github.com Open in urlscan Pro
140.82.121.3 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://t.co/cBgbwk0g94
Effective URL:
https://github.com/StrangerealIntel/CyberThreatIntel/blob/master/Iran/APT/Muddywater/2020-07-02/Analysis.md
Submission: On March 31 via api (March 31st 2021, 5:07:42 pm UTC) from US

Summary HTTP 43 Redirects Links 55 Behaviour Indicators

Summary

This website contacted 8 IPs in 1 countries across 5 domains to perform 43 HTTP transactions. The main IP is 140.82.121.3, located in United States and belongs to GITHUB, US. The main domain is github.com.
TLS certificate: Issued by DigiCert High Assurance TLS Hybrid EC... on March 25th 2021. Valid for: a year.

This is the only time github.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1	104.244.42.133 104.244.42.133	13414 (TWITTER) (TWITTER)
3	140.82.121.3 140.82.121.3	36459 (GITHUB) (GITHUB)
14	185.199.109.154 185.199.109.154	54113 (FASTLY) (FASTLY)
1	185.199.109.133 185.199.109.133	54113 (FASTLY) (FASTLY)
22	185.199.111.133 185.199.111.133	54113 (FASTLY) (FASTLY)
1	54.146.190.157 54.146.190.157	14618 (AMAZON-AES) (AMAZON-AES)
1	140.82.121.5 140.82.121.5	36459 (GITHUB) (GITHUB)
43	8

1 104.244.42.133 (United States)

ASN13414 (TWITTER, US)

t.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 140.82.121.3 (United States)

ASN36459 (GITHUB, US)
PTR: lb-140-82-121-3-fra.github.com

github.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

14 185.199.109.154 (United States)

ASN54113 (FASTLY, US)
PTR: cdn-185-199-109-154.github.com

github.githubassets.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.199.109.133 (United States)

ASN54113 (FASTLY, US)
PTR: cdn-185-199-109-133.github.com

avatars.githubusercontent.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

22 185.199.111.133 (United States)

ASN54113 (FASTLY, US)
PTR: cdn-185-199-111-133.github.com

raw.githubusercontent.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.146.190.157 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-146-190-157.compute-1.amazonaws.com

collector.githubapp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 140.82.121.5 (United States)

ASN36459 (GITHUB, US)
PTR: lb-140-82-121-5-fra.github.com

api.github.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
23	githubusercontent.com avatars.githubusercontent.com raw.githubusercontent.com	8 MB
14	githubassets.com github.githubassets.com	317 KB
4	github.com github.com api.github.com	36 KB
1	githubapp.com collector.githubapp.com	656 B
1	t.co t.co	567 B
43	5

	Domain	Requested by
22	raw.githubusercontent.com	github.com
14	github.githubassets.com	github.com github.githubassets.com
3	github.com	t.co github.githubassets.com
1	api.github.com	github.githubassets.com
1	collector.githubapp.com
1	avatars.githubusercontent.com	github.com
1	t.co
43	7

This site contains links to these domains. Also see Links.

Domain
lab.github.com
opensource.guide
github.community
education.github.com
stars.github.com
enterprise.github.com
desktop.github.com
raw.githubusercontent.com
twitter.com
www.cybermagonline.com
www.upi.com
attack.mitre.org
app.any.run
www.iiss.org
www.hybrid-analysis.com
docs.github.com
www.githubstatus.com
support.github.com
services.github.com
github.blog

Subject Issuer	Validity	Valid
t.co DigiCert TLS RSA SHA256 2020 CA1	`2021-02-05` - `2022-02-04`	a year	crt.sh
github.com DigiCert High Assurance TLS Hybrid ECC SHA256 2020 CA1	`2021-03-25` - `2022-03-30`	a year	crt.sh
*.githubassets.com DigiCert SHA2 High Assurance Server CA	`2020-11-02` - `2021-11-09`	a year	crt.sh
www.github.com DigiCert SHA2 High Assurance Server CA	`2020-05-06` - `2022-04-14`	2 years	crt.sh
*.githubapp.com DigiCert SHA2 High Assurance Server CA	`2020-04-16` - `2022-05-18`	2 years	crt.sh
*.github.com DigiCert High Assurance TLS Hybrid ECC SHA256 2020 CA1	`2021-03-25` - `2022-03-30`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://github.com/StrangerealIntel/CyberThreatIntel/blob/master/Iran/APT/Muddywater/2020-07-02/Analysis.md
Frame ID: 4FE5F240EFC1E95E7FB18D4B6BB97E96
Requests: 44 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://t.co/cBgbwk0g94 Page URL
https://github.com/StrangerealIntel/CyberThreatIntel/blob/master/Iran/APT/Muddywater/2020-07-02... Page URL

Page Statistics

43
Requests

100 %
HTTPS

0 %
IPv6

5
Domains

7
Subdomains

8
IPs

1
Countries

8365 kB
Transfer

9775 kB
Size

4
Cookies

55 Outgoing links

These are links going to different origins than the main page.

URL: https://lab.github.com/
Title: Learning Lab →

Search URL Search Domain Scan URL

URL: https://opensource.guide/
Title: Open source guides →

Search URL Search Domain Scan URL

URL: https://github.community/
Title: Community forum →

Search URL Search Domain Scan URL

URL: https://education.github.com/
Title: GitHub Education →

Search URL Search Domain Scan URL

URL: https://stars.github.com/
Title: GitHub Stars program →

Search URL Search Domain Scan URL

URL: https://enterprise.github.com/contact
Title: Contact Sales →

Search URL Search Domain Scan URL

URL: https://desktop.github.com/
Title:

Search URL Search Domain Scan URL

URL: https://raw.githubusercontent.com/StrangerealIntel/CyberThreatIntel/master/Iran/APT/Muddywater/2020-07-02/Pictures/NSIS/entry0.png

Search URL Search Domain Scan URL

URL: https://raw.githubusercontent.com/StrangerealIntel/CyberThreatIntel/master/Iran/APT/Muddywater/2020-07-02/Pictures/NSIS/Exec.png

Search URL Search Domain Scan URL

URL: https://raw.githubusercontent.com/StrangerealIntel/CyberThreatIntel/master/Iran/APT/Muddywater/2020-07-02/Pictures/Timestamp.png

Search URL Search Domain Scan URL

URL: https://raw.githubusercontent.com/StrangerealIntel/CyberThreatIntel/master/Iran/APT/Muddywater/2020-07-02/Pictures/AgentJan2020/DllRegisterServer.png

Search URL Search Domain Scan URL

URL: https://raw.githubusercontent.com/StrangerealIntel/CyberThreatIntel/master/Iran/APT/Muddywater/2020-07-02/Pictures/AgentJan2020/GetDiskSInfos.png

Search URL Search Domain Scan URL

URL: https://raw.githubusercontent.com/StrangerealIntel/CyberThreatIntel/master/Iran/APT/Muddywater/2020-07-02/Pictures/AgentJan2020/SendDataToC2.png

Search URL Search Domain Scan URL

URL: https://raw.githubusercontent.com/StrangerealIntel/CyberThreatIntel/master/Iran/APT/Muddywater/2020-07-02/Pictures/AgentJune2020/ExecuteActions.png

Search URL Search Domain Scan URL

URL: https://twitter.com/iamwinstonm
Title: d2hvYW1p

Search URL Search Domain Scan URL

URL: https://raw.githubusercontent.com/StrangerealIntel/CyberThreatIntel/master/Iran/APT/Muddywater/2020-07-02/Pictures/AgentJune2020/PowerRef.png

Search URL Search Domain Scan URL

URL: https://raw.githubusercontent.com/StrangerealIntel/CyberThreatIntel/master/Iran/APT/Muddywater/2020-07-02/Pictures/AgentJune2020/PowershellRunner.png

Search URL Search Domain Scan URL

URL: https://raw.githubusercontent.com/StrangerealIntel/CyberThreatIntel/master/Iran/APT/Muddywater/2020-07-02/Pictures/Muddy.png

Search URL Search Domain Scan URL

URL: https://raw.githubusercontent.com/StrangerealIntel/CyberThreatIntel/master/Iran/APT/Muddywater/2020-07-02/Pictures/Comp.png

Search URL Search Domain Scan URL

URL: https://raw.githubusercontent.com/StrangerealIntel/CyberThreatIntel/master/Iran/APT/Muddywater/2020-07-02/Pictures/AgentJune2020/Obfus.png

Search URL Search Domain Scan URL

URL: https://raw.githubusercontent.com/StrangerealIntel/CyberThreatIntel/master/Iran/APT/Muddywater/2020-07-02/Pictures/Maldocs/CyberDefense.png

Search URL Search Domain Scan URL

URL: https://raw.githubusercontent.com/StrangerealIntel/CyberThreatIntel/master/Iran/APT/Muddywater/2020-07-02/Pictures/Maldocs/IPReport.png

Search URL Search Domain Scan URL

URL: https://www.cybermagonline.com/korona-virusu-ve-siber-savunma
Title: here

Search URL Search Domain Scan URL

URL: https://raw.githubusercontent.com/StrangerealIntel/CyberThreatIntel/master/Iran/APT/Muddywater/2020-07-02/Pictures/Maldocs/conf_golf1.png

Search URL Search Domain Scan URL

URL: https://raw.githubusercontent.com/StrangerealIntel/CyberThreatIntel/master/Iran/APT/Muddywater/2020-07-02/Pictures/Maldocs/conf_golf2.png

Search URL Search Domain Scan URL

URL: https://raw.githubusercontent.com/StrangerealIntel/CyberThreatIntel/master/Iran/APT/Muddywater/2020-07-02/Pictures/Maldocs/ArticleUNRWA2.png

Search URL Search Domain Scan URL

URL: https://raw.githubusercontent.com/StrangerealIntel/CyberThreatIntel/master/Iran/APT/Muddywater/2020-07-02/Pictures/Maldocs/ArticleUNRWA.png

Search URL Search Domain Scan URL

URL: https://raw.githubusercontent.com/StrangerealIntel/CyberThreatIntel/master/Iran/APT/Muddywater/2020-07-02/Pictures/Maldocs/unrwa.png

Search URL Search Domain Scan URL

URL: https://raw.githubusercontent.com/StrangerealIntel/CyberThreatIntel/master/Iran/APT/Muddywater/2020-07-02/Pictures/Maldocs/US1.png

Search URL Search Domain Scan URL

URL: https://raw.githubusercontent.com/StrangerealIntel/CyberThreatIntel/master/Iran/APT/Muddywater/2020-07-02/Pictures/Maldocs/US.png

Search URL Search Domain Scan URL

URL: https://www.upi.com/Top_News/US/2020/06/08/US-sanctions-imposed-against-Iranian-shipping-go-into-effect/3231591668097/
Title: here

Search URL Search Domain Scan URL

URL: https://raw.githubusercontent.com/StrangerealIntel/CyberThreatIntel/master/Iran/APT/Muddywater/2020-07-02/Pictures/CyberKill.png

Search URL Search Domain Scan URL

URL: https://attack.mitre.org/techniques/T1053
Title: https://attack.mitre.org/techniques/T1053

Search URL Search Domain Scan URL

URL: https://attack.mitre.org/techniques/T1106
Title: https://attack.mitre.org/techniques/T1106

Search URL Search Domain Scan URL

URL: https://attack.mitre.org/techniques/T1060
Title: https://attack.mitre.org/techniques/T1060

Search URL Search Domain Scan URL

URL: https://attack.mitre.org/techniques/T1012
Title: https://attack.mitre.org/techniques/T1012

Search URL Search Domain Scan URL

URL: https://twitter.com/RedDrip7/status/1272739150165245952
Title: https://twitter.com/RedDrip7/status/1272739150165245952

Search URL Search Domain Scan URL

URL: https://twitter.com/Timele9527/status/1272776776335233024
Title: https://twitter.com/Timele9527/status/1272776776335233024

Search URL Search Domain Scan URL

URL: https://twitter.com/ShadowChasing1/status/1276708757943144448
Title: https://twitter.com/ShadowChasing1/status/1276708757943144448

Search URL Search Domain Scan URL

URL: https://twitter.com/iamwinstonm/status/1273195438619967489
Title: https://twitter.com/iamwinstonm/status/1273195438619967489

Search URL Search Domain Scan URL

URL: https://app.any.run/tasks/bb956e3a-36a5-4106-a50e-567776faf034
Title: New Health Protocols.v13.exe

Search URL Search Domain Scan URL

URL: https://app.any.run/tasks/08f3247b-1550-4b06-9eeb-7da500e4d74a
Title: Corona Virüsü ve Siber Savunma8.exe

Search URL Search Domain Scan URL

URL: https://app.any.run/tasks/e71572a8-2ac9-4002-9401-284fe39d318c
Title: Invite3.exe

Search URL Search Domain Scan URL

URL: https://app.any.run/tasks/a3015868-f51c-4dc5-908a-0c47f6c54cf1
Title: announcement.exe

Search URL Search Domain Scan URL

URL: https://app.any.run/tasks/cba85da2-64ef-4186-a32e-0c06599b6898
Title: bd43f26aedba541c3ed23cc0ffe572c5.virus

Search URL Search Domain Scan URL

URL: https://app.any.run/tasks/1fb528c2-d88c-430b-86c8-c6ff656da3c5
Title: UNRWA-ServerRequest1145.exe

Search URL Search Domain Scan URL

URL: https://www.iiss.org/blogs/analysis/2018/09/trump-unrwa-aid-cut/
Title: What does Trump’s UNRWA aid cut mean for Palestinians and the Middle East ?

Search URL Search Domain Scan URL

URL: https://www.hybrid-analysis.com/sample/ecc711fecb38c3557a5c2b1e9a46e9cf59b63a0c0203a7f4953af05d11582c02/5c19d7907ca3e126264d7cc8
Title: Powerstats ref (2018)

Search URL Search Domain Scan URL

URL: https://docs.github.com/en/github/site-policy/github-terms-of-service
Title: Terms

Search URL Search Domain Scan URL

URL: https://docs.github.com/en/github/site-policy/github-privacy-statement
Title: Privacy

Search URL Search Domain Scan URL

URL: https://www.githubstatus.com/
Title: Status

Search URL Search Domain Scan URL

URL: https://docs.github.com/
Title: Docs

Search URL Search Domain Scan URL

URL: https://support.github.com/
Title: Contact GitHub

Search URL Search Domain Scan URL

URL: https://services.github.com/
Title: Training

Search URL Search Domain Scan URL

URL: https://github.blog/
Title: Blog

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://t.co/cBgbwk0g94 Page URL
https://github.com/StrangerealIntel/CyberThreatIntel/blob/master/Iran/APT/Muddywater/2020-07-02/Analysis.md Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

43 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 cBgbwk0g94
t.co/ 484 B
567 B 222ms
156ms Document
text/html 104.244.42.133
TWITTER

General

Check archive.org

Show headers Download Go to

Full URL

https://t.co/cBgbwk0g94

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.133 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Xss-Protection	0

Request headers

:method: GET
:authority: t.co
:scheme: https
:path: /cBgbwk0g94
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

cache-control: private,max-age=300
content-encoding: gzip
content-length: 257
content-type: text/html; charset=utf-8
date: Wed, 31 Mar 2021 17:07:17 GMT
expires: Wed, 31 Mar 2021 17:12:17 GMT
server: tsa_o
set-cookie: muc=0a584049-9329-4e75-bff5-8bfc74b84a4e; Max-Age=63072000; Expires=Fri, 31 Mar 2023 17:07:17 GMT; Domain=t.co; Secure; SameSite=None
strict-transport-security: max-age=0
vary: Origin
x-connection-hash: 3a5a89d5534ae6a5094643c3a3c35276
x-response-time: 124
x-xss-protection: 0

GET
H2 200 Primary Request Analysis.md Show response
github.com/StrangerealIntel/CyberThreatIntel/blob/master/Iran/APT/Muddywater/2020-07-02/ 162 KB
33 KB 465ms
395ms Document
text/html 140.82.121.3
GITHUB

General

Check archive.org

Show headers Download Go to

Full URL

https://github.com/StrangerealIntel/CyberThreatIntel/blob/master/Iran/APT/Muddywater/2020-07-02/Analysis.md

Requested by

Host: t.co
URL: https://t.co/cBgbwk0g94

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

140.82.121.3 , United States, ASN36459 (GITHUB, US),

Reverse DNS

lb-140-82-121-3-fra.github.com

Software

GitHub.com /

Resource Hash

b4130d32a5cdcc0328bfad274c4cb6f5403ffe495319e94292a8fe5c4ac0b389

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; base-uri 'self'; block-all-mixed-content; connect-src 'self' uploads.github.com www.githubstatus.com collector.githubapp.com api.github.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com cdn.optimizely.com logx.optimizely.com/v1/events wss://alive.github.com .actions.githubusercontent.com wss://.actions.githubusercontent.com online.visualstudio.com/api/v1/locations; font-src github.githubassets.com; form-action 'self' github.com gist.github.com; frame-ancestors 'none'; frame-src render.githubusercontent.com; img-src 'self' data: github.githubassets.com identicons.github.com collector.githubapp.com github-cloud.s3.amazonaws.com secured-user-images.githubusercontent.com/ *.githubusercontent.com; manifest-src 'self'; media-src github.com user-images.githubusercontent.com/; script-src github.githubassets.com; style-src 'unsafe-inline' github.githubassets.com; worker-src github.com/socket-worker-3f088aa2.js gist.github.com/socket-worker-3f088aa2.js
Strict-Transport-Security	max-age=31536000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	0

Request headers

:method: GET
:authority: github.com
:scheme: https
:path: /StrangerealIntel/CyberThreatIntel/blob/master/Iran/APT/Muddywater/2020-07-02/Analysis.md
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: document
referer: https://t.co/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://t.co/

Response headers

server: GitHub.com
date: Wed, 31 Mar 2021 17:07:17 GMT
content-type: text/html; charset=utf-8
vary: X-PJAX, Accept-Encoding, Accept, X-Requested-With
etag: W/"15dccdffe6e4ed3a207842cfdebfc7cc"
cache-control: max-age=0, private, must-revalidate
strict-transport-security: max-age=31536000; includeSubdomains; preload
x-frame-options: deny
x-content-type-options: nosniff
x-xss-protection: 0
referrer-policy: no-referrer-when-downgrade
expect-ct: max-age=2592000, report-uri="https://api.github.com/_private/browser/errors"
content-security-policy: default-src 'none'; base-uri 'self'; block-all-mixed-content; connect-src 'self' uploads.github.com www.githubstatus.com collector.githubapp.com api.github.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com cdn.optimizely.com logx.optimizely.com/v1/events wss://alive.github.com *.actions.githubusercontent.com wss://*.actions.githubusercontent.com online.visualstudio.com/api/v1/locations; font-src github.githubassets.com; form-action 'self' github.com gist.github.com; frame-ancestors 'none'; frame-src render.githubusercontent.com; img-src 'self' data: github.githubassets.com identicons.github.com collector.githubapp.com github-cloud.s3.amazonaws.com secured-user-images.githubusercontent.com/ *.githubusercontent.com; manifest-src 'self'; media-src github.com user-images.githubusercontent.com/; script-src github.githubassets.com; style-src 'unsafe-inline' github.githubassets.com; worker-src github.com/socket-worker-3f088aa2.js gist.github.com/socket-worker-3f088aa2.js
content-encoding: gzip
set-cookie: _gh_sess=Cl9RIaB2d7LfGvEFOec%2BwSr7nQIbia%2BioB%2FdiiGZ8FHkb3MIowLX9%2FCVtUq%2FFEsNSPq2TnZeDxrT%2FdFiyMSc1h2NcxKQw9MzztI%2Fo7nEeoG3NgDoAJRdaudBpqPxrrkZa0VnIAvNnMQalBI5jsOe2PmoH2hdxsLRkdOrnZd%2BWhjAwiBks7ahCixRs3GjRxzz3RCzo0sw0LFlRUmueZ3orjTMhpfZA2NDOO2fwiPsv5%2BMsd1WQ2EpikE1kTMAgYv5odtYktrPGG9OxXufIJ9VmA%3D%3D--lAEkLvgAYfj1uoFW--mSmQ7%2FN%2FPpzrLQRWRIGBiQ%3D%3D; Path=/; HttpOnly; Secure; SameSite=Lax _octo=GH1.1.557225065.1617210437; Path=/; Domain=github.com; Expires=Thu, 31 Mar 2022 17:07:17 GMT; Secure; SameSite=Lax logged_in=no; Path=/; Domain=github.com; Expires=Thu, 31 Mar 2022 17:07:17 GMT; HttpOnly; Secure; SameSite=Lax
accept-ranges: bytes
x-github-request-id: DDF8:5B59:2225C57:2341BA6:6064AC45

GET
H2 200 frameworks-de11bb3994828c8658cdf1813c3ad015.css
github.githubassets.com/assets/ 436 KB
44 KB 82ms
26ms Stylesheet
text/css 185.199.109.154
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://github.githubassets.com/assets/frameworks-de11bb3994828c8658cdf1813c3ad015.css

Requested by

Host: github.com
URL: https://github.com/StrangerealIntel/CyberThreatIntel/blob/master/Iran/APT/Muddywater/2020-07-02/Analysis.md

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

185.199.109.154 , United States, ASN54113 (FASTLY, US),

Reverse DNS

cdn-185-199-109-154.github.com

Software

AmazonS3 /

Resource Hash

c0ae9be09e21fd1436b684ac8f59514e77a669ba48da252408f7128da22b3644

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Origin: https://github.com
Referer: https://github.com/StrangerealIntel/CyberThreatIntel/blob/master/Iran/APT/Muddywater/2020-07-02/Analysis.md
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-fastly-request-id: 748e5dae86b74c35dc91e3f2341fea865db79f5a
date: Wed, 31 Mar 2021 17:07:17 GMT
content-encoding: gzip
vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
age: 36836
x-cache: MISS, HIT
strict-transport-security: max-age=31536000
content-length: 44722
via: 1.1 varnish, 1.1 varnish
x-served-by: cache-dca12927-DCA, cache-hhn4031-HHN
last-modified: Wed, 31 Mar 2021 06:51:04 GMT
server: AmazonS3
etag: "8b84d46c321dde1294b969cf163d4566"
access-control-max-age: 3600
access-control-allow-methods: GET
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
x-cache-hits: 0, 13428

GET
H2 200 site-7c8868efa7b2b508d6f89c0e94f94864.css
github.githubassets.com/assets/ 82 KB
13 KB 130ms
75ms Stylesheet
text/css 185.199.109.154
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://github.githubassets.com/assets/site-7c8868efa7b2b508d6f89c0e94f94864.css

Requested by

Host: github.com
URL: https://github.com/StrangerealIntel/CyberThreatIntel/blob/master/Iran/APT/Muddywater/2020-07-02/Analysis.md

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

185.199.109.154 , United States, ASN54113 (FASTLY, US),

Reverse DNS

cdn-185-199-109-154.github.com

Software

AmazonS3 /

Resource Hash

0762949d5477582b26aba2e6f43616dbaa70bff9204801cb7d4ad25b1c291764

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Origin: https://github.com
Referer: https://github.com/StrangerealIntel/CyberThreatIntel/blob/master/Iran/APT/Muddywater/2020-07-02/Analysis.md
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-fastly-request-id: d19cd415a16a74a39e460327765e716d66db740a
date: Wed, 31 Mar 2021 17:07:17 GMT
content-encoding: gzip
vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
age: 69067
x-cache: HIT, HIT
strict-transport-security: max-age=31536000
content-length: 13114
via: 1.1 varnish, 1.1 varnish
x-served-by: cache-dca17723-DCA, cache-hhn4031-HHN
last-modified: Tue, 30 Mar 2021 21:53:53 GMT
server: AmazonS3
etag: "c2f5f66621c4b2e008104a16892e01a3"
access-control-max-age: 3600
access-control-allow-methods: GET
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
x-cache-hits: 1, 11157

GET
H2 200 behaviors-b3a8a2d79ae58e44048aad06a3bfef12.css
github.githubassets.com/assets/ 210 KB
32 KB 114ms
59ms Stylesheet
text/css 185.199.109.154
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://github.githubassets.com/assets/behaviors-b3a8a2d79ae58e44048aad06a3bfef12.css

Requested by

Host: github.com
URL: https://github.com/StrangerealIntel/CyberThreatIntel/blob/master/Iran/APT/Muddywater/2020-07-02/Analysis.md

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

185.199.109.154 , United States, ASN54113 (FASTLY, US),

Reverse DNS

cdn-185-199-109-154.github.com

Software

AmazonS3 /

Resource Hash

2e5a817e4c400b43ac94e1c3ee33a7be8f0994f5b3364c73bff34a0afb73e119

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Origin: https://github.com
Referer: https://github.com/StrangerealIntel/CyberThreatIntel/blob/master/Iran/APT/Muddywater/2020-07-02/Analysis.md
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-fastly-request-id: eb9856b524d45d72bbfe2fd25514c68f961f9ccc
date: Wed, 31 Mar 2021 17:07:17 GMT
content-encoding: gzip
vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
age: 36836
x-cache: MISS, HIT
strict-transport-security: max-age=31536000
content-length: 32811
via: 1.1 varnish, 1.1 varnish
x-served-by: cache-dca17734-DCA, cache-hhn4031-HHN
last-modified: Wed, 31 Mar 2021 06:51:01 GMT
server: AmazonS3
etag: "73c01613afb2d5cc6c93eeafcdaa19c0"
access-control-max-age: 3600
access-control-allow-methods: GET
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
x-cache-hits: 0, 13379

GET
H2 200 github-7d535f91bc586da01c34f6fa24aeae9a.css
github.githubassets.com/assets/ 233 KB
43 KB 130ms
76ms Stylesheet
text/css 185.199.109.154
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://github.githubassets.com/assets/github-7d535f91bc586da01c34f6fa24aeae9a.css

Requested by

Host: github.com
URL: https://github.com/StrangerealIntel/CyberThreatIntel/blob/master/Iran/APT/Muddywater/2020-07-02/Analysis.md

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

185.199.109.154 , United States, ASN54113 (FASTLY, US),

Reverse DNS

cdn-185-199-109-154.github.com

Software

AmazonS3 /

Resource Hash

c1e55db244debb330d357e2f8570a027a7b0fb0a4b82273df66560afd6354733

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Origin: https://github.com
Referer: https://github.com/StrangerealIntel/CyberThreatIntel/blob/master/Iran/APT/Muddywater/2020-07-02/Analysis.md
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-fastly-request-id: 4938d46c8cdf430470f4aec6d9ce0efd79627d2d
date: Wed, 31 Mar 2021 17:07:17 GMT
content-encoding: gzip
vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
age: 22300
x-cache: HIT, HIT
strict-transport-security: max-age=31536000
content-length: 44064
via: 1.1 varnish, 1.1 varnish
x-served-by: cache-dca17765-DCA, cache-hhn4031-HHN
last-modified: Wed, 31 Mar 2021 10:53:14 GMT
server: AmazonS3
etag: "b68c5f7baa436e8c4597e559503c7a61"
access-control-max-age: 3600
access-control-allow-methods: GET
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
x-cache-hits: 1, 8706

GET
H2 200 environment-0b3798e0.js Show response
github.githubassets.com/assets/ 11 KB
4 KB 146ms
93ms Script
application/javascript 185.199.109.154
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://github.githubassets.com/assets/environment-0b3798e0.js

Requested by

Host: github.com
URL: https://github.com/StrangerealIntel/CyberThreatIntel/blob/master/Iran/APT/Muddywater/2020-07-02/Analysis.md

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

185.199.109.154 , United States, ASN54113 (FASTLY, US),

Reverse DNS

cdn-185-199-109-154.github.com

Software

AmazonS3 /

Resource Hash

cfe81b8c130ef03ec4dbccddd91dc16105a1dd0391a1a5fa5a292f58606b9b96

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Origin: https://github.com
Referer: https://github.com/StrangerealIntel/CyberThreatIntel/blob/master/Iran/APT/Muddywater/2020-07-02/Analysis.md
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-fastly-request-id: 14be578ab3b6c103463bbede1e7ae1cd5023ce04
date: Wed, 31 Mar 2021 17:07:17 GMT
content-encoding: gzip
vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
age: 30754
x-cache: HIT, HIT
strict-transport-security: max-age=31536000
content-length: 4131
via: 1.1 varnish, 1.1 varnish
x-served-by: cache-dca12921-DCA, cache-hhn4031-HHN
last-modified: Wed, 31 Mar 2021 08:32:19 GMT
server: AmazonS3
etag: "c6de6fca03c981017e6e90b83a1a1efe"
access-control-max-age: 3600
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
x-cache-hits: 1, 12031

GET
H2 200 chunk-frameworks-976f5406.js Show response
github.githubassets.com/assets/ 79 KB
25 KB 127ms
75ms Script
application/javascript 185.199.109.154
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://github.githubassets.com/assets/chunk-frameworks-976f5406.js

Requested by

Host: github.com
URL: https://github.com/StrangerealIntel/CyberThreatIntel/blob/master/Iran/APT/Muddywater/2020-07-02/Analysis.md

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

185.199.109.154 , United States, ASN54113 (FASTLY, US),

Reverse DNS

cdn-185-199-109-154.github.com

Software

AmazonS3 /

Resource Hash

7da66173637a9b1e478f1cb122c7caf920203ffb71570f4ca6b9c3ace2eecc79

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Origin: https://github.com
Referer: https://github.com/StrangerealIntel/CyberThreatIntel/blob/master/Iran/APT/Muddywater/2020-07-02/Analysis.md
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-fastly-request-id: 31c08a905b335a17cbb2a08e977afd397739c796
date: Wed, 31 Mar 2021 17:07:17 GMT
content-encoding: gzip
vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
age: 30754
x-cache: HIT, HIT
strict-transport-security: max-age=31536000
content-length: 25231
via: 1.1 varnish, 1.1 varnish
x-served-by: cache-dca17774-DCA, cache-hhn4031-HHN
last-modified: Wed, 31 Mar 2021 08:32:17 GMT
server: AmazonS3
etag: "3bcc4d908c70902fea02abc9b332d58d"
access-control-max-age: 3600
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
x-cache-hits: 1, 12027

GET
H2 200 chunk-vendor-ee82dc34.js Show response
github.githubassets.com/assets/ 148 KB
40 KB 63ms
59ms Script
application/javascript 185.199.109.154
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://github.githubassets.com/assets/chunk-vendor-ee82dc34.js

Requested by

Host: github.com
URL: https://github.com/StrangerealIntel/CyberThreatIntel/blob/master/Iran/APT/Muddywater/2020-07-02/Analysis.md

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

185.199.109.154 , United States, ASN54113 (FASTLY, US),

Reverse DNS

cdn-185-199-109-154.github.com

Software

AmazonS3 /

Resource Hash

e9e11d78791c71c98d30149a52a24c50c716fe98ee33d0e10c7cf35af2cebc70

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Origin: https://github.com
Referer: https://github.com/StrangerealIntel/CyberThreatIntel/blob/master/Iran/APT/Muddywater/2020-07-02/Analysis.md
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-fastly-request-id: 13f884dcd4c75f385dfa304f6fff6c84b7d94bcb
date: Wed, 31 Mar 2021 17:07:18 GMT
content-encoding: gzip
vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
age: 30754
x-cache: HIT, HIT
strict-transport-security: max-age=31536000
content-length: 41002
via: 1.1 varnish, 1.1 varnish
x-served-by: cache-dca17782-DCA, cache-hhn4031-HHN
last-modified: Wed, 31 Mar 2021 08:32:17 GMT
server: AmazonS3
etag: "5a70bb45cb690c8c24c50056b47203fc"
access-control-max-age: 3600
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
x-cache-hits: 1, 12074

GET
H2 200 behaviors-fed944ee.js Show response
github.githubassets.com/assets/ 195 KB
55 KB 44ms
39ms Script
application/javascript 185.199.109.154
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://github.githubassets.com/assets/behaviors-fed944ee.js

Requested by

Host: github.com
URL: https://github.com/StrangerealIntel/CyberThreatIntel/blob/master/Iran/APT/Muddywater/2020-07-02/Analysis.md

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

185.199.109.154 , United States, ASN54113 (FASTLY, US),

Reverse DNS

cdn-185-199-109-154.github.com

Software

AmazonS3 /

Resource Hash

036adc06ad80849bea87962b7e73511949313299b2bf7118fb5d38dd3870cab1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Origin: https://github.com
Referer: https://github.com/StrangerealIntel/CyberThreatIntel/blob/master/Iran/APT/Muddywater/2020-07-02/Analysis.md
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-fastly-request-id: 95f06cc0305aed46644654b70e0ff1f9c8924cc7
date: Wed, 31 Mar 2021 17:07:18 GMT
content-encoding: gzip
vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
age: 22300
x-cache: HIT, HIT
strict-transport-security: max-age=31536000
content-length: 56197
via: 1.1 varnish, 1.1 varnish
x-served-by: cache-dca17759-DCA, cache-hhn4031-HHN
last-modified: Wed, 31 Mar 2021 10:53:10 GMT
server: AmazonS3
etag: "2fce7c1a5007f89efa6b67e69f82b207"
access-control-max-age: 3600
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
x-cache-hits: 1, 8892

GET
H2 200 repositories-5d40ede2.js Show response
github.githubassets.com/assets/ 50 KB
15 KB 44ms
40ms Script
application/javascript 185.199.109.154
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://github.githubassets.com/assets/repositories-5d40ede2.js

Requested by

Host: github.com
URL: https://github.com/StrangerealIntel/CyberThreatIntel/blob/master/Iran/APT/Muddywater/2020-07-02/Analysis.md

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

185.199.109.154 , United States, ASN54113 (FASTLY, US),

Reverse DNS

cdn-185-199-109-154.github.com

Software

AmazonS3 /

Resource Hash

95f235bddfa08b4453d2f3aca641286822c6ff822f47c2d5765523ca7283e2ef

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Origin: https://github.com
Referer: https://github.com/StrangerealIntel/CyberThreatIntel/blob/master/Iran/APT/Muddywater/2020-07-02/Analysis.md
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-fastly-request-id: 04b7ab1653e5eda3338a44ffb54f0a6c2aede79b
date: Wed, 31 Mar 2021 17:07:18 GMT
content-encoding: gzip
vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
age: 30754
x-cache: HIT, HIT
strict-transport-security: max-age=31536000
content-length: 14722
via: 1.1 varnish, 1.1 varnish
x-served-by: cache-dca12922-DCA, cache-hhn4031-HHN
last-modified: Wed, 31 Mar 2021 08:32:27 GMT
server: AmazonS3
etag: "78f4ba4576a6b2a04e30fd4e38dc0073"
access-control-max-age: 3600
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
x-cache-hits: 1, 8923

GET
H2 200 diffs-82df49f6.js Show response
github.githubassets.com/assets/ 58 KB
14 KB 44ms
40ms Script
application/javascript 185.199.109.154
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://github.githubassets.com/assets/diffs-82df49f6.js

Requested by

Host: github.com
URL: https://github.com/StrangerealIntel/CyberThreatIntel/blob/master/Iran/APT/Muddywater/2020-07-02/Analysis.md

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

185.199.109.154 , United States, ASN54113 (FASTLY, US),

Reverse DNS

cdn-185-199-109-154.github.com

Software

AmazonS3 /

Resource Hash

825222592c8869b8fab1206f35df6824ea257e2be00565a443d899c712d87bb2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Origin: https://github.com
Referer: https://github.com/StrangerealIntel/CyberThreatIntel/blob/master/Iran/APT/Muddywater/2020-07-02/Analysis.md
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-fastly-request-id: 0a3420a3a82db9ef3817fa8f1b60fadf136320d4
date: Wed, 31 Mar 2021 17:07:18 GMT
content-encoding: gzip
vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
age: 30752
x-cache: MISS, HIT
strict-transport-security: max-age=31536000
content-length: 14251
via: 1.1 varnish, 1.1 varnish
x-served-by: cache-dca17781-DCA, cache-hhn4031-HHN
last-modified: Wed, 31 Mar 2021 08:32:18 GMT
server: AmazonS3
etag: "6a21bb3cbe62b87ef09068e20ea86904"
access-control-max-age: 3600
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
x-cache-hits: 0, 6836

GET
H2 200 optimizely-a6992a1b.js Show response
github.githubassets.com/assets/ 102 KB
27 KB 65ms
61ms Script
application/javascript 185.199.109.154
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://github.githubassets.com/assets/optimizely-a6992a1b.js

Requested by

Host: github.com
URL: https://github.com/StrangerealIntel/CyberThreatIntel/blob/master/Iran/APT/Muddywater/2020-07-02/Analysis.md

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

185.199.109.154 , United States, ASN54113 (FASTLY, US),

Reverse DNS

cdn-185-199-109-154.github.com

Software

AmazonS3 /

Resource Hash

7afb74e587f2f71c1c892afc97897ff7b4c9385425bbbb3a9ca8ae11253ab8c2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Origin: https://github.com
Referer: https://github.com/StrangerealIntel/CyberThreatIntel/blob/master/Iran/APT/Muddywater/2020-07-02/Analysis.md
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-fastly-request-id: fe54872eaee65f2b7acd780634fe623206a1ed60
date: Wed, 31 Mar 2021 17:07:18 GMT
content-encoding: gzip
vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
age: 30755
x-cache: HIT, HIT
strict-transport-security: max-age=31536000
content-length: 27743
via: 1.1 varnish, 1.1 varnish
x-served-by: cache-dca17747-DCA, cache-hhn4031-HHN
last-modified: Wed, 31 Mar 2021 08:32:26 GMT
server: AmazonS3
etag: "7fd218bdd8acf329edc677cb798ae35c"
access-control-max-age: 3600
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
x-cache-hits: 1, 7000

GET
H2 200 search-key-slash.svg
github.githubassets.com/images/ 462 B
846 B 93ms
26ms Image
image/svg+xml 185.199.109.154
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://github.githubassets.com/images/search-key-slash.svg

Requested by

Host: github.com
URL: https://github.com/StrangerealIntel/CyberThreatIntel/blob/master/Iran/APT/Muddywater/2020-07-02/Analysis.md

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

185.199.109.154 , United States, ASN54113 (FASTLY, US),

Reverse DNS

cdn-185-199-109-154.github.com

Software

AmazonS3 /

Resource Hash

7e2d30caebb4fdfbbb2cdfbf93e1877d14f4fe7ab030c80b28e4973604a4c16e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://github.com/StrangerealIntel/CyberThreatIntel/blob/master/Iran/APT/Muddywater/2020-07-02/Analysis.md
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-fastly-request-id: 4d6a3bbe4216cec2e59c09c42cd2681b3680f2d7
date: Wed, 31 Mar 2021 17:07:18 GMT
via: 1.1 varnish, 1.1 varnish
vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method
age: 3913
x-cache: HIT, HIT
strict-transport-security: max-age=31536000
content-length: 462
x-served-by: cache-dca17725-DCA, cache-hhn4061-HHN
last-modified: Wed, 28 Nov 2018 19:43:05 GMT
server: AmazonS3
etag: "decb466e149b4a9f623c03768e0722f4"
access-control-max-age: 3600
access-control-allow-methods: GET
content-type: image/svg+xml
access-control-allow-origin: *
accept-ranges: bytes
x-cache-hits: 9, 317

GET
H2 200 54320855
avatars.githubusercontent.com/u/ 4 KB
5 KB 89ms
32ms Image
image/png 185.199.109.133
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://avatars.githubusercontent.com/u/54320855?s=48&v=4

Requested by

Host: github.com
URL: https://github.com/StrangerealIntel/CyberThreatIntel/blob/master/Iran/APT/Muddywater/2020-07-02/Analysis.md

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

185.199.109.133 , United States, ASN54113 (FASTLY, US),

Reverse DNS

cdn-185-199-109-133.github.com

Software

Resource Hash

d702cfb08aa4c2e8000c546baed5ed81366655ddb5e72a1f044d4ca4a58b0124

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'
Strict-Transport-Security	max-age=31557600
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

Referer: https://github.com/StrangerealIntel/CyberThreatIntel/blob/master/Iran/APT/Muddywater/2020-07-02/Analysis.md
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-fastly-request-id: a8c2910db07241112ec321b787f7fab79472cf05
content-security-policy: default-src 'none'
via: 1.1 varnish
x-content-type-options: nosniff
x-cache: HIT
x-cache-hits: 1
vary: Authorization,Accept-Encoding
content-length: 4553
x-xss-protection: 1; mode=block
x-served-by: cache-hhn4042-HHN
last-modified: Mon, 16 Nov 2020 17:45:46 GMT
x-github-request-id: 3C02:AAAD:49B229:50934A:6040701C
x-timer: S1617210438.015560,VS0,VE1
x-frame-options: deny
date: Wed, 31 Mar 2021 17:07:18 GMT
source-age: 2374698
strict-transport-security: max-age=31557600
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=300
etag: "40e4929b569cbdb59005d65b9bf40a5ec3184610fe3cd480e5884bc19adab421"
accept-ranges: bytes
timing-allow-origin: https://github.com
expires: Wed, 31 Mar 2021 17:12:18 GMT

GET
H2 200 entry0.png
raw.githubusercontent.com/StrangerealIntel/CyberThreatIntel/master/Iran/APT/Muddywater/2020-07-02/Pictures/NSIS/ 703 KB
704 KB 345ms
286ms Image
image/png 185.199.111.133
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://raw.githubusercontent.com/StrangerealIntel/CyberThreatIntel/master/Iran/APT/Muddywater/2020-07-02/Pictures/NSIS/entry0.png

Requested by

Host: github.com
URL: https://github.com/StrangerealIntel/CyberThreatIntel/blob/master/Iran/APT/Muddywater/2020-07-02/Analysis.md

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

185.199.111.133 , United States, ASN54113 (FASTLY, US),

Reverse DNS

cdn-185-199-111-133.github.com

Software

Resource Hash

71302e224a9dd3da7582c5a021ffa5d8b3c3ab91a2cbf15c9de7f0194a05b94a

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; style-src 'unsafe-inline'; sandbox
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

Referer: https://github.com/StrangerealIntel/CyberThreatIntel/blob/master/Iran/APT/Muddywater/2020-07-02/Analysis.md
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-fastly-request-id: d021b6ff52939d915016ed4a8d70bd053febbd64
content-security-policy: default-src 'none'; style-src 'unsafe-inline'; sandbox
via: 1.1 varnish
x-content-type-options: nosniff
x-cache: MISS
x-cache-hits: 0
vary: Authorization,Accept-Encoding
content-length: 719592
x-xss-protection: 1; mode=block
x-served-by: cache-hhn4048-HHN
x-github-request-id: 70FC:9924:1FF347B:2191A36:6064AA83
x-timer: S1617210438.016282,VS0,VE208
x-frame-options: deny
date: Wed, 31 Mar 2021 17:07:18 GMT
source-age: 0
strict-transport-security: max-age=31536000
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=300
etag: W/"997b69a722ff29d0aec6e424aa42e7fed6c5823ba54670454064ebe53cf0fbd6"
accept-ranges: bytes
expires: Wed, 31 Mar 2021 17:12:18 GMT

GET
H2 200 Exec.png
raw.githubusercontent.com/StrangerealIntel/CyberThreatIntel/master/Iran/APT/Muddywater/2020-07-02/Pictures/NSIS/ 65 KB
65 KB 231ms
173ms Image
image/png 185.199.111.133
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://raw.githubusercontent.com/StrangerealIntel/CyberThreatIntel/master/Iran/APT/Muddywater/2020-07-02/Pictures/NSIS/Exec.png

Requested by

Host: github.com
URL: https://github.com/StrangerealIntel/CyberThreatIntel/blob/master/Iran/APT/Muddywater/2020-07-02/Analysis.md

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

185.199.111.133 , United States, ASN54113 (FASTLY, US),

Reverse DNS

cdn-185-199-111-133.github.com

Software

Resource Hash

a13f908f9e834b27b7490bc095df8669c2daab69ec6168f2ca14abd4b7f6aa68

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; style-src 'unsafe-inline'; sandbox
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

Referer: https://github.com/StrangerealIntel/CyberThreatIntel/blob/master/Iran/APT/Muddywater/2020-07-02/Analysis.md
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-fastly-request-id: 5d7e92dd4d4e5a48f57f5765bbf72fe7709bbbae
content-security-policy: default-src 'none'; style-src 'unsafe-inline'; sandbox
via: 1.1 varnish
x-content-type-options: nosniff
x-cache: MISS
x-cache-hits: 0
vary: Authorization,Accept-Encoding
content-length: 66160
x-xss-protection: 1; mode=block
x-served-by: cache-hhn4048-HHN
x-github-request-id: BC50:99EB:1F8D7B8:212DE1B:6064AA83
x-timer: S1617210438.016558,VS0,VE146
x-frame-options: deny
date: Wed, 31 Mar 2021 17:07:18 GMT
source-age: 0
strict-transport-security: max-age=31536000
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=300
etag: W/"f96aa18d5717fb9b336e9628ff72d6744326c891c5a4833acbf8b525e667ef62"
accept-ranges: bytes
expires: Wed, 31 Mar 2021 17:12:18 GMT

GET
H2 200 Timestamp.png
raw.githubusercontent.com/StrangerealIntel/CyberThreatIntel/master/Iran/APT/Muddywater/2020-07-02/Pictures/ 33 KB
33 KB 309ms
251ms Image
image/png 185.199.111.133
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://raw.githubusercontent.com/StrangerealIntel/CyberThreatIntel/master/Iran/APT/Muddywater/2020-07-02/Pictures/Timestamp.png

Requested by

Host: github.com
URL: https://github.com/StrangerealIntel/CyberThreatIntel/blob/master/Iran/APT/Muddywater/2020-07-02/Analysis.md

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

185.199.111.133 , United States, ASN54113 (FASTLY, US),

Reverse DNS

cdn-185-199-111-133.github.com

Software

Resource Hash

6952483aa2626709552063813c2129b800d1e4e1e21db0f0039cd03532ae7f0e

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; style-src 'unsafe-inline'; sandbox
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

Referer: https://github.com/StrangerealIntel/CyberThreatIntel/blob/master/Iran/APT/Muddywater/2020-07-02/Analysis.md
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-fastly-request-id: 7b3c51d417282e6235c658de39908bb67f5680c5
content-security-policy: default-src 'none'; style-src 'unsafe-inline'; sandbox
via: 1.1 varnish
x-content-type-options: nosniff
x-cache: MISS
x-cache-hits: 0
vary: Authorization,Accept-Encoding
content-length: 34084
x-xss-protection: 1; mode=block
x-served-by: cache-hhn4048-HHN
x-github-request-id: F038:7C1B:4BD6EF:4FA830:6064AA83
x-timer: S1617210438.016502,VS0,VE164
x-frame-options: deny
date: Wed, 31 Mar 2021 17:07:18 GMT
source-age: 0
strict-transport-security: max-age=31536000
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=300
etag: W/"ecfba49411d121ab5d096b5ef6555ff358270e11fd8b5eefaf459c242299f3b2"
accept-ranges: bytes
expires: Wed, 31 Mar 2021 17:12:18 GMT

GET
H2 200 DllRegisterServer.png
raw.githubusercontent.com/StrangerealIntel/CyberThreatIntel/master/Iran/APT/Muddywater/2020-07-02/Pictures/AgentJan2020/ 140 KB
140 KB 272ms
215ms Image
image/png 185.199.111.133
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://raw.githubusercontent.com/StrangerealIntel/CyberThreatIntel/master/Iran/APT/Muddywater/2020-07-02/Pictures/AgentJan2020/DllRegisterServer.png

Requested by

Host: github.com
URL: https://github.com/StrangerealIntel/CyberThreatIntel/blob/master/Iran/APT/Muddywater/2020-07-02/Analysis.md

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

185.199.111.133 , United States, ASN54113 (FASTLY, US),

Reverse DNS

cdn-185-199-111-133.github.com

Software

Resource Hash

7bc1ffb18b07a4f274276a57196f8780c203900cfa9d095853d39e03a7b6d89d

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; style-src 'unsafe-inline'; sandbox
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

Referer: https://github.com/StrangerealIntel/CyberThreatIntel/blob/master/Iran/APT/Muddywater/2020-07-02/Analysis.md
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-fastly-request-id: b5d06be4840d60cfd43380fd657af87b8719c2d5
content-security-policy: default-src 'none'; style-src 'unsafe-inline'; sandbox
via: 1.1 varnish
x-content-type-options: nosniff
x-cache: MISS
x-cache-hits: 0
vary: Authorization,Accept-Encoding
content-length: 142974
x-xss-protection: 1; mode=block
x-served-by: cache-hhn4048-HHN
x-github-request-id: 37BA:ECDA:47FF83:5B9F84:6064AA83
x-timer: S1617210438.016534,VS0,VE155
x-frame-options: deny
date: Wed, 31 Mar 2021 17:07:18 GMT
source-age: 0
strict-transport-security: max-age=31536000
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=300
etag: W/"21f30b2a68e6b668d8c9e10d323379652cb416abbbe27146e85cb0af6f8599b3"
accept-ranges: bytes
expires: Wed, 31 Mar 2021 17:12:18 GMT

GET
H2 200 GetDiskSInfos.png
raw.githubusercontent.com/StrangerealIntel/CyberThreatIntel/master/Iran/APT/Muddywater/2020-07-02/Pictures/AgentJan2020/ 30 KB
30 KB 305ms
248ms Image
image/png 185.199.111.133
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://raw.githubusercontent.com/StrangerealIntel/CyberThreatIntel/master/Iran/APT/Muddywater/2020-07-02/Pictures/AgentJan2020/GetDiskSInfos.png

Requested by

Host: github.com
URL: https://github.com/StrangerealIntel/CyberThreatIntel/blob/master/Iran/APT/Muddywater/2020-07-02/Analysis.md

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

185.199.111.133 , United States, ASN54113 (FASTLY, US),

Reverse DNS

cdn-185-199-111-133.github.com

Software

Resource Hash

9d78c2e44f2d5dbd730ac8855e3aeafe7d0f30463dd919a798a8a78740b20f62

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; style-src 'unsafe-inline'; sandbox
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

Referer: https://github.com/StrangerealIntel/CyberThreatIntel/blob/master/Iran/APT/Muddywater/2020-07-02/Analysis.md
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-fastly-request-id: 863392fb232e45b2909c22c5fb5f8cb62f5ecba8
content-security-policy: default-src 'none'; style-src 'unsafe-inline'; sandbox
via: 1.1 varnish
x-content-type-options: nosniff
x-cache: MISS
x-cache-hits: 0
vary: Authorization,Accept-Encoding
content-length: 30425
x-xss-protection: 1; mode=block
x-served-by: cache-hhn4048-HHN
x-github-request-id: D4F6:69A1:86DD70:8CD12A:6064AA83
x-timer: S1617210438.016498,VS0,VE157
x-frame-options: deny
date: Wed, 31 Mar 2021 17:07:18 GMT
source-age: 0
strict-transport-security: max-age=31536000
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=300
etag: W/"c5424412b4aa1d581aa472618a68437bcc8761131d9534526ca2a920a53da2ac"
accept-ranges: bytes
expires: Wed, 31 Mar 2021 17:12:18 GMT

GET
H2 200 SendDataToC2.png
raw.githubusercontent.com/StrangerealIntel/CyberThreatIntel/master/Iran/APT/Muddywater/2020-07-02/Pictures/AgentJan2020/ 2 MB
2 MB 342ms
286ms Image
image/png 185.199.111.133
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://raw.githubusercontent.com/StrangerealIntel/CyberThreatIntel/master/Iran/APT/Muddywater/2020-07-02/Pictures/AgentJan2020/SendDataToC2.png

Requested by

Host: github.com
URL: https://github.com/StrangerealIntel/CyberThreatIntel/blob/master/Iran/APT/Muddywater/2020-07-02/Analysis.md

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

185.199.111.133 , United States, ASN54113 (FASTLY, US),

Reverse DNS

cdn-185-199-111-133.github.com

Software

Resource Hash

d1d38f016b69e2db7e8982d80e4019a97a880c3e7348bc6f6abb313321eeb175

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; style-src 'unsafe-inline'; sandbox
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

Referer: https://github.com/StrangerealIntel/CyberThreatIntel/blob/master/Iran/APT/Muddywater/2020-07-02/Analysis.md
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-fastly-request-id: 71eccf5f2539617358fc37bb713628f45fa09459
content-security-policy: default-src 'none'; style-src 'unsafe-inline'; sandbox
via: 1.1 varnish
x-content-type-options: nosniff
x-cache: MISS
x-cache-hits: 0
vary: Authorization,Accept-Encoding
content-length: 1967762
x-xss-protection: 1; mode=block
x-served-by: cache-hhn4048-HHN
x-github-request-id: 40B4:6778:1F967F8:2137576:6064AA83
x-timer: S1617210438.016539,VS0,VE208
x-frame-options: deny
date: Wed, 31 Mar 2021 17:07:18 GMT
source-age: 0
strict-transport-security: max-age=31536000
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=300
etag: W/"58c5fdc1bd23766ef32faccbe1193bc66b4e57d73b031b39580bfec7357cac01"
accept-ranges: bytes
expires: Wed, 31 Mar 2021 17:12:18 GMT

GET
H2 200 ExecuteActions.png
raw.githubusercontent.com/StrangerealIntel/CyberThreatIntel/master/Iran/APT/Muddywater/2020-07-02/Pictures/AgentJune2020/ 2 MB
2 MB 252ms
248ms Image
image/png 185.199.111.133
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://raw.githubusercontent.com/StrangerealIntel/CyberThreatIntel/master/Iran/APT/Muddywater/2020-07-02/Pictures/AgentJune2020/ExecuteActions.png

Requested by

Host: github.com
URL: https://github.com/StrangerealIntel/CyberThreatIntel/blob/master/Iran/APT/Muddywater/2020-07-02/Analysis.md

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

185.199.111.133 , United States, ASN54113 (FASTLY, US),

Reverse DNS

cdn-185-199-111-133.github.com

Software

Resource Hash

8953590b56e0c2099b8f293a36b668a50ce2ada6c596527b90f24f780c9413b1

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; style-src 'unsafe-inline'; sandbox
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

Referer: https://github.com/StrangerealIntel/CyberThreatIntel/blob/master/Iran/APT/Muddywater/2020-07-02/Analysis.md
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-fastly-request-id: 452750bc39058400b75c50922a29dfa5a0bae87e
content-security-policy: default-src 'none'; style-src 'unsafe-inline'; sandbox
via: 1.1 varnish
x-content-type-options: nosniff
x-cache: MISS
x-cache-hits: 0
vary: Authorization,Accept-Encoding
content-length: 1933180
x-xss-protection: 1; mode=block
x-served-by: cache-hhn4048-HHN
x-github-request-id: 62D6:99EB:1F8D7BB:212DE1E:6064AA83
x-timer: S1617210438.053466,VS0,VE164
x-frame-options: deny
date: Wed, 31 Mar 2021 17:07:18 GMT
source-age: 0
strict-transport-security: max-age=31536000
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=300
etag: W/"21d368e1fa034d2807ca622d1c776be712504e1978c4e65ddbf41b05c45c2f53"
accept-ranges: bytes
expires: Wed, 31 Mar 2021 17:12:18 GMT

GET
H2 200 PowerRef.png
raw.githubusercontent.com/StrangerealIntel/CyberThreatIntel/master/Iran/APT/Muddywater/2020-07-02/Pictures/AgentJune2020/ 25 KB
25 KB 261ms
257ms Image
image/png 185.199.111.133
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://raw.githubusercontent.com/StrangerealIntel/CyberThreatIntel/master/Iran/APT/Muddywater/2020-07-02/Pictures/AgentJune2020/PowerRef.png

Requested by

Host: github.com
URL: https://github.com/StrangerealIntel/CyberThreatIntel/blob/master/Iran/APT/Muddywater/2020-07-02/Analysis.md

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

185.199.111.133 , United States, ASN54113 (FASTLY, US),

Reverse DNS

cdn-185-199-111-133.github.com

Software

Resource Hash

8474807bf947a2eeeb243cf37a3d8cb7a2e19d167d94139d05d8f689a20303d0

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; style-src 'unsafe-inline'; sandbox
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

Referer: https://github.com/StrangerealIntel/CyberThreatIntel/blob/master/Iran/APT/Muddywater/2020-07-02/Analysis.md
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-fastly-request-id: fb3ab878512d7b58ea98166ecffdee520dd1cbc3
content-security-policy: default-src 'none'; style-src 'unsafe-inline'; sandbox
via: 1.1 varnish
x-content-type-options: nosniff
x-cache: MISS
x-cache-hits: 0
vary: Authorization,Accept-Encoding
content-length: 25374
x-xss-protection: 1; mode=block
x-served-by: cache-hhn4048-HHN
x-github-request-id: FB88:30D4:1332AA6:1428EAC:6064AA83
x-timer: S1617210438.053410,VS0,VE173
x-frame-options: deny
date: Wed, 31 Mar 2021 17:07:18 GMT
source-age: 0
strict-transport-security: max-age=31536000
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=300
etag: W/"0d23b10e29153def9793d0c85c936cf6c8c4b65e0b0401547c476a61676ff9ba"
accept-ranges: bytes
expires: Wed, 31 Mar 2021 17:12:18 GMT

GET
H2 200 PowershellRunner.png
raw.githubusercontent.com/StrangerealIntel/CyberThreatIntel/master/Iran/APT/Muddywater/2020-07-02/Pictures/AgentJune2020/ 1 MB
1 MB 241ms
237ms Image
image/png 185.199.111.133
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://raw.githubusercontent.com/StrangerealIntel/CyberThreatIntel/master/Iran/APT/Muddywater/2020-07-02/Pictures/AgentJune2020/PowershellRunner.png

Requested by

Host: github.com
URL: https://github.com/StrangerealIntel/CyberThreatIntel/blob/master/Iran/APT/Muddywater/2020-07-02/Analysis.md

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

185.199.111.133 , United States, ASN54113 (FASTLY, US),

Reverse DNS

cdn-185-199-111-133.github.com

Software

Resource Hash

848482ae46863997a24b0621977950c1fba170ae37a38724be2256f9070287f3

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; style-src 'unsafe-inline'; sandbox
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

Referer: https://github.com/StrangerealIntel/CyberThreatIntel/blob/master/Iran/APT/Muddywater/2020-07-02/Analysis.md
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-fastly-request-id: 487aa092423f23c0f7ac4fb67dc70247af33be66
content-security-policy: default-src 'none'; style-src 'unsafe-inline'; sandbox
via: 1.1 varnish
x-content-type-options: nosniff
x-cache: MISS
x-cache-hits: 0
vary: Authorization,Accept-Encoding
content-length: 1132368
x-xss-protection: 1; mode=block
x-served-by: cache-hhn4048-HHN
x-github-request-id: 268C:ECDB:CF72E6:E4E427:6064AA83
x-timer: S1617210438.053583,VS0,VE147
x-frame-options: deny
date: Wed, 31 Mar 2021 17:07:18 GMT
source-age: 0
strict-transport-security: max-age=31536000
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=300
etag: W/"0ee85b8b5545e82c3297ca9e0a25e4fcb918164dcd2707653f3b6fb52ac9e1ae"
accept-ranges: bytes
expires: Wed, 31 Mar 2021 17:12:18 GMT

GET
H2 200 Muddy.png
raw.githubusercontent.com/StrangerealIntel/CyberThreatIntel/master/Iran/APT/Muddywater/2020-07-02/Pictures/ 6 KB
6 KB 248ms
245ms Image
image/png 185.199.111.133
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://raw.githubusercontent.com/StrangerealIntel/CyberThreatIntel/master/Iran/APT/Muddywater/2020-07-02/Pictures/Muddy.png

Requested by

Host: github.com
URL: https://github.com/StrangerealIntel/CyberThreatIntel/blob/master/Iran/APT/Muddywater/2020-07-02/Analysis.md

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

185.199.111.133 , United States, ASN54113 (FASTLY, US),

Reverse DNS

cdn-185-199-111-133.github.com

Software

Resource Hash

3b24b6b54edaea98945991a3596fbf589eb1c528441493e0903c76583e080f52

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; style-src 'unsafe-inline'; sandbox
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

Referer: https://github.com/StrangerealIntel/CyberThreatIntel/blob/master/Iran/APT/Muddywater/2020-07-02/Analysis.md
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-fastly-request-id: a050893b78c4f648011bd45a96c5f0c2ec36accb
content-security-policy: default-src 'none'; style-src 'unsafe-inline'; sandbox
via: 1.1 varnish
x-content-type-options: nosniff
x-cache: MISS
x-cache-hits: 0
vary: Authorization,Accept-Encoding
content-length: 6225
x-xss-protection: 1; mode=block
x-served-by: cache-hhn4048-HHN
x-github-request-id: AE54:C735:1EEE8F9:208EC34:6064AA83
x-timer: S1617210438.054356,VS0,VE153
x-frame-options: deny
date: Wed, 31 Mar 2021 17:07:18 GMT
source-age: 0
strict-transport-security: max-age=31536000
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=300
etag: W/"291e55605cb59e6f8134d2b8b0a97d976d950e233e346fca9bcbb560d3c7a682"
accept-ranges: bytes
expires: Wed, 31 Mar 2021 17:12:18 GMT

GET
H2 200 Comp.png
raw.githubusercontent.com/StrangerealIntel/CyberThreatIntel/master/Iran/APT/Muddywater/2020-07-02/Pictures/ 56 KB
56 KB 242ms
238ms Image
image/png 185.199.111.133
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://raw.githubusercontent.com/StrangerealIntel/CyberThreatIntel/master/Iran/APT/Muddywater/2020-07-02/Pictures/Comp.png

Requested by

Host: github.com
URL: https://github.com/StrangerealIntel/CyberThreatIntel/blob/master/Iran/APT/Muddywater/2020-07-02/Analysis.md

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

185.199.111.133 , United States, ASN54113 (FASTLY, US),

Reverse DNS

cdn-185-199-111-133.github.com

Software

Resource Hash

f8afb4e77d5aa320798377c7d2a8c6d993dd250e2383f0c7d50c921aa0a8d4a8

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; style-src 'unsafe-inline'; sandbox
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

Referer: https://github.com/StrangerealIntel/CyberThreatIntel/blob/master/Iran/APT/Muddywater/2020-07-02/Analysis.md
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-fastly-request-id: aed744f877fb33f8796af510e1adac2189ff12e4
content-security-policy: default-src 'none'; style-src 'unsafe-inline'; sandbox
via: 1.1 varnish
x-content-type-options: nosniff
x-cache: MISS
x-cache-hits: 0
vary: Authorization,Accept-Encoding
content-length: 56871
x-xss-protection: 1; mode=block
x-served-by: cache-hhn4048-HHN
x-github-request-id: 1986:7C1B:4BD6F3:4FA834:6064AA83
x-timer: S1617210438.056295,VS0,VE150
x-frame-options: deny
date: Wed, 31 Mar 2021 17:07:18 GMT
source-age: 0
strict-transport-security: max-age=31536000
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=300
etag: W/"3221330371e0d5884ae5127a0925b5389dde9231ffd121583422687c4bc71bf3"
accept-ranges: bytes
expires: Wed, 31 Mar 2021 17:12:18 GMT

GET
H2 200 Obfus.png
raw.githubusercontent.com/StrangerealIntel/CyberThreatIntel/master/Iran/APT/Muddywater/2020-07-02/Pictures/AgentJune2020/ 95 KB
96 KB 250ms
247ms Image
image/png 185.199.111.133
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://raw.githubusercontent.com/StrangerealIntel/CyberThreatIntel/master/Iran/APT/Muddywater/2020-07-02/Pictures/AgentJune2020/Obfus.png

Requested by

Host: github.com
URL: https://github.com/StrangerealIntel/CyberThreatIntel/blob/master/Iran/APT/Muddywater/2020-07-02/Analysis.md

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

185.199.111.133 , United States, ASN54113 (FASTLY, US),

Reverse DNS

cdn-185-199-111-133.github.com

Software

Resource Hash

0a861d8a6062842f75636ca01a0fc34abeeca2c10ff6f899e1bab5f1ccd8129e

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; style-src 'unsafe-inline'; sandbox
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

Referer: https://github.com/StrangerealIntel/CyberThreatIntel/blob/master/Iran/APT/Muddywater/2020-07-02/Analysis.md
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-fastly-request-id: e829c36b8d6cd27031a7947afb649ec148e498ec
content-security-policy: default-src 'none'; style-src 'unsafe-inline'; sandbox
via: 1.1 varnish
x-content-type-options: nosniff
x-cache: MISS
x-cache-hits: 0
vary: Authorization,Accept-Encoding
content-length: 97749
x-xss-protection: 1; mode=block
x-served-by: cache-hhn4048-HHN
x-github-request-id: 285A:7C1B:4BD6F3:4FA832:6064AA83
x-timer: S1617210438.054303,VS0,VE160
x-frame-options: deny
date: Wed, 31 Mar 2021 17:07:18 GMT
source-age: 0
strict-transport-security: max-age=31536000
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=300
etag: W/"cede64aed054799ce81267415c6255435956b74c13b744be258f8ac7af571f12"
accept-ranges: bytes
expires: Wed, 31 Mar 2021 17:12:18 GMT

GET
H2 200 CyberDefense.png
raw.githubusercontent.com/StrangerealIntel/CyberThreatIntel/master/Iran/APT/Muddywater/2020-07-02/Pictures/Maldocs/ 355 KB
356 KB 225ms
221ms Image
image/png 185.199.111.133
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://raw.githubusercontent.com/StrangerealIntel/CyberThreatIntel/master/Iran/APT/Muddywater/2020-07-02/Pictures/Maldocs/CyberDefense.png

Requested by

Host: github.com
URL: https://github.com/StrangerealIntel/CyberThreatIntel/blob/master/Iran/APT/Muddywater/2020-07-02/Analysis.md

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

185.199.111.133 , United States, ASN54113 (FASTLY, US),

Reverse DNS

cdn-185-199-111-133.github.com

Software

Resource Hash

8fb25525625cea83b07fbcc5f2d29ea48bba194649f4d19d1fa4a3998d2f12dc

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; style-src 'unsafe-inline'; sandbox
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

Referer: https://github.com/StrangerealIntel/CyberThreatIntel/blob/master/Iran/APT/Muddywater/2020-07-02/Analysis.md
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-fastly-request-id: c282ed866aa9fc9cf8f33c45b94daf3ffdab1799
content-security-policy: default-src 'none'; style-src 'unsafe-inline'; sandbox
via: 1.1 varnish
x-content-type-options: nosniff
x-cache: MISS
x-cache-hits: 0
vary: Authorization,Accept-Encoding
content-length: 363775
x-xss-protection: 1; mode=block
x-served-by: cache-hhn4048-HHN
x-github-request-id: 7F48:C735:1EEE8F9:208EC33:6064AA83
x-timer: S1617210438.054376,VS0,VE145
x-frame-options: deny
date: Wed, 31 Mar 2021 17:07:18 GMT
source-age: 0
strict-transport-security: max-age=31536000
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=300
etag: W/"2702e1f8a9be0e137d546fe3e35fc143b8bb4264415738afa769f7924302fe71"
accept-ranges: bytes
expires: Wed, 31 Mar 2021 17:12:18 GMT

GET
H2 200 IPReport.png
raw.githubusercontent.com/StrangerealIntel/CyberThreatIntel/master/Iran/APT/Muddywater/2020-07-02/Pictures/Maldocs/ 318 KB
318 KB 261ms
257ms Image
image/png 185.199.111.133
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://raw.githubusercontent.com/StrangerealIntel/CyberThreatIntel/master/Iran/APT/Muddywater/2020-07-02/Pictures/Maldocs/IPReport.png

Requested by

Host: github.com
URL: https://github.com/StrangerealIntel/CyberThreatIntel/blob/master/Iran/APT/Muddywater/2020-07-02/Analysis.md

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

185.199.111.133 , United States, ASN54113 (FASTLY, US),

Reverse DNS

cdn-185-199-111-133.github.com

Software

Resource Hash

bbda711ceb49b4ef137a652df1d29b4cebeafa7b662f604fc273c6d61e5f2324

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; style-src 'unsafe-inline'; sandbox
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

Referer: https://github.com/StrangerealIntel/CyberThreatIntel/blob/master/Iran/APT/Muddywater/2020-07-02/Analysis.md
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-fastly-request-id: 2c211588bd596fd78836bab6902741ad9f9adef2
content-security-policy: default-src 'none'; style-src 'unsafe-inline'; sandbox
via: 1.1 varnish
x-content-type-options: nosniff
x-cache: MISS
x-cache-hits: 0
vary: Authorization,Accept-Encoding
content-length: 325329
x-xss-protection: 1; mode=block
x-served-by: cache-hhn4048-HHN
x-github-request-id: CD5E:7C1B:4BD6F3:4FA833:6064AA83
x-timer: S1617210438.054109,VS0,VE175
x-frame-options: deny
date: Wed, 31 Mar 2021 17:07:18 GMT
source-age: 0
strict-transport-security: max-age=31536000
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=300
etag: W/"006255673875607676984c1c8851104567ebaa1fee1e352e9caa155a79bfd001"
accept-ranges: bytes
expires: Wed, 31 Mar 2021 17:12:18 GMT

GET
H2 200 conf_golf1.png
raw.githubusercontent.com/StrangerealIntel/CyberThreatIntel/master/Iran/APT/Muddywater/2020-07-02/Pictures/Maldocs/ 506 KB
506 KB 249ms
245ms Image
image/png 185.199.111.133
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://raw.githubusercontent.com/StrangerealIntel/CyberThreatIntel/master/Iran/APT/Muddywater/2020-07-02/Pictures/Maldocs/conf_golf1.png

Requested by

Host: github.com
URL: https://github.com/StrangerealIntel/CyberThreatIntel/blob/master/Iran/APT/Muddywater/2020-07-02/Analysis.md

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

185.199.111.133 , United States, ASN54113 (FASTLY, US),

Reverse DNS

cdn-185-199-111-133.github.com

Software

Resource Hash

8ff3c655dbe25b6514d280ee56cbe86b8e3a708b600a28d835bb641e35f36bc0

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; style-src 'unsafe-inline'; sandbox
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

Referer: https://github.com/StrangerealIntel/CyberThreatIntel/blob/master/Iran/APT/Muddywater/2020-07-02/Analysis.md
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-fastly-request-id: 0de0c02405b9b54f5ea27f8632c0015ff0da7b7e
content-security-policy: default-src 'none'; style-src 'unsafe-inline'; sandbox
via: 1.1 varnish
x-content-type-options: nosniff
x-cache: MISS
x-cache-hits: 0
vary: Authorization,Accept-Encoding
content-length: 518004
x-xss-protection: 1; mode=block
x-served-by: cache-hhn4048-HHN
x-github-request-id: 6C36:B912:383284:3A6D4D:6064AA83
x-timer: S1617210438.054089,VS0,VE153
x-frame-options: deny
date: Wed, 31 Mar 2021 17:07:18 GMT
source-age: 0
strict-transport-security: max-age=31536000
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=300
etag: W/"4af084852424f5757a2c681b9c65a32ac94f2feb7eff8d61b75893b5500a698d"
accept-ranges: bytes
expires: Wed, 31 Mar 2021 17:12:18 GMT

GET
H2 200 conf_golf2.png
raw.githubusercontent.com/StrangerealIntel/CyberThreatIntel/master/Iran/APT/Muddywater/2020-07-02/Pictures/Maldocs/ 247 KB
247 KB 241ms
238ms Image
image/png 185.199.111.133
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://raw.githubusercontent.com/StrangerealIntel/CyberThreatIntel/master/Iran/APT/Muddywater/2020-07-02/Pictures/Maldocs/conf_golf2.png

Requested by

Host: github.com
URL: https://github.com/StrangerealIntel/CyberThreatIntel/blob/master/Iran/APT/Muddywater/2020-07-02/Analysis.md

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

185.199.111.133 , United States, ASN54113 (FASTLY, US),

Reverse DNS

cdn-185-199-111-133.github.com

Software

Resource Hash

fee7f3be9852053c09128f0c179d829d87671c434c9a5b320dae9bb4f433f44d

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; style-src 'unsafe-inline'; sandbox
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

Referer: https://github.com/StrangerealIntel/CyberThreatIntel/blob/master/Iran/APT/Muddywater/2020-07-02/Analysis.md
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-fastly-request-id: 0b3747d1f8d8e31d6433a9614f87979b3074a67f
content-security-policy: default-src 'none'; style-src 'unsafe-inline'; sandbox
via: 1.1 varnish
x-content-type-options: nosniff
x-cache: MISS
x-cache-hits: 0
vary: Authorization,Accept-Encoding
content-length: 252702
x-xss-protection: 1; mode=block
x-served-by: cache-hhn4048-HHN
x-github-request-id: 5BDA:5E79:ADBCEC:B5F6B1:6064AA83
x-timer: S1617210438.054072,VS0,VE152
x-frame-options: deny
date: Wed, 31 Mar 2021 17:07:18 GMT
source-age: 0
strict-transport-security: max-age=31536000
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=300
etag: W/"4088ef13f9d8db53bd589323fbc305f0b2c8cfed8a8687f5a8243999d4c2785a"
accept-ranges: bytes
expires: Wed, 31 Mar 2021 17:12:18 GMT

GET
H2 200 ArticleUNRWA2.png
raw.githubusercontent.com/StrangerealIntel/CyberThreatIntel/master/Iran/APT/Muddywater/2020-07-02/Pictures/Maldocs/ 87 KB
88 KB 241ms
237ms Image
image/png 185.199.111.133
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://raw.githubusercontent.com/StrangerealIntel/CyberThreatIntel/master/Iran/APT/Muddywater/2020-07-02/Pictures/Maldocs/ArticleUNRWA2.png

Requested by

Host: github.com
URL: https://github.com/StrangerealIntel/CyberThreatIntel/blob/master/Iran/APT/Muddywater/2020-07-02/Analysis.md

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

185.199.111.133 , United States, ASN54113 (FASTLY, US),

Reverse DNS

cdn-185-199-111-133.github.com

Software

Resource Hash

2f4784d83c454caa1c62f05984e67008120c0ceeeb48bccc8627ae2ca2debaaf

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; style-src 'unsafe-inline'; sandbox
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

Referer: https://github.com/StrangerealIntel/CyberThreatIntel/blob/master/Iran/APT/Muddywater/2020-07-02/Analysis.md
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-fastly-request-id: 8ba8bfa0419073e3bed92cee2838a28ab5e6c649
content-security-policy: default-src 'none'; style-src 'unsafe-inline'; sandbox
via: 1.1 varnish
x-content-type-options: nosniff
x-cache: MISS
x-cache-hits: 0
vary: Authorization,Accept-Encoding
content-length: 89399
x-xss-protection: 1; mode=block
x-served-by: cache-hhn4048-HHN
x-github-request-id: 723A:7C1B:4BD6F3:4FA831:6064AA83
x-timer: S1617210438.054220,VS0,VE147
x-frame-options: deny
date: Wed, 31 Mar 2021 17:07:18 GMT
source-age: 0
strict-transport-security: max-age=31536000
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=300
etag: W/"20249efa53d8c1016ac4586e21b1ac07d96d8712e5ef947441a281a03926148d"
accept-ranges: bytes
expires: Wed, 31 Mar 2021 17:12:18 GMT

GET
H2 200 ArticleUNRWA.png
raw.githubusercontent.com/StrangerealIntel/CyberThreatIntel/master/Iran/APT/Muddywater/2020-07-02/Pictures/Maldocs/ 51 KB
52 KB 241ms
238ms Image
image/png 185.199.111.133
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://raw.githubusercontent.com/StrangerealIntel/CyberThreatIntel/master/Iran/APT/Muddywater/2020-07-02/Pictures/Maldocs/ArticleUNRWA.png

Requested by

Host: github.com
URL: https://github.com/StrangerealIntel/CyberThreatIntel/blob/master/Iran/APT/Muddywater/2020-07-02/Analysis.md

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

185.199.111.133 , United States, ASN54113 (FASTLY, US),

Reverse DNS

cdn-185-199-111-133.github.com

Software

Resource Hash

9f5b52df01df5a5bce6ccb260f528e0577ead3efd2603e493d3aa24f24c9fd44

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; style-src 'unsafe-inline'; sandbox
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

Referer: https://github.com/StrangerealIntel/CyberThreatIntel/blob/master/Iran/APT/Muddywater/2020-07-02/Analysis.md
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-fastly-request-id: 99028538caa92f1b31b48ef80b1c7186912eebca
content-security-policy: default-src 'none'; style-src 'unsafe-inline'; sandbox
via: 1.1 varnish
x-content-type-options: nosniff
x-cache: MISS
x-cache-hits: 0
vary: Authorization,Accept-Encoding
content-length: 52558
x-xss-protection: 1; mode=block
x-served-by: cache-hhn4048-HHN
x-github-request-id: 5C82:6777:E06720:F6905F:6064AA83
x-timer: S1617210438.054019,VS0,VE150
x-frame-options: deny
date: Wed, 31 Mar 2021 17:07:18 GMT
source-age: 0
strict-transport-security: max-age=31536000
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=300
etag: W/"92c74c71a86f302a0c50e2c1dc9818f7edea99c342176229fa028b286d74028c"
accept-ranges: bytes
expires: Wed, 31 Mar 2021 17:12:18 GMT

GET
H2 200 unrwa.png
raw.githubusercontent.com/StrangerealIntel/CyberThreatIntel/master/Iran/APT/Muddywater/2020-07-02/Pictures/Maldocs/ 49 KB
49 KB 249ms
245ms Image
image/png 185.199.111.133
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://raw.githubusercontent.com/StrangerealIntel/CyberThreatIntel/master/Iran/APT/Muddywater/2020-07-02/Pictures/Maldocs/unrwa.png

Requested by

Host: github.com
URL: https://github.com/StrangerealIntel/CyberThreatIntel/blob/master/Iran/APT/Muddywater/2020-07-02/Analysis.md

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

185.199.111.133 , United States, ASN54113 (FASTLY, US),

Reverse DNS

cdn-185-199-111-133.github.com

Software

Resource Hash

bb0bf43b4163c825f6cdc537d301a358403ef7179a17b1b4dc7e1e52e2d0567c

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; style-src 'unsafe-inline'; sandbox
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

Referer: https://github.com/StrangerealIntel/CyberThreatIntel/blob/master/Iran/APT/Muddywater/2020-07-02/Analysis.md
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-fastly-request-id: bc920473d369bbba17d8a580e2c7de504f62d592
content-security-policy: default-src 'none'; style-src 'unsafe-inline'; sandbox
via: 1.1 varnish
x-content-type-options: nosniff
x-cache: MISS
x-cache-hits: 0
vary: Authorization,Accept-Encoding
content-length: 50163
x-xss-protection: 1; mode=block
x-served-by: cache-hhn4048-HHN
x-github-request-id: 6DAE:C735:1EEE8F9:208EC32:6064AA83
x-timer: S1617210438.054000,VS0,VE155
x-frame-options: deny
date: Wed, 31 Mar 2021 17:07:18 GMT
source-age: 0
strict-transport-security: max-age=31536000
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=300
etag: W/"61546600cc70d55621c8efd2861564f460ec670211f92f4c13431016158fcfb0"
accept-ranges: bytes
expires: Wed, 31 Mar 2021 17:12:18 GMT

GET
H2 200 US1.png
raw.githubusercontent.com/StrangerealIntel/CyberThreatIntel/master/Iran/APT/Muddywater/2020-07-02/Pictures/Maldocs/ 242 KB
242 KB 262ms
259ms Image
image/png 185.199.111.133
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://raw.githubusercontent.com/StrangerealIntel/CyberThreatIntel/master/Iran/APT/Muddywater/2020-07-02/Pictures/Maldocs/US1.png

Requested by

Host: github.com
URL: https://github.com/StrangerealIntel/CyberThreatIntel/blob/master/Iran/APT/Muddywater/2020-07-02/Analysis.md

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

185.199.111.133 , United States, ASN54113 (FASTLY, US),

Reverse DNS

cdn-185-199-111-133.github.com

Software

Resource Hash

aa398d28ec4e6a02b9dda081db13bb9b8dd016acf55bfdaeeaeaa109126d0c0d

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; style-src 'unsafe-inline'; sandbox
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

Referer: https://github.com/StrangerealIntel/CyberThreatIntel/blob/master/Iran/APT/Muddywater/2020-07-02/Analysis.md
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-fastly-request-id: ca65e00431e60bb2794639542b4eee77207af0fa
content-security-policy: default-src 'none'; style-src 'unsafe-inline'; sandbox
via: 1.1 varnish
x-content-type-options: nosniff
x-cache: MISS
x-cache-hits: 0
vary: Authorization,Accept-Encoding
content-length: 247511
x-xss-protection: 1; mode=block
x-served-by: cache-hhn4048-HHN
x-github-request-id: 8AB4:117DA:1F14E6C:20B2817:6064AA82
x-timer: S1617210438.054653,VS0,VE178
x-frame-options: deny
date: Wed, 31 Mar 2021 17:07:18 GMT
source-age: 0
strict-transport-security: max-age=31536000
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=300
etag: W/"fdd240e82258fa5a1396a390c95aaeabdd28ca403c60f68256922b315fadbf7b"
accept-ranges: bytes
expires: Wed, 31 Mar 2021 17:12:18 GMT

GET
H2 200 US.png
raw.githubusercontent.com/StrangerealIntel/CyberThreatIntel/master/Iran/APT/Muddywater/2020-07-02/Pictures/Maldocs/ 64 KB
65 KB 262ms
258ms Image
image/png 185.199.111.133
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://raw.githubusercontent.com/StrangerealIntel/CyberThreatIntel/master/Iran/APT/Muddywater/2020-07-02/Pictures/Maldocs/US.png

Requested by

Host: github.com
URL: https://github.com/StrangerealIntel/CyberThreatIntel/blob/master/Iran/APT/Muddywater/2020-07-02/Analysis.md

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

185.199.111.133 , United States, ASN54113 (FASTLY, US),

Reverse DNS

cdn-185-199-111-133.github.com

Software

Resource Hash

8f95b7ddf8a39e48c92cd57152bbf22cebf011135ed4d89fc7bd6b777568a14c

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; style-src 'unsafe-inline'; sandbox
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

Referer: https://github.com/StrangerealIntel/CyberThreatIntel/blob/master/Iran/APT/Muddywater/2020-07-02/Analysis.md
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-fastly-request-id: e4cce90b83b4e10402840182b4d23ab1a9d66ae0
content-security-policy: default-src 'none'; style-src 'unsafe-inline'; sandbox
via: 1.1 varnish
x-content-type-options: nosniff
x-cache: MISS
x-cache-hits: 0
vary: Authorization,Accept-Encoding
content-length: 65912
x-xss-protection: 1; mode=block
x-served-by: cache-hhn4048-HHN
x-github-request-id: E752:D672:EA8BE5:100EC41:6064AA83
x-timer: S1617210438.053940,VS0,VE179
x-frame-options: deny
date: Wed, 31 Mar 2021 17:07:18 GMT
source-age: 0
strict-transport-security: max-age=31536000
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=300
etag: W/"9edca5b31217a6ad431e56ff766ad8c885f2c2483ef92f16ca279e2f5c8bfd57"
accept-ranges: bytes
expires: Wed, 31 Mar 2021 17:12:18 GMT

GET
H2 200 CyberKill.png
raw.githubusercontent.com/StrangerealIntel/CyberThreatIntel/master/Iran/APT/Muddywater/2020-07-02/Pictures/ 9 KB
9 KB 261ms
258ms Image
image/png 185.199.111.133
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://raw.githubusercontent.com/StrangerealIntel/CyberThreatIntel/master/Iran/APT/Muddywater/2020-07-02/Pictures/CyberKill.png

Requested by

Host: github.com
URL: https://github.com/StrangerealIntel/CyberThreatIntel/blob/master/Iran/APT/Muddywater/2020-07-02/Analysis.md

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

185.199.111.133 , United States, ASN54113 (FASTLY, US),

Reverse DNS

cdn-185-199-111-133.github.com

Software

Resource Hash

d79c10cf66dade74089e3cf617877a79f52ce0c218b7dfdc05198a7c8d39def7

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; style-src 'unsafe-inline'; sandbox
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

Referer: https://github.com/StrangerealIntel/CyberThreatIntel/blob/master/Iran/APT/Muddywater/2020-07-02/Analysis.md
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-fastly-request-id: 31e1739209ece4c6cce23b94a6118d311a7818bf
content-security-policy: default-src 'none'; style-src 'unsafe-inline'; sandbox
via: 1.1 varnish
x-content-type-options: nosniff
x-cache: MISS
x-cache-hits: 0
vary: Authorization,Accept-Encoding
content-length: 8839
x-xss-protection: 1; mode=block
x-served-by: cache-hhn4048-HHN
x-github-request-id: A974:99E9:45B130:59BB3D:6064AA83
x-timer: S1617210438.070788,VS0,VE159
x-frame-options: deny
date: Wed, 31 Mar 2021 17:07:18 GMT
source-age: 0
strict-transport-security: max-age=31536000
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=300
etag: W/"af764ca4b2a27ca35a47b6943f4c198388e0cf4f6ded1a2bf2764207ef06eb4e"
accept-ranges: bytes
expires: Wed, 31 Mar 2021 17:12:18 GMT

GET
DATA 200
OK truncated
/ 42 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/gif

GET
H2 200 overall-count Show response
github.com/StrangerealIntel/CyberThreatIntel/security/ 0
2 KB 153ms
152ms Fetch
text/fragment+html 140.82.121.3
GITHUB

General

Check archive.org

Show headers Download Go to

Full URL

https://github.com/StrangerealIntel/CyberThreatIntel/security/overall-count

Requested by

Host: github.githubassets.com
URL: https://github.githubassets.com/assets/chunk-vendor-ee82dc34.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

140.82.121.3 , United States, ASN36459 (GITHUB, US),

Reverse DNS

lb-140-82-121-3-fra.github.com

Software

GitHub.com /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; base-uri 'self'; block-all-mixed-content; connect-src 'self' uploads.github.com www.githubstatus.com collector.githubapp.com api.github.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com cdn.optimizely.com logx.optimizely.com/v1/events wss://alive.github.com .actions.githubusercontent.com wss://.actions.githubusercontent.com online.visualstudio.com/api/v1/locations; font-src github.githubassets.com; form-action 'self' github.com gist.github.com; frame-ancestors 'none'; frame-src render.githubusercontent.com; img-src 'self' data: github.githubassets.com identicons.github.com collector.githubapp.com github-cloud.s3.amazonaws.com secured-user-images.githubusercontent.com/ *.githubusercontent.com; manifest-src 'self'; media-src github.com user-images.githubusercontent.com/; script-src github.githubassets.com; style-src 'unsafe-inline' github.githubassets.com; worker-src github.com/socket-worker-3f088aa2.js gist.github.com/socket-worker-3f088aa2.js
Strict-Transport-Security	max-age=31536000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	0

Request headers

Accept: text/fragment+html
Referer: https://github.com/StrangerealIntel/CyberThreatIntel/blob/master/Iran/APT/Muddywater/2020-07-02/Analysis.md
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 31 Mar 2021 17:07:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
vary: X-PJAX, Accept-Encoding, Accept, X-Requested-With
content-length: 20
x-xss-protection: 0
referrer-policy: no-referrer-when-downgrade
server: GitHub.com
x-github-request-id: DDF8:5B59:2225DEC:2341D51:6064AC45
x-frame-options: deny
expect-ct: max-age=2592000, report-uri="https://api.github.com/_private/browser/errors"
strict-transport-security: max-age=31536000; includeSubdomains; preload
content-type: text/fragment+html; charset=utf-8
cache-control: max-age=14400, private
content-security-policy: default-src 'none'; base-uri 'self'; block-all-mixed-content; connect-src 'self' uploads.github.com www.githubstatus.com collector.githubapp.com api.github.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com cdn.optimizely.com logx.optimizely.com/v1/events wss://alive.github.com *.actions.githubusercontent.com wss://*.actions.githubusercontent.com online.visualstudio.com/api/v1/locations; font-src github.githubassets.com; form-action 'self' github.com gist.github.com; frame-ancestors 'none'; frame-src render.githubusercontent.com; img-src 'self' data: github.githubassets.com identicons.github.com collector.githubapp.com github-cloud.s3.amazonaws.com secured-user-images.githubusercontent.com/ *.githubusercontent.com; manifest-src 'self'; media-src github.com user-images.githubusercontent.com/; script-src github.githubassets.com; style-src 'unsafe-inline' github.githubassets.com; worker-src github.com/socket-worker-3f088aa2.js gist.github.com/socket-worker-3f088aa2.js
accept-ranges: bytes

GET
H2 200 rollup Show response
github.com/StrangerealIntel/CyberThreatIntel/commit/b36300e151dc763b5546556cf1d16cf4c768a6be/ 0
2 KB 178ms
178ms Fetch
text/fragment+html 140.82.121.3
GITHUB

General

Check archive.org

Show headers Download Go to

Full URL

https://github.com/StrangerealIntel/CyberThreatIntel/commit/b36300e151dc763b5546556cf1d16cf4c768a6be/rollup?direction=e

Requested by

Host: github.githubassets.com
URL: https://github.githubassets.com/assets/chunk-vendor-ee82dc34.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

140.82.121.3 , United States, ASN36459 (GITHUB, US),

Reverse DNS

lb-140-82-121-3-fra.github.com

Software

GitHub.com /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; base-uri 'self'; block-all-mixed-content; connect-src 'self' uploads.github.com www.githubstatus.com collector.githubapp.com api.github.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com cdn.optimizely.com logx.optimizely.com/v1/events wss://alive.github.com .actions.githubusercontent.com wss://.actions.githubusercontent.com online.visualstudio.com/api/v1/locations; font-src github.githubassets.com; form-action 'self' github.com gist.github.com; frame-ancestors 'none'; frame-src render.githubusercontent.com; img-src 'self' data: github.githubassets.com identicons.github.com collector.githubapp.com github-cloud.s3.amazonaws.com secured-user-images.githubusercontent.com/ *.githubusercontent.com; manifest-src 'self'; media-src github.com user-images.githubusercontent.com/; script-src github.githubassets.com; style-src 'unsafe-inline' github.githubassets.com; worker-src github.com/socket-worker-3f088aa2.js gist.github.com/socket-worker-3f088aa2.js
Strict-Transport-Security	max-age=31536000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	0

Request headers

Accept: text/fragment+html
Referer: https://github.com/StrangerealIntel/CyberThreatIntel/blob/master/Iran/APT/Muddywater/2020-07-02/Analysis.md
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 31 Mar 2021 17:07:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
vary: X-PJAX, Accept-Encoding, Accept, X-Requested-With
content-length: 20
x-xss-protection: 0
referrer-policy: no-referrer-when-downgrade
server: GitHub.com
x-github-request-id: DDF8:5B59:2225DEC:2341D52:6064AC46
x-frame-options: deny
expect-ct: max-age=2592000, report-uri="https://api.github.com/_private/browser/errors"
strict-transport-security: max-age=31536000; includeSubdomains; preload
content-type: text/fragment+html
cache-control: no-cache
content-security-policy: default-src 'none'; base-uri 'self'; block-all-mixed-content; connect-src 'self' uploads.github.com www.githubstatus.com collector.githubapp.com api.github.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com cdn.optimizely.com logx.optimizely.com/v1/events wss://alive.github.com *.actions.githubusercontent.com wss://*.actions.githubusercontent.com online.visualstudio.com/api/v1/locations; font-src github.githubassets.com; form-action 'self' github.com gist.github.com; frame-ancestors 'none'; frame-src render.githubusercontent.com; img-src 'self' data: github.githubassets.com identicons.github.com collector.githubapp.com github-cloud.s3.amazonaws.com secured-user-images.githubusercontent.com/ *.githubusercontent.com; manifest-src 'self'; media-src github.com user-images.githubusercontent.com/; script-src github.githubassets.com; style-src 'unsafe-inline' github.githubassets.com; worker-src github.com/socket-worker-3f088aa2.js gist.github.com/socket-worker-3f088aa2.js
accept-ranges: bytes

GET
H2 200 chunk-edit-d264edaf.js Show response
github.githubassets.com/assets/ 7 KB
2 KB 31ms
31ms Script
application/javascript 185.199.109.154
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://github.githubassets.com/assets/chunk-edit-d264edaf.js

Requested by

Host: github.githubassets.com
URL: https://github.githubassets.com/assets/environment-0b3798e0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

185.199.109.154 , United States, ASN54113 (FASTLY, US),

Reverse DNS

cdn-185-199-109-154.github.com

Software

AmazonS3 /

Resource Hash

02da92ca3d29a9321d211685d5f6acd37e77a31eab3294fbfdc004b8ce96f13f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Origin: https://github.com
Referer: https://github.com/StrangerealIntel/CyberThreatIntel/blob/master/Iran/APT/Muddywater/2020-07-02/Analysis.md
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-fastly-request-id: f1893e451ee0dbd2ad86ef66b0472b7cc47810b0
date: Wed, 31 Mar 2021 17:07:18 GMT
content-encoding: gzip
vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
age: 30754
x-cache: HIT, HIT
strict-transport-security: max-age=31536000
content-length: 2158
via: 1.1 varnish, 1.1 varnish
x-served-by: cache-dca17760-DCA, cache-hhn4031-HHN
last-modified: Wed, 31 Mar 2021 08:32:17 GMT
server: AmazonS3
etag: "546119d41d2184ab4f43ba3b1ba151c2"
access-control-max-age: 3600
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
x-cache-hits: 1, 11770

GET
H2 200 chunk-color-modes-684780b1.js Show response
github.githubassets.com/assets/ 885 B
709 B 32ms
31ms Script
application/javascript 185.199.109.154
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://github.githubassets.com/assets/chunk-color-modes-684780b1.js

Requested by

Host: github.githubassets.com
URL: https://github.githubassets.com/assets/environment-0b3798e0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

185.199.109.154 , United States, ASN54113 (FASTLY, US),

Reverse DNS

cdn-185-199-109-154.github.com

Software

AmazonS3 /

Resource Hash

c01e1ae1dfcca67b07dc9d216b9f5d9fddecc31044b8f7018b3649323a4d2d7f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Origin: https://github.com
Referer: https://github.com/StrangerealIntel/CyberThreatIntel/blob/master/Iran/APT/Muddywater/2020-07-02/Analysis.md
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-fastly-request-id: 34a76db403d4a05a558f2d1764ae0847f3f7b7be
date: Wed, 31 Mar 2021 17:07:18 GMT
content-encoding: gzip
vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
age: 30754
x-cache: HIT, HIT
strict-transport-security: max-age=31536000
content-length: 394
via: 1.1 varnish, 1.1 varnish
x-served-by: cache-dca17745-DCA, cache-hhn4031-HHN
last-modified: Wed, 31 Mar 2021 08:32:17 GMT
server: AmazonS3
etag: "196517acd0ce9824c996263f56f97209"
access-control-max-age: 3600
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
x-cache-hits: 1, 12032

GET
H/1.1 200
OK page_view
collector.githubapp.com/github/ 35 B
656 B 490ms
122ms Image
image/gif 54.146.190.157
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://collector.githubapp.com/github/page_view?dimensions[page]=https%3A%2F%2Fgithub.com%2FStrangerealIntel%2FCyberThreatIntel%2Fblob%2Fmaster%2FIran%2FAPT%2FMuddywater%2F2020-07-02%2FAnalysis.md&dimensions[title]=CyberThreatIntel%2FAnalysis.md%20at%20master%20%C2%B7%20StrangerealIntel%2FCyberThreatIntel%20%C2%B7%20GitHub&dimensions[referrer]=https%3A%2F%2Ft.co%2F&dimensions[user_agent]=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F89.0.4389.72%20Safari%2F537.36&dimensions[screen_resolution]=1600x1200&dimensions[pixel_ratio]=1&dimensions[browser_resolution]=1600x1200&dimensions[tz_seconds]=7200&dimensions[timestamp]=1617210438995&dimensions[referrer]=https%3A%2F%2Ft.co%2F&dimensions[request_id]=DDF8%3A5B59%3A2225C57%3A2341BA6%3A6064AC45&dimensions[visitor_id]=2393263432303684677&dimensions[region_edge]=fra&dimensions[region_render]=fra&dimensions[user_id]=54320855&dimensions[user_login]=StrangerealIntel&dimensions[repository_id]=203393461&dimensions[repository_nwo]=StrangerealIntel%2FCyberThreatIntel&dimensions[repository_public]=true&dimensions[repository_is_fork]=false&dimensions[repository_network_root_id]=203393461&dimensions[repository_network_root_nwo]=StrangerealIntel%2FCyberThreatIntel&&measures[performance_timing]=1-72-4-1547-1146-1146-511-472-4-3-1--1547-0---72-494-467-23--&&&dimensions[cid]=557225065.1617210437

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.146.190.157 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-146-190-157.compute-1.amazonaws.com

Software

GitHub.com /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519, max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Referer: https://github.com/StrangerealIntel/CyberThreatIntel/blob/master/Iran/APT/Muddywater/2020-07-02/Analysis.md
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Wed, 31 Mar 2021 17:07:19 GMT
X-Content-Type-Options: nosniff
X-Permitted-Cross-Domain-Policies: none
Connection: keep-alive
Content-Length: 35
X-XSS-Protection: 1; mode=block
X-Request-Id: 1c6f575a-6e51-419a-bcbd-d02bcbaba7e5
X-Runtime: 0.002430
Last-Modified: Wed, 31 Mar 2021 17:07:19 GMT
Server: GitHub.com
X-Frame-Options: DENY
X-Download-Options: noopen
Strict-Transport-Security: max-age=631138519, max-age=31536000
Content-Type: image/gif; charset=utf-8
Pragma: no-cache
Cache-Control: no-cache, no-store
Expires: Sat, 25 Nov 2000 05:00:00 GMT

POST
H2 200 stats
api.github.com/_private/browser/ 0
0 284ms
214ms Other
text/plain 140.82.121.5
GITHUB

General

Check archive.org

Show headers Download Go to

Full URL: https://api.github.com/_private/browser/stats
Requested by: Host: github.githubassets.com
URL: https://github.githubassets.com/assets/chunk-frameworks-976f5406.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 140.82.121.5 , United States, ASN36459 (GITHUB, US),
Reverse DNS: lb-140-82-121-5-fra.github.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://github.com/StrangerealIntel/CyberThreatIntel/blob/master/Iran/APT/Muddywater/2020-07-02/Analysis.md
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
access-control-expose-headers: ETag, Link, Location, Retry-After, X-GitHub-OTP, X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Used, X-RateLimit-Reset, X-OAuth-Scopes, X-Accepted-OAuth-Scopes, X-Poll-Interval, X-GitHub-Media-Type, Deprecation, Sunset

Verdicts & Comments Add Verdict or Comment

71 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

4 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.github.com/	1970-01-20 01:59:06	Name: logged_in Value: no
.github.com/	1969-12-31 23:59:59	Name: tz Value: Europe%2FBerlin
.github.com/	1970-01-20 01:59:06	Name: _octo Value: GH1.1.557225065.1617210437
github.com/	1969-12-31 23:59:59	Name: _gh_sess Value: Cl9RIaB2d7LfGvEFOec%2BwSr7nQIbia%2BioB%2FdiiGZ8FHkb3MIowLX9%2FCVtUq%2FFEsNSPq2TnZeDxrT%2FdFiyMSc1h2NcxKQw9MzztI%2Fo7nEeoG3NgDoAJRdaudBpqPxrrkZa0VnIAvNnMQalBI5jsOe2PmoH2hdxsLRkdOrnZd%2BWhjAwiBks7ahCixRs3GjRxzz3RCzo0sw0LFlRUmueZ3orjTMhpfZA2NDOO2fwiPsv5%2BMsd1WQ2EpikE1kTMAgYv5odtYktrPGG9OxXufIJ9VmA%3D%3D--lAEkLvgAYfj1uoFW--mSmQ7%2FN%2FPpzrLQRWRIGBiQ%3D%3D

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=0
X-Xss-Protection	0

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

api.github.com
avatars.githubusercontent.com
collector.githubapp.com
github.com
github.githubassets.com
raw.githubusercontent.com
t.co
104.244.42.133
140.82.121.3
140.82.121.5
185.199.109.133
185.199.109.154
185.199.111.133
54.146.190.157
02da92ca3d29a9321d211685d5f6acd37e77a31eab3294fbfdc004b8ce96f13f
036adc06ad80849bea87962b7e73511949313299b2bf7118fb5d38dd3870cab1
0762949d5477582b26aba2e6f43616dbaa70bff9204801cb7d4ad25b1c291764
0a861d8a6062842f75636ca01a0fc34abeeca2c10ff6f899e1bab5f1ccd8129e
2e5a817e4c400b43ac94e1c3ee33a7be8f0994f5b3364c73bff34a0afb73e119
2f4784d83c454caa1c62f05984e67008120c0ceeeb48bccc8627ae2ca2debaaf
3b24b6b54edaea98945991a3596fbf589eb1c528441493e0903c76583e080f52
6952483aa2626709552063813c2129b800d1e4e1e21db0f0039cd03532ae7f0e
71302e224a9dd3da7582c5a021ffa5d8b3c3ab91a2cbf15c9de7f0194a05b94a
7afb74e587f2f71c1c892afc97897ff7b4c9385425bbbb3a9ca8ae11253ab8c2
7bc1ffb18b07a4f274276a57196f8780c203900cfa9d095853d39e03a7b6d89d
7da66173637a9b1e478f1cb122c7caf920203ffb71570f4ca6b9c3ace2eecc79
7e2d30caebb4fdfbbb2cdfbf93e1877d14f4fe7ab030c80b28e4973604a4c16e
825222592c8869b8fab1206f35df6824ea257e2be00565a443d899c712d87bb2
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
8474807bf947a2eeeb243cf37a3d8cb7a2e19d167d94139d05d8f689a20303d0
848482ae46863997a24b0621977950c1fba170ae37a38724be2256f9070287f3
8953590b56e0c2099b8f293a36b668a50ce2ada6c596527b90f24f780c9413b1
8f95b7ddf8a39e48c92cd57152bbf22cebf011135ed4d89fc7bd6b777568a14c
8fb25525625cea83b07fbcc5f2d29ea48bba194649f4d19d1fa4a3998d2f12dc
8ff3c655dbe25b6514d280ee56cbe86b8e3a708b600a28d835bb641e35f36bc0
95f235bddfa08b4453d2f3aca641286822c6ff822f47c2d5765523ca7283e2ef
9d78c2e44f2d5dbd730ac8855e3aeafe7d0f30463dd919a798a8a78740b20f62
9f5b52df01df5a5bce6ccb260f528e0577ead3efd2603e493d3aa24f24c9fd44
a13f908f9e834b27b7490bc095df8669c2daab69ec6168f2ca14abd4b7f6aa68
aa398d28ec4e6a02b9dda081db13bb9b8dd016acf55bfdaeeaeaa109126d0c0d
b4130d32a5cdcc0328bfad274c4cb6f5403ffe495319e94292a8fe5c4ac0b389
bb0bf43b4163c825f6cdc537d301a358403ef7179a17b1b4dc7e1e52e2d0567c
bbda711ceb49b4ef137a652df1d29b4cebeafa7b662f604fc273c6d61e5f2324
c01e1ae1dfcca67b07dc9d216b9f5d9fddecc31044b8f7018b3649323a4d2d7f
c0ae9be09e21fd1436b684ac8f59514e77a669ba48da252408f7128da22b3644
c1e55db244debb330d357e2f8570a027a7b0fb0a4b82273df66560afd6354733
cfe81b8c130ef03ec4dbccddd91dc16105a1dd0391a1a5fa5a292f58606b9b96
d1d38f016b69e2db7e8982d80e4019a97a880c3e7348bc6f6abb313321eeb175
d702cfb08aa4c2e8000c546baed5ed81366655ddb5e72a1f044d4ca4a58b0124
d79c10cf66dade74089e3cf617877a79f52ce0c218b7dfdc05198a7c8d39def7
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e9e11d78791c71c98d30149a52a24c50c716fe98ee33d0e10c7cf35af2cebc70
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f8afb4e77d5aa320798377c7d2a8c6d993dd250e2383f0c7d50c921aa0a8d4a8
fee7f3be9852053c09128f0c179d829d87671c434c9a5b320dae9bb4f433f44d

github.com Open in urlscan Pro 140.82.121.3 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Page Statistics

43 Requests

100 %HTTPS

0 %IPv6

5 Domains

7 Subdomains

8 IPs

1 Countries

8365 kBTransfer

9775 kBSize

4 Cookies

55 Outgoing links

Page URL History

Redirected requests

43 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

github.com Open in urlscan Pro
140.82.121.3 Public Scan

Screenshot
Live screenshot

Full Image

43
Requests

100 %
HTTPS

0 %
IPv6

5
Domains

7
Subdomains

8
IPs

1
Countries

8365 kB
Transfer

9775 kB
Size

4
Cookies

43 HTTP transactions
1 data transactions