AdsScriptLoaderCloudflare-web-prod,staticjsapp-prod
content-encoding: br
x-envoy-upstream-service-time: 1
x-amz-replication-status: COMPLETED
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 6d901185-5d61-4545-bfef-d3590c4bb619
last-modified: Tue, 18 Jul 2023 03:27:27 UTC
server: cloudflare
etag: W/"784f994871e489c9943a65326d43e875"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
x-hs-cache-status: HIT
x-evy-trace-virtual-host: all
cache-control: max-age=600
x-evy-trace-served-by-pod: iad02/app-td/envoy-proxy-57ff77fcd-qrxbq
cf-ray: 7f2f98fdc85b9241-FRA
x-amz-cf-id: EwQqSqbZ4JBrZOGNbcVGFXL2HilzvKgp5XcWXTLgDt6OegJ7xDX8rw==
x-hs-target-asset: adsscriptloaderstatic/static-1.387/bundles/pixels-release.js

GET
H2 200 collectedforms.js Show response
js.hscollectedforms.net/ 69 KB
25 KB 142ms
51ms Script
application/javascript 2606:4700::6811:6bc7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js.hscollectedforms.net/collectedforms.js

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/hs/scriptloader/3375217.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:6bc7 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f54b61a120e0240c98428d76beab031099f4f0379cbc623de071277255088fdc

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
Origin: https://www.reversinglabs.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

content-encoding: br
age: 464
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
content-security-policy-report-only: frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=collected-forms-embed-js/static-1.380/bundles/project.js&cfRay=7f2f8da9ed9a9a35-FRA
x-amz-replication-status: COMPLETED
x-evy-trace-listener: listener_https
etag: W/"85b7f9af32b27bd6cc93e80bfb2911df"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
x-evy-trace-virtual-host: all
cache-control: s-maxage=600, max-age=300
x-hs-target-asset: collected-forms-embed-js/static-1.380/bundles/project.js
date: Mon, 07 Aug 2023 12:42:06 GMT
x-amz-version-id: 3rNMTio6eswfsQ6sgXOFNNmyULDAVi34
via: 1.1 16d910967d343c8da7828222a653755e.cloudfront.net (CloudFront)
x-content-type-options: nosniff
cf-cache-status: HIT
x-amz-cf-pop: IAD12-P3
x-hubspot-correlation-id: b0e8ebcc-f52f-4214-97cf-2b5c1a83288a
x-cache: Hit from cloudfront
cache-tag: staticjsapp-collected-forms-embed-js-web-prod,staticjsapp-prod
x-envoy-upstream-service-time: 2
x-evy-trace-route-configuration: listener_https/all
x-request-id: b0e8ebcc-f52f-4214-97cf-2b5c1a83288a
last-modified: Mon, 10 Jul 2023 09:43:19 UTC
server: cloudflare
x-hs-cache-status: HIT
x-evy-trace-served-by-pod: iad02/app-td/envoy-proxy-57ff77fcd-xjmf2
cf-ray: 7f2f98fdccf55bf5-FRA
x-amz-cf-id: Ri8hsRmusJOJoJJFjcx4XJiR8lwupZ2LT6K_ikeeQ52sLdsvV85Dkw==

GET
H2 200 conversations-embed.js Show response
js.usemessages.com/ 76 KB
22 KB 145ms
56ms Script
application/javascript 2606:4700::6811:64ac
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js.usemessages.com/conversations-embed.js

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/hs/scriptloader/3375217.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:64ac , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1a949852daa2fe2be0d5e7dfbf2d0edf71121b49a82b1d82992aa8aa9b7c2d9b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:42:06 GMT
x-amz-version-id: ODJS4by7FZvkpoRvjuP9B12j3hHA63aR
via: 1.1 3203c4b5504fa019a752072f0419ef6a.cloudfront.net (CloudFront)
x-content-type-options: nosniff
cf-cache-status: HIT
x-amz-cf-pop: IAD12-P3
age: 527
x-amz-server-side-encryption: AES256
x-evy-trace-route-service-name: envoyset-translator
content-security-policy-report-only: frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=conversations-embed/static-1.13717/bundles/project.js&cfRay=7f2f8c1ed9425c98-FRA
x-cache: Hit from cloudfront
x-hubspot-correlation-id: f4afe93d-8857-4732-9efe-d2608ca4e403
cache-tag: staticjsapp-conversations-embed-web-prod,staticjsapp-prod
content-encoding: br
x-envoy-upstream-service-time: 0
x-amz-replication-status: COMPLETED
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: f4afe93d-8857-4732-9efe-d2608ca4e403
last-modified: Tue, 01 Aug 2023 04:58:19 UTC
server: cloudflare
etag: W/"99645c9c8dd31a70b2127da46f42c10f"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
x-hs-cache-status: HIT
x-evy-trace-virtual-host: all
cache-control: max-age=600
x-evy-trace-served-by-pod: iad02/app-td/envoy-proxy-57ff77fcd-wd7jg
cf-ray: 7f2f98fdcc6d5c56-FRA
x-amz-cf-id: KiRxJhze3g77cZs2K0grNzfed4NMsbVQ2jA5AOYJoEYeowE9xag6dA==
x-hs-target-asset: conversations-embed/static-1.13717/bundles/project.js

GET
H2 204 has-permission Show response
app.hubspot.com/content-tools-menu/api/v1/tools-menu/ 0
1002 B 298ms
211ms Script
text/plain 2606:4700::6813:9b53
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://app.hubspot.com/content-tools-menu/api/v1/tools-menu/has-permission?portalId=3375217&callback=jsonpHandler

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/hs/hsstatic/HubspotToolsMenu/static-1.191/js/index.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6813:9b53 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	no-sniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:42:06 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: no-sniff
cf-cache-status: DYNAMIC
x-hs-worker-debug-mode: false
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: a7ccdc37-f038-42eb-b434-3b22a1578ac8
x-envoy-upstream-service-time: 5
alt-svc: h3=":443"; ma=86400
x-evy-trace-route-configuration: listener_https/all
reporting-endpoints: default="https://send.hsbrowserreports.com/csp/reports?cfRay=7f2f98fddac4046e&resource=unknown"
x-evy-trace-listener: listener_https
x-request-id: a7ccdc37-f038-42eb-b434-3b22a1578ac8
server: cloudflare
x-trace: 2BF5ED3C6A3665A5C05B25FF9A4D002E9B672D0481000000000000000000
vary: origin, Accept-Encoding
access-control-allow-methods: GET
report-to: {"group":"default","max_age":86400,"endpoints":[{"url":"https://send.hsbrowserreports.com/csp/reports"}]}
x-evy-trace-served-by-pod: iad02/app-td/envoy-proxy-57ff77fcd-ksc82
x-evy-trace-virtual-host: all
cache-control: max-age=0
access-control-allow-credentials: true
cf-ray: 7f2f98fddac4046e-FRA

GET
DATA 200
OK truncated
/ 37 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

Content-Type: image/gif

GET
H/1.1 200
OK counters.gif
forms.hsforms.com/embed/v3/ 35 B
1016 B 350ms
157ms Image
image/gif 2606:4700::6811:d2f3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://forms.hsforms.com/embed/v3/counters.gif?key=forms-embed-v2-DEFINITION_SUCCESS&count=1

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:d2f3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

Date: Mon, 07 Aug 2023 12:42:06 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
X-Content-Type-Options: nosniff
CF-Cache-Status: DYNAMIC
x-evy-trace-route-service-name: envoyset-translator
X-HubSpot-Correlation-Id: e5c24168-7c50-4853-bf63-931fe8a01220
x-envoy-upstream-service-time: 5
Connection: keep-alive
alt-svc: h3=":443"; ma=86400
Content-Length: 35
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: e5c24168-7c50-4853-bf63-931fe8a01220
Server: cloudflare
X-Trace: 2BC53D61E4A9056BDC26715E6BC11AB1084A004251000000000000000000
Vary: origin
Content-Type: image/gif
x-evy-trace-virtual-host: all
x-evy-trace-served-by-pod: iad02/star-hubspot-td/envoy-proxy-759c64d45c-nt996
Access-Control-Expose-Headers: X-Origin-Hublet
Cache-Control: max-age=0, no-cache, no-store
Access-Control-Allow-Credentials: false
X-Robots-Tag: none
CF-RAY: 7f2f98ff3dfe4da0-FRA

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/970567826/ 3 KB
2 KB 261ms
81ms Script
text/javascript 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/970567826/?random=1691412126347&cv=11&fst=1691412126347&bg=ffffff&guid=ON&async=1&gtm=45je3820&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fvmconnect-malicious-pypi-packages-imitate-popular-open-source-modules&hn=www.googleadservices.com&frm=0&tiba=VMConnect%3A%20Malicious%20PyPI%20packages%20imitate%20popular%20open%20source%20modules&auid=1098008830.1691412126&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-JVM9Z1XQPL&l=dataLayer&cx=c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4c6f3ea309c0a9fcb0170f32ff38053635117a2c08890ca0b0478278ce24ec02

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 07 Aug 2023 12:42:06 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1389
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
region1.analytics.google.com/g/ 0
249 B 188ms
53ms Ping
text/plain 2001:4860:4802:34::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.analytics.google.com/g/collect?v=2&tid=G-JVM9Z1XQPL&gtm=45je3820&_p=2141760045&_gaz=1&cid=282268885.1691412126&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=1&sid=1691412126&sct=1&seg=0&dl=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fvmconnect-malicious-pypi-packages-imitate-popular-open-source-modules&dt=VMConnect%3A%20Malicious%20PyPI%20packages%20imitate%20popular%20open%20source%20modules&en=page_view&_fv=1&_nsi=1&_ss=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-JVM9Z1XQPL&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 07 Aug 2023 12:42:06 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.reversinglabs.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
258 B 198ms
63ms Ping
text/plain 2a00:1450:400c:c0b::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-JVM9Z1XQPL&cid=282268885.1691412126&gtm=45je3820&aip=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-JVM9Z1XQPL&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:400c:c0b::9a Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 07 Aug 2023 12:42:06 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.reversinglabs.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
region1.analytics.google.com/g/ 0
45 B 168ms
53ms Ping
text/plain 2001:4860:4802:34::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.analytics.google.com/g/collect?v=2&tid=G-JVM9Z1XQPL&gtm=45je3820&_p=2141760045&cid=282268885.1691412126&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=2&sid=1691412126&sct=1&seg=0&dl=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fvmconnect-malicious-pypi-packages-imitate-popular-open-source-modules&dt=VMConnect%3A%20Malicious%20PyPI%20packages%20imitate%20popular%20open%20source%20modules&en=Hubspot%20Form%20-%20Listener&_c=1&_et=4
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-JVM9Z1XQPL&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 07 Aug 2023 12:42:06 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.reversinglabs.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
region1.analytics.google.com/g/ 0
45 B 158ms
53ms Ping
text/plain 2001:4860:4802:34::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.analytics.google.com/g/collect?v=2&tid=G-JVM9Z1XQPL&gtm=45je3820&_p=2141760045&cid=282268885.1691412126&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=3&sid=1691412126&sct=1&seg=0&dl=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fvmconnect-malicious-pypi-packages-imitate-popular-open-source-modules&dt=VMConnect%3A%20Malicious%20PyPI%20packages%20imitate%20popular%20open%20source%20modules&en=LinkedIn%20Insight&_c=1&_et=2
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-JVM9Z1XQPL&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 07 Aug 2023 12:42:06 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.reversinglabs.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
region1.analytics.google.com/g/ 0
45 B 152ms
54ms Ping
text/plain 2001:4860:4802:34::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.analytics.google.com/g/collect?v=2&tid=G-JVM9Z1XQPL&gtm=45je3820&_p=2141760045&cid=282268885.1691412126&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=4&sid=1691412126&sct=1&seg=0&dl=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fvmconnect-malicious-pypi-packages-imitate-popular-open-source-modules&dt=VMConnect%3A%20Malicious%20PyPI%20packages%20imitate%20popular%20open%20source%20modules&en=MetaData%20Script%20Landing%20page%20Conv&_c=1&_et=2
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-JVM9Z1XQPL&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 07 Aug 2023 12:42:06 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.reversinglabs.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
region1.analytics.google.com/g/ 0
45 B 55ms
47ms Ping
text/plain 2001:4860:4802:34::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.analytics.google.com/g/collect?v=2&tid=G-JVM9Z1XQPL&gtm=45je3820&_p=2141760045&cid=282268885.1691412126&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=5&sid=1691412126&sct=1&seg=0&dl=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fvmconnect-malicious-pypi-packages-imitate-popular-open-source-modules&dt=VMConnect%3A%20Malicious%20PyPI%20packages%20imitate%20popular%20open%20source%20modules&en=Reddit%20Conversion%20Tracking&_c=1&_et=2
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-JVM9Z1XQPL&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 07 Aug 2023 12:42:06 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.reversinglabs.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
408 B 178ms
86ms Image
image/gif 2a00:1450:4001:810::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-JVM9Z1XQPL&cid=282268885.1691412126&gtm=45je3820&aip=1&z=696321165

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 07 Aug 2023 12:42:06 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 rp.gif
alb.reddit.com/ 42 B
637 B 259ms
143ms Image
image/gif 151.101.1.140
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://alb.reddit.com/rp.gif?ts=1691412126495&id=t2_neftrm6a&event=PageVisit&m.itemCount=undefined&m.value=&m.valueDecimal=undefined&m.currency=undefined&m.transactionId=&m.customEventName=&m.products=&m.conversionId=&uuid=1891b037-5f7b-4b9a-b70b-65c392d4a7c2&aaid=&em=&external_id=&idfa=&integration=gtm&opt_out=0&sh=1600&sw=1200&v=rdt_f5bd31b2
Requested by: Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.1.140 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: Varnish /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:42:06 GMT
via: 1.1 varnish
nel: {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.3, "failure_fraction": 0.3}
server: Varnish
report-to: {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]}
content-type: image/gif
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
content-length: 42
retry-after: 0

GET
H2 200 6si.min.js Show response
j.6sc.co/ 48 KB
14 KB 248ms
48ms Script
application/javascript 2.20.143.57
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://j.6sc.co/6si.min.js

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.20.143.57 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-20-143-57.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

ae3536ecd79c98f87387cee9060be3053e0eb8fe0871e7336554812ef8138772

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 07 Aug 2023 12:42:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 20 Jul 2023 16:27:10 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "64b9605e-bf6f"
vary: Accept-Encoding
content-type: application/javascript
cache-control: private, no-cache, proxy-revalidate
accept-ranges: bytes
content-length: 14190
expires: Mon, 07 Aug 2023 12:42:06 GMT

GET
H2 200 token Show response
cdn.linkedin.oribi.io/partner/976924/domain/reversinglabs.com/ 36 B
376 B 173ms
52ms XHR
application/json 2600:9000:2127:b200:2:53b2:240:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.linkedin.oribi.io/partner/976924/domain/reversinglabs.com/token
Requested by: Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2127:b200:2:53b2:240:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 7b1eaaaf180a13c29b6dddc3b0ae23333b4397e0f3c065b4c86da2f2530a5f89

Request headers

Accept: *
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:01:18 GMT
content-encoding: gzip
via: 1.1 017ac0aeeb057314a9b1c06f8b97ba34.cloudfront.net (CloudFront)
x-amz-cf-pop: PRG50-C1
age: 2448
vary: accept-encoding
x-cache: Hit from cloudfront
content-type: application/json
access-control-allow-origin: *
cache-control: public, max-age=39449
x-amz-cf-id: unabhE32r8PZzvFKtBDExiC76zX6QN8xRl_KcezHbxiYSo6m8GUB6A==

GET
H2

200

collect
px4.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=976924&time=1691412126647&url=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fvmconnect-malicious-pypi-packages-imitate-popular-open-source-modules&t...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=976924&time=1691412126647&url=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fvmconnect-malicious-pypi-packages-imitate-popular-open-source-modules&t...
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D976924%26time%3D1691412126647%26url%3Dhttps%253A%252F%252Fwww.reversinglabs.com%2...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=976924&time=1691412126647&url=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fvmconnect-malicious-pypi-packages-imitate-popular-open-source-modules&t...
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=976924&time=1691412126647&url=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fvmconnect-malicious-pypi-packages-imitate-popular-open-source-modules&...

0
267 B

320ms
214ms

Image
application/javascript

13.107.42.14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=976924&time=1691412126647&url=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fvmconnect-malicious-pypi-packages-imitate-popular-open-source-modules&tm=gtmv2&cookiesTest=true&liSync=true&e_ipv6=AQJqw2EfqqthpgAAAYnQBN9R2MeH0QV0TCWBeDdjOTNqfMxdx_U-gtuizSgsoS10f_ZyEeQ
Requested by: Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
Protocol: H2
Server: 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:42:07 GMT
x-li-pop: afd-prod-lor1-x
x-msedge-ref: Ref A: 54FF38F97A654FFFBCC971456B2A4D2B Ref B: DUS30EDGE0914 Ref C: 2023-08-07T12:42:07Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
content-type: application/javascript
x-li-fabric: prod-lor1
x-li-proto: http/2
content-length: 0
x-li-uuid: AAYCVJMNIvmgp2SiYP17+Q==

Redirect headers

date: Mon, 07 Aug 2023 12:42:06 GMT
x-li-pop: afd-prod-lor1-x
x-msedge-ref: Ref A: 6D04F76FA7C5447EAE799E2A5F77E7E5 Ref B: FRAEDGE1718 Ref C: 2023-08-07T12:42:07Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-lor1
location: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=976924&time=1691412126647&url=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fvmconnect-malicious-pypi-packages-imitate-popular-open-source-modules&tm=gtmv2&cookiesTest=true&liSync=true&e_ipv6=AQJqw2EfqqthpgAAAYnQBN9R2MeH0QV0TCWBeDdjOTNqfMxdx_U-gtuizSgsoS10f_ZyEeQ
x-li-proto: http/2
content-length: 0
x-li-uuid: AAYCVJMIMkCxu503Fwezbg==

GET
H2 200 token Show response
cdn.linkedin.oribi.io/partner/976924/domain/reversinglabs.com/ 36 B
375 B 171ms
52ms XHR
application/json 2600:9000:2127:b200:2:53b2:240:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.linkedin.oribi.io/partner/976924/domain/reversinglabs.com/token
Requested by: Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2127:b200:2:53b2:240:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 7b1eaaaf180a13c29b6dddc3b0ae23333b4397e0f3c065b4c86da2f2530a5f89

Request headers

Accept: *
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:01:18 GMT
content-encoding: gzip
via: 1.1 017ac0aeeb057314a9b1c06f8b97ba34.cloudfront.net (CloudFront)
x-amz-cf-pop: PRG50-C1
age: 2448
vary: accept-encoding
x-cache: Hit from cloudfront
content-type: application/json
access-control-allow-origin: *
cache-control: public, max-age=39449
x-amz-cf-id: hsAZaJ7fctCvKTltSAZ5EyC8dX5ge6rEMclNpa5ki0MPN4-_mJyZuQ==

POST
H2 200 collect Show response
www.google-analytics.com/j/ 15 B
225 B 57ms
54ms XHR
text/plain 2001:4860:4802:36::178
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=2141760045&t=pageview&_s=1&dl=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fvmconnect-malicious-pypi-packages-imitate-popular-open-source-modules&ul=en-us&de=UTF-8&dt=VMConnect%3A%20Malicious%20PyPI%20packages%20imitate%20popular%20open%20source%20modules&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YADAAEABAAAAACAAI~&jid=1727701157&gjid=631016365&cid=282268885.1691412126&tid=UA-32828290-1&_gid=498499907.1691412127&_r=1&_slc=1&gtm=45He3820n81MKL9P8B&z=180549161

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2001:4860:4802:36::178 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

e5808455786f658eccda5e658ffcc1073d757dd9b70ea3c931fa7a36d583abbc

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 07 Aug 2023 12:42:06 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.reversinglabs.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK counters.gif
forms-na1.hsforms.com/embed/v3/ 35 B
1016 B 255ms
151ms Image
image/gif 2606:4700::6811:d6f3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://forms-na1.hsforms.com/embed/v3/counters.gif?key=forms-embed-v2-RENDER_SUCCESS&count=1

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:d6f3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

Date: Mon, 07 Aug 2023 12:42:06 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
X-Content-Type-Options: nosniff
CF-Cache-Status: DYNAMIC
x-evy-trace-route-service-name: envoyset-translator
X-HubSpot-Correlation-Id: 4a880988-b734-4b7b-9549-375aea8e8591
x-envoy-upstream-service-time: 1
Connection: keep-alive
alt-svc: h3=":443"; ma=86400
Content-Length: 35
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 4a880988-b734-4b7b-9549-375aea8e8591
Server: cloudflare
X-Trace: 2B585F53B24B91B95D3F848884676EC4693D036672000000000000000000
Vary: origin
Content-Type: image/gif
x-evy-trace-virtual-host: all
x-evy-trace-served-by-pod: iad02/star-hubspot-td/envoy-proxy-759c64d45c-g2zls
Access-Control-Expose-Headers: X-Origin-Hublet
Cache-Control: max-age=0, no-cache, no-store
Access-Control-Allow-Credentials: false
X-Robots-Tag: none
CF-RAY: 7f2f99009f57bc03-FRA

GET
H3 200 all.js Show response
connect.facebook.net/en_GB/ 303 KB
85 KB 94ms
41ms Script
application/x-javascript 2a03:2880:f083:9:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_GB/all.js?hash=cd35d2383f802bc59f9d809c0e58770c

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_GB/all.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f083:9:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

12c8e4eb0826656e26b370c3d2b26d918a04cb80a6c7a44f610127babdc9ca77

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
Origin: https://www.reversinglabs.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
date: Mon, 07 Aug 2023 12:42:06 GMT
content-md5: 3DqoxuqBhtIBN5hgT7uMPg==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 87049
x-fb-debug: 8o9Gmd+6abdpo1ho90L/VQ9qqinTNbdClI2S/O2y396whs5Giv/Qdxh+xtpPkbLJKUrm3J1Vu++18kPGa6rSZw==
x-fb-content-md5: 26ad65b6f3ade4c043c190083a02b108
cross-origin-opener-policy: same-origin-allow-popups
etag: "0234788dce3479ba38689b20b799d686"
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
origin-agent-cluster: ?0
access-control-expose-headers: X-FB-Content-MD5
cache-control: public,max-age=31536000,stale-while-revalidate=3600,immutable
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), microphone=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=()
timing-allow-origin: *
priority: u=3,i
expires: Tue, 06 Aug 2024 11:16:40 GMT

POST
H2 200 / Show response
www.facebook.com/tr/ Frame 80F6 0
53 B 51ms
37ms Document
text/plain 2a03:2880:f176:84:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/tr/

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f176:84:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Content-Type: application/x-www-form-urlencoded
Origin: https://www.reversinglabs.com
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-origin: https://www.reversinglabs.com
alt-svc: h3=":443"; ma=86400
content-length: 0
content-type: text/plain
cross-origin-resource-policy: cross-origin
date: Mon, 07 Aug 2023 12:42:06 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains

GET
H2 200 widget_iframe.2b2d73daf636805223fb11d48f3e94f7.html Show response
platform.twitter.com/widgets/ Frame D5FB 320 KB
103 KB 40ms
39ms Document
text/html 146.75.116.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/widgets/widget_iframe.2b2d73daf636805223fb11d48f3e94f7.html?origin=https%3A%2F%2Fwww.reversinglabs.com
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 146.75.116.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 4002d65e95f94dc87ae8ad170eb8dbc3644921032ac76dcb376537d9304a6fbf

Request headers

Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-methods: GET
access-control-allow-origin: *
cache-control: public, max-age=315360000
content-encoding: gzip
content-length: 105435
content-type: text/html; charset=utf-8
date: Mon, 07 Aug 2023 12:42:06 GMT
etag: "95e1b50b0c179aefb47b5b211bb347b5+gzip"
last-modified: Tue, 24 Jan 2023 21:41:13 GMT
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
tw-cdn: FT
vary: Accept-Encoding
x-amz-server-side-encryption: AES256
x-cache: HIT, HIT
x-served-by: cache-iad-kcgs7200043-IAD, cache-fra-eddf8230064-FRA

GET
H2 200 json Show response
api.hubapi.com/hs-script-loader-public/v1/config/pixels-and-events/ 115 B
1 KB 353ms
172ms XHR
application/json 2606:4700::6811:c9cc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://api.hubapi.com/hs-script-loader-public/v1/config/pixels-and-events/json?portalId=3375217

Requested by

Host: js.hsadspixel.net
URL: https://js.hsadspixel.net/fb.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:c9cc , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

95fbf2ab9776737534e11c42ed7370e97aa96be93bdda3783a252eab6d9a0e70

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:42:07 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: 45828da8-2aaf-4f41-b08f-280c47a926b2
content-encoding: br
x-envoy-upstream-service-time: 4
alt-svc: h3=":443"; ma=86400
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 45828da8-2aaf-4f41-b08f-280c47a926b2
server: cloudflare
x-trace: 2BF364D9DAE28312D61CC2DF7F59B02E66B3DAF8E9000000000000000000
vary: origin, Accept-Encoding
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
content-type: application/json;charset=utf-8
access-control-allow-origin: https://www.reversinglabs.com
x-evy-trace-served-by-pod: iad02/hubapi-td/envoy-proxy-598c95b5b7-gtcbx
access-control-max-age: 180
access-control-allow-credentials: false
x-evy-trace-virtual-host: all
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RIcZAXaSWKLuEfP4hY9OlDJOFBmJkKQXOHnkqfGbZpPhNZhRS6bLSJkRXNmLa05JQrZm9LeKodHlBFVu%2Fk89jlsTEBEqldUIvDAfYqylMbAne33Z1BEO8vX3Ombj1j%2FWS8JjmLwBRfVXYFAJ"}],"group":"cf-nel","max_age":604800}
cf-ray: 7f2f9901ba284dcd-FRA
access-control-allow-headers: *

GET
H3 200 widget Show response
www.reversinglabs.com/_hcms/livechat/ 338 B
2 KB 201ms
200ms XHR
application/json 2606:2c40::c73c:671f
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reversinglabs.com/_hcms/livechat/widget?portalId=3375217&conversations-embed=static-1.13717&mobile=false&messagesUtk=fa02bc6796e6404f9e78341cc83a4cf3&traceId=fa02bc6796e6404f9e78341cc83a4cf3

Requested by

Host: js.usemessages.com
URL: https://js.usemessages.com/conversations-embed.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

0d8e30adfec247d61be8172549cc16e36bd1eb63859b8e818aa0f9965b4dcaef

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
accept-language: de-DE,de;q=0.9
X-HubSpot-Messages-Uri: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:42:07 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
content-security-policy: upgrade-insecure-requests
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: d930304c-757b-43f9-abef-57aa0108944b
x-envoy-upstream-service-time: 11
x-hs-https-only: worker
alt-svc: h3=":443"; ma=86400
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: d930304c-757b-43f9-abef-57aa0108944b
server: cloudflare
x-trace: 2BAC2D52BB637C775501C1305816AA35099AB9E845000000000000000000
vary: origin, Accept-Encoding
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
content-type: application/json;charset=utf-8
x-evy-trace-served-by-pod: iad02/hubapi-td/envoy-proxy-598c95b5b7-wmk7z
x-evy-trace-virtual-host: all
cache-control: no-cache, no-store, no-transform, must-revalidate, max-age=0
access-control-allow-credentials: false
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=iidnhGmmEeYrEmVx%2FvkpWTosU1kNBcpHnLtMcCJ8xE4qxiXNF9FqqUGa%2F2aOiihoEpGIoKCtZNphSXGUXhhvXwnCUtwOInOE5GzUgqEp%2BkPmiBSJ7isTrno%2BfnPgfWuFnfhx%2BQz0SmxiBM74tSOu9IUt5w%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 7f2f9900caf53a85-FRA
access-control-allow-headers: Accept, Accept-Charset, Accept-Encoding, Accept-Language, Content-Type, Host, Origin, Referer, User-Agent, X-HubSpot-Messages-Uri

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 242 KB
81 KB 49ms
49ms Script
application/javascript 2a00:1450:4001:829::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-6H8MZ60CSB&cx=c&_slc=1

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

0f2c2246f2ec99323efae891bba00b3935c12dcb6abb41f9ff4a309f46497dc8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:42:06 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 83008
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Mon, 07 Aug 2023 12:42:06 GMT

GET
H2 200 json Show response
forms.hscollectedforms.net/collected-forms/v1/config/ 115 B
457 B 166ms
159ms XHR
application/json 2606:4700::6811:6bc7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://forms.hscollectedforms.net/collected-forms/v1/config/json?portalId=3375217&utk=

Requested by

Host: js.hscollectedforms.net
URL: https://js.hscollectedforms.net/collectedforms.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:6bc7 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

fb71e0d749623b7c583b86934740d866e5f6fc000204c6b3cb7dfe25a888cc60

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:42:07 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: d33832b1-8cb2-4f7f-979e-c3851e870e18
x-envoy-upstream-service-time: 2
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: d33832b1-8cb2-4f7f-979e-c3851e870e18
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
content-type: application/json;charset=utf-8
access-control-allow-origin: https://www.reversinglabs.com
x-evy-trace-virtual-host: all
cache-control: max-age=0
x-evy-trace-served-by-pod: iad02/app-td/envoy-proxy-57ff77fcd-nnm64
access-control-max-age: 180
x-robots-tag: none
access-control-allow-headers: *
cf-ray: 7f2f9901094f5bf5-FRA

GET
H2 200 /
www.google.com/pagead/1p-user-list/970567826/ 42 B
455 B 159ms
53ms Image
image/gif 2a00:1450:4001:82f::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/970567826/?random=1691412126347&cv=11&fst=1691409600000&bg=ffffff&guid=ON&async=1&gtm=45je3820&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fvmconnect-malicious-pypi-packages-imitate-popular-open-source-modules&frm=0&tiba=VMConnect%3A%20Malicious%20PyPI%20packages%20imitate%20popular%20open%20source%20modules&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=1462679742&rmt_tld=0&ipr=y

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 07 Aug 2023 12:42:07 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/970567826/ 42 B
154 B 61ms
60ms Image
image/gif 2a00:1450:4001:810::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/970567826/?random=1691412126347&cv=11&fst=1691409600000&bg=ffffff&guid=ON&async=1&gtm=45je3820&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fvmconnect-malicious-pypi-packages-imitate-popular-open-source-modules&frm=0&tiba=VMConnect%3A%20Malicious%20PyPI%20packages%20imitate%20popular%20open%20source%20modules&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=1462679742&rmt_tld=1&ipr=y

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 07 Aug 2023 12:42:06 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 settings Show response
syndication.twitter.com/ Frame D5FB 869 B
659 B 236ms
149ms Fetch
application/json 104.244.42.200
TWITTER

General

Check archive.org

Show headers Download Go to

Full URL

https://syndication.twitter.com/settings?session_id=359b2ad778efc06d13e5be5c8b50bb432ba86557

Requested by

Host: platform.twitter.com
URL: https://platform.twitter.com/widgets/widget_iframe.2b2d73daf636805223fb11d48f3e94f7.html?origin=https%3A%2F%2Fwww.reversinglabs.com

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.200 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

302da628a6afc3e93f1b86bf7c65e4d6536d8283d78266964822a76d1c645aa4

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://platform.twitter.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

x-response-time: 110
date: Mon, 07 Aug 2023 12:42:06 GMT
content-encoding: gzip
strict-transport-security: max-age=631138519
last-modified: Mon, 07 Aug 2023 12:42:07 GMT
server: tsa_o
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://platform.twitter.com
x-transaction-id: 8551636749e34854
cache-control: must-revalidate, max-age=600
access-control-allow-credentials: true
perf: 7626143928
x-connection-hash: 853f731921c0f112768674704e92a465916fd0533b31b9828eca4b407b98fb27
content-length: 337

GET
H2 200 / Show response
c.6sc.co/ 7 B
197 B 52ms
44ms XHR
text/html 2.20.143.57
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://c.6sc.co/
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.20.143.57 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a2-20-143-57.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:42:06 GMT
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: text/html
access-control-allow-origin: https://www.reversinglabs.com
access-control-allow-credentials: true
access-control-allow-headers: *
content-length: 7

GET
H2 200 / Show response
ipv6.6sc.co/ 19 B
310 B 181ms
42ms XHR
text/html 2a02:26f0:ab00::214:8e70
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://ipv6.6sc.co/
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:ab00::214:8e70 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: d5792801335f11b32a948d51b64bb655b16f8767f5837f2be4c406715994752f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 07 Aug 2023 12:42:07 GMT
vary: Origin
content-type: text/html
access-control-allow-origin: https://www.reversinglabs.com
cache-control: max-age=0, no-cache, no-store
6si-ipv6: 2a01:4a0:1338:92::7
server-timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1691412126996_34901612_213465043_19_825_38_0_219";dur=1
content-length: 19
expires: Mon, 07 Aug 2023 12:42:07 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
485 B 238ms
226ms Image
image/gif 2.20.143.57
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=125cf4892bae30e8b53458235ef53f8d&svisitor=null&visitor=b427d916-5c4b-43ca-8822-a2585adeb9d7&session=cba49a15-aa6c-4e5c-82dc-75d01b8c33eb&event=a_pageload&q=%7B%22pageLoadTime%22%3A%22Mon%2C%2007%20Aug%202023%2012%3A42%3A06%20GMT%22%2C%22settings%22%3A%22%5B%7B%5C%22name%5C%22%3A%5C%22enableEventTracking%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Mon%2C%2007%20Aug%202023%2012%3A42%3A06%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setToken%5C%22%2C%5C%22value%5C%22%3A%5C%22125cf4892bae30e8b53458235ef53f8d%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Mon%2C%2007%20Aug%202023%2012%3A42%3A06%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setEndpoint%5C%22%2C%5C%22value%5C%22%3A%5C%22b.6sc.co%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Mon%2C%2007%20Aug%202023%2012%3A42%3A06%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%5D%22%7D&isIframe=false&m=%7B%22description%22%3A%22ReversingLabs%20threat%20researchers%20have%20identified%20a%20new%20malicious%20PyPI%20campaign%20that%20includes%20a%20suspicious%20VMConnect%20package%20published%20to%20the%20PyPI%20repo.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22VMConnect%3A%20Malicious%20PyPI%20packages%20imitate%20popular%20open%20source%20modules%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fvmconnect-malicious-pypi-packages-imitate-popular-open-source-modules&pageViewId=af35e293-ad79-40ab-8e86-530584adea64&v=1.1.5

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.20.143.57 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-20-143-57.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:42:07 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Sat, 05 Jun 2021 07:56:05 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "60bb2e15-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H3 200 counters.gif
forms.hsforms.com/embed/v3/ 35 B
625 B 216ms
165ms Image
image/gif 2606:4700::6811:d2f3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://forms.hsforms.com/embed/v3/counters.gif?key=collected-forms-embed-js-form-bind&count=2

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6811:d2f3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:42:07 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: b2750d05-62ca-47dd-904d-cd81fbdc4b64
x-envoy-upstream-service-time: 2
alt-svc: h3=":443"; ma=86400
content-length: 35
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: b2750d05-62ca-47dd-904d-cd81fbdc4b64
server: cloudflare
x-trace: 2B441A11D9479AA7760A0CA6ADA5AA553BAD56937C000000000000000000
vary: origin
content-type: image/gif
x-evy-trace-virtual-host: all
x-evy-trace-served-by-pod: iad02/star-hubspot-td/envoy-proxy-759c64d45c-llkhw
access-control-expose-headers: X-Origin-Hublet
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: false
x-robots-tag: none
cf-ray: 7f2f9902797337f2-FRA

POST
H2 204 collect
region1.google-analytics.com/g/ 0
54 B 54ms
50ms Ping
text/plain 2001:4860:4802:34::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-6H8MZ60CSB&gtm=45je3820&_p=2141760045&ul=en-us&sr=1600x1200&cid=282268885.1691412126&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_eu=ABAI&_s=1&dl=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fvmconnect-malicious-pypi-packages-imitate-popular-open-source-modules&dt=VMConnect%3A%20Malicious%20PyPI%20packages%20imitate%20popular%20open%20source%20modules&sid=1691412127&sct=1&seg=0&en=page_view&_fv=1&_ss=1&_ee=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-6H8MZ60CSB&cx=c&_slc=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 07 Aug 2023 12:42:07 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.reversinglabs.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
484 B 234ms
234ms Image
image/gif 2.20.143.57
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=125cf4892bae30e8b53458235ef53f8d&svisitor=null&visitor=b427d916-5c4b-43ca-8822-a2585adeb9d7&session=cba49a15-aa6c-4e5c-82dc-75d01b8c33eb&event=ipv6&q=%7B%22address%22%3A%222a01%3A4a0%3A1338%3A92%3A%3A7%22%7D&isIframe=false&m=%7B%22description%22%3A%22ReversingLabs%20threat%20researchers%20have%20identified%20a%20new%20malicious%20PyPI%20campaign%20that%20includes%20a%20suspicious%20VMConnect%20package%20published%20to%20the%20PyPI%20repo.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22VMConnect%3A%20Malicious%20PyPI%20packages%20imitate%20popular%20open%20source%20modules%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fvmconnect-malicious-pypi-packages-imitate-popular-open-source-modules&pageViewId=af35e293-ad79-40ab-8e86-530584adea64&v=1.1.5

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.20.143.57 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-20-143-57.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:42:07 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Sat, 18 Feb 2023 00:49:36 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "63f020a0-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 279 KB
94 KB 49ms
49ms Script
application/javascript 2a00:1450:4001:829::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-970567826

Requested by

Host: js.hsadspixel.net
URL: https://js.hsadspixel.net/fb.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

2fa7c14f2d2b18cda960810bb87b4e28b6830663b86c45a51c9bf23bdb7d259d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:42:07 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 95894
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Mon, 07 Aug 2023 12:42:07 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
485 B 242ms
241ms Image
image/gif 2.20.143.57
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.20.143.57 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-20-143-57.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:42:08 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Sat, 18 Feb 2023 02:04:22 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "63f03226-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H2 200 up Show response
insight.adsrvr.org/track/ Frame 153E 0
182 B 175ms
56ms Document
text/html 3.33.220.150
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://insight.adsrvr.org/track/up?adv=7qhctws&ref=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fvmconnect-malicious-pypi-packages-imitate-popular-open-source-modules&upid=8t4axvj&upv=1.1.0
Requested by: Host: js.adsrvr.org
URL: https://js.adsrvr.org/up_loader.1.1.0.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.33.220.150 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: private,no-cache, must-revalidate
content-type: text/html
date: Mon, 07 Aug 2023 12:42:08 GMT
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
pragma: no-cache
x-aspnet-version: 4.0.30319

GET
H2 200 __ptq.gif
track.hubspot.com/ 45 B
394 B 250ms
249ms Image
image/gif 2606:4700::6813:9b53
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://track.hubspot.com/__ptq.gif?k=1&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=2246696628&v=1.1&a=3375217&pi=128190968732&ct=blog-post&ccu=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fvmconnect-malicious-pypi-packages-imitate-popular-open-source-modules&cpi=128190968732&cgi=5901382633&lpi=128190968732&lvi=128190968732&lvc=en&pu=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fvmconnect-malicious-pypi-packages-imitate-popular-open-source-modules&t=VMConnect%3A+Malicious+PyPI+packages+imitate+popular+open+source+modules&cts=1691412128172&vi=6842e52b3211e4a1272a14ffb033d7a3&nc=true&u=60854195.6842e52b3211e4a1272a14ffb033d7a3.1691412128169.1691412128169.1691412128169.1&b=60854195.1.1691412128169&cc=15

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6813:9b53 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:42:08 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: 63e68ed8-ec17-4158-ae25-461260dcd57b
p3p: CP="NOI CUR ADM OUR NOR STA NID"
x-envoy-upstream-service-time: 7
alt-svc: h3=":443"; ma=86400
content-length: 45
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 63e68ed8-ec17-4158-ae25-461260dcd57b
server: cloudflare
vary: origin, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=GdSLNlJZMGJ9ETXz%2FSfZeZNbtFhxaxWg53ZFM0F96pYgG8pXwTsrFILm1WdwbYyPlp85fzM2adVxjdPqo448K7Bp4M1T5lJ5Sof%2Fy07xQ%2F0scBTpUur5o6Q4cwOHk70la5mqgm0FAJoLcg1XLWtN"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
x-evy-trace-served-by-pod: iad02/analytics-tracking-td/envoy-proxy-5f6448c676-j9299
x-evy-trace-virtual-host: all
cache-control: no-cache, no-store, no-transform
access-control-allow-credentials: false
cf-ray: 7f2f99093d52046e-FRA
x-robots-tag: none

GET
H2 200 __ptq.gif
track.hubspot.com/ 45 B
436 B 176ms
176ms Image
image/gif 2606:4700::6813:9b53
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://track.hubspot.com/__ptq.gif?k=15&fi=24abef2a-a2f4-4889-8899-dd4026584fa9&fci=32c383cc-5360-4461-9eeb-f4fc3da52730&ft=0&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=2246696628&v=1.1&a=3375217&pi=128190968732&ct=blog-post&ccu=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fvmconnect-malicious-pypi-packages-imitate-popular-open-source-modules&cpi=128190968732&cgi=5901382633&lpi=128190968732&lvi=128190968732&lvc=en&pu=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fvmconnect-malicious-pypi-packages-imitate-popular-open-source-modules&t=VMConnect%3A+Malicious+PyPI+packages+imitate+popular+open+source+modules&cts=1691412128173&vi=6842e52b3211e4a1272a14ffb033d7a3&nc=true&u=60854195.6842e52b3211e4a1272a14ffb033d7a3.1691412128169.1691412128169.1691412128169.1&b=60854195.1.1691412128169&cc=15

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6813:9b53 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:42:08 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: 16ca615e-19ec-45dd-8dd9-770ccf894232
p3p: CP="NOI CUR ADM OUR NOR STA NID"
x-envoy-upstream-service-time: 9
alt-svc: h3=":443"; ma=86400
content-length: 45
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 16ca615e-19ec-45dd-8dd9-770ccf894232
server: cloudflare
vary: origin, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=pPbd64ykaRSo4rGmOXJ4dOzYhFuZPfIg4xemXyLeO1CgxUMucO%2BjUkIXCsVqlmWnAFQZiQcDIA0SJQICmcjc5%2FxBG4qdn5oZidEForTI41SknNjUwKF5pFuu8xgmSdraUSGaHx%2BS8IB2F1IQPZwQ"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
x-evy-trace-served-by-pod: iad02/analytics-tracking-td/envoy-proxy-5f6448c676-z7z79
x-evy-trace-virtual-host: all
cache-control: no-cache, no-store, no-transform
access-control-allow-credentials: false
cf-ray: 7f2f99094d5e046e-FRA
x-robots-tag: none

GET
H2 200 __ptq.gif
track.hubspot.com/ 45 B
617 B 175ms
174ms Image
image/gif 2606:4700::6813:9b53
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://track.hubspot.com/__ptq.gif?k=17&fi=24abef2a-a2f4-4889-8899-dd4026584fa9&fci=32c383cc-5360-4461-9eeb-f4fc3da52730&ft=0&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=2246696628&v=1.1&a=3375217&pi=128190968732&ct=blog-post&ccu=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fvmconnect-malicious-pypi-packages-imitate-popular-open-source-modules&cpi=128190968732&cgi=5901382633&lpi=128190968732&lvi=128190968732&lvc=en&pu=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fvmconnect-malicious-pypi-packages-imitate-popular-open-source-modules&t=VMConnect%3A+Malicious+PyPI+packages+imitate+popular+open+source+modules&cts=1691412128174&vi=6842e52b3211e4a1272a14ffb033d7a3&nc=true&u=60854195.6842e52b3211e4a1272a14ffb033d7a3.1691412128169.1691412128169.1691412128169.1&b=60854195.1.1691412128169&cc=15

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6813:9b53 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:42:08 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: 5d691d7f-c7ee-47b9-b0ad-db179b30e5cd
p3p: CP="NOI CUR ADM OUR NOR STA NID"
x-envoy-upstream-service-time: 9
alt-svc: h3=":443"; ma=86400
content-length: 45
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 5d691d7f-c7ee-47b9-b0ad-db179b30e5cd
server: cloudflare
vary: origin, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FX5ukuBHh%2FX2NM6VNjpLDewu8DyJAdfdvYGB%2FNX4aYcsbZBj%2BX3SZh62%2B2reXqoqQicJ4MTTAfrv3U9wRzNXxqgJLjkFUFGP%2BuJgWcEFXRPmIktCf28iCggDJMM0fiSlabXivwsDSwbVzJFOBuVL"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
x-evy-trace-served-by-pod: iad02/analytics-tracking-td/envoy-proxy-5f6448c676-j9299
x-evy-trace-virtual-host: all
cache-control: no-cache, no-store, no-transform
access-control-allow-credentials: false
cf-ray: 7f2f99094d62046e-FRA
x-robots-tag: none

GET
H2 200 json Show response
forms.hubspot.com/lead-flows-config/v1/config/ 178 B
1 KB 255ms
172ms XHR
application/json 2606:4700::6813:9a53
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://forms.hubspot.com/lead-flows-config/v1/config/json?portalId=3375217&utk=6842e52b3211e4a1272a14ffb033d7a3&__hstc=60854195.6842e52b3211e4a1272a14ffb033d7a3.1691412128169.1691412128169.1691412128169.1&__hssc=60854195.1.1691412128169&contentId=128190968732&currentUrl=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fvmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Requested by

Host: js.hsleadflows.net
URL: https://js.hsleadflows.net/leadflows.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6813:9a53 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

fe27c4285a354bd54bae7a730c2c581405509b81a7e05bab70e4b19f5bfc4912

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:42:08 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: e825308d-e07f-4383-b5e9-3e771db0b6b3
content-encoding: br
x-envoy-upstream-service-time: 22
alt-svc: h3=":443"; ma=86400
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: e825308d-e07f-4383-b5e9-3e771db0b6b3
server: cloudflare
vary: origin
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
content-type: application/json;charset=utf-8
access-control-allow-origin: https://www.reversinglabs.com
x-evy-trace-virtual-host: all
access-control-max-age: 180
access-control-allow-credentials: false
cache-control: max-age=0, no-cache, no-store
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=l2pAXzaPrqPv0frpv4GR60%2BqjB8GAvK4sScAws2Fa5Nm0PpUdzmccN%2FLuABSyLhn9izbALGu6N0nlZ%2BSF4TKmXyx6mB3RwXsxLC%2BDSa5zb%2F0GowSK3MmIbJv0JNj%2FkfnVO774feOO%2Bpyt5uCsEH%2B"}],"group":"cf-nel","max_age":604800}
x-robots-tag: none
access-control-allow-headers: Accept, Accept-Charset, Accept-Encoding, Accept-Language, Content-Type, Host, Origin, Referer, User-Agent
cf-ray: 7f2f990a2d1a1c9f-FRA
x-evy-trace-served-by-pod: iad02/star-hubspot-td/envoy-proxy-759c64d45c-jn5ls

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
484 B 240ms
240ms Image
image/gif 2.20.143.57
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.20.143.57 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-20-143-57.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:42:09 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Fri, 21 Feb 2020 18:57:20 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "5e502810-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
484 B 242ms
241ms Image
image/gif 2.20.143.57
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.20.143.57 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-20-143-57.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:42:10 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Tue, 05 Oct 2021 22:17:52 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "615ccf10-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
485 B 235ms
234ms Image
image/gif 2.20.143.57
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.20.143.57 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-20-143-57.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:42:11 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Sat, 05 Jun 2021 07:56:05 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "60bb2e15-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
485 B 234ms
233ms Image
image/gif 2.20.143.57
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.20.143.57 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-20-143-57.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:42:12 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Sat, 05 Jun 2021 07:56:05 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "60bb2e15-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
484 B 246ms
246ms Image
image/gif 2.20.143.57
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.20.143.57 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-20-143-57.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:42:13 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Tue, 05 Oct 2021 22:17:52 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "615ccf10-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

Verdicts & Comments Add Verdict or Comment

116 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

35 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.www.reversinglabs.com/	1970-01-20 13:50:13	Name: __cf_bm Value: uQDUh_.kgVob7IWg.SeGsfsSMjMn8IgEABf8DyoIPsw-1691412124-0-AVDc6OWR8ApXnfdPHVPSIJMbLsFM5be/FFtxS52Gdc+7e/kmWVLQWbAh+Jx//5gt+hd+hwoAG2N8tGQQMdJ69/Q=
.www.reversinglabs.com/	1969-12-31 23:59:59	Name: __cfruid Value: 85b49460cf4faaee0396b58839be857fb6ce2c5b-1691412124
.linkedin.com/	1970-01-20 13:51:38	Name: lidc Value: "b=OGST05:s=O:r=O:a=O:p=O:g=2805:u=1:x=1:i=1691412124:t=1691498524:v=2:sig=AQFQ5k4wZkfC9deZTpBW35tA6xBRTr4N"
.reversinglabs.com/	1970-01-20 15:59:48	Name: _gcl_au Value: 1.1.1098008830.1691412126
.reversinglabs.com/	1970-01-20 15:59:48	Name: _fbp Value: fb.1.1691412126069.842737840
.reversinglabs.com/	1970-01-20 22:35:48	Name: _hjSessionUser_3176008 Value: eyJpZCI6Ijk0MDhkNzcxLTQ2ZTMtNTU3OS05MDcwLWUxZTVjYzU0ZWMzNSIsImNyZWF0ZWQiOjE2OTE0MTIxMjYxMjcsImV4aXN0aW5nIjpmYWxzZX0=
.reversinglabs.com/	1970-01-20 13:50:13	Name: _hjFirstSeen Value: 1
.reversinglabs.com/	1970-01-20 13:50:12	Name: _hjIncludedInSessionSample_3176008 Value: 0
.reversinglabs.com/	1970-01-20 13:50:13	Name: _hjSession_3176008 Value: eyJpZCI6Ijg3NzNmOWI1LWZmM2MtNGRjZC1iZjVlLWRhZDhjZTc5YTc1ZSIsImNyZWF0ZWQiOjE2OTE0MTIxMjYyODAsImluU2FtcGxlIjpmYWxzZX0=
.reversinglabs.com/	1970-01-20 13:50:13	Name: _hjAbsoluteSessionInProgress Value: 0
.reversinglabs.com/	1970-01-20 23:26:12	Name: _ga_JVM9Z1XQPL Value: GS1.1.1691412126.1.0.1691412126.60.0.0
.reversinglabs.com/	1970-01-20 15:59:48	Name: _rdt_uuid Value: 1691412126494.1891b037-5f7b-4b9a-b70b-65c392d4a7c2
.ws.zoominfo.com/	1970-01-20 22:35:48	Name: visitorId Value: 1df51b64b35b68671c9a690ba2c928fb9e837415a6ae00e94c6feeaf2711b573
.zoominfo.com/	1970-01-20 13:50:13	Name: __cf_bm Value: OYadyj1hHdjz1qCDqt6wxI8OBDr0.R6Uqp110kI4FP0-1691412126-0-AWVr7h+jGwv0sGlTtTf3bfFow9g9jrvDrl3YVeEelBbZhlAe5Tk83JFw1s0DYFAIuVAKxKvVfJN9V1Gx+CJpUT0=
.zoominfo.com/	1969-12-31 23:59:59	Name: _cfuvid Value: DmQM6Z48O0BFplYeCDkwBjXhgMi6f5WEcHa.9OY5D0c-1691412126478-0-604800000
.hubspot.com/	1970-01-20 13:50:13	Name: __cf_bm Value: 9q0dSGsp5XwuJpCV9SsSOErqPbxSI9Q36Wdw49Fu.vA-1691412126-0-ATQBSfcV6jLhM6ua5sP6V5VoDY0O7JIq4zp1DBpGTW3lYnFJeNCRoQ4HDvz7+u+NDbbWmxa/KC9A56mpk6kR2Zw=
.doubleclick.net/	1970-01-20 13:50:13	Name: test_cookie Value: CheckForPermission
.reversinglabs.com/	1970-01-20 23:26:12	Name: _ga Value: GA1.2.282268885.1691412126
.reversinglabs.com/	1970-01-20 13:51:38	Name: _gid Value: GA1.2.498499907.1691412127
.reversinglabs.com/	1970-01-20 13:50:12	Name: _gat_UA-32828290-1 Value: 1
www.reversinglabs.com/	1970-01-20 13:51:38	Name: ln_or Value: eyI5NzY5MjQiOiJkIn0%3D
www.reversinglabs.com/	1970-01-20 23:26:12	Name: _gd_visitor Value: b427d916-5c4b-43ca-8822-a2585adeb9d7
www.reversinglabs.com/	1970-01-20 13:50:26	Name: _gd_session Value: cba49a15-aa6c-4e5c-82dc-75d01b8c33eb
.linkedin.com/	1970-01-20 15:59:48	Name: li_sugr Value: 1e56eb30-d635-4150-a771-b27199878779
.linkedin.com/	1970-01-20 22:35:48	Name: bcookie Value: "v=2&4ccacec9-03e7-432f-821d-69fcfd4ff878"
.reversinglabs.com/	1970-01-20 23:26:12	Name: _ga_6H8MZ60CSB Value: GS1.2.1691412127.1.0.1691412127.0.0.0
.6sc.co/	1970-01-20 23:26:12	Name: 6suuid Value: 358f1402eeb201009fe6d0648c00000033241f00
.linkedin.com/	1970-01-20 14:33:24	Name: UserMatchHistory Value: AQLjAJDMDil_KgAAAYnQBN2WQwvqzxj6PIRE_LKns0TX3eElwHizsNIg7NEfsaZHebyDKoUhsUM20A
.linkedin.com/	1970-01-20 14:33:24	Name: AnalyticsSyncHistory Value: AQJ4-oHS-2JVeQAAAYnQBN2WmlOqoS1dADZpeB3TnBPOKWK3iSFB10QNx8Qff9tq0I08bmpJyy28S1dEeAGsVw
.www.linkedin.com/	1970-01-20 22:35:48	Name: bscookie Value: "v=1&20230807124207d41709e5-a99f-496f-816e-734e199da222AQH6ubFdgQOf41xoTLnmvyyCQgtmGfqp"
.linkedin.com/	1970-01-20 18:09:24	Name: li_gc Value: MTswOzE2OTE0MTIxMjc7MjswMjEaQ4zpceS2o2exEhh5YANgByz4eZNjQVtU7xExrGwZvw==
.reversinglabs.com/	1970-01-20 18:09:24	Name: __hstc Value: 60854195.6842e52b3211e4a1272a14ffb033d7a3.1691412128169.1691412128169.1691412128169.1
.reversinglabs.com/	1970-01-20 18:09:24	Name: hubspotutk Value: 6842e52b3211e4a1272a14ffb033d7a3
.reversinglabs.com/	1969-12-31 23:59:59	Name: __hssrc Value: 1
.reversinglabs.com/	1970-01-20 13:50:13	Name: __hssc Value: 60854195.1.1691412128169

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

3375217.fs1.hubspotusercontent-na1.net
alb.reddit.com
api.hubapi.com
app.hubspot.com
b.6sc.co
c.6sc.co
cdn.linkedin.oribi.io
cdn.metadata.io
cdn2.hubspot.net
cdnjs.cloudflare.com
connect.facebook.net
cookieinfoscript.com
fonts.googleapis.com
fonts.gstatic.com
forms-na1.hsforms.com
forms.hscollectedforms.net
forms.hsforms.com
forms.hubspot.com
googleads.g.doubleclick.net
insight.adsrvr.org
ipv6.6sc.co
j.6sc.co
js.adsrvr.org
js.hs-analytics.net
js.hs-banner.com
js.hsadspixel.net
js.hscollectedforms.net
js.hsleadflows.net
js.usemessages.com
platform.linkedin.com
platform.twitter.com
play.vidyard.com
px.ads.linkedin.com
px4.ads.linkedin.com
q.quora.com
region1.analytics.google.com
region1.google-analytics.com
script.hotjar.com
snap.licdn.com
static.hotjar.com
static.hsappstatic.net
stats.g.doubleclick.net
syndication.twitter.com
track.hubspot.com
ws.zoominfo.com
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googletagmanager.com
www.linkedin.com
www.redditstatic.com
www.reversinglabs.com
104.244.42.200
13.107.42.14
146.75.116.157
151.101.1.140
151.101.1.181
2.20.143.57
2001:4860:4802:34::36
2001:4860:4802:36::178
2600:9000:2127:9800:9:d7d4:1380:93a1
2600:9000:2127:b200:2:53b2:240:93a1
2606:2c40::c73c:671f
2606:4700::6810:650c
2606:4700::6810:75be
2606:4700::6810:8ace
2606:4700::6811:190e
2606:4700::6811:64ac
2606:4700::6811:6bc7
2606:4700::6811:836e
2606:4700::6811:c9cc
2606:4700::6811:d2f3
2606:4700::6811:d6f3
2606:4700::6812:18c4
2606:4700::6812:8e65
2606:4700::6812:cfc9
2606:4700::6812:e0f
2606:4700::6813:9a53
2606:4700::6813:9b53
2620:1ec:21::14
2620:1ec:46::45
2a00:1450:4001:806::2002
2a00:1450:4001:80e::200a
2a00:1450:4001:810::2003
2a00:1450:4001:829::2003
2a00:1450:4001:829::2008
2a00:1450:4001:82f::2004
2a00:1450:400c:c0b::9a
2a02:26f0:780::210:a423
2a02:26f0:ab00::214:8e70
2a03:2880:f083:9:face:b00c:0:3
2a03:2880:f176:84:face:b00c:0:25de
2a04:4e42:400::396
2a06:98c1:3121::3
3.33.220.150
52.207.107.232
52.222.139.19
65.9.95.27
65.9.99.119
0135a1b91a6cbf07bf1a74fba4b90ad8c06421df9f3577701a093b6a6fc9ff9a
04245f85425b7978fbfd092971444a755772b93d9fb41f4c58f388e520403afd
09d01a00c23781420e6623249a514a995ea7dd8417159f308ca5391078243928
0ab31a97c236988bb6e415187b2197cdbf689664173015dffd6da8eb96b1626f
0d8e30adfec247d61be8172549cc16e36bd1eb63859b8e818aa0f9965b4dcaef
0f2c2246f2ec99323efae891bba00b3935c12dcb6abb41f9ff4a309f46497dc8
0f631dc190b0572010591fe489a4d434db77ce0ff6156e9e7e9aa745156c095c
12c8e4eb0826656e26b370c3d2b26d918a04cb80a6c7a44f610127babdc9ca77
130eb7bbe1dca232b6636767637e6bdc2a35fc2d412db3a601593d79c1d743a5
199a07091795dc18d5f648c8ae6ea323b953a6232f814e35c0217925de105a94
1a5131ba88c40e02e211f48163838569b854a383f19817b94db2f4e83f5d044d
1a5f6ffeb8930092b29aef8860e2c8ebbe25dd2dcdf70ab4b6b137c4b4592f70
1a949852daa2fe2be0d5e7dfbf2d0edf71121b49a82b1d82992aa8aa9b7c2d9b
1d4548c03b28521204ab490e46b39179b8fa196998d45215a24602306b662ab5
1e1dd2ba3301366a9c3415c59880459342966cc23845e6d980c1605aeda5d3a9
249d08c8fde3e1912f9d6d25ff14eed26f4adea29df815b794933eb133f8ec37
257855f4e23a1e3d382077b15bfc30971c9c261fc23512c88abfdcda05f28bc4
262c51d03e4bdb5c91511e2df131b608a522b7a96c6a89048ceb90084b3402dc
27215dede1579d37bcf4ab9ef8fc7d968bd02081c4e61d77837a9bb8f6ca9511
29d170b4f372603eff8bafec8eedd2dc57712f5e38b276f31c4a5295eeeb9de3
2e0e46665e34d5b09152a1ab9be9e89802f26f40b6e1a29780bf07ae94bc2376
2e5436b217fb1a7d9d2365cccfcc95e7483fcba03205c3a216d512302e982d4d
2fa7c14f2d2b18cda960810bb87b4e28b6830663b86c45a51c9bf23bdb7d259d
302da628a6afc3e93f1b86bf7c65e4d6536d8283d78266964822a76d1c645aa4
350dfd290fcaf704accd61883b7d6dd6e2fcb8d6f10c747ba96707c20bddc000
373f4f92cf1385f8c016b6fd61929484fdcc6a45bbd33250bfe6ecde5bd6543f
37eae8190baecf55f16575bf754238976116ad37b55f81e27db05743461cd507
392c9fa9cd1273a2a89d1a83a69cd1f63f21d1d55e7be21e1d8f51f25145668b
3ac9f879f23b53c0856f5a719a5d2913f2890b5e06b60a8879945c245080fc52
3c50dd5c1727efe22037460b8eaa121b22932d39ab13865d1ecf5b8372d2da4d
3dcf5ab0268e05f2e26960055d40e37a5ec0cb225dcc9da43f52967710cea56b
4002d65e95f94dc87ae8ad170eb8dbc3644921032ac76dcb376537d9304a6fbf
412210341224fc44fcc8940c5f08af574d564091059a809c0fd0cebba9251dae
415f1b24f09d34ace4333cdd8a1a2ed4c0f74db2f4f6c76967f1a5555e87d0cc
48caefba7197eca695349c196a4fb51a5998c8f3bd365988462d71e3c65a4b1d
4bc7148ba69c82eccc86c4a9b90d4cf456d9129c9503ad143c8005735f3fb8ba
4c6f3ea309c0a9fcb0170f32ff38053635117a2c08890ca0b0478278ce24ec02
4ed697a94ae987ec690170223f411112068b61caf8678788cb4c37347249fd00
4fe6def01e693b4ff7f8a5baa5663c2b2eb7a228d7eb28ca379d255b640df211
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
57fd9a32cc09b40cc00fd9878fd6149c750c903cbc604237b9f625bfb5895fc5
589ec6096d83ed322d2e1cf7b85f978ecfe80dc19aab6ac106ef5e2352e32269
61ce08dbad99d88826d7e7d374b628662137c7893a943d6a541cf4b0455c5067
68858bf90cb3efb40b74dc096a0c14d3d7d8df522e30067cbee82f0640af2bab
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
6ba44383bc980179d0772e2785fdb088c71034b7c54607e739bc56c0e1002250
6e4d408ece6803ecb0c2356f7c16a9e1acdbf01228830ac38274ec1ada687e36
70d1119d232eb54079a766d9e1564320f2c20e6e71683e31edf766c26e9c678e
716dcc9643502eb35aa1f08b4805ec1f377daad3e67c11f9d00d65c6fc6336cf
7426c1c0d2289ccde69718bb10ae44a1a6602702194410999afb700e1e580d94
77b1e37a44606f04534b026795250cfb8f06416adbe129533a6d855e9b573f67
7b1eaaaf180a13c29b6dddc3b0ae23333b4397e0f3c065b4c86da2f2530a5f89
7b1ecc91aa14b48acb2f7655cc2f4285d7839ab8d239982d4473b02917cd55db
7d6d019be5fdd6ed212ab83345278024e52cb55e59e5a577644a58f1c29ae316
84240275eed2746f9d66bb0a5f46915d74ba6a7c6e210ba4634a16e03ca54270
867e2af897e43a15b5cb0cbf905ba563964426f8707d602891643fe039aa2566
86bc7c25a3bf03fad86ce1733e1a562b1395d60635b29960b7b3f68aefa8bc7a
899663bfeab6b11842c974c2417dc0ad88bd79bb7510b1e032384ccf2618dcc1
8ae4a0865523070959595a6df44d592fd924f6a8503d913a2cbfb81b5df45e62
8da927b6b1240ffca4323fbb2a12c8e5abb541040965c2bc5b7d09a2eb963b02
8dc97419c862f91c4279fb9e2d9a0b7b9b63982ae1d3700a351ea1950c46f564
9103cd19fa0db417520474c8682d15529708804e7d5dcee981c8a19a7c083875
94e9a5e460eda83b3532d27cbb92a176ac95f1429ae89f9164d47a29d3370ee2
95fbf2ab9776737534e11c42ed7370e97aa96be93bdda3783a252eab6d9a0e70
96012ea1e665f4555d84592c02ed5ee2ae06ae12e7869c7878a9fb15cf2bd729
96ea6b1e986879257e104371bf5f0cb0bf2bb9957a1aa73fa9df8be99aeeb157
9a612c9ad7bdfdfeb71ed257ea676a5bca9db5694ee8a0f0c1f8a96330429ea3
9b78354357bc04de9fa52562968bad64ef1311b665cc6ea927d2ec08bcc82cd8
9e634b615e771259a6dc723ef2cda097c480ad26dc92faa6450c5e4e16e3288a
a9ff889aa2badd5dcf9989574fa2006fb183febc1685353d19bf1dd28ed7c1b2
abe603cadd5d178715e8d259697dd4470bf63c6ad1115eb0af8715c778640133
ae3536ecd79c98f87387cee9060be3053e0eb8fe0871e7336554812ef8138772
b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e
b452e67d0f273f9147920b2ec0783838b1ee33727eb9c6fae0a7cff22bf0ac85
b99e57a180459ef9973b9bb3f41ce4a28c015ac31ec686c087bf21f42d366608
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96
bb8007225d94a099cddbade7ea904667c0dd0b68d5e30778e5c6257589ab94d1
bc595999f7c46e3f7a293c86fcc256c35467e9947bf0051464628416f1db14f0
be806513bf84af0e310b27e6d4c7eaa56119e06690c7b0bc50d728b7e82b3c9f
c44bc92eb78d7b1596789095812e8c24f5c3f9b4835318cf329204d1efc37abb
c7d36be0a73651297b0f6b15b1aa2e63a204489bb9c552c11e0cf7db771081d4
c889e86e6c42fc475d139233bc09a8fe599673cfeebe015bd3083cd1ea994e93
c9b277f813652ab4fc3476fe4b9771d2d29e10204caef39416ad8d30e45fc5a2
cafcf576874435cca6e41394ae820ab1573b83f8b405d10d3ff8add93614c8fe
cc3652de6720e88bb9378b09d34a2e807d1706b7a59a2d29903a68fa481759d5
ce0ff3ad5c4fb7d0479d29b749b17455767345431cc73dd776b08b79f52acbbe
cebbc0e23f1d58a574eab9a677d14629b3aa59a6fbfb0133feb3e03f0e43f754
d09af97ee06f58b7c0e071433e4f08dcfc244e3786639a601e31d3227418473a
d0f80d27eb235c529b6f87057ab7763ab82f8eb2396e8d40df573eb80e5364ec
d5792801335f11b32a948d51b64bb655b16f8767f5837f2be4c406715994752f
d57a29c035e1164e865f08b030edaa603ee2a60d806138df4c2975eac83cb08f
d58fcc9b037c7817d2d7565a677f19616b2ca13d2575df0a2c82f4ad60b0ec87
d6dc97993d7e4803aeb35d0e9a24f0393eceb43de5f7ff0f0e437f1b05aea4e2
d8f9afbf492e4c139e9d2bcb9ba6ef7c14921eb509fb703bc7a3f911b774eff8
dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
ddb82c84e1cb4f9ed0e23ada938029f0ac7a79f8a8215eee7bd5177726c02c32
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
e10ce26ead0eca58cd5346843538415611b745bfd29825322efad56424a4c911
e2d14bf82ef15e64d7503eed437a43ad5f26d4f5bcac6745870c32f1ed77a8a6
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e40c8f9d7a3c7c71ee109b2ae4df7dd9b6e3b0cd287d77f9a98312c53392ae25
e5808455786f658eccda5e658ffcc1073d757dd9b70ea3c931fa7a36d583abbc
e600901c3822e2410c8113d763d1f8babb08aab7d06aa1c861be265408cdf649
e803e774c7b59fe74f71ed93acaa875cf9a99947ff8ed7615cd0c93c1667250f
eb8d8c2427fab53f2c4d0c70d9661c7d33d995e486cdb923b0c6d65b6b4fef19
ec283af1b220ae388d616832c82a2612f2630ac572784dd39b6d2c5b8e81e7aa
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f35c317df74c5ceaca83bc620ab17f68e882a21e5378933002f20aae3af0517f
f419ad33d162aefac608940b47d2a524fca46eee0c82f877710a6369e68be33c
f54b61a120e0240c98428d76beab031099f4f0379cbc623de071277255088fdc
f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615
f75911313e1c7802c23345ab57e754d87801581706780c993fb23ff4e0fe62ef
f827ec383239317deb9387ea204a9a0089594aaa0a763922e3d85222010531e2
fa53fcd8da139d256c0ca83b69cb37473ca627b6052368ed3327c80d9fb61e25
fb71e0d749623b7c583b86934740d866e5f6fc000204c6b3cb7dfe25a888cc60
fc2fab7ad17829305a9146a6a0db45bf46dba8b104548a2777c5583c0aff059d
fd5e0c3a0682f03217f201588e51e77bf778d5506224074918f505423f0e25a2
fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a
fe27c4285a354bd54bae7a730c2c581405509b81a7e05bab70e4b19f5bfc4912
ff5b2a04410456da0a8e7d8a4db3eacf62ab980e163a500b81781ea6c5b0a73b

www.reversinglabs.com Open in urlscan Pro 2606:2c40::c73c:671f Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

152 Requests

99 %HTTPS

77 %IPv6

37 Domains

53 Subdomains

47 IPs

3 Countries

3511 kBTransfer

7183 kBSize

35 Cookies

25 Outgoing links

Redirected requests

152 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

www.reversinglabs.com Open in urlscan Pro
2606:2c40::c73c:671f Public Scan

Screenshot
Live screenshot

Full Image

152
Requests

99 %
HTTPS

77 %
IPv6

37
Domains

53
Subdomains

47
IPs

3
Countries

3511 kB
Transfer

7183 kB
Size

35
Cookies

152 HTTP transactions
1 data transactions