www.group-ib.com Open in urlscan Pro
3.72.181.255  Public Scan

22 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

1. https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Page URL
2. https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Page URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 101

• https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=4496601&time=1695215382811&url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&tm=gtmv2 HTTP 302
• https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=4496601&time=1695215382811&url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&tm=gtmv2&cookiesTest=true HTTP 302
• https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D4496601%26time%3D1695215382811%26url%3Dhttps%253A%252F%252Fwww.group-ib.com%252Fblog%252Fcve-2023-38831-winrar-zero-day%252F%26tm%3Dgtmv2%26cookiesTest%3Dtrue%26liSync%3Dtrue HTTP 302
• https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=4496601&time=1695215382811&url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&tm=gtmv2&cookiesTest=true&liSync=true HTTP 302
• https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=4496601&time=1695215382811&url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&tm=gtmv2&cookiesTest=true&liSync=true&e_ipv6=AQLcyAulWPeOLQAAAYqytfPmy7GLhhPLulZ-RIrMkfB34QAur2obYgm3eZ_2in1nQnMBb-Q

Request Chain 105

• https://mc.yandex.com/sync_cookie_image_check HTTP 302
• https://mc.yandex.ru/sync_cookie_image_start?redirect_domain=mc.yandex.com&token=10132.9l-NvcaQlRybkuZDApAgTwQ62WNwlSAeLVh0fJjQZaDNRgxPJKqejUs-arYWvkOv._Xa_ocrWJY19qUywSkbqdIYl4J8%2C HTTP 302
• https://mc.yandex.com/sync_cookie_image_decide?token=10132.KqhPcIvVJO3mFdAXqZ7LbqUjo0K2pTqjAoUe8uEry3exuJsYohlztbh3sdFv5kTiSsANzarC14dz7US99ZUxLHG6zAntpEpEPH9BAo-6F3E%2C.DglcRpUJVceflfr6QDxMM7lfyx0%2C

Request Chain 125

• https://mc.yandex.com/watch/26812653?wmode=7&page-url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&charset=utf-8&site-info=%7B%22shareVersion%22%3A2%2C%22strategy%22%3A%22d%2Fn%2Fq%2Fr%2Fs%2Ft%22%7D&uah=chm%0A%3F0&browser-info=pv%3A1%3Avf%3A3qm6qq812ez2u52y4wzrnbv%3Afp%3A502%3Afu%3A1%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A1111%3Acn%3A1%3Adp%3A0%3Als%3A393427733342%3Ahid%3A66148892%3Az%3A120%3Ai%3A20230920150942%3Aet%3A1695215383%3Ac%3A1%3Arn%3A379040932%3Arqn%3A1%3Au%3A1695215383204017989%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Awv%3A2%3Ads%3A0%2C0%2C68%2C41%2C0%2C0%2C%2C508%2C3%2C%2C%2C%2C647%3Aco%3A0%3Acpf%3A1%3Ans%3A1695215381869%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1695215383%3At%3ATraders%27%20dollars%20in%20danger%3A%20CVE-2023-38831%20zero-day%20vulnerability%20in%20WinRAR%20exploited%20by%20cybercriminals%20to%20target%20traders%20%7C%20Group-IB%20Blog&t=gdpr(14)clc(0-0-0)rqnt(1)aw(1)ti(2) HTTP 302
• https://mc.yandex.com/watch/26812653/1?wmode=7&page-url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&charset=utf-8&site-info=%7B%22shareVersion%22%3A2%2C%22strategy%22%3A%22d%2Fn%2Fq%2Fr%2Fs%2Ft%22%7D&uah=chm%0A%3F0&browser-info=pv%3A1%3Avf%3A3qm6qq812ez2u52y4wzrnbv%3Afp%3A502%3Afu%3A1%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A1111%3Acn%3A1%3Adp%3A0%3Als%3A393427733342%3Ahid%3A66148892%3Az%3A120%3Ai%3A20230920150942%3Aet%3A1695215383%3Ac%3A1%3Arn%3A379040932%3Arqn%3A1%3Au%3A1695215383204017989%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Awv%3A2%3Ads%3A0%2C0%2C68%2C41%2C0%2C0%2C%2C508%2C3%2C%2C%2C%2C647%3Aco%3A0%3Acpf%3A1%3Ans%3A1695215381869%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1695215383%3At%3ATraders%27%20dollars%20in%20danger%3A%20CVE-2023-38831%20zero-day%20vulnerability%20in%20WinRAR%20exploited%20by%20cybercriminals%20to%20target%20traders%20%7C%20Group-IB%20Blog&t=gdpr%2814%29clc%280-0-0%29rqnt%281%29aw%281%29ti%282%29&redirnss=1

Request Chain 131

• https://mc.yandex.com/sync_cookie_image_check_secondary HTTP 302
• https://mc.yandex.ru/sync_cookie_image_start_secondary?redirect_domain=mc.yandex.com&token=10132.4W5ef6hAUoNcpbFRWyxt23HOuUkQvaKwGksqfuLWR2DLuO9g1s5VDud--KIDoxLl.3jx_4K2uTQDJCTIYCm-oPN7y3Uo%2C HTTP 302
• https://mc.yandex.com/sync_cookie_image_decide_secondary?token=10132.gMqkv_Isy-vBgWLUZTUMVMkD7tgvEOYi5JzMMtyOcDwtezRZ8B9X0FFWG9IcXhjY0mGlMzaI1pac3aXjTjfIOVM3DxoL-JxE6mx8mqooVaw%2C.3PZcVmMwBiYuMDo3MuBCkVf07nM%2C

133 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
21 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	403	/ Show response www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/	7 KB 7 KB	1424ms 53ms	Document text/html	3.72.181.255 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-72-181-255.eu-central-1.compute.amazonaws.com Software / Resource Hash 34de17ac1bf040d56f0be4c35cb916ede68c6a119347007caf8560722f6de959 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers cache-control no-cache, no-store, must-revalidate content-type text/html date Wed, 20 Sep 2023 13:09:40 GMT
GET H/1.1	200 OK	bt-autoinject.js Show response fhp-de-js.group-ib.com/d/	348 KB 137 KB	239ms 77ms	Script text/javascript	88.99.251.116 HETZNER-AS
General Check archive.org Show headers Download Go to Full URL https://fhp-de-js.group-ib.com/d/bt-autoinject.js Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 88.99.251.116 , Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS static.116.251.99.88.clients.your-server.de Software nginx / Resource Hash 270c3f042ad64bd6151ebf2ef5bb0367e458fa3a92b6e48447b8e7a9256af382 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers Date Wed, 20 Sep 2023 13:09:40 GMT Content-Encoding gzip Server nginx Transfer-Encoding chunked Vary Accept-Encoding Content-Type text/javascript; charset=UTF-8 Access-Control-Allow-Methods GET, POST, OPTIONS x-envoy-upstream-service-time 0 Access-Control-Allow-Credentials true Connection keep-alive Access-Control-Allow-Headers Accept,DNT,Keep-Alive,User-Agent,If-Modified-Since,Cache-Control,Content-Type,Origin,ETag,If-None-Match,X-Cfids,Authorization
GET DATA	200 OK	truncated /	487 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash ebef5366685643f66c9ae43951b47f0ca8a13f8da48e9950eb93bdd8b216cef8 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	4 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash bba52a49dacef01d863d0a53154779e7ed764df99f32a77ef6791a55987a581a Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers Content-Type image/png
GET H2	200	idgib-w-61354c22-16cc-40a8-a871-6901f1a76e24 Show response www.group-ib.com/api/fl/	205 B 665 B	52ms 52ms	XHR application/json	3.72.181.255 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://www.group-ib.com/api/fl/idgib-w-61354c22-16cc-40a8-a871-6901f1a76e24 Requested by Host: fhp-de-js.group-ib.com URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-72-181-255.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash fe3e4ec87a225723c6d59e60778340bdfd6e00d285c05696c746c7813c942936 Request headers Referer https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 x-cfids - Response headers date Wed, 20 Sep 2023 13:09:40 GMT content-encoding gzip server nginx etag W/"1+ZwedtN06j4ZDGQrHAA0SzZ8JFq1rf5OIRXGLSfp7MVDV3byuXmEF3lFZIRhveQGNN1+KIMM5hv3uQ6uo8zEE7LWd6wB+aMO4eXvHe5M92N+YN3xTFz9LiWADeYhVJqZ7q0YfF1P8ac9Wt6+uGMEamL" vary Accept-Encoding content-type application/json; charset=utf-8 cache-control no-cache x-envoy-upstream-service-time 1
POST H2	200	fl Show response www.group-ib.com/api/	665 B 988 B	95ms 94ms	XHR application/json	3.72.181.255 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://www.group-ib.com/api/fl?u=41135e40-5707-11ee-a667-edd728235f9c&cfidsgib-w-61354c22-16cc-40a8-a871-6901f1a76e24=1%2BZwedtN06j4ZDGQrHAA0SzZ8JFq1rf5OIRXGLSfp7MVDV3byuXmEF3lFZIRhveQGNN1%2BKIMM5hv3uQ6uo8zEE7LWd6wB%2BaMO4eXvHe5M92N%2BYN3xTFz9LiWADeYhVJqZ7q0YfF1P8ac9Wt6%2BuGMEamL Requested by Host: fhp-de-js.group-ib.com URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-72-181-255.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash 7b1b866efefb82764a51e68c5e13930966bbb8c4d73d823ebbb0a2ee93d5ca83 Request headers Referer https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers date Wed, 20 Sep 2023 13:09:41 GMT content-encoding gzip server nginx vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/json; charset=utf-8 access-control-allow-origin https://www.group-ib.com cache-control no-store access-control-allow-credentials true x-envoy-upstream-service-time 2 access-control-allow-headers Accept,DNT,Keep-Alive,User-Agent,If-Modified-Since,Cache-Control,Content-Type,Origin,ETag,If-None-Match,X-Cfids,Authorization
POST H2	200	fl www.group-ib.com/api/	665 B 688 B	50ms 50ms	Ping application/json	3.72.181.255 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://www.group-ib.com/api/fl?u=41135e40-5707-11ee-a667-edd728235f9c&cfidsgib-w-61354c22-16cc-40a8-a871-6901f1a76e24=GO3TkLXXgCLis0LK9QBqfXC1FddoY9oLBJQYm434%2FLT60IIl9JP9P9ZcVnkE%2BoizRPRQq%2BDKxN0pSMBdD1p%2F8yhCvl3t4DTyjLXS9A6HSR1jD5O1hXEViV4%2FyB%2BE9gaThAiekDME83gjS02vb8oxi2bEFpxYHIVq6AQG Requested by Host: fhp-de-js.group-ib.com URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-72-181-255.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash Request headers Referer https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers date Wed, 20 Sep 2023 13:09:41 GMT content-encoding gzip server nginx vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/json; charset=utf-8 access-control-allow-origin https://www.group-ib.com cache-control no-store access-control-allow-credentials true x-envoy-upstream-service-time 1 access-control-allow-headers Accept,DNT,Keep-Alive,User-Agent,If-Modified-Since,Cache-Control,Content-Type,Origin,ETag,If-None-Match,X-Cfids,Authorization
GET H2	200	Primary Request / Show response www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/	115 KB 28 KB	68ms 68ms	Document text/html	3.72.181.255 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-72-181-255.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash 22e0d3c2ac86bd7f67dd929c599123af4d62bfc3a7bdef00e796a23279a12c52 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers Referer https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers accept-ranges bytes access-control-allow-origin https://www.group-ib.com cache-control private, max-age=3600 content-encoding gzip content-length 28120 content-security-policy frame-ancestors 'self'; content-type text/html; charset=UTF-8 date Wed, 20 Sep 2023 13:09:41 GMT etag "6cf8-605c57f5a5abd" last-modified Wed, 20 Sep 2023 07:41:03 GMT permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() referrer-policy strict-origin-when-cross-origin server nginx strict-transport-security max-age=31536000; includeSubDomains vary X-Forwarded-Proto,Accept-Encoding,Cookie x-content-type-options nosniff x-frame-options sameorigin x-xss-protection 1; mode=block
GET H/1.1	200 OK	bt-autoinject.js Show response fhp-de-js.group-ib.com/d/	348 KB 137 KB	80ms 79ms	Script text/javascript	88.99.251.116 HETZNER-AS
General Check archive.org Show headers Download Go to Full URL https://fhp-de-js.group-ib.com/d/bt-autoinject.js Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 88.99.251.116 , Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS static.116.251.99.88.clients.your-server.de Software nginx / Resource Hash 270c3f042ad64bd6151ebf2ef5bb0367e458fa3a92b6e48447b8e7a9256af382 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers Date Wed, 20 Sep 2023 13:09:41 GMT Content-Encoding gzip Server nginx Transfer-Encoding chunked Vary Accept-Encoding Content-Type text/javascript; charset=UTF-8 Access-Control-Allow-Methods GET, POST, OPTIONS x-envoy-upstream-service-time 0 Access-Control-Allow-Credentials true Connection keep-alive Access-Control-Allow-Headers Accept,DNT,Keep-Alive,User-Agent,If-Modified-Since,Cache-Control,Content-Type,Origin,ETag,If-None-Match,X-Cfids,Authorization
GET H2	200	lazyload.min.js Show response www.group-ib.com/wp-content/plugins/w3-total-cache/pub/js/	6 KB 2 KB	66ms 63ms	Script application/x-javascript	3.72.181.255 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://www.group-ib.com/wp-content/plugins/w3-total-cache/pub/js/lazyload.min.js Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-72-181-255.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash 1a54a1907a6443e3c81608130bfed4546eb0ce5d0c8897e1d7a3b43d89ecc367 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Wed, 20 Sep 2023 13:09:41 GMT strict-transport-security max-age=31536000; includeSubDomains content-length 2356 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Thu, 29 Jun 2023 07:01:06 GMT server nginx etag "1883-5ff3f43abc651-gzip" vary X-Forwarded-Proto,Accept-Encoding x-frame-options sameorigin content-type application/x-javascript access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes expires Wed, 20 Sep 2023 13:39:41 GMT
GET H2	200	swiper-bundle.min.js Show response website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/js/	140 KB 39 KB	206ms 79ms	Script application/x-javascript	2600:9000:225b:2a00:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/js/swiper-bundle.min.js Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:225b:2a00:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash b624e1e378abe009ef0de69a698b0a3e734af47efcdbd6816d5fcb8fc64c8bfe Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Wed, 20 Sep 2023 13:09:42 GMT via 1.1 af1bbc213b3a9ee2f125be77ca3609a0.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop MUC50-P1 x-cache Miss from cloudfront content-length 39504 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Mon, 05 Sep 2022 07:41:14 GMT server nginx etag "22ede-5e7e9344df9f2-gzip" x-frame-options sameorigin vary Accept-Encoding content-type application/x-javascript access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id EzNpjLKFJf6kxFaCRRWaibKjCF5x_jIWsGPgqte2ul59iI4AqZK5kA== expires Wed, 20 Sep 2023 13:39:42 GMT
GET H2	200	classic-themes.min.css website.cdn.group-ib.com/wp-includes/css/	217 B 1007 B	196ms 70ms	Stylesheet text/css	2600:9000:225b:2a00:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://website.cdn.group-ib.com/wp-includes/css/classic-themes.min.css Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:225b:2a00:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 5a5f39391fbf5b06db84b8f9716d53de575ee97a627d2c5f12f79a991a671eb5 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Wed, 20 Sep 2023 13:09:42 GMT via 1.1 af1bbc213b3a9ee2f125be77ca3609a0.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop MUC50-P1 x-cache Miss from cloudfront content-length 189 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Fri, 11 Nov 2022 11:58:50 GMT server nginx etag "d9-5ed309cf15c82-gzip" x-frame-options sameorigin vary Accept-Encoding content-type text/css access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id 4fuObCgYCcVt0Urf98WSREcM8VLZ_ju_mhmad9Q3k0qL_m0VFMD9aQ== expires Wed, 20 Sep 2023 13:39:42 GMT
GET H2	200	dashicons.min.css website.cdn.group-ib.com/wp-includes/css/	58 KB 36 KB	286ms 159ms	Stylesheet text/css	2600:9000:225b:2a00:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://website.cdn.group-ib.com/wp-includes/css/dashicons.min.css Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:225b:2a00:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash c21e5a2b32c47bc5f9d9efc97bc0e29fd081946d1d3ebffc5621cfafb1d3960e Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Wed, 20 Sep 2023 13:09:42 GMT via 1.1 af1bbc213b3a9ee2f125be77ca3609a0.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop MUC50-P1 x-cache Miss from cloudfront content-length 35730 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Fri, 10 Jun 2022 07:03:36 GMT server nginx etag "e688-5e112897ec200-gzip" x-frame-options sameorigin vary Accept-Encoding content-type text/css access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id PwKveU2MsSQSeSaLmuA2iUBkuoPNNklOcZ3ps5iDo_Ie3SbeB3-dew== expires Wed, 20 Sep 2023 13:39:42 GMT
GET H2	200	frontend.min.css www.group-ib.com/wp-content/plugins/post-views-counter/css/	215 B 251 B	66ms 64ms	Stylesheet text/css	3.72.181.255 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://www.group-ib.com/wp-content/plugins/post-views-counter/css/frontend.min.css Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-72-181-255.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash ed70c2cf61d0f24d03299ffc5896c7abd86bb858501987dc10e3afec086c01df Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Wed, 20 Sep 2023 13:09:41 GMT strict-transport-security max-age=31536000; includeSubDomains content-length 160 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Wed, 26 Apr 2023 07:26:40 GMT server nginx etag "d7-5fa38293ec798-gzip" vary X-Forwarded-Proto,Accept-Encoding x-frame-options sameorigin content-type text/css access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes expires Wed, 20 Sep 2023 13:39:41 GMT
GET H2	200	jquery.min.js Show response website.cdn.group-ib.com/wp-includes/js/jquery/	88 KB 31 KB	260ms 134ms	Script application/x-javascript	2600:9000:225b:2a00:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://website.cdn.group-ib.com/wp-includes/js/jquery/jquery.min.js Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:225b:2a00:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash cc7403bab52ed166e24ea9324241045af370be482f5b594468f4a6ac6e7e7981 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Wed, 20 Sep 2023 13:09:42 GMT via 1.1 af1bbc213b3a9ee2f125be77ca3609a0.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop MUC50-P1 x-cache Miss from cloudfront content-length 30995 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Fri, 11 Nov 2022 11:58:50 GMT server nginx etag "15e54-5ed309cf21802-gzip" x-frame-options sameorigin vary Accept-Encoding content-type application/x-javascript access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id 6NOIFcV-ArK-evlp6R5PrBu_gvHdklEPRFjdBDJBDHQ8Zj0MyJChqw== expires Wed, 20 Sep 2023 13:39:42 GMT
GET H2	200	single-blog-post.css website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/	271 KB 39 KB	244ms 118ms	Stylesheet text/css	2600:9000:225b:2a00:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:225b:2a00:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 5f3eb686a53660713a24f146256d6184081e7a42a15833d98367b19162e611f6 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Wed, 20 Sep 2023 13:09:42 GMT via 1.1 af1bbc213b3a9ee2f125be77ca3609a0.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop MUC50-P1 x-cache Miss from cloudfront content-length 39011 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Wed, 20 Sep 2023 13:09:07 GMT server nginx etag "43aea-605ca14a25cc9-gzip" x-frame-options sameorigin vary Accept-Encoding content-type text/css access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id be2lr1TfXKsnOofkB0uvGjzb0O5v85Zd5CfvIGoAX9MnIxJTM25Sjg== expires Wed, 20 Sep 2023 13:39:42 GMT
GET H2	200	v2.js Show response js-eu1.hsforms.net/forms/	549 KB 175 KB	172ms 52ms	Script application/javascript	172.65.255.172 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js-eu1.hsforms.net/forms/v2.js Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.65.255.172 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash a968f7560a3f021198c233b384d7a88f43caacfa0154f88e02116aa74fb65e6d Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers content-encoding br age 503 x-evy-trace-route-service-name envoyset-translator x-amz-server-side-encryption AES256 content-security-policy-report-only frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=forms-embed/static-1.3775/bundles/project-v2.js&cfRay=809a41a521123620-FRA x-amz-replication-status PENDING x-evy-trace-listener listener_https etag W/"a51322b373df386bb77a795cb978ff6b" vary Accept-Encoding content-type application/javascript; charset=utf-8 access-control-allow-origin * x-evy-trace-virtual-host all cache-control s-maxage=600, max-age=300 x-hs-target-asset forms-embed/static-1.3775/bundles/project-v2.js date Wed, 20 Sep 2023 13:09:42 GMT x-amz-version-id cf9Ibwjfs0bKfJMoo1B1m6It1HkZCzhH via 1.1 993c0866e705e48daa4fed5e30627712.cloudfront.net (CloudFront) x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} strict-transport-security max-age=31536000; includeSubDomains; preload x-amz-cf-pop FRA56-P2 x-hubspot-correlation-id 093d8573-91a9-42dc-8095-5af624158b7e x-cache Hit from cloudfront cache-tag staticjsapp-forms-embed-v2-web-prod,staticjsapp-prod x-envoy-upstream-service-time 1 alt-svc h3=":443"; ma=86400 x-evy-trace-route-configuration listener_https/all x-request-id 093d8573-91a9-42dc-8095-5af624158b7e last-modified Mon, 18 Sep 2023 12:36:49 UTC server cloudflare report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5nJ8%2BHu8Rj9OimllnFJyF4oGekQlXZR6ljzxkMkyIEgO%2FYy7BArS%2FNHYL3wYlggcGhYfEnYomySd9jeGVgCmXwbfyd1uySjT08ynv8pVvtsNlv7zN6PomAZM%2FP2%2FTqNdKNpaBg%3D%3D"}],"group":"cf-nel","max_age":604800} x-hs-cache-status HIT x-evy-trace-served-by-pod fra04/app-td/envoy-proxy-5b45bc9bc5-w8lzh cf-ray 809a4dea084235fc-FRA x-amz-cf-id 2e2QjtX9qgGPlrABO8Z0ezDIFjDGbxfwuKNv-4AUDXK6uoVmywus0Q==
GET H2	200	1-9.webp website.cdn.group-ib.com/wp-content/uploads/	26 KB 26 KB	72ms 68ms	Image image/webp	2600:9000:225b:2a00:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/uploads/1-9.webp Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:225b:2a00:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 12694cf25c8b39aa1c1ffec08e918329ff5ede72cac2d072676c8966d0ecb232 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; date Wed, 20 Sep 2023 13:09:42 GMT x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains via 1.1 af1bbc213b3a9ee2f125be77ca3609a0.cloudfront.net (CloudFront) x-amz-cf-pop MUC50-P1 x-cache Miss from cloudfront content-length 26152 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 15 Aug 2023 11:18:42 GMT server nginx etag "6628-602f45775ef38" x-frame-options sameorigin content-type image/webp access-control-allow-origin https://www.group-ib.com cache-control no-cache, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id f4qYkDJV_8sfL52tHTs37FLWWphIHCsRHJGQ0xjdHNYcRU9VTOVJ6w== expires Wed, 20 Sep 2023 13:09:41 GMT
GET H2	200	3-9.webp website.cdn.group-ib.com/wp-content/uploads/	28 KB 28 KB	128ms 125ms	Image image/webp	2600:9000:225b:2a00:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/uploads/3-9.webp Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:225b:2a00:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 91142fb37a1afd429d81b87ca85e1f90ddfe4adbb2371355c9f16a2d35dbfe73 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; date Wed, 20 Sep 2023 13:09:42 GMT x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains via 1.1 af1bbc213b3a9ee2f125be77ca3609a0.cloudfront.net (CloudFront) x-amz-cf-pop MUC50-P1 x-cache Miss from cloudfront content-length 28366 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 15 Aug 2023 11:18:48 GMT server nginx etag "6ece-602f457ce122e" x-frame-options sameorigin content-type image/webp access-control-allow-origin https://www.group-ib.com cache-control no-cache, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id HeInHYk-pZSHSHJCvd5zSBTKordrTbp-zJVmi-Pe4_VFtocY9gGrfw== expires Wed, 20 Sep 2023 13:09:41 GMT
GET H2	200	4-8.webp website.cdn.group-ib.com/wp-content/uploads/	49 KB 50 KB	89ms 87ms	Image image/webp	2600:9000:225b:2a00:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/uploads/4-8.webp Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:225b:2a00:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 9bb9e90fb96a3d0ab60eccf88c4b0832073adda15ecc9701aeab7b63d2e4ac57 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; date Wed, 20 Sep 2023 13:09:42 GMT x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains via 1.1 af1bbc213b3a9ee2f125be77ca3609a0.cloudfront.net (CloudFront) x-amz-cf-pop MUC50-P1 x-cache Miss from cloudfront content-length 50338 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 15 Aug 2023 11:18:54 GMT server nginx etag "c4a2-602f4582450c1" x-frame-options sameorigin content-type image/webp access-control-allow-origin https://www.group-ib.com cache-control no-cache, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id H3Qzo2OJF3Y_J5ZQrZrmcT1LiSBhN61dxaYjoCKoaPTd2YBCWmYQgA== expires Wed, 20 Sep 2023 13:09:41 GMT
GET H2	200	5-7.webp website.cdn.group-ib.com/wp-content/uploads/	54 KB 55 KB	99ms 97ms	Image image/webp	2600:9000:225b:2a00:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/uploads/5-7.webp Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:225b:2a00:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 8f2a83616053ea89700e5f226589cd1c84ab988e40cd1201ea3122f9c88fe9a8 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; date Wed, 20 Sep 2023 13:09:42 GMT x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains via 1.1 af1bbc213b3a9ee2f125be77ca3609a0.cloudfront.net (CloudFront) x-amz-cf-pop MUC50-P1 x-cache Miss from cloudfront content-length 55798 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 15 Aug 2023 11:18:59 GMT server nginx etag "d9f6-602f4587aae94" x-frame-options sameorigin content-type image/webp access-control-allow-origin https://www.group-ib.com cache-control no-cache, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id d5KPEL5gM8ohe9Z_5i_AWbYeVQotiVRb_5wJerQQhiYsxFIJMa2tAA== expires Wed, 20 Sep 2023 13:09:41 GMT
GET H2	200	6-7.webp website.cdn.group-ib.com/wp-content/uploads/	31 KB 32 KB	78ms 76ms	Image image/webp	2600:9000:225b:2a00:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/uploads/6-7.webp Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:225b:2a00:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash c8c136448d94d42b73df0606ee587f793b66a14d81b7cfae1a348acd7235e3eb Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; date Wed, 20 Sep 2023 13:09:42 GMT x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains via 1.1 af1bbc213b3a9ee2f125be77ca3609a0.cloudfront.net (CloudFront) x-amz-cf-pop MUC50-P1 x-cache Miss from cloudfront content-length 31676 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 15 Aug 2023 11:19:05 GMT server nginx etag "7bbc-602f458d16a28" x-frame-options sameorigin content-type image/webp access-control-allow-origin https://www.group-ib.com cache-control no-cache, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id f7HmQJnoPLZTaBHVInNU2RX8pv6jIRjySVurlXiNH4nuMZYaokn8mA== expires Wed, 20 Sep 2023 13:09:41 GMT
GET H2	200	7-7.webp website.cdn.group-ib.com/wp-content/uploads/	31 KB 32 KB	109ms 106ms	Image image/webp	2600:9000:225b:2a00:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/uploads/7-7.webp Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:225b:2a00:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 7329cdfadeb1fb651c8f76b7c8819a69b7e51ff93c6fb327db12664cbe891168 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; date Wed, 20 Sep 2023 13:09:42 GMT x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains via 1.1 af1bbc213b3a9ee2f125be77ca3609a0.cloudfront.net (CloudFront) x-amz-cf-pop MUC50-P1 x-cache Miss from cloudfront content-length 31918 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 15 Aug 2023 11:19:11 GMT server nginx etag "7cae-602f4592a0a1f" x-frame-options sameorigin content-type image/webp access-control-allow-origin https://www.group-ib.com cache-control no-cache, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id HD0sGVxyBP4O_iHd967NaeFCzuHPYXfLgz_RjP_jQQ74VdcUVc6Ksw== expires Wed, 20 Sep 2023 13:09:41 GMT
GET H2	200	main.js Show response website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/js/	211 KB 46 KB	120ms 118ms	Script application/x-javascript	2600:9000:225b:2a00:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/js/main.js Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:225b:2a00:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 9e74da602eceae93875543dd9a235f2fbbbca8c254c125bcb733fa6a0486c9bd Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Wed, 20 Sep 2023 13:09:42 GMT via 1.1 af1bbc213b3a9ee2f125be77ca3609a0.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop MUC50-P1 x-cache Miss from cloudfront content-length 45806 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Mon, 18 Sep 2023 12:05:43 GMT server nginx etag "34b3c-605a0f63455a5-gzip" x-frame-options sameorigin vary Accept-Encoding content-type application/x-javascript access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id FPZkRNbDbH9U9dH4-kisYAA-Z4sbREdZtIhKr7qjS3uwIrzMTSX2EQ== expires Wed, 20 Sep 2023 13:39:42 GMT
GET H2	200	fancybox.umd.js Show response website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/libs/fancybox/	103 KB 30 KB	136ms 136ms	Script application/x-javascript	2600:9000:225b:2a00:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/libs/fancybox/fancybox.umd.js Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:225b:2a00:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 942e02acf640c0308f65e057a8afaed63dfaf995034cda9cfc75532a1009ec72 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Wed, 20 Sep 2023 13:09:42 GMT via 1.1 af1bbc213b3a9ee2f125be77ca3609a0.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop MUC50-P1 x-cache Miss from cloudfront content-length 29634 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Mon, 05 Sep 2022 07:24:28 GMT server nginx etag "19ca6-5e7e8f85cb376-gzip" x-frame-options sameorigin vary Accept-Encoding content-type application/x-javascript access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id HwM8a1bwqG7-ewXXjEiSTpiwTKZL9WCweNQ3sLAVZTpMGrBLqT7-UA== expires Wed, 20 Sep 2023 13:39:42 GMT
GET H2	200	frontend.min.js Show response www.group-ib.com/wp-content/plugins/post-views-counter/js/	1 KB 723 B	96ms 96ms	Script application/x-javascript	3.72.181.255 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://www.group-ib.com/wp-content/plugins/post-views-counter/js/frontend.min.js Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-72-181-255.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash 12475fdd5d48640d7ad60670a2342f02cf560b8cd977cf8e7e624e6a22576f82 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Wed, 20 Sep 2023 13:09:42 GMT strict-transport-security max-age=31536000; includeSubDomains content-length 628 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Wed, 26 Apr 2023 07:26:40 GMT server nginx etag "484-5fa38293ec798-gzip" vary X-Forwarded-Proto,Accept-Encoding x-frame-options sameorigin content-type application/x-javascript access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes expires Wed, 20 Sep 2023 13:39:42 GMT
GET H2	200	25755956.js Show response js-eu1.hs-scripts.com/	2 KB 1 KB	175ms 71ms	Script application/javascript	172.65.208.22 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js-eu1.hs-scripts.com/25755956.js Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.65.208.22 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 7f291fb128154aefa48ed01b4b67393f1e586d3336071b3fec868b06e7dbf2c5 Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers date Wed, 20 Sep 2023 13:09:42 GMT content-encoding br x-content-type-options nosniff cf-cache-status EXPIRED x-evy-trace-route-service-name envoyset-translator x-hubspot-correlation-id 8953132b-0d5a-4e5d-ba36-b884ffa12f77 x-envoy-upstream-service-time 6 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id 8953132b-0d5a-4e5d-ba36-b884ffa12f77 last-modified Wed, 20 Sep 2023 12:59:50 GMT server cloudflare x-trace 2BDE577BC0B6B2306520BF590EE07BA7018BEC6C1B000000000000000000 vary origin, Accept-Encoding access-control-max-age 3600 content-type application/javascript;charset=utf-8 access-control-allow-origin https://www.group-ib.com x-evy-trace-virtual-host all cache-control public, max-age=30 access-control-allow-credentials true x-evy-trace-served-by-pod fra04/hubapi-td/envoy-proxy-74f74b4b68-qtbfk cf-ray 809a4debdb93383a-FRA
GET DATA	200 OK	truncated /	487 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash d4d49bd7f581bbab48eb139d9c50b24fa82f42513345019073af0ef666a6f3fa Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	4 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 0b4f54c8cded468660f2f60cd757e3deb73c050c635ac5af88988c99a34ffb54 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers Content-Type image/png
GET H2	200	idgib-w-61354c22-16cc-40a8-a871-6901f1a76e24 Show response www.group-ib.com/api/fl/	217 B 632 B	51ms 50ms	XHR application/json	3.72.181.255 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://www.group-ib.com/api/fl/idgib-w-61354c22-16cc-40a8-a871-6901f1a76e24 Requested by Host: fhp-de-js.group-ib.com URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-72-181-255.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash 3128ea14c106dd86c961b23c07c2b0b8823b08d243e8624adfd752a3c3c21cae Request headers X-GIB-GSSCgib-w-61354c22-16cc-40a8-a871-6901f1a76e24 4iViNwVg5R2sZMyaiJHjyM0Mm/fadGJoi8/ZgwRnwDbvALCr9llW3v0v7jweW+NXWhpCxrbh5K2VqbbkOGAR2YmzaAq7bPiUgS4n4H4HfPTa0cv93HZNUjREqkEKKbxjtXwXunVl4XhuQEIBokWtGlil4bXn+eczerLMOUk6htsTL58ijUOKIO7SsyOzuKEBttwV1PDgC5grConrJhj64kl+Ech8qCdAw7U7RQRbsO9k3Lpru7ujOsE2WKEFTw== Referer https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 X-GIB-FGSSCgib-w-61354c22-16cc-40a8-a871-6901f1a76e24 CsZ8f87682400ba8301ffe5f869b32dfd536cf01 x-cfids GO3TkLXXgCLis0LK9QBqfXC1FddoY9oLBJQYm434/LT60IIl9JP9P9ZcVnkE+oizRPRQq+DKxN0pSMBdD1p/8yhCvl3t4DTyjLXS9A6HSR1jD5O1hXEViV4/yB+E9gaThAiekDME83gjS02vb8oxi2bEFpxYHIVq6AQG Response headers date Wed, 20 Sep 2023 13:09:42 GMT content-encoding gzip server nginx etag W/"K8EcpuTfJAu+FWRGiuAera1NXTWz/LfcHD7A+PMd9IZhUscAP+NIWhNeqi8YntBavtetYBJc2KfJ0qf8ZiKc2zh5f7hMWsurPmwwbqsPLqgl0eKSa0QDb7DXDGgiCUHRZsPqTinb8pWNoGLrbTXqyl8PcvSejP5MakcY" vary Accept-Encoding content-type application/json; charset=utf-8 cache-control no-cache x-envoy-upstream-service-time 1
GET H2	200	G-font-Medium.otf website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/fonts/G-font/	60 KB 35 KB	195ms 114ms	Font application/x-font-otf	2600:9000:225b:2a00:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/fonts/G-font/G-font-Medium.otf Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:225b:2a00:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 1efe16c9efbadde5e242d88a315eca3906a55669fcd4882a904fbc723306a4e4 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers Referer https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css Origin https://www.group-ib.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Wed, 20 Sep 2023 13:09:42 GMT via 1.1 fb542039f97bb702c0e68d2142c449aa.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop MUC50-P1 x-cache Miss from cloudfront content-length 35382 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 28 Jun 2022 07:55:26 GMT server nginx etag "eed4-5e27d5c025780-gzip" x-frame-options sameorigin vary Accept-Encoding content-type application/x-font-otf access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id li1lZcjrUNXFg0pUDmdwLD8alOA6SxDP_zmdMl0pDOpLS2fSZpIf-Q== expires Wed, 20 Sep 2023 13:39:42 GMT
GET H2	200	G-font-Regular.otf website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/fonts/G-font/	47 KB 31 KB	158ms 76ms	Font application/x-font-otf	2600:9000:225b:2a00:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/fonts/G-font/G-font-Regular.otf Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:225b:2a00:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 6cee0fb06339ba13e1f15d044e0e4904bbeeb7fbe4351e3f102b6d80b2465061 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers Referer https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css Origin https://www.group-ib.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Wed, 20 Sep 2023 13:09:42 GMT via 1.1 fb542039f97bb702c0e68d2142c449aa.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop MUC50-P1 x-cache Miss from cloudfront content-length 30798 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 28 Jun 2022 07:55:26 GMT server nginx etag "bbf8-5e27d5c025780-gzip" x-frame-options sameorigin vary Accept-Encoding content-type application/x-font-otf access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id HcK-I57MSAgpp8BqLEFI4Weh01-Z1pU6FHMwItbykCy0qad87UI85g== expires Wed, 20 Sep 2023 13:39:42 GMT
GET H/1.1	200 OK	json Show response forms-eu1.hsforms.com/embed/v3/form/25755956/044e7558-8073-478a-ad3c-5807dd76840f/	9 KB 3 KB	195ms 82ms	XHR application/json	172.65.232.43 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://forms-eu1.hsforms.com/embed/v3/form/25755956/044e7558-8073-478a-ad3c-5807dd76840f/json?hs_static_app=forms-embed&hs_static_app_version=1.3775&X-HubSpot-Static-App-Info=forms-embed-1.3775 Requested by Host: fhp-de-js.group-ib.com URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 172.65.232.43 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash cff1b23befe235b93fefe488cb0c9372c69510253eccdb1f555f47256ba7a75f Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Accept application/json, text/plain, */* Referer https://www.group-ib.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers X-Origin-Hublet eu1 Date Wed, 20 Sep 2023 13:09:42 GMT Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff CF-Cache-Status DYNAMIC Content-Encoding br x-evy-trace-route-service-name envoyset-translator X-HubSpot-Correlation-Id e0a6479e-c9f8-4eb5-a780-4c559ee9c90a Transfer-Encoding chunked x-envoy-upstream-service-time 10 Connection keep-alive alt-svc h3=":443"; ma=86400 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id e0a6479e-c9f8-4eb5-a780-4c559ee9c90a Server cloudflare X-Trace 2B075EF83AE2111F2AC446F61734CADCCB1955623F000000000000000000 Vary origin Access-Control-Allow-Methods OPTIONS, GET Content-Type application/json;charset=utf-8 Access-Control-Allow-Origin https://www.group-ib.com x-evy-trace-virtual-host all Access-Control-Expose-Headers X-Origin-Hublet Access-Control-Max-Age 180 Access-Control-Allow-Credentials false Cache-Control max-age=0, no-cache, no-store X-Robots-Tag none Access-Control-Allow-Headers * CF-RAY 809a4dec3c9c03b0-FRA x-evy-trace-served-by-pod fra04/star-hubspot-td/envoy-proxy-79bb87d888-f772t
GET H2	200	cross.svg website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/	342 B 1 KB	109ms 109ms	Image image/svg+xml	2600:9000:225b:2a00:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/cross.svg Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:225b:2a00:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash dfb059f8aa219769088fd6c85d85aae789f1e72bfe3d314748f1f3ccfffffb1c Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Wed, 20 Sep 2023 13:09:42 GMT via 1.1 af1bbc213b3a9ee2f125be77ca3609a0.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop MUC50-P1 x-cache Miss from cloudfront content-length 207 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 28 Jun 2022 07:55:26 GMT server nginx etag "156-5e27d5c025780-gzip" x-frame-options sameorigin vary Accept-Encoding content-type image/svg+xml access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id OPvnYFiyNzZ9HAS5fMOuE4Vk0DTU37roCHSxU0ifeiX5z46njUJsgg== expires Wed, 20 Sep 2023 13:39:42 GMT
GET H/1.1	200 OK	json Show response forms-eu1.hsforms.com/embed/v3/form/25755956/4dbceae1-75ae-423a-9c12-dee8f1ca3345/	112 KB 30 KB	176ms 78ms	XHR application/json	172.65.232.43 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://forms-eu1.hsforms.com/embed/v3/form/25755956/4dbceae1-75ae-423a-9c12-dee8f1ca3345/json?hs_static_app=forms-embed&hs_static_app_version=1.3775&X-HubSpot-Static-App-Info=forms-embed-1.3775 Requested by Host: fhp-de-js.group-ib.com URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 172.65.232.43 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 86d1b946d3fa7abc9e72c7d42a3f120dde1a4d6640905847892d728d81e42e83 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Accept application/json, text/plain, */* Referer https://www.group-ib.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers X-Origin-Hublet eu1 Date Wed, 20 Sep 2023 13:09:42 GMT Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff CF-Cache-Status DYNAMIC Content-Encoding br x-evy-trace-route-service-name envoyset-translator X-HubSpot-Correlation-Id b4fb5fdd-dc22-403e-a5b1-53f41c2c3074 Transfer-Encoding chunked x-envoy-upstream-service-time 18 Connection keep-alive alt-svc h3=":443"; ma=86400 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id b4fb5fdd-dc22-403e-a5b1-53f41c2c3074 Server cloudflare X-Trace 2B7DD3950423814A2D343635DD3F733DBE74B03671000000000000000000 Vary origin Access-Control-Allow-Methods OPTIONS, GET Content-Type application/json;charset=utf-8 Access-Control-Allow-Origin https://www.group-ib.com x-evy-trace-virtual-host all Access-Control-Expose-Headers X-Origin-Hublet Access-Control-Max-Age 180 Access-Control-Allow-Credentials false Cache-Control max-age=0, no-cache, no-store X-Robots-Tag none Access-Control-Allow-Headers * CF-RAY 809a4dec3e29928f-FRA x-evy-trace-served-by-pod fra04/star-hubspot-td/envoy-proxy-79bb87d888-vvgjb
GET DATA	200 OK	truncated /	64 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 01caf20e667c8e300960582162f912d9405e9895c32cff1a9ee95511fd509a2c Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	68 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 1f464ef7c0b366ff00e2f023cb6b48112306212648e451ddf16be40c2b99d639 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	69 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 81cc2a3a0c0b6e8335f5f3143390b8b6f036dc573e73d3f4b5742482f0bdca73 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers Content-Type image/svg+xml
GET H2	200	dropdown_before.svg website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/	154 B 972 B	106ms 106ms	Image image/svg+xml	2600:9000:225b:2a00:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/dropdown_before.svg Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:225b:2a00:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 574ab1a3d7b47add5d43a927f62c87698264f63572acd70b42081dd4a1dc5ced Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Wed, 20 Sep 2023 13:09:42 GMT via 1.1 af1bbc213b3a9ee2f125be77ca3609a0.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop MUC50-P1 x-cache Miss from cloudfront content-length 150 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 28 Jun 2022 07:55:26 GMT server nginx etag "9a-5e27d5c025780-gzip" x-frame-options sameorigin vary Accept-Encoding content-type image/svg+xml access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id CrG74zG7naH9lGcuh498lzM9O_jdM52ytmF9lp5ixTu3lSyN-xTSFw== expires Wed, 20 Sep 2023 13:39:42 GMT
GET H2	200	link-arrow.svg website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/	409 B 1 KB	100ms 100ms	Image image/svg+xml	2600:9000:225b:2a00:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/link-arrow.svg Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:225b:2a00:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash e91c5731358570d3e4cd684118251d243fc799059648b152403dcd775ceba632 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Wed, 20 Sep 2023 13:09:42 GMT via 1.1 af1bbc213b3a9ee2f125be77ca3609a0.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop MUC50-P1 x-cache Miss from cloudfront content-length 267 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 28 Jun 2022 07:55:26 GMT server nginx etag "199-5e27d5c025780-gzip" x-frame-options sameorigin vary Accept-Encoding content-type image/svg+xml access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id 16F_Vr0jhZIgNplIWblcJqWLPITEz0T78SSnq5jt3GDEIHsPKXxtPA== expires Wed, 20 Sep 2023 13:39:42 GMT
GET H2	200	Close.svg www.group-ib.com/wp-content/themes/gib-theme/assets/images/	227 B 264 B	91ms 91ms	Image image/svg+xml	3.72.181.255 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://www.group-ib.com/wp-content/themes/gib-theme/assets/images/Close.svg Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-72-181-255.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash 31d1c5bd0cd38e6e6b8eb944944df273044e826c7d3daacbe602caead3068c7a Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://website.cdn.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Wed, 20 Sep 2023 13:09:42 GMT strict-transport-security max-age=31536000; includeSubDomains content-length 180 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 29 Nov 2022 12:14:21 GMT server nginx etag "e3-5ee9aed8bc981-gzip" vary Accept-Encoding x-frame-options sameorigin content-type image/svg+xml access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes expires Wed, 20 Sep 2023 13:39:42 GMT
GET H2	200	file_copy.svg www.group-ib.com/wp-content/themes/gib-theme/assets/images/	668 B 438 B	94ms 94ms	Image image/svg+xml	3.72.181.255 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://www.group-ib.com/wp-content/themes/gib-theme/assets/images/file_copy.svg Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-72-181-255.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash f367bbc4429fc9fb0a93045245aef519a000ab275549645cddecb3f953e0a05f Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://website.cdn.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Wed, 20 Sep 2023 13:09:42 GMT strict-transport-security max-age=31536000; includeSubDomains content-length 352 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Mon, 28 Nov 2022 13:01:55 GMT server nginx etag "29c-5ee8779d1a6cb-gzip" vary Accept-Encoding x-frame-options sameorigin content-type image/svg+xml access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes expires Wed, 20 Sep 2023 13:39:42 GMT
GET H2	200	success.svg www.group-ib.com/wp-content/themes/gib-theme/assets/images/	386 B 364 B	88ms 88ms	Image image/svg+xml	3.72.181.255 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://www.group-ib.com/wp-content/themes/gib-theme/assets/images/success.svg Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-72-181-255.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash fa4859289ded4c674dcee233811758743116b1d7ce4e9f0c0e7e259391504c43 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://website.cdn.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Wed, 20 Sep 2023 13:09:42 GMT strict-transport-security max-age=31536000; includeSubDomains content-length 254 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 29 Nov 2022 11:07:05 GMT server nginx etag "182-5ee99fd05f106-gzip" vary Accept-Encoding x-frame-options sameorigin content-type image/svg+xml access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes expires Wed, 20 Sep 2023 13:39:42 GMT
GET H2	200	list-dot.svg www.group-ib.com/wp-content/themes/gib-theme/assets/images/	313 B 309 B	93ms 93ms	Image image/svg+xml	3.72.181.255 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://www.group-ib.com/wp-content/themes/gib-theme/assets/images/list-dot.svg Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-72-181-255.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash 6b0775723ccade5ca3170fcc6a321c5b4768a5dc2b7c83b8b8b595407a2f0018 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://website.cdn.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Wed, 20 Sep 2023 13:09:42 GMT strict-transport-security max-age=31536000; includeSubDomains content-length 205 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Thu, 08 Sep 2022 12:02:57 GMT server nginx etag "139-5e82935d2238c-gzip" vary Accept-Encoding x-frame-options sameorigin content-type image/svg+xml access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes expires Wed, 20 Sep 2023 13:39:42 GMT
GET H2	200	Dropdown-right.svg website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/	503 B 1 KB	63ms 63ms	Image image/svg+xml	2600:9000:225b:2a00:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/Dropdown-right.svg Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:225b:2a00:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 4d4a484a100e469b6e3dcf880a37755086e246cc291bab46e3edd4529e3d5d6a Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Wed, 20 Sep 2023 13:09:42 GMT via 1.1 af1bbc213b3a9ee2f125be77ca3609a0.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop MUC50-P1 x-cache Miss from cloudfront content-length 307 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Fri, 16 Dec 2022 09:56:36 GMT server nginx etag "1f7-5efeefc3ee1d1-gzip" x-frame-options sameorigin vary Accept-Encoding content-type image/svg+xml access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id xgx-qpvPqSSjX9ijxLpkk-b7ab-mOad0Q8iIqYjZJ8vH-8F0hQ7Y4w== expires Wed, 20 Sep 2023 13:39:42 GMT
GET H2	200	G-font-Bold.otf website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/fonts/G-font/	49 KB 32 KB	156ms 128ms	Font application/x-font-otf	2600:9000:225b:2a00:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/fonts/G-font/G-font-Bold.otf Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:225b:2a00:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 8d15a221986226efe4f742f390f46f9d5ae8b2008a6edd40e10ff121ef9cca9b Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers Referer https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css Origin https://www.group-ib.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Wed, 20 Sep 2023 13:09:42 GMT via 1.1 fb542039f97bb702c0e68d2142c449aa.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop MUC50-P1 x-cache Miss from cloudfront content-length 31918 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 28 Jun 2022 07:55:26 GMT server nginx etag "c320-5e27d5c025780-gzip" x-frame-options sameorigin vary Accept-Encoding content-type application/x-font-otf access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id 8t9CIgTeHhNHReuRH9MkpU0kaFTrzHMuBxNDmSagNEDIzX00ZnvvaA== expires Wed, 20 Sep 2023 13:39:42 GMT
GET DATA	200 OK	truncated /	68 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 735f81dd07d1be528a1109302dabc97c7c8b467d60d7184d3a09dc4817703388 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	70 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 4d3e9d61c84a9a3d9e67408de91640d9960ade0384f91137b41b2db7242cee46 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	68 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash eb34f496dadbb9a36d46f7cb1f331a7b8d128cbbf92bc8bf166fcd4b8bd4cc50 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	69 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash c794a1b7e43ae801fa6d36ccda0cf1d344cd1dd8ab9d14d89b52c32236193265 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	68 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash b3ceb8713eaee6c95dffc5e4b1c6187675d8ba16f58f73fc30b5c5ae762f0ad7 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	68 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 403ac797af2f41dca43b737054d3751629920850b59f433b5b5076ea20e32a07 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	69 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 32942cb255fb7f8c412c42973599e2e32cf4899df5a9dfe0b6173640fa9d6f70 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	68 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 248468001ca64ad036ae965b6ce2de991bea9e8d4d59342fd3389a2e05fea523 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	69 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 93b716bdb2ddaeaf8424a1834eb09925889a1911ce6bac298b4f4e9fedbb4f4b Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	68 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 688c32f4de8bd2a7dd5917bae5ddce56a28223db4953c3c701977b8b2e358eb9 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	68 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash b486dfa94fde5b7e78a90b34417c9f976057f55b862dcdb3c7e41dfd7c5e93e3 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	68 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash a57f1ad414e426849b2d9f404fa861248d9b65d927ca32c337f11b022acce8aa Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	69 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash cf38411843332cbc47ca7d9974d8edc2d12850a698bba900795c2eaa6e12f9f3 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers Content-Type image/svg+xml
GET H2	200	Material-Icons.woff2 website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/fonts/Material-Icons/	125 KB 126 KB	138ms 138ms	Font application/font-woff2	2600:9000:225b:2a00:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/fonts/Material-Icons/Material-Icons.woff2 Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:225b:2a00:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 8265f64786397d6b832d1ca0aafdf149ad84e72759fffa9f7272e91a0fb015d1 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers Referer https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css Origin https://www.group-ib.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Wed, 20 Sep 2023 13:09:42 GMT via 1.1 fb542039f97bb702c0e68d2142c449aa.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop MUC50-P1 x-cache Miss from cloudfront x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Mon, 12 Sep 2022 13:11:21 GMT server nginx etag "1f560-5e87aa1cf30ee-gzip" x-frame-options sameorigin vary Accept-Encoding content-type application/font-woff2 access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id WcYCHyGxHGkK4bhSdLlOnZaZ5I_nq_YX1o-9tpuk86DW8vGj3VvRnw== expires Wed, 20 Sep 2023 13:39:42 GMT
GET DATA	200 OK	truncated /	68 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 34e0bb5c5ed1184e6452cf7562faf332af1a26e95e50e035ff0a9f7065e6df9e Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers Content-Type image/svg+xml
GET H/1.1	200 OK	json Show response forms-eu1.hsforms.com/embed/v3/form/25755956/55a22738-d5a5-43f9-9c1c-fa4c1a6eb349/	8 KB 3 KB	171ms 89ms	XHR application/json	172.65.232.43 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://forms-eu1.hsforms.com/embed/v3/form/25755956/55a22738-d5a5-43f9-9c1c-fa4c1a6eb349/json?hs_static_app=forms-embed&hs_static_app_version=1.3775&X-HubSpot-Static-App-Info=forms-embed-1.3775 Requested by Host: fhp-de-js.group-ib.com URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 172.65.232.43 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e7c9f50de52e2bc6020001b4f6cdd18bf3002d2ba7e71cbc28c45255373a3d28 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Accept application/json, text/plain, */* Referer https://www.group-ib.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers X-Origin-Hublet eu1 Date Wed, 20 Sep 2023 13:09:42 GMT Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff CF-Cache-Status DYNAMIC Content-Encoding br x-evy-trace-route-service-name envoyset-translator X-HubSpot-Correlation-Id 31f58c46-6eb9-4be0-b674-b7117da29b31 Transfer-Encoding chunked x-envoy-upstream-service-time 8 Connection keep-alive alt-svc h3=":443"; ma=86400 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id 31f58c46-6eb9-4be0-b674-b7117da29b31 Server cloudflare X-Trace 2B916E15DA6E757DCCC5BA45495BE865AA4CBC2DD9000000000000000000 Vary origin Access-Control-Allow-Methods OPTIONS, GET Content-Type application/json;charset=utf-8 Access-Control-Allow-Origin https://www.group-ib.com x-evy-trace-virtual-host all Access-Control-Expose-Headers X-Origin-Hublet Access-Control-Max-Age 180 Access-Control-Allow-Credentials false Cache-Control max-age=0, no-cache, no-store X-Robots-Tag none Access-Control-Allow-Headers * CF-RAY 809a4decbd8a03b0-FRA x-evy-trace-served-by-pod fra04/star-hubspot-td/envoy-proxy-79bb87d888-6mshh
GET H2	200	gtm.js Show response www.googletagmanager.com/	273 KB 89 KB	145ms 57ms	Script application/javascript	2a00:1450:4001:80b::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtm.js?id=GTM-PW7265 Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80b::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 778519fd8b54c0302796253e662e8bdc5476a67013152ab5c82cf7a921ace107 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers date Wed, 20 Sep 2023 13:09:42 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 90338 x-xss-protection 0 last-modified Wed, 20 Sep 2023 12:00:00 GMT server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Wed, 20 Sep 2023 13:09:42 GMT
GET H2	200	insight.min.js Show response website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/js/	8 KB 4 KB	69ms 69ms	Script application/x-javascript	2600:9000:225b:2a00:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/js/insight.min.js Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:225b:2a00:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 14f2ec002b176e0dee403cb7dd4ef2274a1353080e1e3e4084678770f4c15b9c Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Wed, 20 Sep 2023 13:09:42 GMT via 1.1 af1bbc213b3a9ee2f125be77ca3609a0.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop MUC50-P1 x-cache Miss from cloudfront content-length 3085 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Fri, 15 Jul 2022 14:12:57 GMT server nginx etag "1e5a-5e3d89d6a8c40-gzip" x-frame-options sameorigin vary Accept-Encoding content-type application/x-javascript access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id 2RYT_wxbwiP6uVOMKxYMUzzkhiQVTxhJlGj2a19zc6_t9dkOo7SQRg== expires Wed, 20 Sep 2023 13:39:42 GMT
GET H/1.1	200 OK	json Show response forms-eu1.hsforms.com/embed/v3/form/25755956/eb903dab-0ef3-43b5-bdeb-71372e6ad0f0/	7 KB 3 KB	164ms 92ms	XHR application/json	172.65.232.43 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://forms-eu1.hsforms.com/embed/v3/form/25755956/eb903dab-0ef3-43b5-bdeb-71372e6ad0f0/json?hs_static_app=forms-embed&hs_static_app_version=1.3775&X-HubSpot-Static-App-Info=forms-embed-1.3775 Requested by Host: fhp-de-js.group-ib.com URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 172.65.232.43 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash a0fd4881fbac377ec8b384d9b980b65931903a55b1ae29200d3e20c86bffedaa Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Accept application/json, text/plain, */* Referer https://www.group-ib.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers X-Origin-Hublet eu1 Date Wed, 20 Sep 2023 13:09:42 GMT Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff CF-Cache-Status DYNAMIC Content-Encoding br x-evy-trace-route-service-name envoyset-translator X-HubSpot-Correlation-Id 580d1b9b-0268-4e6f-af09-02ea82bfb444 Transfer-Encoding chunked x-envoy-upstream-service-time 7 Connection keep-alive alt-svc h3=":443"; ma=86400 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id 580d1b9b-0268-4e6f-af09-02ea82bfb444 Server cloudflare X-Trace 2B885985F40F777B507F9AC3113B661ECECC2810ED000000000000000000 Vary origin Access-Control-Allow-Methods OPTIONS, GET Content-Type application/json;charset=utf-8 Access-Control-Allow-Origin https://www.group-ib.com x-evy-trace-virtual-host all Access-Control-Expose-Headers X-Origin-Hublet Access-Control-Max-Age 180 Access-Control-Allow-Credentials false Cache-Control max-age=0, no-cache, no-store X-Robots-Tag none Access-Control-Allow-Headers * CF-RAY 809a4decbe94928f-FRA x-evy-trace-served-by-pod fra04/star-hubspot-td/envoy-proxy-79bb87d888-vvgjb
GET H2	200	main-logo.svg www.group-ib.com/wp-content/themes/gib-theme/assets/images/	3 KB 2 KB	139ms 131ms	Image image/svg+xml	3.72.181.255 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://www.group-ib.com/wp-content/themes/gib-theme/assets/images/main-logo.svg Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-72-181-255.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash 589c9a6a159cf2ecc8555bc4457827f21002eaec9a24e3bc54401ed0b4d30ac8 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Wed, 20 Sep 2023 13:09:42 GMT strict-transport-security max-age=31536000; includeSubDomains content-length 1527 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Mon, 30 Jan 2023 11:16:06 GMT server nginx etag "d82-5f379576be685-gzip" vary Accept-Encoding x-frame-options sameorigin content-type image/svg+xml access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes expires Wed, 20 Sep 2023 13:39:42 GMT
GET H2	200	ti.png website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/	6 KB 7 KB	165ms 157ms	Image image/png	2600:9000:225b:2a00:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/ti.png Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:225b:2a00:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash f0e3a799744c0c67782742af2c13b85f769b58abd04800a04853d26f60cf7314 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; date Wed, 20 Sep 2023 13:09:42 GMT x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains via 1.1 af1bbc213b3a9ee2f125be77ca3609a0.cloudfront.net (CloudFront) x-amz-cf-pop MUC50-P1 x-cache Miss from cloudfront content-length 5919 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 28 Jun 2022 07:55:26 GMT server nginx etag "171f-5e27d5c025780" x-frame-options sameorigin content-type image/png access-control-allow-origin https://www.group-ib.com cache-control no-cache, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id inY82F4No3isEyhrcm8MLhYTTJfqKlb9yb7pZq3imMqo70sqhYvuFg== expires Wed, 20 Sep 2023 13:09:41 GMT
GET H2	200	asm.png website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/	6 KB 7 KB	167ms 159ms	Image image/png	2600:9000:225b:2a00:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/asm.png Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:225b:2a00:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 997d49d316b533985208f14602a1ff15a76bf6a567afbb6b6980629ca8d78bab Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; date Wed, 20 Sep 2023 13:09:42 GMT x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains via 1.1 af1bbc213b3a9ee2f125be77ca3609a0.cloudfront.net (CloudFront) x-amz-cf-pop MUC50-P1 x-cache Miss from cloudfront content-length 5941 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 28 Jun 2022 07:55:26 GMT server nginx etag "1735-5e27d5c025780" x-frame-options sameorigin content-type image/png access-control-allow-origin https://www.group-ib.com cache-control no-cache, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id nC6rOxF_Svuz1U_pbzTs7VAR_wkVFIJ1ED0d-DlurMY2dU4uFYyNYA== expires Wed, 20 Sep 2023 13:09:41 GMT
GET H2	200	fp.png website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/	8 KB 8 KB	164ms 156ms	Image image/png	2600:9000:225b:2a00:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/fp.png Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:225b:2a00:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 15534f98c260c3c3caaedf53335d912010b2de1731477a9fd4dbea89fb4995d9 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; date Wed, 20 Sep 2023 13:09:42 GMT x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains via 1.1 af1bbc213b3a9ee2f125be77ca3609a0.cloudfront.net (CloudFront) x-amz-cf-pop MUC50-P1 x-cache Miss from cloudfront content-length 7844 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 28 Jun 2022 07:55:26 GMT server nginx etag "1ea4-5e27d5c025780" x-frame-options sameorigin content-type image/png access-control-allow-origin https://www.group-ib.com cache-control no-cache, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id xDL3RgPX9_c_8VcVLPhmWZLIyq936OjFsvrft0ZG7rLTkDUpwyERAQ== expires Wed, 20 Sep 2023 13:09:41 GMT
GET H2	200	drp.png website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/	5 KB 6 KB	164ms 157ms	Image image/png	2600:9000:225b:2a00:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/drp.png Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:225b:2a00:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash a300a894e169169882504968fae71958a87e0a4322e2aee1b6b0bbd63fd9621f Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; date Wed, 20 Sep 2023 13:09:42 GMT x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains via 1.1 af1bbc213b3a9ee2f125be77ca3609a0.cloudfront.net (CloudFront) x-amz-cf-pop MUC50-P1 x-cache Miss from cloudfront content-length 5398 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 28 Jun 2022 07:55:26 GMT server nginx etag "1516-5e27d5c025780" x-frame-options sameorigin content-type image/png access-control-allow-origin https://www.group-ib.com cache-control no-cache, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id wyS0rf8u9pZ8QOPNXeczVAuGOv6nWSWEZ73R-L3ahpiBv0MvkGwRNA== expires Wed, 20 Sep 2023 13:09:41 GMT
GET H2	200	mxdr.png website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/	6 KB 7 KB	146ms 139ms	Image image/png	2600:9000:225b:2a00:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/mxdr.png Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:225b:2a00:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 2be8ce2b065360537771ed230d5d72cbd84758ec127ffa035e6d260ed14af5b0 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; date Wed, 20 Sep 2023 13:09:42 GMT x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains via 1.1 af1bbc213b3a9ee2f125be77ca3609a0.cloudfront.net (CloudFront) x-amz-cf-pop MUC50-P1 x-cache Miss from cloudfront content-length 6506 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 28 Jun 2022 07:55:26 GMT server nginx etag "196a-5e27d5c025780" x-frame-options sameorigin content-type image/png access-control-allow-origin https://www.group-ib.com cache-control no-cache, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id EnkBXXyYwCxhV_CVSNGzf7hB1JNah2xQmvb_qat9IhQTSRH35MNjIA== expires Wed, 20 Sep 2023 13:09:41 GMT
GET H2	200	bep.png website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/	6 KB 7 KB	98ms 91ms	Image image/png	2600:9000:225b:2a00:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/bep.png Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:225b:2a00:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 7574ba97d4ee7e81bd60873a52a31ff13359f246d0ac492ef2dabf96233a99e6 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; date Wed, 20 Sep 2023 13:09:42 GMT x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains via 1.1 af1bbc213b3a9ee2f125be77ca3609a0.cloudfront.net (CloudFront) x-amz-cf-pop MUC50-P1 x-cache Miss from cloudfront content-length 6362 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 28 Jun 2022 07:55:26 GMT server nginx etag "18da-5e27d5c025780" x-frame-options sameorigin content-type image/png access-control-allow-origin https://www.group-ib.com cache-control no-cache, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id SddrUk17DmhecE-8uVKNgulXR5Q9Z0vbZk3AzEq_Nnb_W3_KQ_dzrQ== expires Wed, 20 Sep 2023 13:09:41 GMT
GET H2	200	share-black.svg www.group-ib.com/wp-content/themes/gib-theme/assets/images/	1 KB 584 B	136ms 130ms	Image image/svg+xml	3.72.181.255 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://www.group-ib.com/wp-content/themes/gib-theme/assets/images/share-black.svg Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-72-181-255.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash 3689e488f5478e26f0347353ad608ccd66e4d62992021c51d9db93f89d43c880 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Wed, 20 Sep 2023 13:09:42 GMT strict-transport-security max-age=31536000; includeSubDomains content-length 500 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 22 Nov 2022 11:16:45 GMT server nginx etag "468-5ee0d4eb0feca-gzip" vary Accept-Encoding x-frame-options sameorigin content-type image/svg+xml access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes expires Wed, 20 Sep 2023 13:39:42 GMT
GET H2	200	wb_sunny-black.svg www.group-ib.com/wp-content/themes/gib-theme/assets/images/	724 B 505 B	140ms 134ms	Image image/svg+xml	3.72.181.255 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://www.group-ib.com/wp-content/themes/gib-theme/assets/images/wb_sunny-black.svg Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-72-181-255.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash cc5dcea4d483d798630d7fe0846a1b784618aa3d4f86bdfa655083d81750322a Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Wed, 20 Sep 2023 13:09:42 GMT strict-transport-security max-age=31536000; includeSubDomains content-length 385 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 22 Nov 2022 11:16:45 GMT server nginx etag "2d4-5ee0d4eb0feca-gzip" vary Accept-Encoding x-frame-options sameorigin content-type image/svg+xml access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes expires Wed, 20 Sep 2023 13:39:42 GMT
GET H2	200	moon.svg www.group-ib.com/wp-content/themes/gib-theme/assets/images/	627 B 447 B	138ms 133ms	Image image/svg+xml	3.72.181.255 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://www.group-ib.com/wp-content/themes/gib-theme/assets/images/moon.svg Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-72-181-255.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash dedf6c9294a8b9e4b13b1575641071e45c8e61235bd154d19103fd2893ccd708 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Wed, 20 Sep 2023 13:09:42 GMT strict-transport-security max-age=31536000; includeSubDomains content-length 361 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Thu, 24 Nov 2022 12:37:03 GMT server nginx etag "273-5ee36a9860213-gzip" vary Accept-Encoding x-frame-options sameorigin content-type image/svg+xml access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes expires Wed, 20 Sep 2023 13:39:42 GMT
GET H2	200	zero-day-blog.webp website.cdn.group-ib.com/wp-content/uploads/	537 KB 538 KB	149ms 143ms	Image image/webp	2600:9000:225b:2a00:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/uploads/zero-day-blog.webp Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:225b:2a00:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash bdf12ec840a34387693613f68d9c92c83777c5318d5d1ff7d0392930297ede69 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; date Wed, 20 Sep 2023 13:09:42 GMT x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains via 1.1 af1bbc213b3a9ee2f125be77ca3609a0.cloudfront.net (CloudFront) x-amz-cf-pop MUC50-P1 x-cache Miss from cloudfront content-length 549864 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 15 Aug 2023 07:54:45 GMT server nginx etag "863e8-602f17e0c7095" x-frame-options sameorigin content-type image/webp access-control-allow-origin https://www.group-ib.com cache-control no-cache, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id -74tnQkNfP8mJns6jJBtkPnPIMLUC5AlRfYnLu-e0ZqK5igAmXs38w== expires Wed, 20 Sep 2023 13:09:41 GMT
GET H2	200	polovinkin-1.png website.cdn.group-ib.com/wp-content/uploads/	49 KB 50 KB	144ms 139ms	Image image/png	2600:9000:225b:2a00:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/uploads/polovinkin-1.png Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:225b:2a00:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash e2bc964baa3f3b79d9ef59a46164809bde86d6550a4de912535d056e514ae152 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; date Wed, 20 Sep 2023 13:09:42 GMT x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains via 1.1 af1bbc213b3a9ee2f125be77ca3609a0.cloudfront.net (CloudFront) x-amz-cf-pop MUC50-P1 x-cache Miss from cloudfront content-length 50537 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Fri, 14 Apr 2023 09:15:22 GMT server nginx etag "c569-5f94847e19d03" x-frame-options sameorigin content-type image/png access-control-allow-origin https://www.group-ib.com cache-control no-cache, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id MLGWBirBEDV3VwMbT-oMKMqnOuHHDQ7Tq7NbQj67nK0f8JdPVjc7yQ== expires Wed, 20 Sep 2023 13:09:41 GMT
GET H2	200	bg-blog-1.webp website.cdn.group-ib.com/wp-content/uploads/	78 KB 79 KB	90ms 85ms	Image image/webp	2600:9000:225b:2a00:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/uploads/bg-blog-1.webp Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:225b:2a00:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 262bf2c92169d5c716192eeefffdbf6733a931638effa19c924d1d645e438c75 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; date Wed, 20 Sep 2023 13:09:42 GMT x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains via 1.1 af1bbc213b3a9ee2f125be77ca3609a0.cloudfront.net (CloudFront) x-amz-cf-pop MUC50-P1 x-cache Miss from cloudfront content-length 80256 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Fri, 15 Sep 2023 10:04:13 GMT server nginx etag "13980-60562ea252000" x-frame-options sameorigin content-type image/webp access-control-allow-origin https://www.group-ib.com cache-control no-cache, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id 5RAoSgC_ZGSlmTUQ5mrJfFL-i78y3aZb4hitkZ4QVjtUoCzRksa04g== expires Wed, 20 Sep 2023 13:09:41 GMT
GET H2	200	investment-scam-global-small.webp website.cdn.group-ib.com/wp-content/uploads/	140 KB 141 KB	173ms 170ms	Image image/webp	2600:9000:225b:2a00:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/uploads/investment-scam-global-small.webp Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:225b:2a00:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 8fd12740461147a867c96750f2040e646997e6c747bf4ad8f071794931a0dd0b Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; date Wed, 20 Sep 2023 13:09:42 GMT x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains via 1.1 af1bbc213b3a9ee2f125be77ca3609a0.cloudfront.net (CloudFront) x-amz-cf-pop MUC50-P1 x-cache Miss from cloudfront content-length 143070 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Wed, 06 Sep 2023 09:05:12 GMT server nginx etag "22ede-604ad0a7dc04c" x-frame-options sameorigin content-type image/webp access-control-allow-origin https://www.group-ib.com cache-control no-cache, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id br4X3dvlBK8XaNcrS2d0V1JPp9BvSQ0pcioXsRv6MaDVKfXjty78oA== expires Wed, 20 Sep 2023 13:09:41 GMT
GET H2	200	loyalty-small.webp website.cdn.group-ib.com/wp-content/uploads/	105 KB 106 KB	143ms 140ms	Image image/webp	2600:9000:225b:2a00:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/uploads/loyalty-small.webp Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:225b:2a00:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 2ce8f3f95a9f5296e5527036b6613cdc26b59329c358737044e1b45236e25c47 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; date Wed, 20 Sep 2023 13:09:42 GMT x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains via 1.1 af1bbc213b3a9ee2f125be77ca3609a0.cloudfront.net (CloudFront) x-amz-cf-pop MUC50-P1 x-cache Miss from cloudfront content-length 107134 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Fri, 01 Sep 2023 14:24:55 GMT server nginx etag "1a27e-6044cecb631a8" x-frame-options sameorigin content-type image/webp access-control-allow-origin https://www.group-ib.com cache-control no-cache, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id 1qGI7v4-05nxcVaffUclD7-9sA98ogXty_MMIEVF_qJuZbvMTvAa9w== expires Wed, 20 Sep 2023 13:09:41 GMT
GET H2	200	tag.js Show response mc.yandex.ru/metrika/	202 KB 70 KB	310ms 147ms	Script application/javascript	2a02:6b8::1:119 GLOBAL_DC
General Check archive.org Show headers Download Go to Full URL https://mc.yandex.ru/metrika/tag.js Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/js/main.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI), Reverse DNS Software / Resource Hash 92d967aa9f47d13c45fa328edf25255a86f1b4cabf5673a516166a274da4c235 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers date Wed, 20 Sep 2023 13:09:42 GMT content-encoding br strict-transport-security max-age=31536000 last-modified Thu, 07 Sep 2023 11:49:37 GMT accept-ch Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA etag "64f98ea1-11420" content-type application/javascript access-control-allow-origin * cache-control max-age=3600 timing-allow-origin * content-length 70688 expires Wed, 20 Sep 2023 14:09:42 GMT
POST		admin-ajax.php www.group-ib.com/wp-admin/	0 0
GET H2	200	twitter-64.svg website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/	1 KB 1 KB	172ms 171ms	Image image/svg+xml	2600:9000:225b:2a00:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/twitter-64.svg Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:225b:2a00:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash ae9dad69229703dfa3b6d226c4c7d692e2f2809bf2475f22612824c2f7602efc Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Wed, 20 Sep 2023 13:09:42 GMT via 1.1 af1bbc213b3a9ee2f125be77ca3609a0.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop MUC50-P1 x-cache Miss from cloudfront content-length 554 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 29 Nov 2022 07:39:21 GMT server nginx etag "426-5ee9716179e8a-gzip" x-frame-options sameorigin vary Accept-Encoding content-type image/svg+xml access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id wy85aW-HFxSUrMqebeP4JQL1zxQkDBn2bUB2Q8nEMuJxf23V35_h6A== expires Wed, 20 Sep 2023 13:39:42 GMT
GET H2	200	twitter-lbg.svg website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/	2 KB 2 KB	127ms 125ms	Image image/svg+xml	2600:9000:225b:2a00:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/twitter-lbg.svg Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:225b:2a00:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 294fdc878aa8c42b19edc18d385880ad886397846aca640c305f3eb53a965e13 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Wed, 20 Sep 2023 13:09:42 GMT via 1.1 af1bbc213b3a9ee2f125be77ca3609a0.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop MUC50-P1 x-cache Miss from cloudfront content-length 742 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 29 Nov 2022 07:39:21 GMT server nginx etag "8f2-5ee9716179e8a-gzip" x-frame-options sameorigin vary Accept-Encoding content-type image/svg+xml access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id FxGFfffU_sZhytNG_XBLux8n0ssY3bEs9CqiR9j8fc_EJYdb3-Y1vA== expires Wed, 20 Sep 2023 13:39:42 GMT
GET H2	200	linkedin-64.svg website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/	919 B 1 KB	94ms 93ms	Image image/svg+xml	2600:9000:225b:2a00:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/linkedin-64.svg Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:225b:2a00:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash f4991587d5312981e74087707ed399bd3820d83f773e7773c013ce00d6835f28 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Wed, 20 Sep 2023 13:09:42 GMT via 1.1 af1bbc213b3a9ee2f125be77ca3609a0.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop MUC50-P1 x-cache Miss from cloudfront content-length 470 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 29 Nov 2022 07:39:21 GMT server nginx etag "397-5ee9716179e8a-gzip" x-frame-options sameorigin vary Accept-Encoding content-type image/svg+xml access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id agWyExTaFPgcinyn7O5JsnkKmo0rTWWIysCQzfzWUx8K_Mp2b5IQNQ== expires Wed, 20 Sep 2023 13:39:42 GMT
GET H2	200	linkedin-lbg.svg website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/	2 KB 1 KB	153ms 152ms	Image image/svg+xml	2600:9000:225b:2a00:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/linkedin-lbg.svg Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:225b:2a00:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash c33709a20ca4cd516d65b07a79c1d75445892fcb6d8c6f3871a47ab38d85e075 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Wed, 20 Sep 2023 13:09:42 GMT via 1.1 af1bbc213b3a9ee2f125be77ca3609a0.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop MUC50-P1 x-cache Miss from cloudfront content-length 639 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 29 Nov 2022 07:39:21 GMT server nginx etag "7ca-5ee9716179e8a-gzip" x-frame-options sameorigin vary Accept-Encoding content-type image/svg+xml access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id OZ7-INTArsrH-iIPdQFRV9TdahrmXDW0YMyc0XUNV7pqjXz2Una_IQ== expires Wed, 20 Sep 2023 13:39:42 GMT
GET H2	200	telegram-64.svg website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/	1 KB 2 KB	105ms 104ms	Image image/svg+xml	2600:9000:225b:2a00:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/telegram-64.svg Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:225b:2a00:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash cdc4d10b6b74ad79b55333b9882e854f054ee8b9953c6203dc46c68dc74eb0fb Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Wed, 20 Sep 2023 13:09:42 GMT via 1.1 af1bbc213b3a9ee2f125be77ca3609a0.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop MUC50-P1 x-cache Miss from cloudfront content-length 787 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 29 Nov 2022 07:39:21 GMT server nginx etag "5fc-5ee9716179e8a-gzip" x-frame-options sameorigin vary Accept-Encoding content-type image/svg+xml access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id UhCFIJ6mFQmC45_0L44G2RTzte_AX8Sqjj13pclDPj6miqSL71LxSw== expires Wed, 20 Sep 2023 13:39:42 GMT
GET H2	200	telegram-lbg.svg website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/	3 KB 2 KB	133ms 132ms	Image image/svg+xml	2600:9000:225b:2a00:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/telegram-lbg.svg Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:225b:2a00:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash ac57c7130d61697977d2ed1796c27eefed8249083472716e474e5604b20636aa Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Wed, 20 Sep 2023 13:09:42 GMT via 1.1 af1bbc213b3a9ee2f125be77ca3609a0.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop MUC50-P1 x-cache Miss from cloudfront content-length 949 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 29 Nov 2022 07:39:21 GMT server nginx etag "bf1-5ee9716179e8a-gzip" x-frame-options sameorigin vary Accept-Encoding content-type image/svg+xml access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id SeIkPWkfB9BoShcbKFhHJwv8Gb1iO5fuE_tXa5jfKPm6uT8N-b51xA== expires Wed, 20 Sep 2023 13:39:42 GMT
GET H2	200	collectedforms.js Show response js-eu1.hscollectedforms.net/	69 KB 25 KB	166ms 58ms	Script application/javascript	172.65.192.122 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js-eu1.hscollectedforms.net/collectedforms.js Requested by Host: js-eu1.hs-scripts.com URL: https://js-eu1.hs-scripts.com/25755956.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.65.192.122 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 026c249acda71b64fe2510542d88ae26073694f89b595b1fd0e9f3ad501bf6b4 Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://www.group-ib.com/ Origin https://www.group-ib.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers date Wed, 20 Sep 2023 13:09:42 GMT x-amz-version-id EcjZkyUfgxNGQ.xnv1Vqq9Oda2f1T.dE via 1.1 84294257ed643a88ee54d2e3f7d7ccea.cloudfront.net (CloudFront) x-content-type-options nosniff cf-cache-status EXPIRED x-amz-cf-pop FRA56-P2 x-evy-trace-route-service-name envoyset-translator x-amz-server-side-encryption AES256 x-hubspot-correlation-id 247105e8-fb5f-4e61-812c-7b633cddd7d1 content-security-policy-report-only frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=collected-forms-embed-js/static-1.394/bundles/project.js&cfRay=809a4dedddf83689-FRA x-cache Hit from cloudfront cache-tag staticjsapp-collected-forms-embed-js-web-prod,staticjsapp-prod content-encoding br x-envoy-upstream-service-time 2 x-amz-replication-status COMPLETED x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id 247105e8-fb5f-4e61-812c-7b633cddd7d1 last-modified Wed, 09 Aug 2023 09:05:38 UTC server cloudflare etag W/"6fb5b8aa66d730f2a49b41a9c712ffa7" vary Accept-Encoding content-type application/javascript; charset=utf-8 access-control-allow-origin * x-evy-trace-virtual-host all x-hs-cache-status HIT cache-control s-maxage=600, max-age=300 x-evy-trace-served-by-pod fra04/app-td/envoy-proxy-5b45bc9bc5-8ct2c cf-ray 809a4dedddf83689-FRA x-amz-cf-id d3wnFSARccC4w4PG4FoNX0RG9j-i90AomPIrp41JBgpyaByL043h7g== x-hs-target-asset collected-forms-embed-js/static-1.394/bundles/project.js
GET H2	200	banner.js Show response js-eu1.hs-banner.com/v2/25755956/	66 KB 20 KB	189ms 75ms	Script text/javascript	172.65.202.201 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js-eu1.hs-banner.com/v2/25755956/banner.js Requested by Host: js-eu1.hs-scripts.com URL: https://js-eu1.hs-scripts.com/25755956.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.65.202.201 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 76cad6003ccfa9b83430a57d5c8365dec62d0799619adcf257e4d762fe499c0a Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers date Wed, 20 Sep 2023 13:09:42 GMT x-amz-version-id Gr5hDFYfL2RydCQo7DZDtOTuBy6zWKNp content-encoding br cf-cache-status REVALIDATED x-amz-request-id HGD4959723QSW3EY x-evy-trace-route-service-name envoyset-translator x-amz-server-side-encryption AES256 x-hubspot-correlation-id 8db673b0-e966-47cf-83c0-4233de437391 x-envoy-upstream-service-time 18 x-amz-id-2 kVTsJSnc7XHlXTvFnhg40g1zpG7MLUGmPKYuvhRbycp9ZYK/OuRxRS9XNxtDN9BNYVqy/QMir1A= x-evy-trace-listener listener_https x-request-id 8db673b0-e966-47cf-83c0-4233de437391 x-evy-trace-route-configuration listener_https/all last-modified Tue, 05 Sep 2023 17:16:06 GMT server cloudflare etag W/"521e41ed5a9a8b6bea16ac212e4e6633" access-control-max-age 604800 access-control-allow-methods GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD content-type text/javascript; charset=UTF-8 access-control-allow-origin https://www.group-ib.com x-evy-trace-virtual-host all access-control-expose-headers x-last-modified-timestamp, X-HubSpot-NotFound, X-HS-User-Request, Link, Server-Timing cache-control max-age=300,public access-control-allow-credentials true x-evy-trace-served-by-pod fra04/analytics-js-proxy-td/envoy-proxy-85d65fb994-k9w6j vary origin, Accept-Encoding timing-allow-origin * access-control-allow-headers Origin, X-Requested-With, Content-Type, Accept, Accept-Charset, Accept-Encoding, X-Override-Internal-Permissions, X-Properties-Source, X-Properties-SourceId, X-Properties-Flag, X-Hubspot-User-Id, X-Hubspot-Trace, X-Hubspot-Callee, X-Hubspot-Offset, X-Hubspot-No-Trace, X-HubSpot-Static-App-Info, X-HubSpot-Messages-Uri, X-HubSpot-Request-Source, X-HubSpot-Request-Reason, Subscription-Billing-Auth-Token, X-App-CSRF, X-Tools-CSRF, Online-Payment-Signing-UUID, X-Source, X-SourceId, X-Origin-UserId, X-Biden-Request-Source, X-HubSpot-CSRF-hubspotapi, X-Force-Cookie-Refresh, X-Force-Cookie-Refresh-No-Cache, X-HS-User-Request, X-Application-Id, X-HS-Referer, X-HubSpot-Correlation-Id cf-ray 809a4dedeced9231-FRA expires Wed, 20 Sep 2023 13:14:42 GMT
GET H2	200	fb.js Show response js-eu1.hsadspixel.net/	6 KB 4 KB	173ms 48ms	Script application/javascript	172.65.219.229 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js-eu1.hsadspixel.net/fb.js Requested by Host: js-eu1.hs-scripts.com URL: https://js-eu1.hs-scripts.com/25755956.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.65.219.229 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e1e4e3cba3eeeb3ad74ae67c1f42012ebb51d8497482e5c01d404579d49c6b04 Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers date Wed, 20 Sep 2023 13:09:42 GMT x-amz-version-id MiORZOji2P27E5f3usS102mv5dcg0lYn via 1.1 0baa339c02d06988c65d8623d1b3c6ec.cloudfront.net (CloudFront) x-content-type-options nosniff cf-cache-status HIT x-amz-cf-pop FRA56-P2 age 373 x-amz-server-side-encryption AES256 x-evy-trace-route-service-name envoyset-translator content-security-policy-report-only frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=adsscriptloaderstatic/static-1.485/bundles/pixels-release.js&cfRay=809a44cfde43bbe5-FRA x-cache Hit from cloudfront x-hubspot-correlation-id b84b22d0-d99d-432a-b33b-19470a449d21 cache-tag staticjsapp-AdsScriptLoaderCloudflare-web-prod,staticjsapp-prod content-encoding br x-envoy-upstream-service-time 0 x-amz-replication-status COMPLETED x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id b84b22d0-d99d-432a-b33b-19470a449d21 last-modified Tue, 19 Sep 2023 08:21:28 UTC server cloudflare etag W/"1bce211846e6a6691aa314979e0a21fb" vary Accept-Encoding content-type application/javascript; charset=utf-8 x-hs-cache-status HIT x-evy-trace-virtual-host all cache-control max-age=600 x-evy-trace-served-by-pod fra04/app-td/envoy-proxy-5b45bc9bc5-w8lzh cf-ray 809a4dedfff5bb79-FRA x-amz-cf-id j53KSuulUWCoQBcCpe1cwc5O5Lb4KI-BAmW6m9kJBhjE3IQOCvNUog== x-hs-target-asset adsscriptloaderstatic/static-1.485/bundles/pixels-release.js
GET H2	200	25755956.js Show response js-eu1.hs-analytics.net/analytics/1695215100000/	66 KB 21 KB	196ms 84ms	Script text/javascript	172.65.238.60 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js-eu1.hs-analytics.net/analytics/1695215100000/25755956.js Requested by Host: js-eu1.hs-scripts.com URL: https://js-eu1.hs-scripts.com/25755956.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.65.238.60 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash fb6d4b072a3600313d26823a5904a0d86b638e99bbbb7f28df4d01f9fc54c1bf Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers date Wed, 20 Sep 2023 13:09:42 GMT content-encoding br cf-cache-status MISS x-amz-request-id N7FN7JYK3E9V0MCD x-evy-trace-route-service-name envoyset-translator x-amz-server-side-encryption AES256 x-hubspot-correlation-id b93cbb5b-76cb-4736-aab3-34b2f31702c2 x-envoy-upstream-service-time 18 x-amz-id-2 NnU22GMSQ2AvY9QGV2Sju5NGrYrkKYtLexTnteEf2fKn/ZdNTiW0d4qE51A/z3kqElnEe/iMg5c= x-evy-trace-listener listener_https x-request-id b93cbb5b-76cb-4736-aab3-34b2f31702c2 x-evy-trace-route-configuration listener_https/all last-modified Fri, 15 Sep 2023 18:22:56 GMT server cloudflare etag W/"bddf65f21de48f070df8e8508c7a77e6" vary origin, Accept-Encoding content-type text/javascript x-evy-trace-virtual-host all x-evy-trace-served-by-pod fra04/analytics-js-proxy-td/envoy-proxy-85d65fb994-mmx2s cache-control max-age=300,public access-control-allow-credentials false cf-ray 809a4dedefda929f-FRA expires Wed, 20 Sep 2023 13:14:42 GMT
GET H2	200	web-interactives-embed.js Show response js-eu1.hubspot.com/	74 KB 22 KB	161ms 56ms	Script application/javascript	172.65.236.181 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js-eu1.hubspot.com/web-interactives-embed.js Requested by Host: js-eu1.hs-scripts.com URL: https://js-eu1.hs-scripts.com/25755956.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.65.236.181 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 67086be44b34af81faa7570f0fb7d386bd829fa51f00be9094c2d02457700969 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://www.group-ib.com/ Origin https://www.group-ib.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers content-encoding br age 591 x-evy-trace-route-service-name envoyset-translator x-amz-server-side-encryption AES256 content-security-policy-report-only frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=web-interactives-embed/static-2.539/bundles/project.js&cfRay=809a3f7cefc41da0-FRA x-amz-replication-status COMPLETED x-evy-trace-listener listener_https etag W/"b01108181457056f08cd184d0451cfbc" vary Accept-Encoding content-type application/javascript; charset=utf-8 access-control-allow-origin * x-evy-trace-virtual-host all cache-control max-age=600 x-hs-target-asset web-interactives-embed/static-2.539/bundles/project.js date Wed, 20 Sep 2023 13:09:42 GMT x-amz-version-id CHaSKqxinPLGzgYJzkiY20bXhNU5xmiF via 1.1 5d5481cfa85227a3fdd5ff0b03093c62.cloudfront.net (CloudFront) x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} strict-transport-security max-age=31536000; includeSubDomains; preload x-amz-cf-pop FRA56-P2 x-hubspot-correlation-id e8991f69-4190-4ec8-805b-02a16342dc36 x-cache Hit from cloudfront cache-tag staticjsapp-web-interactives-embed-web-prod,staticjsapp-prod x-envoy-upstream-service-time 1 x-evy-trace-route-configuration listener_https/all x-request-id e8991f69-4190-4ec8-805b-02a16342dc36 last-modified Tue, 19 Sep 2023 09:01:45 UTC server cloudflare report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Ww%2BBCf1P0kaMYnCJECZnzmyeyYs0svWc%2FfntUVX7eRc8OKsHhJEANgQhUUEdcFOyM3rqhW7Q6OmdtMRhsW%2Fe2hCT6t95I7cbJ7lcYjtgcvLQgrv29rI8Vl9FlroS7j9V8s1iRg%3D%3D"}],"group":"cf-nel","max_age":604800} x-hs-cache-status HIT x-evy-trace-served-by-pod fra04/app-td/envoy-proxy-5b45bc9bc5-w8lzh cf-ray 809a4deddd71bbbc-FRA x-amz-cf-id -85lGUBMEEJD6dEsAfXrOi84R18nHQV_4APM-hZyiH1V0FodcGmKMA==
GET H/1.1	200 OK	counters.gif forms.hsforms.com/embed/v3/	35 B 1017 B	292ms 201ms	Image image/gif	2606:4700::6811:cff9 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://forms.hsforms.com/embed/v3/counters.gif?key=forms-embed-v2-DEFINITION_SUCCESS&count=1 Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6811:cff9 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers Date Wed, 20 Sep 2023 13:09:42 GMT Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff CF-Cache-Status DYNAMIC x-evy-trace-route-service-name envoyset-translator X-HubSpot-Correlation-Id 677eec91-2f81-40de-aeca-14a512e419dc x-envoy-upstream-service-time 51 Connection keep-alive alt-svc h3=":443"; ma=86400 Content-Length 35 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id 677eec91-2f81-40de-aeca-14a512e419dc Server cloudflare X-Trace 2B7357D8103478D951A2D35FA331D090449000A26E000000000000000000 Vary origin Content-Type image/gif x-evy-trace-virtual-host all x-evy-trace-served-by-pod iad02/star-hubspot-td/envoy-proxy-7f89ffc67f-hgnfq Access-Control-Expose-Headers X-Origin-Hublet Cache-Control max-age=0, no-cache, no-store Access-Control-Allow-Credentials false X-Robots-Tag none CF-RAY 809a4deddf60366f-FRA
GET H2	200	collect px.ads.linkedin.com/	0 535 B	259ms 148ms	Image application/javascript	2620:1ec:21::14 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=&time=1695215382687&url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers date Wed, 20 Sep 2023 13:09:42 GMT x-li-pop afd-prod-lva1-x x-msedge-ref Ref A: 75E364839FED47FD90D9BCBF4D17C0BF Ref B: DUS30EDGE0415 Ref C: 2023-09-20T13:09:42Z linkedin-action 1 x-cache CONFIG_NOCACHE content-type application/javascript x-li-fabric prod-lva1 x-li-proto http/2 content-length 0 x-li-uuid AAYFyha2rpxPZbPBPxKaEw==
GET H/1.1	200 OK	counters.gif forms-eu1.hsforms.com/embed/v3/	35 B 1016 B	154ms 71ms	Image image/gif	172.65.232.43 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://forms-eu1.hsforms.com/embed/v3/counters.gif?key=forms-embed-v2-RENDER_SUCCESS&count=1 Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 172.65.232.43 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers Date Wed, 20 Sep 2023 13:09:42 GMT Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff CF-Cache-Status DYNAMIC x-evy-trace-route-service-name envoyset-translator X-HubSpot-Correlation-Id b5333d1e-f93d-40d2-bb30-1b60768f0132 x-envoy-upstream-service-time 3 Connection keep-alive alt-svc h3=":443"; ma=86400 Content-Length 35 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id b5333d1e-f93d-40d2-bb30-1b60768f0132 Server cloudflare X-Trace 2B85C5A5D572446C437823F70A7CCF2D1DEDE6F54D000000000000000000 Vary origin Content-Type image/gif x-evy-trace-virtual-host all x-evy-trace-served-by-pod fra04/star-hubspot-td/envoy-proxy-79bb87d888-nv9kd Access-Control-Expose-Headers X-Origin-Hublet Cache-Control max-age=0, no-cache, no-store Access-Control-Allow-Credentials false X-Robots-Tag none CF-RAY 809a4dee9b8c1c0f-FRA
GET H2	200	6si.min.js Show response j.6sc.co/	51 KB 15 KB	169ms 39ms	Script application/javascript	23.53.43.58 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://j.6sc.co/6si.min.js Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 23.53.43.58 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a23-53-43-58.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash 3ac0c589d242920586289eabdd93bf71f3d85bb1c6c8333d3e2deb4e173b61a4 Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers pragma no-cache date Wed, 20 Sep 2023 13:09:42 GMT content-encoding gzip x-content-type-options nosniff last-modified Thu, 24 Aug 2023 22:29:49 GMT server nginx/1.14.0 (Ubuntu) etag "64e7d9dd-cc38" vary Accept-Encoding content-type application/javascript cache-control private, no-cache, proxy-revalidate accept-ranges bytes content-length 14993 expires Wed, 20 Sep 2023 13:09:42 GMT
GET H2	200	/ Show response googleads.g.doubleclick.net/pagead/viewthroughconversion/10897073384/	3 KB 2 KB	293ms 205ms	Script text/javascript	2a00:1450:4001:810::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://googleads.g.doubleclick.net/pagead/viewthroughconversion/10897073384/?random=1695215382806&cv=11&fst=1695215382806&bg=ffffff&guid=ON&async=1&gtm=45He39i0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&ref=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&hn=www.googleadservices.com&frm=0&tiba=Traders%27%20dollars%20in%20danger%3A%20CVE-2023-38831%20zero-day%20vulnerability%20in%20WinRAR%20exploited%20by%20cybercriminals%20to%20target%20traders%20%7C%20Group-IB%20Blog&auid=1974006772.1695215383&uamb=0&uaw=0&rfmt=3&fmt=4 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-PW7265 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash f0a8b21efd108122f8371a1c574e9cbc19b19e9c0b5f024703f68a85dec47b10 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers pragma no-cache date Wed, 20 Sep 2023 13:09:42 GMT content-encoding br x-content-type-options nosniff server cafe content-type text/javascript; charset=UTF-8 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 1423 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	NeverBounce.js Show response cdn.neverbounce.com/widget/dist/	96 KB 29 KB	164ms 46ms	Script application/javascript	13.225.78.60 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://cdn.neverbounce.com/widget/dist/NeverBounce.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-PW7265 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.225.78.60 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-225-78-60.fra2.r.cloudfront.net Software AmazonS3 / Resource Hash c99d11cb4960d6e1918ed55d5bcbb316d38b51098e2efc1201904d7274d3273e Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers date Wed, 20 Sep 2023 03:35:03 GMT content-encoding gzip via 1.1 0d94766f433ae64cf30c40acb74fc43e.cloudfront.net (CloudFront) last-modified Mon, 02 Mar 2020 18:37:33 GMT server AmazonS3 x-amz-cf-pop FRA2-C2 age 34480 etag W/"c1e06621030dfcba15b88abbcaa546eb" vary Accept-Encoding x-cache Hit from cloudfront content-type application/javascript x-amz-cf-id 9SJNp-p5D6h-bcKl0iWvVhrAK3dX288ZS9MO1Y-v24qPmNwgNYSeCA==
GET H2	200	63e267f61a03d71ea3df5fe7 Show response ws.zoominfo.com/pixel/	3 KB 2 KB	282ms 198ms	Script text/javascript	2606:4700::6810:880f CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://ws.zoominfo.com/pixel/63e267f61a03d71ea3df5fe7 Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:880f , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Express Resource Hash 9841da78b8c28af73141927f9b27b7618735aca649894f938979998515ff1773 Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers date Wed, 20 Sep 2023 13:09:43 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status DYNAMIC via 1.1 google server cloudflare x-powered-by Express vary Accept-Encoding content-type text/javascript access-control-allow-origin * access-control-allow-credentials true cf-ray 809a4def38a52c59-FRA access-control-allow-headers Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for, x-ws-collect-type,requestFromZITag,unifiedScriptVerified,_zitok,_vtok alt-svc h3=":443"; ma=86400
GET H2	200	fbevents.js Show response connect.facebook.net/en_US/	197 KB 53 KB	142ms 40ms	Script application/x-javascript	2a03:2880:f083:100:face:b00c:0:3 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/en_US/fbevents.js Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f083:100:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash 66e58d37cc4b8168a1bd6678e085b43e939eb138fe608b7faffe3b1ba76b0c7b Security Headers Name Value Content-Security-Policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script'; Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers content-security-policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script'; content-encoding gzip x-content-type-options nosniff strict-transport-security max-age=31536000; preload; includeSubDomains date Wed, 20 Sep 2023 13:09:42 GMT document-policy force-load-at-top cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 content-length 53155 x-xss-protection 0 pragma public x-fb-debug zHOaO0utwlCtKhO/JBhy36qxln/I0f3lprRr5WuiHL8dnxmeBiX4gEnqoF8X6JaBKZ9YFVu+ZohAfEmDYvZjSA== cross-origin-opener-policy same-origin-allow-popups vary Accept-Encoding x-frame-options DENY content-type application/x-javascript; charset=utf-8 origin-agent-cluster ?0 cache-control public, max-age=1200 permissions-policy accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), microphone=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=() expires Sat, 01 Jan 2000 00:00:00 GMT
GET H2	200	js Show response www.googletagmanager.com/gtag/	287 KB 94 KB	60ms 59ms	Script application/javascript	2a00:1450:4001:80b::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=G-QMES53K3Y2&l=dataLayer&cx=c Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-PW7265 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80b::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash bf105c3a86d04333554496bbe2f3eeaa4b37332cce0e6632df5ccbf2db177938 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers date Wed, 20 Sep 2023 13:09:42 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true cross-origin-resource-policy cross-origin access-control-allow-headers Cache-Control content-length 95838 x-xss-protection 0 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 expires Wed, 20 Sep 2023 13:09:42 GMT
GET H2	200	collect px4.ads.linkedin.com/ Redirect Chain https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=4496601&time=1695215382811&url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&tm=gtmv2 https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=4496601&time=1695215382811&url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&tm=gtmv2&cookiesTest=true https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D4496601%26time%3D1695215382811%26url%3Dhttps%253A%252F%252Fwww.group-ib.com%252Fb... https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=4496601&time=1695215382811&url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&tm=gtmv2&cookiesTest=true&liSync=true https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=4496601&time=1695215382811&url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&tm=gtmv2&cookiesTest=true&liSync=true&e_...	0 481 B	294ms 189ms	Image application/javascript	13.107.42.14 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=4496601&time=1695215382811&url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&tm=gtmv2&cookiesTest=true&liSync=true&e_ipv6=AQLcyAulWPeOLQAAAYqytfPmy7GLhhPLulZ-RIrMkfB34QAur2obYgm3eZ_2in1nQnMBb-Q Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Server 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers date Wed, 20 Sep 2023 13:09:43 GMT nel {"report_to":"network-errors","max_age":1296000,"success_fraction":0.00066,"failure_fraction":1,"include_subdomains":true} x-li-pop afd-prod-ltx1-x x-msedge-ref Ref A: 4FF80F6C0D0647C199B0BDA11499AB23 Ref B: FRAEDGE2018 Ref C: 2023-09-20T13:09:43Z linkedin-action 1 report-to {"group":"network-errors","max_age":2592000,"endpoints":[{"url":"https://www.linkedin.com/li/rep"}],"include_subdomains":true} content-type application/javascript x-li-fabric prod-ltx1 x-cache CONFIG_NOCACHE x-li-proto http/2 content-length 0 x-li-uuid AAYFyhbFIG/mKiqN6aDuTA== Redirect headers date Wed, 20 Sep 2023 13:09:43 GMT nel {"report_to":"network-errors","max_age":1296000,"success_fraction":0.00066,"failure_fraction":1,"include_subdomains":true} x-li-pop afd-prod-ltx1-x x-msedge-ref Ref A: 9CD7DAEFDC324D569A4B950CE8241BD0 Ref B: DUS30EDGE0415 Ref C: 2023-09-20T13:09:43Z linkedin-action 1 report-to {"group":"network-errors","max_age":2592000,"endpoints":[{"url":"https://www.linkedin.com/li/rep"}],"include_subdomains":true} x-li-fabric prod-ltx1 location https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=4496601&time=1695215382811&url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&tm=gtmv2&cookiesTest=true&liSync=true&e_ipv6=AQLcyAulWPeOLQAAAYqytfPmy7GLhhPLulZ-RIrMkfB34QAur2obYgm3eZ_2in1nQnMBb-Q x-cache CONFIG_NOCACHE x-li-proto http/2 content-length 0 x-li-uuid AAYFyhbAdTkrYdUCX+PsQQ==
GET H2	200	combinedConfigs Show response cta-eu1.hubspot.com/web-interactives/public/v1/embed/	171 B 1 KB	163ms 73ms	Fetch application/json	172.65.198.159 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cta-eu1.hubspot.com/web-interactives/public/v1/embed/combinedConfigs?portalId=25755956&currentUrl=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&referrer=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F Requested by Host: fhp-de-js.group-ib.com URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.65.198.159 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 6bc87468387163b201b6ad804182c8ee68b7f52e33fa23666e536b678f1a0ef0 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers date Wed, 20 Sep 2023 13:09:42 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status DYNAMIC nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} x-evy-trace-route-service-name envoyset-translator x-hubspot-correlation-id 7b534e02-3d3b-4c90-ae73-5fc1b59e779d content-encoding br x-envoy-upstream-service-time 10 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id 7b534e02-3d3b-4c90-ae73-5fc1b59e779d server cloudflare vary origin access-control-allow-methods OPTIONS, GET content-type application/json;charset=utf-8 access-control-allow-origin https://www.group-ib.com x-evy-trace-virtual-host all access-control-max-age 180 access-control-allow-credentials true cache-control max-age=0, no-cache, no-store report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hkkNL1%2F1uGc%2FtvZrK8sdyfORcB2%2F1%2Bd5cpkVfSoOdZtX8zvql0c5a6IJZLhhS4zC%2BqRVcx4UNfla%2BpE4zdcQps30thdIVoBMKeWKKa0v8NhD77NQLaQCjKezOm5g8Jh%2FrBsGFoI%3D"}],"group":"cf-nel","max_age":604800} x-robots-tag noindex, follow access-control-allow-headers Accept, Accept-Charset, Accept-Encoding, Accept-Language, Content-Type, Host, Origin, Referer, User-Agent cf-ray 809a4def8c5f9188-FRA x-evy-trace-served-by-pod fra04/star-hubspot-td/envoy-proxy-79bb87d888-nv9kd
GET H2	200	json Show response forms-eu1.hscollectedforms.net/collected-forms/v1/config/	116 B 435 B	67ms 56ms	XHR application/json	172.65.192.122 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://forms-eu1.hscollectedforms.net/collected-forms/v1/config/json?portalId=25755956&utk= Requested by Host: fhp-de-js.group-ib.com URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.65.192.122 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 43f22362329b9705cf8629061fb5b1d1a38f1cc2bc9fd46728f73e5cd9eb77cf Security Headers Name Value X-Content-Type-Options nosniff Request headers Accept application/json, text/plain, */* Referer https://www.group-ib.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers date Wed, 20 Sep 2023 13:09:42 GMT content-encoding br x-content-type-options nosniff cf-cache-status DYNAMIC x-evy-trace-route-service-name envoyset-translator x-hubspot-correlation-id ddd4b0a2-4a10-47b8-a3c9-bf80a6ca4b7a x-envoy-upstream-service-time 3 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id ddd4b0a2-4a10-47b8-a3c9-bf80a6ca4b7a server cloudflare vary Accept-Encoding access-control-allow-methods GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD content-type application/json;charset=utf-8 access-control-allow-origin https://www.group-ib.com x-evy-trace-virtual-host all cache-control max-age=0 x-evy-trace-served-by-pod fra04/app-td/envoy-proxy-5b45bc9bc5-w8lzh access-control-max-age 180 x-robots-tag none access-control-allow-headers * cf-ray 809a4def1f893689-FRA
GET H2	200	json Show response api-eu1.hubapi.com/hs-script-loader-public/v1/config/pixels-and-events/	250 B 1 KB	166ms 58ms	XHR application/json	2a06:98c1:3200::90:3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://api-eu1.hubapi.com/hs-script-loader-public/v1/config/pixels-and-events/json?portalId=25755956 Requested by Host: fhp-de-js.group-ib.com URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a06:98c1:3200::90:3 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 1aa462865a143f6b053d5d1594aea3e38d36ebad2a23a7fcfdd84ba7a7a1fddb Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers date Wed, 20 Sep 2023 13:09:43 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status DYNAMIC nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} x-evy-trace-route-service-name envoyset-translator x-hubspot-correlation-id da01782d-b4c1-4ede-9649-c16f09d7148c content-encoding br x-envoy-upstream-service-time 2 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id da01782d-b4c1-4ede-9649-c16f09d7148c server cloudflare x-trace 2BDCF93F58DAB0B69FA5304C3374BFBDA591956209000000000000000000 vary origin access-control-allow-methods GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD content-type application/json;charset=utf-8 access-control-allow-origin https://www.group-ib.com x-evy-trace-virtual-host all access-control-max-age 180 access-control-allow-credentials false x-evy-trace-served-by-pod fra04/hubapi-td/envoy-proxy-74f74b4b68-qtbfk report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=EKAmDsGJXy0j16NgYa446ayS%2BCEjp7LnxpbMpb9XNkKEiieBUN%2FXDNzbxp4vDnV4bsPRQ9xDqO3cs20SOJTnFwQPWUhd7c3F2ygfsgtKbSyzql%2BEGA%2FqUaILFXAexWqY7bTtxaWfP2sfvdmR%2FnQioA%3D%3D"}],"group":"cf-nel","max_age":604800} cf-ray 809a4defb8e52c57-FRA access-control-allow-headers *
GET H2	200	sync_cookie_image_decide mc.yandex.com/ Redirect Chain https://mc.yandex.com/sync_cookie_image_check https://mc.yandex.ru/sync_cookie_image_start?redirect_domain=mc.yandex.com&token=10132.9l-NvcaQlRybkuZDApAgTwQ62WNwlSAeLVh0fJjQZaDNRgxPJKqejUs-arYWvkOv._Xa_ocrWJY19qUywSkbqdIYl4J8%2C https://mc.yandex.com/sync_cookie_image_decide?token=10132.KqhPcIvVJO3mFdAXqZ7LbqUjo0K2pTqjAoUe8uEry3exuJsYohlztbh3sdFv5kTiSsANzarC14dz7US99ZUxLHG6zAntpEpEPH9BAo-6F3E%2C.DglcRpUJVceflfr6QDxMM7lfyx0%2C	43 B 67 B	74ms 74ms	Image image/gif	2a02:6b8::1:119 GLOBAL_DC
General Check archive.org Show headers Download Go to Show image Full URL https://mc.yandex.com/sync_cookie_image_decide?token=10132.KqhPcIvVJO3mFdAXqZ7LbqUjo0K2pTqjAoUe8uEry3exuJsYohlztbh3sdFv5kTiSsANzarC14dz7US99ZUxLHG6zAntpEpEPH9BAo-6F3E%2C.DglcRpUJVceflfr6QDxMM7lfyx0%2C Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Server 2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI), Reverse DNS Software / Resource Hash 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers date Wed, 20 Sep 2023 13:09:43 GMT strict-transport-security max-age=31536000 content-length 43 x-xss-protection 1; mode=block content-type image/gif Redirect headers location https://mc.yandex.com/sync_cookie_image_decide?token=10132.KqhPcIvVJO3mFdAXqZ7LbqUjo0K2pTqjAoUe8uEry3exuJsYohlztbh3sdFv5kTiSsANzarC14dz7US99ZUxLHG6zAntpEpEPH9BAo-6F3E%2C.DglcRpUJVceflfr6QDxMM7lfyx0%2C date Wed, 20 Sep 2023 13:09:43 GMT strict-transport-security max-age=31536000 x-xss-protection 1; mode=block
GET H2	200	advert.gif mc.yandex.com/metrika/	43 B 114 B	79ms 74ms	Image image/gif	2a02:6b8::1:119 GLOBAL_DC
General Check archive.org Show headers Download Go to Show image Full URL https://mc.yandex.com/metrika/advert.gif Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI), Reverse DNS Software / Resource Hash 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers date Wed, 20 Sep 2023 13:09:42 GMT strict-transport-security max-age=31536000 last-modified Thu, 07 Sep 2023 11:49:37 GMT accept-ch Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA etag "64f98ea1-2b" content-type image/gif access-control-allow-origin * cache-control max-age=3600 accept-ranges bytes timing-allow-origin * content-length 43 expires Wed, 20 Sep 2023 14:09:42 GMT
POST H2	204	collect region1.analytics.google.com/g/	0 246 B	136ms 48ms	Ping text/plain	2001:4860:4802:34::36 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://region1.analytics.google.com/g/collect?v=2&tid=G-QMES53K3Y2&gtm=45je39i0&_p=1261767563&_gaz=1&cid=1967857213.1695215383&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=1&dl=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&sid=1695215382&sct=1&seg=0&dr=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&dt=Traders%27%20dollars%20in%20danger%3A%20CVE-2023-38831%20zero-day%20vulnerability%20in%20WinRAR%20exploited%20by%20cybercriminals%20to%20target%20traders%20%7C%20Group-IB%20Blog&en=page_view&_fv=1&_nsi=1&_ss=1 Requested by Host: fhp-de-js.group-ib.com URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers pragma no-cache date Wed, 20 Sep 2023 13:09:43 GMT server Golfe2 content-type text/plain access-control-allow-origin https://www.group-ib.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 0 expires Fri, 01 Jan 1990 00:00:00 GMT
POST H2	204	collect stats.g.doubleclick.net/g/	0 255 B	143ms 47ms	Ping text/plain	2a00:1450:400c:c0b::9b GOOGLE
General Check archive.org Show headers Download Go to Full URL https://stats.g.doubleclick.net/g/collect?v=2&tid=G-QMES53K3Y2&cid=1967857213.1695215383&gtm=45je39i0&aip=1 Requested by Host: fhp-de-js.group-ib.com URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:400c:c0b::9b Brussels, Belgium, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers pragma no-cache date Wed, 20 Sep 2023 13:09:43 GMT server Golfe2 content-type text/plain access-control-allow-origin https://www.group-ib.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	ga-audiences www.google.de/ads/	42 B 408 B	164ms 78ms	Image image/gif	2a00:1450:4001:81c::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-QMES53K3Y2&cid=1967857213.1695215383&gtm=45je39i0&aip=1&z=1329139170 Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers pragma no-cache date Wed, 20 Sep 2023 13:09:43 GMT x-content-type-options nosniff server cafe content-type image/gif p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H/1.1	200 OK	counters.gif forms-eu1.hsforms.com/embed/v3/	35 B 1016 B	366ms 65ms	Image image/gif	172.65.232.43 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://forms-eu1.hsforms.com/embed/v3/counters.gif?key=collected-forms-embed-js-form-bind&count=4 Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 172.65.232.43 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers Date Wed, 20 Sep 2023 13:09:43 GMT Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff CF-Cache-Status DYNAMIC x-evy-trace-route-service-name envoyset-translator X-HubSpot-Correlation-Id 97ea45bc-3b85-4ca4-94db-a9d99cc2c632 x-envoy-upstream-service-time 3 Connection keep-alive alt-svc h3=":443"; ma=86400 Content-Length 35 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id 97ea45bc-3b85-4ca4-94db-a9d99cc2c632 Server cloudflare X-Trace 2B52CDF39CCB90AD743C82C314610D159AEC67F0C2000000000000000000 Vary origin Content-Type image/gif x-evy-trace-virtual-host all x-evy-trace-served-by-pod fra04/star-hubspot-td/envoy-proxy-79bb87d888-nv9kd Access-Control-Expose-Headers X-Origin-Hublet Cache-Control max-age=0, no-cache, no-store Access-Control-Allow-Credentials false X-Robots-Tag none CF-RAY 809a4df18fe51c0f-FRA
GET H2	200	notify Show response api.neverbounce.com/v4/poe/	63 B 282 B	395ms 131ms	Script application/javascript	18.208.77.225 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://api.neverbounce.com/v4/poe/notify?key=public_feedec8c69cd171b06421bb96273f04d&event=form.load&callback=__neverbounce_727152 Requested by Host: cdn.neverbounce.com URL: https://cdn.neverbounce.com/widget/dist/NeverBounce.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 18.208.77.225 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-18-208-77-225.compute-1.amazonaws.com Software nginx / Resource Hash fe0b32decd877ed17be84bf0ca58e35b23eef5bb95928130a4147e761e7a8f5b Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers date Wed, 20 Sep 2023 13:09:43 GMT content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains server nginx vary Accept-Encoding content-type application/javascript cache-control no-cache, private x-ua-compatible IE=Edge
GET H2	200	notify Show response api.neverbounce.com/v4/poe/	63 B 282 B	393ms 138ms	Script application/javascript	18.208.77.225 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://api.neverbounce.com/v4/poe/notify?key=public_feedec8c69cd171b06421bb96273f04d&event=form.load&callback=__neverbounce_841983 Requested by Host: cdn.neverbounce.com URL: https://cdn.neverbounce.com/widget/dist/NeverBounce.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 18.208.77.225 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-18-208-77-225.compute-1.amazonaws.com Software nginx / Resource Hash 448391dd3a01f20955f77ec1ac47f06182ed25a9bcaf9c1ff18fb7f89c687d6c Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers date Wed, 20 Sep 2023 13:09:43 GMT content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains server nginx vary Accept-Encoding content-type application/javascript cache-control no-cache, private x-ua-compatible IE=Edge
GET H2	200	notify Show response api.neverbounce.com/v4/poe/	62 B 282 B	373ms 129ms	Script application/javascript	18.208.77.225 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://api.neverbounce.com/v4/poe/notify?key=public_feedec8c69cd171b06421bb96273f04d&event=form.load&callback=__neverbounce_441488 Requested by Host: cdn.neverbounce.com URL: https://cdn.neverbounce.com/widget/dist/NeverBounce.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 18.208.77.225 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-18-208-77-225.compute-1.amazonaws.com Software nginx / Resource Hash 17976ab640cd7028181024f67a2a44129f969b6e1ca120883fd0a1f9d1b7af1b Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers date Wed, 20 Sep 2023 13:09:43 GMT content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains server nginx vary Accept-Encoding content-type application/javascript cache-control no-cache, private x-ua-compatible IE=Edge
GET H2	200	notify Show response api.neverbounce.com/v4/poe/	62 B 281 B	344ms 129ms	Script application/javascript	18.208.77.225 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://api.neverbounce.com/v4/poe/notify?key=public_feedec8c69cd171b06421bb96273f04d&event=form.load&callback=__neverbounce_463715 Requested by Host: cdn.neverbounce.com URL: https://cdn.neverbounce.com/widget/dist/NeverBounce.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 18.208.77.225 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-18-208-77-225.compute-1.amazonaws.com Software nginx / Resource Hash 7fa356ee222fbce42c8f1cb9656d1f9a4d575f35acd05e189b8277c3e81581c6 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers date Wed, 20 Sep 2023 13:09:43 GMT content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains server nginx vary Accept-Encoding content-type application/javascript cache-control no-cache, private x-ua-compatible IE=Edge
GET H/1.1	200 OK	counters.gif perf-eu1.hsforms.com/embed/v3/	35 B 1 KB	157ms 63ms	Image image/gif	172.65.232.43 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://perf-eu1.hsforms.com/embed/v3/counters.gif?key=config-loaded-success&value=1 Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 172.65.232.43 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers Date Wed, 20 Sep 2023 13:09:43 GMT Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff CF-Cache-Status MISS x-evy-trace-route-service-name envoyset-translator X-HubSpot-Correlation-Id c9fb01e1-4aa0-4b1f-8b74-bbc6a47f4d85 x-envoy-upstream-service-time 2 Connection keep-alive alt-svc h3=":443"; ma=86400 Content-Length 35 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id c9fb01e1-4aa0-4b1f-8b74-bbc6a47f4d85 Last-Modified Wed, 20 Sep 2023 13:09:43 GMT Server cloudflare X-Trace 2B5C4E0C67EA3CE2F4BD50CD64927EA23ED6C153AD000000000000000000 Vary origin, Accept-Encoding Content-Type image/gif x-evy-trace-virtual-host all x-evy-trace-served-by-pod fra04/star-hubspot-td/envoy-proxy-79bb87d888-vvgjb Access-Control-Expose-Headers X-Origin-Hublet Cache-Control max-age=0, no-cache, no-store Access-Control-Allow-Credentials false Accept-Ranges bytes X-Robots-Tag none CF-RAY 809a4df10d710487-FRA
GET H2	200	/ Show response c.6sc.co/	7 B 194 B	42ms 41ms	XHR text/html	23.53.43.58 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://c.6sc.co/ Requested by Host: fhp-de-js.group-ib.com URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 23.53.43.58 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a23-53-43-58.deploy.static.akamaitechnologies.com Software / Resource Hash fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers date Wed, 20 Sep 2023 13:09:43 GMT access-control-max-age 86400 access-control-allow-methods GET,POST content-type text/html access-control-allow-origin https://www.group-ib.com access-control-allow-credentials true access-control-allow-headers * content-length 7
GET H2	200	/ Show response ipv6.6sc.co/	19 B 310 B	185ms 52ms	XHR text/html	2a02:26f0:7100::210:172 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://ipv6.6sc.co/ Requested by Host: fhp-de-js.group-ib.com URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:7100::210:172 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software / Resource Hash 40b3b2394802a2951bbb2f37a41326ef6056e5fd68cbda83c657e79c10ffa9e7 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers pragma no-cache date Wed, 20 Sep 2023 13:09:43 GMT vary Origin content-type text/html access-control-allow-origin https://www.group-ib.com cache-control max-age=0, no-cache, no-store 6si-ipv6 2a01:4a0:1338:92::8 server-timing cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1695215383110_34603374_1107335698_17_933_38_89_219";dur=1 content-length 19 expires Wed, 20 Sep 2023 13:09:43 GMT
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 484 B	239ms 238ms	Image image/gif	23.53.43.58 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=e84d9c08a990af8592952e7ac9a983ad&svisitor=null&visitor=fcb89dec-1741-41fb-83d4-40af3fc3d8b1&session=0194bd91-882e-4138-8950-83d9440f2e35&event=a_pageload&q=%7B%22pageLoadTime%22%3A%22Wed%2C%2020%20Sep%202023%2013%3A09%3A43%20GMT%22%2C%22settings%22%3A%22%5B%7B%5C%22name%5C%22%3A%5C%22enableEventTracking%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Wed%2C%2020%20Sep%202023%2013%3A09%3A43%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setToken%5C%22%2C%5C%22value%5C%22%3A%5C%22e84d9c08a990af8592952e7ac9a983ad%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Wed%2C%2020%20Sep%202023%2013%3A09%3A43%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setEndpoint%5C%22%2C%5C%22value%5C%22%3A%5C%22b.6sc.co%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Wed%2C%2020%20Sep%202023%2013%3A09%3A43%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%5D%22%7D&isIframe=false&m=%7B%22description%22%3A%22Spoof%20extensions%20help%20cybercriminals%20target%20users%20on%20trading%20forums%20as%20130%20devices%20still%20infected%20at%20time%20of%20writing%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Traders%27%20dollars%20in%20danger%3A%20CVE-2023-38831%20zero-day%20vulnerability%20in%20WinRAR%20exploited%20by%20cybercriminals%20to%20target%20traders%20%7C%20Group-IB%20Blog%22%7D&cb=&r=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&pageViewId=cd461d68-e665-4ba7-8bc1-f58dd8cfd043&v=1.1.6 Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 23.53.43.58 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a23-53-43-58.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers date Wed, 20 Sep 2023 13:09:43 GMT x-content-type-options nosniff content-length 43 pragma no-cache last-modified Tue, 05 Oct 2021 22:17:52 GMT server nginx/1.14.0 (Ubuntu) etag "615ccf10-2b" access-control-max-age 86400 access-control-allow-methods GET,POST content-type image/gif access-control-allow-origin cache-control private, no-cache, no-cache=Set-Cookie, proxy-revalidate access-control-allow-credentials true accept-ranges bytes access-control-allow-headers * expires Wed, 19 Apr 2000 11:43:00 GMT
GET H3	200	js Show response www.googletagmanager.com/gtag/	226 KB 79 KB	56ms 56ms	Script application/javascript	2a00:1450:4001:80b::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=AW-10882981508 Requested by Host: js-eu1.hsadspixel.net URL: https://js-eu1.hsadspixel.net/fb.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80b::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 97d6b111ce6865cef074046f6ca442d9740370be06cad8c68500c57f16a140f7 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers date Wed, 20 Sep 2023 13:09:43 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 80511 x-xss-protection 0 last-modified Wed, 20 Sep 2023 12:00:00 GMT server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Wed, 20 Sep 2023 13:09:43 GMT
GET H3	200	js Show response www.googletagmanager.com/gtag/	226 KB 79 KB	58ms 57ms	Script application/javascript	2a00:1450:4001:80b::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=AW-10882981508&l=dataLayer&cx=c Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-PW7265 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80b::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash a2d52a3bf957e4825574b88ca3f846ac9ea11f1a9e6a8d36b7c9a131355b6333 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers date Wed, 20 Sep 2023 13:09:43 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 80643 x-xss-protection 0 last-modified Wed, 20 Sep 2023 12:00:00 GMT server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Wed, 20 Sep 2023 13:09:43 GMT
GET H2	200	649324202964935 Show response connect.facebook.net/signals/config/	144 KB 37 KB	98ms 97ms	Script application/x-javascript	2a03:2880:f083:100:face:b00c:0:3 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/signals/config/649324202964935?v=2.9.127&r=stable&domain=www.group-ib.com Requested by Host: connect.facebook.net URL: https://connect.facebook.net/en_US/fbevents.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f083:100:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash 1bbc22d6b763122be4f9c38a501d8ac5593df79808c16852dcf4a2a1a6155bc6 Security Headers Name Value Content-Security-Policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script'; Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers content-security-policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script'; content-encoding gzip x-content-type-options nosniff strict-transport-security max-age=31536000; preload; includeSubDomains date Wed, 20 Sep 2023 13:09:43 GMT document-policy force-load-at-top cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 x-xss-protection 0 pragma public x-fb-debug AoqYWGHzFLfc5P09Q5qu/uRu0BhDIFOtZ5ZdWlJS05SUmGxod4u6EsYGjAxca0Ivc9nssuzUldW1k90xy4zb2A== cross-origin-opener-policy same-origin-allow-popups vary Accept-Encoding x-frame-options DENY content-type application/x-javascript; charset=utf-8 origin-agent-cluster ?0 cache-control public, max-age=1200 permissions-policy accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), microphone=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=() expires Sat, 01 Jan 2000 00:00:00 GMT
GET H2	200	/ www.google.com/pagead/1p-user-list/10897073384/	42 B 455 B	138ms 52ms	Image image/gif	2a00:1450:4001:802::2004 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/pagead/1p-user-list/10897073384/?random=1695215382806&cv=11&fst=1695214800000&bg=ffffff&guid=ON&async=1&gtm=45He39i0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&ref=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&frm=0&tiba=Traders%27%20dollars%20in%20danger%3A%20CVE-2023-38831%20zero-day%20vulnerability%20in%20WinRAR%20exploited%20by%20cybercriminals%20to%20target%20traders%20%7C%20Group-IB%20Blog&fmt=3&is_vtc=1&random=866901037&rmt_tld=0&ipr=y Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:802::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers pragma no-cache date Wed, 20 Sep 2023 13:09:43 GMT content-security-policy script-src 'none'; object-src 'none' x-content-type-options nosniff server cafe content-type image/gif p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	/ www.google.de/pagead/1p-user-list/10897073384/	42 B 154 B	53ms 53ms	Image image/gif	2a00:1450:4001:81c::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/pagead/1p-user-list/10897073384/?random=1695215382806&cv=11&fst=1695214800000&bg=ffffff&guid=ON&async=1&gtm=45He39i0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&ref=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&frm=0&tiba=Traders%27%20dollars%20in%20danger%3A%20CVE-2023-38831%20zero-day%20vulnerability%20in%20WinRAR%20exploited%20by%20cybercriminals%20to%20target%20traders%20%7C%20Group-IB%20Blog&fmt=3&is_vtc=1&random=866901037&rmt_tld=1&ipr=y Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers pragma no-cache date Wed, 20 Sep 2023 13:09:43 GMT content-security-policy script-src 'none'; object-src 'none' x-content-type-options nosniff server cafe content-type image/gif p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	/ www.facebook.com/tr/	0 185 B	126ms 39ms	Image text/plain	2a03:2880:f176:181:face:b00c:0:25de FACEBOOK
General Check archive.org Show headers Download Go to Show image Full URL https://www.facebook.com/tr/?id=649324202964935&ev=PageView&dl=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&rl=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&if=false&ts=1695215383183&sw=1600&sh=1200&v=2.9.127&r=stable&ec=0&o=30&fbp=fb.1.1695215383180.2130745159&cs_est=true&it=1695215383052&coo=false&rqm=GET Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f176:181:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software proxygen-bolt / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers strict-transport-security max-age=31536000; includeSubDomains date Wed, 20 Sep 2023 13:09:43 GMT server proxygen-bolt content-type text/plain access-control-allow-origin access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 content-length 0
GET H2	200	1 Show response mc.yandex.com/watch/26812653/ Redirect Chain https://mc.yandex.com/watch/26812653?wmode=7&page-url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&charset=utf-8&site-info=%7B%22shareVersion%22%3A2%2C%22strategy%22%3A... https://mc.yandex.com/watch/26812653/1?wmode=7&page-url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&charset=utf-8&site-info=%7B%22shareVersion%22%3A2%2C%22strategy%22%...	435 B 769 B	79ms 79ms	XHR application/json	2a02:6b8::1:119 GLOBAL_DC
General Check archive.org Show headers Download Go to Full URL https://mc.yandex.com/watch/26812653/1?wmode=7&page-url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&charset=utf-8&site-info=%7B%22shareVersion%22%3A2%2C%22strategy%22%3A%22d%2Fn%2Fq%2Fr%2Fs%2Ft%22%7D&uah=chm%0A%3F0&browser-info=pv%3A1%3Avf%3A3qm6qq812ez2u52y4wzrnbv%3Afp%3A502%3Afu%3A1%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A1111%3Acn%3A1%3Adp%3A0%3Als%3A393427733342%3Ahid%3A66148892%3Az%3A120%3Ai%3A20230920150942%3Aet%3A1695215383%3Ac%3A1%3Arn%3A379040932%3Arqn%3A1%3Au%3A1695215383204017989%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Awv%3A2%3Ads%3A0%2C0%2C68%2C41%2C0%2C0%2C%2C508%2C3%2C%2C%2C%2C647%3Aco%3A0%3Acpf%3A1%3Ans%3A1695215381869%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1695215383%3At%3ATraders%27%20dollars%20in%20danger%3A%20CVE-2023-38831%20zero-day%20vulnerability%20in%20WinRAR%20exploited%20by%20cybercriminals%20to%20target%20traders%20%7C%20Group-IB%20Blog&t=gdpr%2814%29clc%280-0-0%29rqnt%281%29aw%281%29ti%282%29&redirnss=1 Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Server 2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI), Reverse DNS Software / Resource Hash 8fdeed49c18a9adfeab5c257f236b0e89e8c05a017706fcc2ba516c8e618436f Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers pragma no-cache date Wed, 20 Sep 2023 13:09:43 GMT strict-transport-security max-age=31536000 x-content-type-options nosniff last-modified Wed, 20-Sep-2023 13:09:43 GMT accept-ch Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA content-type application/json; charset=utf-8 access-control-allow-origin https://www.group-ib.com cache-control private, no-cache, no-store, must-revalidate, max-age=0 access-control-allow-credentials true content-length 435 x-xss-protection 1; mode=block expires Wed, 20-Sep-2023 13:09:43 GMT Redirect headers pragma no-cache date Wed, 20 Sep 2023 13:09:43 GMT strict-transport-security max-age=31536000 last-modified Wed, 20-Sep-2023 13:09:43 GMT accept-ch Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA location /watch/26812653/1?wmode=7&page-url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&charset=utf-8&site-info=%7B%22shareVersion%22%3A2%2C%22strategy%22%3A%22d%2Fn%2Fq%2Fr%2Fs%2Ft%22%7D&uah=chm%0A%3F0&browser-info=pv%3A1%3Avf%3A3qm6qq812ez2u52y4wzrnbv%3Afp%3A502%3Afu%3A1%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A1111%3Acn%3A1%3Adp%3A0%3Als%3A393427733342%3Ahid%3A66148892%3Az%3A120%3Ai%3A20230920150942%3Aet%3A1695215383%3Ac%3A1%3Arn%3A379040932%3Arqn%3A1%3Au%3A1695215383204017989%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Awv%3A2%3Ads%3A0%2C0%2C68%2C41%2C0%2C0%2C%2C508%2C3%2C%2C%2C%2C647%3Aco%3A0%3Acpf%3A1%3Ans%3A1695215381869%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1695215383%3At%3ATraders%27%20dollars%20in%20danger%3A%20CVE-2023-38831%20zero-day%20vulnerability%20in%20WinRAR%20exploited%20by%20cybercriminals%20to%20target%20traders%20%7C%20Group-IB%20Blog&t=gdpr%2814%29clc%280-0-0%29rqnt%281%29aw%281%29ti%282%29&redirnss=1 access-control-allow-origin https://www.group-ib.com cache-control private, no-cache, no-store, must-revalidate, max-age=0 access-control-allow-credentials true x-xss-protection 1; mode=block expires Wed, 20-Sep-2023 13:09:43 GMT
GET H2	200	/ Show response googleads.g.doubleclick.net/pagead/viewthroughconversion/10882981508/	3 KB 2 KB	208ms 207ms	Script text/javascript	2a00:1450:4001:810::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://googleads.g.doubleclick.net/pagead/viewthroughconversion/10882981508/?random=1695215383205&cv=11&fst=1695215383205&bg=ffffff&guid=ON&async=1&gtm=45be39i0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&ref=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&hn=www.googleadservices.com&frm=0&tiba=Traders%27%20dollars%20in%20danger%3A%20CVE-2023-38831%20zero-day%20vulnerability%20in%20WinRAR%20exploited%20by%20cybercriminals%20to%20target%20traders%20%7C%20Group-IB%20Blog&did=dZTQ1Zm&gdid=dZTQ1Zm&auid=1974006772.1695215383&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=AW-10882981508&l=dataLayer&cx=c Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 84deb2c8cb9f64fb1aa8d728cfa456555bae97d87d30652a96d3153a3d5ec4a1 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers pragma no-cache date Wed, 20 Sep 2023 13:09:43 GMT content-encoding br x-content-type-options nosniff server cafe content-type text/javascript; charset=UTF-8 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 1443 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 484 B	245ms 245ms	Image image/gif	23.53.43.58 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=e84d9c08a990af8592952e7ac9a983ad&svisitor=null&visitor=fcb89dec-1741-41fb-83d4-40af3fc3d8b1&session=0194bd91-882e-4138-8950-83d9440f2e35&event=ipv6&q=%7B%22address%22%3A%222a01%3A4a0%3A1338%3A92%3A%3A8%22%7D&isIframe=false&m=%7B%22description%22%3A%22Spoof%20extensions%20help%20cybercriminals%20target%20users%20on%20trading%20forums%20as%20130%20devices%20still%20infected%20at%20time%20of%20writing%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Traders%27%20dollars%20in%20danger%3A%20CVE-2023-38831%20zero-day%20vulnerability%20in%20WinRAR%20exploited%20by%20cybercriminals%20to%20target%20traders%20%7C%20Group-IB%20Blog%22%7D&cb=&r=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&pageViewId=cd461d68-e665-4ba7-8bc1-f58dd8cfd043&v=1.1.6 Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 23.53.43.58 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a23-53-43-58.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers date Wed, 20 Sep 2023 13:09:43 GMT x-content-type-options nosniff content-length 43 pragma no-cache last-modified Sat, 18 Feb 2023 00:49:36 GMT server nginx/1.14.0 (Ubuntu) etag "63f020a0-2b" access-control-max-age 86400 access-control-allow-methods GET,POST content-type image/gif access-control-allow-origin cache-control private, no-cache, no-cache=Set-Cookie, proxy-revalidate access-control-allow-credentials true accept-ranges bytes access-control-allow-headers * expires Wed, 19 Apr 2000 11:43:00 GMT
POST H2	200	fl Show response www.group-ib.com/api/	665 B 1009 B	91ms 90ms	XHR application/json	3.72.181.255 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://www.group-ib.com/api/fl?u=41135e40-5707-11ee-a667-edd728235f9c&cfidsgib-w-61354c22-16cc-40a8-a871-6901f1a76e24=K8EcpuTfJAu%2BFWRGiuAera1NXTWz%2FLfcHD7A%2BPMd9IZhUscAP%2BNIWhNeqi8YntBavtetYBJc2KfJ0qf8ZiKc2zh5f7hMWsurPmwwbqsPLqgl0eKSa0QDb7DXDGgiCUHRZsPqTinb8pWNoGLrbTXqyl8PcvSejP5MakcY Requested by Host: fhp-de-js.group-ib.com URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-72-181-255.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash 82b62c8c2afc0d16396b6696c074edf47113e8f2a4c637deea57f7e36667cdb7 Request headers X-GIB-GSSCgib-w-61354c22-16cc-40a8-a871-6901f1a76e24 4iViNwVg5R2sZMyaiJHjyM0Mm/fadGJoi8/ZgwRnwDbvALCr9llW3v0v7jweW+NXWhpCxrbh5K2VqbbkOGAR2YmzaAq7bPiUgS4n4H4HfPTa0cv93HZNUjREqkEKKbxjtXwXunVl4XhuQEIBokWtGlil4bXn+eczerLMOUk6htsTL58ijUOKIO7SsyOzuKEBttwV1PDgC5grConrJhj64kl+Ech8qCdAw7U7RQRbsO9k3Lpru7ujOsE2WKEFTw== Referer https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 X-GIB-FGSSCgib-w-61354c22-16cc-40a8-a871-6901f1a76e24 Lg8ee7b7273306a39d1f9308fd1975f695a0d4b8 Content-Type text/plain;charset=UTF-8 Response headers date Wed, 20 Sep 2023 13:09:43 GMT content-encoding gzip server nginx vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/json; charset=utf-8 access-control-allow-origin https://www.group-ib.com cache-control no-store access-control-allow-credentials true x-envoy-upstream-service-time 2 access-control-allow-headers Accept,DNT,Keep-Alive,User-Agent,If-Modified-Since,Cache-Control,Content-Type,Origin,ETag,If-None-Match,X-Cfids,Authorization
GET H2	200	/ www.google.com/pagead/1p-user-list/10882981508/	42 B 108 B	53ms 52ms	Image image/gif	2a00:1450:4001:802::2004 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/pagead/1p-user-list/10882981508/?random=1695215383205&cv=11&fst=1695214800000&bg=ffffff&guid=ON&async=1&gtm=45be39i0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&ref=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&frm=0&tiba=Traders%27%20dollars%20in%20danger%3A%20CVE-2023-38831%20zero-day%20vulnerability%20in%20WinRAR%20exploited%20by%20cybercriminals%20to%20target%20traders%20%7C%20Group-IB%20Blog&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=2954825460&rmt_tld=0&ipr=y Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:802::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers pragma no-cache date Wed, 20 Sep 2023 13:09:43 GMT content-security-policy script-src 'none'; object-src 'none' x-content-type-options nosniff server cafe content-type image/gif p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	/ www.google.de/pagead/1p-user-list/10882981508/	42 B 108 B	53ms 53ms	Image image/gif	2a00:1450:4001:81c::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/pagead/1p-user-list/10882981508/?random=1695215383205&cv=11&fst=1695214800000&bg=ffffff&guid=ON&async=1&gtm=45be39i0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&ref=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&frm=0&tiba=Traders%27%20dollars%20in%20danger%3A%20CVE-2023-38831%20zero-day%20vulnerability%20in%20WinRAR%20exploited%20by%20cybercriminals%20to%20target%20traders%20%7C%20Group-IB%20Blog&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=2954825460&rmt_tld=1&ipr=y Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers pragma no-cache date Wed, 20 Sep 2023 13:09:43 GMT content-security-policy script-src 'none'; object-src 'none' x-content-type-options nosniff server cafe content-type image/gif p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	sync_cookie_image_decide_secondary mc.yandex.com/ Redirect Chain https://mc.yandex.com/sync_cookie_image_check_secondary https://mc.yandex.ru/sync_cookie_image_start_secondary?redirect_domain=mc.yandex.com&token=10132.4W5ef6hAUoNcpbFRWyxt23HOuUkQvaKwGksqfuLWR2DLuO9g1s5VDud--KIDoxLl.3jx_4K2uTQDJCTIYCm-oPN7y3Uo%2C https://mc.yandex.com/sync_cookie_image_decide_secondary?token=10132.gMqkv_Isy-vBgWLUZTUMVMkD7tgvEOYi5JzMMtyOcDwtezRZ8B9X0FFWG9IcXhjY0mGlMzaI1pac3aXjTjfIOVM3DxoL-JxE6mx8mqooVaw%2C.3PZcVmMwBiYuMDo3M...	43 B 106 B	74ms 74ms	Image image/gif	2a02:6b8::1:119 GLOBAL_DC
General Check archive.org Show headers Download Go to Show image Full URL https://mc.yandex.com/sync_cookie_image_decide_secondary?token=10132.gMqkv_Isy-vBgWLUZTUMVMkD7tgvEOYi5JzMMtyOcDwtezRZ8B9X0FFWG9IcXhjY0mGlMzaI1pac3aXjTjfIOVM3DxoL-JxE6mx8mqooVaw%2C.3PZcVmMwBiYuMDo3MuBCkVf07nM%2C Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Server 2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI), Reverse DNS Software / Resource Hash 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers date Wed, 20 Sep 2023 13:09:43 GMT strict-transport-security max-age=31536000 content-length 43 x-xss-protection 1; mode=block content-type image/gif Redirect headers location https://mc.yandex.com/sync_cookie_image_decide_secondary?token=10132.gMqkv_Isy-vBgWLUZTUMVMkD7tgvEOYi5JzMMtyOcDwtezRZ8B9X0FFWG9IcXhjY0mGlMzaI1pac3aXjTjfIOVM3DxoL-JxE6mx8mqooVaw%2C.3PZcVmMwBiYuMDo3MuBCkVf07nM%2C date Wed, 20 Sep 2023 13:09:43 GMT strict-transport-security max-age=31536000 x-xss-protection 1; mode=block
GET H/1.1	200 OK	counters.gif forms-eu1.hsforms.com/embed/v3/	35 B 1016 B	371ms 70ms	Image image/gif	172.65.232.43 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://forms-eu1.hsforms.com/embed/v3/counters.gif?key=collected-forms-embed-js-form-bind&count=1 Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 172.65.232.43 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers Date Wed, 20 Sep 2023 13:09:44 GMT Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff CF-Cache-Status DYNAMIC x-evy-trace-route-service-name envoyset-translator X-HubSpot-Correlation-Id fe180dca-91cf-4cc7-849c-1308d907283f x-envoy-upstream-service-time 1 Connection keep-alive alt-svc h3=":443"; ma=86400 Content-Length 35 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id fe180dca-91cf-4cc7-849c-1308d907283f Server cloudflare X-Trace 2B1BA54F26DB6C7954AA47F8589901ED791465A87A000000000000000000 Vary origin Content-Type image/gif x-evy-trace-virtual-host all x-evy-trace-served-by-pod fra04/star-hubspot-td/envoy-proxy-79bb87d888-6mshh Access-Control-Expose-Headers X-Origin-Hublet Cache-Control max-age=0, no-cache, no-store Access-Control-Allow-Credentials false X-Robots-Tag none CF-RAY 809a4df61db31c0f-FRA
POST H2	200	/ Show response www.facebook.com/tr/ Frame 3312	0 50 B	40ms 39ms	Document text/plain	2a03:2880:f176:181:face:b00c:0:25de FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://www.facebook.com/tr/ Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f176:181:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software proxygen-bolt / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Content-Type application/x-www-form-urlencoded Origin https://www.group-ib.com Referer https://www.group-ib.com/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers access-control-allow-credentials true access-control-allow-origin https://www.group-ib.com alt-svc h3=":443"; ma=86400 content-length 0 content-type text/plain cross-origin-resource-policy cross-origin date Wed, 20 Sep 2023 13:09:43 GMT server proxygen-bolt strict-transport-security max-age=31536000; includeSubDomains
POST H2	200	1 Show response mc.yandex.com/watch/26812653/	43 B 74 B	79ms 78ms	XHR image/gif	2a02:6b8::1:119 GLOBAL_DC
General Check archive.org Show headers Download Go to Full URL https://mc.yandex.com/watch/26812653/1?page-url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&charset=utf-8&hittoken=1695215383_2aefde280483675aaca745c05bc40dcc1a329ffc1340e2c28c0f8c8b16dca212&browser-info=pa%3A1%3Aar%3A1%3Avf%3A3qm6qq812ez2u52y4wzrnbv%3Afu%3A1%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A1111%3Acn%3A1%3Adp%3A1%3Als%3A393427733342%3Ahid%3A66148892%3Az%3A120%3Ai%3A20230920150943%3Aet%3A1695215384%3Ac%3A1%3Arn%3A659636836%3Arqn%3A2%3Au%3A1695215383204017989%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Awv%3A2%3Aco%3A0%3Acpf%3A1%3Ans%3A1695215381869%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1695215384&t=gdpr(14)mc(p-3)clc(0-0-0)rqnt(2)lt(5300)aw(1)ti(2) Requested by Host: fhp-de-js.group-ib.com URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI), Reverse DNS Software / Resource Hash 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Xss-Protection 1; mode=block Request headers Referer https://www.group-ib.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Content-Type application/x-www-form-urlencoded Response headers pragma no-cache date Wed, 20 Sep 2023 13:09:43 GMT strict-transport-security max-age=31536000 last-modified Wed, 20-Sep-2023 13:09:43 GMT accept-ch Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA content-type image/gif access-control-allow-origin https://www.group-ib.com cache-control private, no-cache, no-store, must-revalidate, max-age=0 access-control-allow-credentials true content-length 43 x-xss-protection 1; mode=block expires Wed, 20-Sep-2023 13:09:43 GMT
POST H2	200	1 Show response mc.yandex.com/watch/26812653/	43 B 74 B	76ms 75ms	XHR image/gif	2a02:6b8::1:119 GLOBAL_DC
General Check archive.org Show headers Download Go to Full URL https://mc.yandex.com/watch/26812653/1?page-url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&charset=utf-8&hittoken=1695215383_2aefde280483675aaca745c05bc40dcc1a329ffc1340e2c28c0f8c8b16dca212&browser-info=pa%3A1%3Aar%3A1%3Avf%3A3qm6qq812ez2u52y4wzrnbv%3Afu%3A1%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A1111%3Acn%3A1%3Adp%3A1%3Als%3A393427733342%3Ahid%3A66148892%3Az%3A120%3Ai%3A20230920150943%3Aet%3A1695215384%3Ac%3A1%3Arn%3A842033249%3Arqn%3A3%3Au%3A1695215383204017989%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Awv%3A2%3Aco%3A0%3Acpf%3A1%3Ans%3A1695215381869%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1695215384&t=gdpr(14)mc(p-3)clc(0-0-0)rqnt(3)lt(5300)aw(1)ti(2) Requested by Host: fhp-de-js.group-ib.com URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI), Reverse DNS Software / Resource Hash 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Xss-Protection 1; mode=block Request headers Referer https://www.group-ib.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Content-Type application/x-www-form-urlencoded Response headers pragma no-cache date Wed, 20 Sep 2023 13:09:43 GMT strict-transport-security max-age=31536000 last-modified Wed, 20-Sep-2023 13:09:43 GMT accept-ch Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA content-type image/gif access-control-allow-origin https://www.group-ib.com cache-control private, no-cache, no-store, must-revalidate, max-age=0 access-control-allow-credentials true content-length 43 x-xss-protection 1; mode=block expires Wed, 20-Sep-2023 13:09:43 GMT
POST H2	200	1 Show response mc.yandex.com/watch/26812653/	43 B 74 B	79ms 78ms	XHR image/gif	2a02:6b8::1:119 GLOBAL_DC
General Check archive.org Show headers Download Go to Full URL https://mc.yandex.com/watch/26812653/1?page-url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&charset=utf-8&hittoken=1695215383_2aefde280483675aaca745c05bc40dcc1a329ffc1340e2c28c0f8c8b16dca212&browser-info=pa%3A1%3Aar%3A1%3Avf%3A3qm6qq812ez2u52y4wzrnbv%3Afu%3A1%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A1111%3Acn%3A1%3Adp%3A1%3Als%3A393427733342%3Ahid%3A66148892%3Az%3A120%3Ai%3A20230920150943%3Aet%3A1695215384%3Ac%3A1%3Arn%3A21013391%3Arqn%3A4%3Au%3A1695215383204017989%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Awv%3A2%3Aco%3A0%3Acpf%3A1%3Ans%3A1695215381869%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1695215384&t=gdpr(14)mc(p-3)clc(0-0-0)rqnt(4)lt(5300)aw(1)ti(2) Requested by Host: fhp-de-js.group-ib.com URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI), Reverse DNS Software / Resource Hash 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Xss-Protection 1; mode=block Request headers Referer https://www.group-ib.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Content-Type application/x-www-form-urlencoded Response headers pragma no-cache date Wed, 20 Sep 2023 13:09:43 GMT strict-transport-security max-age=31536000 last-modified Wed, 20-Sep-2023 13:09:43 GMT accept-ch Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA content-type image/gif access-control-allow-origin https://www.group-ib.com cache-control private, no-cache, no-store, must-revalidate, max-age=0 access-control-allow-credentials true content-length 43 x-xss-protection 1; mode=block expires Wed, 20-Sep-2023 13:09:43 GMT
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 484 B	236ms 236ms	Image image/gif	23.53.43.58 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=e84d9c08a990af8592952e7ac9a983ad&svisitor=null&visitor=fcb89dec-1741-41fb-83d4-40af3fc3d8b1&session=0194bd91-882e-4138-8950-83d9440f2e35&event=active_time_track&q=%7B%22currentTime%22%3A%22Wed%2C%2020%20Sep%202023%2013%3A09%3A44%20GMT%22%2C%22lastTrackTime%22%3A%22Wed%2C%2020%20Sep%202023%2013%3A09%3A43%20GMT%22%2C%22timeSpent%22%3A%221003%22%2C%22totalTimeSpent%22%3A%221003%22%7D&isIframe=false&m=%7B%22description%22%3A%22Spoof%20extensions%20help%20cybercriminals%20target%20users%20on%20trading%20forums%20as%20130%20devices%20still%20infected%20at%20time%20of%20writing%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Traders%27%20dollars%20in%20danger%3A%20CVE-2023-38831%20zero-day%20vulnerability%20in%20WinRAR%20exploited%20by%20cybercriminals%20to%20target%20traders%20%7C%20Group-IB%20Blog%22%7D&cb=&r=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&pageViewId=cd461d68-e665-4ba7-8bc1-f58dd8cfd043&v=1.1.6 Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 23.53.43.58 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a23-53-43-58.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers date Wed, 20 Sep 2023 13:09:44 GMT x-content-type-options nosniff content-length 43 pragma no-cache last-modified Fri, 21 Feb 2020 18:57:20 GMT server nginx/1.14.0 (Ubuntu) etag "5e502810-2b" access-control-max-age 86400 access-control-allow-methods GET,POST content-type image/gif access-control-allow-origin cache-control private, no-cache, no-cache=Set-Cookie, proxy-revalidate access-control-allow-credentials true accept-ranges bytes access-control-allow-headers * expires Wed, 19 Apr 2000 11:43:00 GMT
GET H3	200	709834390277869 Show response connect.facebook.net/signals/config/	141 KB 36 KB	98ms 98ms	Script application/x-javascript	2a03:2880:f083:100:face:b00c:0:3 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/signals/config/709834390277869?v=2.9.127&r=stable&domain=www.group-ib.com Requested by Host: connect.facebook.net URL: https://connect.facebook.net/en_US/fbevents.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a03:2880:f083:100:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash 1c479ed0e2352f8993f7324918ae85f6b93b13e93bfa594d3de97557598c35d4 Security Headers Name Value Content-Security-Policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script'; Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers content-security-policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script'; content-encoding gzip x-content-type-options nosniff strict-transport-security max-age=31536000; preload; includeSubDomains date Wed, 20 Sep 2023 13:09:44 GMT document-policy force-load-at-top cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 x-xss-protection 0 pragma public x-fb-debug UQSwEk+h3/hlQWY9beCTAxw6WayAKdhggoJcWTOWr+esC2fDJgrZwmq8lz35M4sy+slHdACbeswVLO5p3zmQWQ== cross-origin-opener-policy same-origin-allow-popups vary Accept-Encoding x-frame-options DENY content-type application/x-javascript; charset=utf-8 origin-agent-cluster ?0 cache-control public, max-age=1200 permissions-policy accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), microphone=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=() priority u=3,i expires Sat, 01 Jan 2000 00:00:00 GMT
GET H2	200	__ptq.gif track-eu1.hubspot.com/	45 B 631 B	212ms 75ms	Image image/gif	172.65.240.166
General Check archive.org Show headers Download Go to Show image Full URL https://track-eu1.hubspot.com/__ptq.gif?k=1&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=3298999280&v=1.1&a=25755956&rcu=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&r=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&pu=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&t=Traders%27+dollars+in+danger%3A+CVE-2023-38831+zero-day+vulnerability+in+WinRAR+exploited+by+cybercriminals+to+target+traders+%7C+Group-IB+Blog&cts=1695215384285&vi=dee2c195eeb22a2653b8931a5a367a67&nc=true&u=84897990.dee2c195eeb22a2653b8931a5a367a67.1695215384282.1695215384282.1695215384282.1&b=84897990.1.1695215384282&cc=15 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.65.240.166 -, , ASN (), Reverse DNS Software cloudflare / Resource Hash dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers date Wed, 20 Sep 2023 13:09:44 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status MISS nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} x-evy-trace-route-service-name envoyset-translator x-hubspot-correlation-id b65b84fc-004b-425d-9c1c-04f81992610e p3p CP="NOI CUR ADM OUR NOR STA NID" x-envoy-upstream-service-time 4 content-length 45 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id b65b84fc-004b-425d-9c1c-04f81992610e last-modified Wed, 20 Sep 2023 13:09:44 GMT server cloudflare vary origin, Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=oRxElqMFmniFZq7NKWmoeJ9hGf4GA13cF06xnQPO3nFSWpO%2BG2hBozZE66ZpNmCqg%2Fj8F0MBpPr0j0rbducHqIR3yxD1AaIaiuxBZ8JKACrmAuOPILNap7CemkraQMUGlL9glPVrXA%3D%3D"}],"group":"cf-nel","max_age":604800} content-type image/gif x-evy-trace-served-by-pod fra04/analytics-tracking-td/envoy-proxy-9dffd6dd-7p5lg x-evy-trace-virtual-host all cache-control no-cache, no-store, no-transform access-control-allow-credentials false accept-ranges bytes cf-ray 809a4df8d9d2363c-FRA x-robots-tag none
GET H2	200	__ptq.gif track-eu1.hubspot.com/	45 B 1 KB	194ms 76ms	Image image/gif	172.65.240.166
General Check archive.org Show headers Download Go to Show image Full URL https://track-eu1.hubspot.com/__ptq.gif?k=15&fi=4dbceae1-75ae-423a-9c12-dee8f1ca3345&fci=44fd9eb8-98af-4feb-929c-c5a07d06e904&ft=0&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=3298999280&v=1.1&a=25755956&rcu=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&r=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&pu=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&t=Traders%27+dollars+in+danger%3A+CVE-2023-38831+zero-day+vulnerability+in+WinRAR+exploited+by+cybercriminals+to+target+traders+%7C+Group-IB+Blog&cts=1695215384287&vi=dee2c195eeb22a2653b8931a5a367a67&nc=true&u=84897990.dee2c195eeb22a2653b8931a5a367a67.1695215384282.1695215384282.1695215384282.1&b=84897990.1.1695215384282&cc=15 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.65.240.166 -, , ASN (), Reverse DNS Software cloudflare / Resource Hash dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers date Wed, 20 Sep 2023 13:09:44 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status MISS nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} x-evy-trace-route-service-name envoyset-translator x-hubspot-correlation-id c3560792-684a-496d-b4b4-ebcf7f0ff5c7 p3p CP="NOI CUR ADM OUR NOR STA NID" x-envoy-upstream-service-time 2 content-length 45 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id c3560792-684a-496d-b4b4-ebcf7f0ff5c7 last-modified Wed, 20 Sep 2023 13:09:44 GMT server cloudflare vary origin, Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=X8zmDUSBus8t%2F26lzGOREFBiQL%2FonF0uid2QtCbZdqsJgWrlHa5ZNAEwC1ecuIEPCEt3nDewsJObx5D3%2FFdfYoeo26UDEoYPDU8icd52BhCTrlDgD8o1eLW7dlMf2kVtgdCb8%2Bj6tA%3D%3D"}],"group":"cf-nel","max_age":604800} content-type image/gif x-evy-trace-served-by-pod fra04/analytics-tracking-td/envoy-proxy-9dffd6dd-bpkrq x-evy-trace-virtual-host all cache-control no-cache, no-store, no-transform access-control-allow-credentials false accept-ranges bytes cf-ray 809a4df8d9d3363c-FRA x-robots-tag none
GET H2	200	__ptq.gif track-eu1.hubspot.com/	45 B 628 B	206ms 89ms	Image image/gif	172.65.240.166
General Check archive.org Show headers Download Go to Show image Full URL https://track-eu1.hubspot.com/__ptq.gif?k=15&fi=044e7558-8073-478a-ad3c-5807dd76840f&fci=21fdba58-f2f1-4337-b514-2e25e122e249&ft=0&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=3298999280&v=1.1&a=25755956&rcu=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&r=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&pu=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&t=Traders%27+dollars+in+danger%3A+CVE-2023-38831+zero-day+vulnerability+in+WinRAR+exploited+by+cybercriminals+to+target+traders+%7C+Group-IB+Blog&cts=1695215384288&vi=dee2c195eeb22a2653b8931a5a367a67&nc=true&u=84897990.dee2c195eeb22a2653b8931a5a367a67.1695215384282.1695215384282.1695215384282.1&b=84897990.1.1695215384282&cc=15 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.65.240.166 -, , ASN (), Reverse DNS Software cloudflare / Resource Hash dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers date Wed, 20 Sep 2023 13:09:44 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status MISS nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} x-evy-trace-route-service-name envoyset-translator x-hubspot-correlation-id 0a98bab5-4537-475b-ae3f-1af5f979f922 p3p CP="NOI CUR ADM OUR NOR STA NID" x-envoy-upstream-service-time 2 content-length 45 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id 0a98bab5-4537-475b-ae3f-1af5f979f922 last-modified Wed, 20 Sep 2023 13:09:44 GMT server cloudflare vary origin, Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=BCa3rGDclajWKntG0a7HPRkZhIJSe9KMy0fL0a7QpUgrUQggZ5iW7yQrMib%2FNMDXHOBK3FPhgqvdghpHjNiRS6JVWFuqVY10WaUIbfAEvCeZxiR4dS9xzgrLoKTNDen2ePWqtrgf0A%3D%3D"}],"group":"cf-nel","max_age":604800} content-type image/gif x-evy-trace-served-by-pod fra04/analytics-tracking-td/envoy-proxy-9dffd6dd-4x9zf x-evy-trace-virtual-host all cache-control no-cache, no-store, no-transform access-control-allow-credentials false accept-ranges bytes cf-ray 809a4df8d9d7363c-FRA x-robots-tag none
GET H2	200	__ptq.gif track-eu1.hubspot.com/	45 B 1 KB	207ms 90ms	Image image/gif	172.65.240.166
General Check archive.org Show headers Download Go to Show image Full URL https://track-eu1.hubspot.com/__ptq.gif?k=15&fi=55a22738-d5a5-43f9-9c1c-fa4c1a6eb349&fci=6edbff4a-27b7-486a-9f89-2ab50521e929&ft=0&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=3298999280&v=1.1&a=25755956&rcu=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&r=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&pu=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&t=Traders%27+dollars+in+danger%3A+CVE-2023-38831+zero-day+vulnerability+in+WinRAR+exploited+by+cybercriminals+to+target+traders+%7C+Group-IB+Blog&cts=1695215384288&vi=dee2c195eeb22a2653b8931a5a367a67&nc=true&u=84897990.dee2c195eeb22a2653b8931a5a367a67.1695215384282.1695215384282.1695215384282.1&b=84897990.1.1695215384282&cc=15 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.65.240.166 -, , ASN (), Reverse DNS Software cloudflare / Resource Hash dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers date Wed, 20 Sep 2023 13:09:44 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status MISS nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} x-evy-trace-route-service-name envoyset-translator x-hubspot-correlation-id 52dff5ef-cc8c-4b4d-91b6-58c507218173 p3p CP="NOI CUR ADM OUR NOR STA NID" x-envoy-upstream-service-time 2 content-length 45 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id 52dff5ef-cc8c-4b4d-91b6-58c507218173 last-modified Wed, 20 Sep 2023 13:09:44 GMT server cloudflare vary origin, Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=NVdbDnPWxKkQulQTb7ddn0JyAJvo9wz%2FOvHBCR%2FVcnzZDZgOtOSCKWPHFM4f7nf6BDjIf3esR4KK8IleZM2pUsrGUGAWAhBSc5drqhqi1aU%2BhS9K3rP5We0VLiB2JmAKAsb0lhLJFQ%3D%3D"}],"group":"cf-nel","max_age":604800} content-type image/gif x-evy-trace-served-by-pod fra04/analytics-tracking-td/envoy-proxy-9dffd6dd-mfzqs x-evy-trace-virtual-host all cache-control no-cache, no-store, no-transform access-control-allow-credentials false accept-ranges bytes cf-ray 809a4df8d9d8363c-FRA x-robots-tag none
GET H2	200	__ptq.gif track-eu1.hubspot.com/	45 B 630 B	202ms 85ms	Image image/gif	172.65.240.166
General Check archive.org Show headers Download Go to Show image Full URL https://track-eu1.hubspot.com/__ptq.gif?k=15&fi=eb903dab-0ef3-43b5-bdeb-71372e6ad0f0&fci=26a1c2fd-c681-4613-8031-4a56fe19be6d&ft=0&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=3298999280&v=1.1&a=25755956&rcu=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&r=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&pu=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&t=Traders%27+dollars+in+danger%3A+CVE-2023-38831+zero-day+vulnerability+in+WinRAR+exploited+by+cybercriminals+to+target+traders+%7C+Group-IB+Blog&cts=1695215384289&vi=dee2c195eeb22a2653b8931a5a367a67&nc=true&u=84897990.dee2c195eeb22a2653b8931a5a367a67.1695215384282.1695215384282.1695215384282.1&b=84897990.1.1695215384282&cc=15 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.65.240.166 -, , ASN (), Reverse DNS Software cloudflare / Resource Hash dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers date Wed, 20 Sep 2023 13:09:44 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status MISS nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} x-evy-trace-route-service-name envoyset-translator x-hubspot-correlation-id cb33cf18-faa8-471e-8d4f-6b5db7db00b8 p3p CP="NOI CUR ADM OUR NOR STA NID" x-envoy-upstream-service-time 3 content-length 45 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id cb33cf18-faa8-471e-8d4f-6b5db7db00b8 last-modified Wed, 20 Sep 2023 13:09:44 GMT server cloudflare vary origin, Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7SwKuHjFG0DPLAX14oAdGdtalEk80sy92H5bgjm5hx3otygXMd%2FBbh3GzGU1YUW%2FcUjyKylLFgtraWv486hsiCTDMjuKYshF7dAN0ECMnO2IUpUfW7ByIdKZRCb6AHRmzZlMsO2FeQ%3D%3D"}],"group":"cf-nel","max_age":604800} content-type image/gif x-evy-trace-served-by-pod fra04/analytics-tracking-td/envoy-proxy-9dffd6dd-7p5lg x-evy-trace-virtual-host all cache-control no-cache, no-store, no-transform access-control-allow-credentials false accept-ranges bytes cf-ray 809a4df8d9d9363c-FRA x-robots-tag none
GET H2	200	__ptq.gif track-eu1.hubspot.com/	45 B 1 KB	188ms 71ms	Image image/gif	172.65.240.166
General Check archive.org Show headers Download Go to Show image Full URL https://track-eu1.hubspot.com/__ptq.gif?k=17&fi=044e7558-8073-478a-ad3c-5807dd76840f&fci=21fdba58-f2f1-4337-b514-2e25e122e249&ft=0&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=3298999280&v=1.1&a=25755956&rcu=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&r=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&pu=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&t=Traders%27+dollars+in+danger%3A+CVE-2023-38831+zero-day+vulnerability+in+WinRAR+exploited+by+cybercriminals+to+target+traders+%7C+Group-IB+Blog&cts=1695215384290&vi=dee2c195eeb22a2653b8931a5a367a67&nc=true&u=84897990.dee2c195eeb22a2653b8931a5a367a67.1695215384282.1695215384282.1695215384282.1&b=84897990.1.1695215384282&cc=15 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.65.240.166 -, , ASN (), Reverse DNS Software cloudflare / Resource Hash dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers date Wed, 20 Sep 2023 13:09:44 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status MISS nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} x-evy-trace-route-service-name envoyset-translator x-hubspot-correlation-id 6832c391-fa5f-48d7-9fe4-5eec5c3f89b3 p3p CP="NOI CUR ADM OUR NOR STA NID" x-envoy-upstream-service-time 2 content-length 45 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id 6832c391-fa5f-48d7-9fe4-5eec5c3f89b3 last-modified Wed, 20 Sep 2023 13:09:44 GMT server cloudflare vary origin, Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qUg3qPl%2Fn1xbOVt8Jlyh483Lg0QCejhE%2FOy6%2F3Fe%2BIdX%2FXrlWN8BMa3sNNe9yzxoGxm4mB0BM49J2PxbrZfCLFNSZF7cB06feIKvcKPCsTk0MfK3z7Ack3YDDeUh0tNA7gQqRgZ3lA%3D%3D"}],"group":"cf-nel","max_age":604800} content-type image/gif x-evy-trace-served-by-pod fra04/analytics-tracking-td/envoy-proxy-9dffd6dd-bpkrq x-evy-trace-virtual-host all cache-control no-cache, no-store, no-transform access-control-allow-credentials false accept-ranges bytes cf-ray 809a4df8d9da363c-FRA x-robots-tag none
GET H2	200	__ptq.gif track-eu1.hubspot.com/	45 B 631 B	76ms 76ms	Image image/gif	172.65.240.166
General Check archive.org Show headers Download Go to Show image Full URL https://track-eu1.hubspot.com/__ptq.gif?k=17&fi=4dbceae1-75ae-423a-9c12-dee8f1ca3345&fci=44fd9eb8-98af-4feb-929c-c5a07d06e904&ft=0&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=3298999280&v=1.1&a=25755956&rcu=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&r=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&pu=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&t=Traders%27+dollars+in+danger%3A+CVE-2023-38831+zero-day+vulnerability+in+WinRAR+exploited+by+cybercriminals+to+target+traders+%7C+Group-IB+Blog&cts=1695215384291&vi=dee2c195eeb22a2653b8931a5a367a67&nc=true&u=84897990.dee2c195eeb22a2653b8931a5a367a67.1695215384282.1695215384282.1695215384282.1&b=84897990.1.1695215384282&cc=15 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.65.240.166 -, , ASN (), Reverse DNS Software cloudflare / Resource Hash dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers date Wed, 20 Sep 2023 13:09:44 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status MISS nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} x-evy-trace-route-service-name envoyset-translator x-hubspot-correlation-id 4ed66c36-d91a-4b40-8333-4fe6c40fc4a6 p3p CP="NOI CUR ADM OUR NOR STA NID" x-envoy-upstream-service-time 4 content-length 45 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id 4ed66c36-d91a-4b40-8333-4fe6c40fc4a6 last-modified Wed, 20 Sep 2023 13:09:44 GMT server cloudflare vary origin, Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gIqOmZVwMdlFvRdV4%2FEsmGLDuuViOQM%2FNNa5feKAGBrE4c%2FaFTJbALD3hzeCQUX9GnHFov8xRNbQgF7cSNBEZRim%2FnynzxSSCKVNmGpvceEshsebXnk2AmB9KeYwqApjoaTSkXv3Ew%3D%3D"}],"group":"cf-nel","max_age":604800} content-type image/gif x-evy-trace-served-by-pod fra04/analytics-tracking-td/envoy-proxy-9dffd6dd-2ds5g x-evy-trace-virtual-host all cache-control no-cache, no-store, no-transform access-control-allow-credentials false accept-ranges bytes cf-ray 809a4df8d9dc363c-FRA x-robots-tag none
GET H2	200	facebook-64.svg website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/	627 B 1 KB	67ms 66ms	Image image/svg+xml	2600:9000:225b:2a00:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/facebook-64.svg Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:225b:2a00:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash f006e8bbfa4f0537780571436b5bed50ff10ff28759924c53b67732ec5af28ba Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Wed, 20 Sep 2023 13:09:44 GMT via 1.1 af1bbc213b3a9ee2f125be77ca3609a0.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop MUC50-P1 x-cache Miss from cloudfront content-length 376 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 29 Nov 2022 07:39:21 GMT server nginx etag "273-5ee9716178eea-gzip" x-frame-options sameorigin vary Accept-Encoding content-type image/svg+xml access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id doekbw6IhTldI0Q0RU4b0SToG99ggWAD0mCy63NaWXO-e5zKnsR7pg== expires Wed, 20 Sep 2023 13:39:44 GMT
GET H2	200	facebook-lbg.svg website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/	1 KB 1 KB	65ms 65ms	Image image/svg+xml	2600:9000:225b:2a00:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/facebook-lbg.svg Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:225b:2a00:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 1e0e607b314623cf3e5ba71869ca47d1549556369988daa5e8a1bf56559c2973 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Wed, 20 Sep 2023 13:09:44 GMT via 1.1 af1bbc213b3a9ee2f125be77ca3609a0.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop MUC50-P1 x-cache Miss from cloudfront content-length 522 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 29 Nov 2022 07:39:21 GMT server nginx etag "4f0-5ee9716178eea-gzip" x-frame-options sameorigin vary Accept-Encoding content-type image/svg+xml access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id mLmTIL8KrNg58DwW8pp3cOqA0O_rTVMHbVVArueHoBa2XaE5easpxQ== expires Wed, 20 Sep 2023 13:39:44 GMT
POST H2	200	fl Show response www.group-ib.com/api/	665 B 779 B	50ms 50ms	XHR application/json	3.72.181.255 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://www.group-ib.com/api/fl?u=41135e40-5707-11ee-a667-edd728235f9c&cfidsgib-w-61354c22-16cc-40a8-a871-6901f1a76e24=mEYJs6hMGbXmNcunCEsDZm1%2B3eZICN4wDyTSnSlA3017XifWCGaBF3lfpnSLCdbI9KGRjEkb0IROVa93uyHR%2B%2FV1t%2B11CzqEmiXLHK3%2Bg6I%2FoC2AnniN%2F5o20culJdcau0hCnn0ySLbt7k7qb18CIfP0cC5S05hUsCMd Requested by Host: fhp-de-js.group-ib.com URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-72-181-255.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash 33bdf2ae30148d11c6ce665540d0c9815cadb29e266bd537e0d144e8b00fea49 Request headers X-GIB-GSSCgib-w-61354c22-16cc-40a8-a871-6901f1a76e24 do1iId2Kg3bJNxP1geDv6OQRlr4pFDZW6jgT+t+Ve40bbfUJMo5TDhW/igG6PrqjhhiOwpNn2loP8I4RNDXGUm0xkHU13U8d1p7OvhwA8UsopFK05RJ+t7fFkd+zusfd0//k29+wOJ4YB3p2iKg2SOZojBoQcBR8bDzwgpPoWTz1dmp27nvHjkEXsZagCBiO62H5nwUaJDbI8/KontcJ06PosiXWOcEOuynppvp/+W6IuPJsFMOROTlS/kXwpg== Referer https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 X-GIB-FGSSCgib-w-61354c22-16cc-40a8-a871-6901f1a76e24 FbaV8589874ad4f1bdeb22df4b9e69281a5d8cfe Content-Type text/plain;charset=UTF-8 Response headers date Wed, 20 Sep 2023 13:09:44 GMT content-encoding gzip server nginx vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/json; charset=utf-8 access-control-allow-origin https://www.group-ib.com cache-control no-store access-control-allow-credentials true x-envoy-upstream-service-time 1 access-control-allow-headers Accept,DNT,Keep-Alive,User-Agent,If-Modified-Since,Cache-Control,Content-Type,Origin,ETag,If-None-Match,X-Cfids,Authorization
GET H3	200	/ www.facebook.com/tr/	0 18 B	39ms 39ms	Image text/plain	2a03:2880:f176:181:face:b00c:0:25de FACEBOOK
General Check archive.org Show headers Download Go to Show image Full URL https://www.facebook.com/tr/?id=709834390277869&ev=PageView&dl=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&rl=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&if=false&ts=1695215384441&sw=1600&sh=1200&ud[external_id]=dee2c195eeb22a2653b8931a5a367a67&v=2.9.127&r=stable&ec=0&o=30&fbp=fb.1.1695215383180.2130745159&cs_est=true&it=1695215383052&coo=false&rqm=GET Protocol H3 Security QUIC, , AES_128_GCM Server 2a03:2880:f176:181:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software proxygen-bolt / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers strict-transport-security max-age=31536000; includeSubDomains date Wed, 20 Sep 2023 13:09:44 GMT server proxygen-bolt content-type text/plain access-control-allow-origin access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 content-length 0 priority u=3,i
GET		counters.gif forms-eu1.hsforms.com/embed/v3/	0 0
POST H3	200	/ Show response www.facebook.com/tr/ Frame D650	0 15 B	40ms 39ms	Document text/plain	2a03:2880:f176:181:face:b00c:0:25de FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://www.facebook.com/tr/ Protocol H3 Security QUIC, , AES_128_GCM Server 2a03:2880:f176:181:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software proxygen-bolt / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Content-Type application/x-www-form-urlencoded Origin https://www.group-ib.com Referer https://www.group-ib.com/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers access-control-allow-credentials true access-control-allow-origin https://www.group-ib.com alt-svc h3=":443"; ma=86400 content-length 0 content-type text/plain cross-origin-resource-policy cross-origin date Wed, 20 Sep 2023 13:09:44 GMT priority u=0,i server proxygen-bolt strict-transport-security max-age=31536000; includeSubDomains
GET		img.gif b.6sc.co/v1/beacon/	0 0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain

www.group-ib.com

URL

https://www.group-ib.com/wp-admin/admin-ajax.php

Domain

forms-eu1.hsforms.com

URL

https://forms-eu1.hsforms.com/embed/v3/counters.gif?key=collected-forms-embed-js-form-bind&count=1

Domain

b.6sc.co

URL

https://b.6sc.co/v1/beacon/img.gif?token=e84d9c08a990af8592952e7ac9a983ad&svisitor=null&visitor=fcb89dec-1741-41fb-83d4-40af3fc3d8b1&session=0194bd91-882e-4138-8950-83d9440f2e35&event=active_time_track&q=%7B%22currentTime%22%3A%22Wed%2C%2020%20Sep%202023%2013%3A09%3A45%20GMT%22%2C%22lastTrackTime%22%3A%22Wed%2C%2020%20Sep%202023%2013%3A09%3A44%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%222004%22%7D&isIframe=false&m=%7B%22description%22%3A%22Spoof%20extensions%20help%20cybercriminals%20target%20users%20on%20trading%20forums%20as%20130%20devices%20still%20infected%20at%20time%20of%20writing%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Traders%27%20dollars%20in%20danger%3A%20CVE-2023-38831%20zero-day%20vulnerability%20in%20WinRAR%20exploited%20by%20cybercriminals%20to%20target%20traders%20%7C%20Group-IB%20Blog%22%7D&cb=&r=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&pageViewId=cd461d68-e665-4ba7-8bc1-f58dd8cfd043&v=1.1.6