www.recordedfuture.com Open in urlscan Pro
172.64.152.166 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.recordedfuture.com/research/reddelta-chinese-state-sponsored-group-targets-mongolia-taiwan-southeast-asia
Submission: On January 10 via manual (January 10th 2025, 5:12:50 pm UTC) from PH — Scanned from DE

Summary HTTP 119 Redirects Links 31 Behaviour Indicators

Summary

This website contacted 38 IPs in 5 countries across 28 domains to perform 119 HTTP transactions. The main IP is 172.64.152.166, located in San Francisco, United States and belongs to CLOUDFLARENET, US. The main domain is www.recordedfuture.com. The Cisco Umbrella rank of the primary domain is 385878.
TLS certificate: Issued by DigiCert Global G2 TLS RSA SHA256 202... on February 7th 2024. Valid for: a year.

This is the only time www.recordedfuture.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
41	172.64.152.166 172.64.152.166	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	104.18.35.90 104.18.35.90	13335 (CLOUDFLAR...) (CLOUDFLARENET)
8	34.107.218.251 34.107.218.251	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
4	2a00:1450:400... 2a00:1450:4001:810::2008	15169 (GOOGLE) (GOOGLE)
13	2.20.245.211 2.20.245.211	20940 (AKAMAI-AS...) (AKAMAI-ASN1 Akamai International B.V.)
1	172.217.16.196 172.217.16.196	15169 (GOOGLE) (GOOGLE)
1	199.232.188.157 199.232.188.157	54113 (FASTLY) (FASTLY)
2	2a02:26f0:480... 2a02:26f0:480:15::213:7e4a	20940 (AKAMAI-AS...) (AKAMAI-ASN1 Akamai International B.V.)
2	2a00:1450:400... 2a00:1450:4001:800::2008	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:811::200a	15169 (GOOGLE) (GOOGLE)
2	157.240.0.6 157.240.0.6	32934 (FACEBOOK) (FACEBOOK)
2	2600:9000:272... 2600:9000:2724:7200:c:7d55:b3c0:93a1	16509 (AMAZON-02) (AMAZON-02)
1	2606:4700::68... 2606:4700::6810:8dd1	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a04:4e42:600... 2a04:4e42:600::485	54113 (FASTLY) (FASTLY)
1	162.159.140.229 162.159.140.229	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	104.244.42.131 104.244.42.131	13414 (TWITTER) (TWITTER)
2	157.240.0.35 157.240.0.35	32934 (FACEBOOK) (FACEBOOK)
1 3	2620:1ec:21::14 2620:1ec:21::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	2001:4860:480... 2001:4860:4802:34::36	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:400c:c0a::9a	15169 (GOOGLE) (GOOGLE)
1	172.217.23.99 172.217.23.99	15169 (GOOGLE) (GOOGLE)
2	18.195.235.189 18.195.235.189	16509 (AMAZON-02) (AMAZON-02)
1	13.107.42.14 13.107.42.14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
2	18.196.170.251 18.196.170.251	16509 (AMAZON-02) (AMAZON-02)
5	2606:4700::68... 2606:4700::6810:7574	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6810:a0a8	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2606:4700::68... 2606:4700::6810:6ffe	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6812:8911	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700:440... 2606:4700:4400::ac40:9310	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	185.89.210.141 185.89.210.141	29990 (ASN-APPNEX) (ASN-APPNEX)
1	2.21.65.138 2.21.65.138	20940 (AKAMAI-AS...) (AKAMAI-ASN1 Akamai International B.V.)
1	2a02:26f0:278... 2a02:26f0:2780:67::217:e394	20940 (AKAMAI-AS...) (AKAMAI-ASN1 Akamai International B.V.)
2	99.83.231.3 99.83.231.3	16509 (AMAZON-02) (AMAZON-02)
2	75.2.108.141 75.2.108.141	16509 (AMAZON-02) (AMAZON-02)
4	13.35.58.23 13.35.58.23	16509 (AMAZON-02) (AMAZON-02)
1	104.19.175.188 104.19.175.188	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	199.60.103.2 199.60.103.2	209242 (CLOUDFLAR...) (CLOUDFLARESPECTRUM Cloudflare London)
119	38

41 172.64.152.166 (San Francisco, United States)

ASN13335 (CLOUDFLARENET, US)

www.recordedfuture.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cms.recordedfuture.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.18.35.90 (None, )

ASN13335 (CLOUDFLARENET, US)

cms.recordedfuture.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 34.107.218.251 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 251.218.107.34.bc.googleusercontent.com

dev.visualwebsiteoptimizer.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:810::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 2.20.245.211 (Netherlands)

ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL)
PTR: a2-20-245-211.deploy.static.akamaitechnologies.com

j.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
b.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.217.16.196 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s65-in-f4.1e100.net

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 199.232.188.157 (Munich, Germany)

ASN54113 (FASTLY, US)

static.ads-twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a02:26f0:480:15::213:7e4a (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL)

snap.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:800::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ssl.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:811::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 157.240.0.6 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)
PTR: xx-fbcdn-shv-02-fra3.fbcdn.net

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:9000:2724:7200:c:7d55:b3c0:93a1 (United States)

ASN16509 (AMAZON-02, US)

cdn.matomo.cloud	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:8dd1 (United States)

ASN13335 (CLOUDFLARENET, US)

js.hs-scripts.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42:600::485 (United States)

ASN54113 (FASTLY, US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 162.159.140.229 (None, )

ASN13335 (CLOUDFLARENET, US)

t.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.131 (United States)

ASN13414 (TWITTER, US)

analytics.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 157.240.0.35 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)
PTR: edge-star-mini-shv-02-fra3.facebook.com

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2620:1ec:21::14 (United States) 1 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4860:4802:34::36 (United States)

ASN15169 (GOOGLE, US)

region1.analytics.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c0a::9a (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.217.23.99 (United States)

ASN15169 (GOOGLE, US)
PTR: mil04s23-in-f99.1e100.net

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 18.195.235.189 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-195-235-189.eu-central-1.compute.amazonaws.com

recordedfuture.matomo.cloud	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.107.42.14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px4.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 18.196.170.251 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-196-170-251.eu-central-1.compute.amazonaws.com

data.hockeystack.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2606:4700::6810:7574 (United States)

ASN13335 (CLOUDFLARENET, US)

js.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
track.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cta-service-cms2.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
forms.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:a0a8 (United States)

ASN13335 (CLOUDFLARENET, US)

js.hs-analytics.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6810:6ffe (United States)

ASN13335 (CLOUDFLARENET, US)

js.hscollectedforms.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
forms.hscollectedforms.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:8911 (United States)

ASN13335 (CLOUDFLARENET, US)

js.hsleadflows.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:4400::ac40:9310 (United States)

ASN13335 (CLOUDFLARENET, US)

js.hs-banner.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.89.210.141 (Frankfurt am Main, Germany)

ASN29990 (ASN-APPNEX, US)
PTR: 950.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net

secure.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2.21.65.138 (Netherlands)

ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL)
PTR: a2-21-65-138.deploy.static.akamaitechnologies.com

c.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:2780:67::217:e394 (Netherlands)

ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL)

ipv6.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 99.83.231.3 (United States)

ASN16509 (AMAZON-02, US)
PTR: afe865822f884bb48.awsglobalaccelerator.com

epsilon.6sense.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 75.2.108.141 (United States)

ASN16509 (AMAZON-02, US)
PTR: afe865822f884bb48.awsglobalaccelerator.com

eps.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 13.35.58.23 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-35-58-23.fra60.r.cloudfront.net

v.eps.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.19.175.188 (None, )

ASN13335 (CLOUDFLARENET, US)

perf-na1.hsforms.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 199.60.103.2 (United States)

ASN209242 (CLOUDFLARESPECTRUM Cloudflare London, LLC, US)

go.recordedfuture.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
44	recordedfuture.com www.recordedfuture.com — Cisco Umbrella Rank: 385878 cms.recordedfuture.com — Cisco Umbrella Rank: 572311 go.recordedfuture.com — Cisco Umbrella Rank: 595107	1 MB
21	6sc.co j.6sc.co — Cisco Umbrella Rank: 5557 c.6sc.co — Cisco Umbrella Rank: 6739 ipv6.6sc.co — Cisco Umbrella Rank: 5633 b.6sc.co — Cisco Umbrella Rank: 3603 eps.6sc.co — Cisco Umbrella Rank: 9024 v.eps.6sc.co — Cisco Umbrella Rank: 16220	32 KB
8	visualwebsiteoptimizer.com dev.visualwebsiteoptimizer.com — Cisco Umbrella Rank: 3020	155 KB
5	hubspot.com js.hubspot.com — Cisco Umbrella Rank: 3653 track.hubspot.com — Cisco Umbrella Rank: 2477 cta-service-cms2.hubspot.com — Cisco Umbrella Rank: 3677 forms.hubspot.com — Cisco Umbrella Rank: 6196	30 KB
4	linkedin.com 1 redirects px.ads.linkedin.com — Cisco Umbrella Rank: 333 px4.ads.linkedin.com — Cisco Umbrella Rank: 7032	3 KB
4	matomo.cloud cdn.matomo.cloud — Cisco Umbrella Rank: 17022 recordedfuture.matomo.cloud	122 KB
4	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 39	354 KB
2	6sense.com epsilon.6sense.com — Cisco Umbrella Rank: 29160	668 B
2	hscollectedforms.net js.hscollectedforms.net — Cisco Umbrella Rank: 4811 forms.hscollectedforms.net — Cisco Umbrella Rank: 4960	26 KB
2	hockeystack.com data.hockeystack.com — Cisco Umbrella Rank: 49278	558 B
2	facebook.com www.facebook.com — Cisco Umbrella Rank: 120	213 B
2	facebook.net connect.facebook.net — Cisco Umbrella Rank: 192	77 KB
2	google-analytics.com ssl.google-analytics.com — Cisco Umbrella Rank: 972	18 KB
2	licdn.com snap.licdn.com — Cisco Umbrella Rank: 831	24 KB
2	google.com www.google.com — Cisco Umbrella Rank: 3 region1.analytics.google.com — Cisco Umbrella Rank: 4108
1	hsforms.com perf-na1.hsforms.com — Cisco Umbrella Rank: 3819	958 B
1	adnxs.com secure.adnxs.com — Cisco Umbrella Rank: 495	705 B
1	hs-banner.com js.hs-banner.com — Cisco Umbrella Rank: 2343	19 KB
1	hsleadflows.net js.hsleadflows.net — Cisco Umbrella Rank: 5955	92 KB
1	hs-analytics.net js.hs-analytics.net — Cisco Umbrella Rank: 2358	25 KB
1	google.de www.google.de — Cisco Umbrella Rank: 10745	63 B
1	doubleclick.net stats.g.doubleclick.net — Cisco Umbrella Rank: 135	559 B
1	twitter.com analytics.twitter.com — Cisco Umbrella Rank: 991	394 B
1	t.co t.co — Cisco Umbrella Rank: 904	628 B
1	jsdelivr.net cdn.jsdelivr.net — Cisco Umbrella Rank: 318	8 KB
1	hs-scripts.com js.hs-scripts.com — Cisco Umbrella Rank: 2580	1 KB
1	googleapis.com ajax.googleapis.com — Cisco Umbrella Rank: 415	31 KB
1	ads-twitter.com static.ads-twitter.com — Cisco Umbrella Rank: 1016	16 KB
119	28

	Domain	Requested by
37	www.recordedfuture.com	www.recordedfuture.com
11	b.6sc.co
8	dev.visualwebsiteoptimizer.com	www.recordedfuture.com
6	cms.recordedfuture.com	www.recordedfuture.com
4	v.eps.6sc.co	j.6sc.co
4	www.googletagmanager.com	www.recordedfuture.com www.googletagmanager.com
3	px.ads.linkedin.com	1 redirects snap.licdn.com
2	eps.6sc.co	j.6sc.co
2	epsilon.6sense.com	j.6sc.co
2	track.hubspot.com
2	data.hockeystack.com	cdn.jsdelivr.net
2	recordedfuture.matomo.cloud	cdn.matomo.cloud
2	www.facebook.com
2	cdn.matomo.cloud	www.recordedfuture.com
2	connect.facebook.net	www.recordedfuture.com connect.facebook.net
2	ssl.google-analytics.com	www.recordedfuture.com
2	snap.licdn.com	www.googletagmanager.com snap.licdn.com
2	j.6sc.co	www.googletagmanager.com j.6sc.co
1	go.recordedfuture.com
1	perf-na1.hsforms.com
1	forms.hubspot.com	js.hsleadflows.net
1	cta-service-cms2.hubspot.com	js.hubspot.com
1	forms.hscollectedforms.net	js.hscollectedforms.net
1	ipv6.6sc.co	j.6sc.co
1	c.6sc.co	j.6sc.co
1	secure.adnxs.com	j.6sc.co
1	js.hs-banner.com	js.hs-scripts.com
1	js.hsleadflows.net	js.hs-scripts.com
1	js.hscollectedforms.net	js.hs-scripts.com
1	js.hs-analytics.net	js.hs-scripts.com
1	js.hubspot.com	js.hs-scripts.com
1	px4.ads.linkedin.com
1	www.google.de
1	stats.g.doubleclick.net	www.googletagmanager.com
1	region1.analytics.google.com	www.googletagmanager.com
1	analytics.twitter.com
1	t.co
1	cdn.jsdelivr.net	www.recordedfuture.com
1	js.hs-scripts.com	www.googletagmanager.com
1	ajax.googleapis.com	www.googletagmanager.com
1	static.ads-twitter.com	www.googletagmanager.com
1	www.google.com	www.googletagmanager.com
119	42

This site contains links to these domains. Also see Links.

Domain
app.recordedfuture.com
go.recordedfuture.com
www.cisa.gov
media.defense.gov
attack.mitre.org
www.youtube.com
www.facebook.com
twitter.com
www.instagram.com

Subject Issuer	Validity	Valid
*.recordedfuture.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-02-07` - `2025-03-08`	a year	crt.sh
*.visualwebsiteoptimizer.com Starfield Secure Certificate Authority - G2	`2024-06-29` - `2025-07-31`	a year	crt.sh
*.google-analytics.com WR2	`2024-12-09` - `2025-03-03`	3 months	crt.sh
6sc.co R11	`2024-12-20` - `2025-03-20`	3 months	crt.sh
*.google.com WR2	`2024-12-09` - `2025-03-03`	3 months	crt.sh
ads-twitter.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-06-25` - `2025-06-24`	a year	crt.sh
snap.licdn.com DigiCert SHA2 Secure Server CA	`2024-12-02` - `2025-12-01`	a year	crt.sh
upload.video.google.com WR2	`2024-12-09` - `2025-03-03`	3 months	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2024-10-19` - `2025-01-17`	3 months	crt.sh
cdn.matomo.cloud Amazon RSA 2048 M02	`2024-09-25` - `2025-10-23`	a year	crt.sh
hs-scripts.com WE1	`2024-11-24` - `2025-02-22`	3 months	crt.sh
jsdelivr.net GlobalSign Atlas R3 DV TLS CA 2024 Q3	`2024-07-30` - `2025-08-31`	a year	crt.sh
t.co E6	`2024-11-26` - `2025-02-24`	3 months	crt.sh
*.twitter.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-09-30` - `2025-09-29`	a year	crt.sh
www.linkedin.com DigiCert SHA2 Secure Server CA	`2024-10-14` - `2025-04-14`	6 months	crt.sh
*.g.doubleclick.net WR2	`2024-12-09` - `2025-03-03`	3 months	crt.sh
*.google.de WR2	`2024-12-09` - `2025-03-03`	3 months	crt.sh
*.matomo.cloud Amazon RSA 2048 M02	`2024-05-21` - `2025-06-19`	a year	crt.sh
*.hockeystack.com R10	`2024-11-06` - `2025-02-04`	3 months	crt.sh
hubspot.com WE1	`2024-12-01` - `2025-03-01`	3 months	crt.sh
hs-analytics.net WE1	`2024-12-05` - `2025-03-05`	3 months	crt.sh
hscollectedforms.net WE1	`2024-11-20` - `2025-02-18`	3 months	crt.sh
hsleadflows.net WE1	`2024-11-27` - `2025-02-25`	3 months	crt.sh
hs-banner.com WE1	`2024-11-22` - `2025-02-20`	3 months	crt.sh
*.adnxs.com GeoTrust ECC CA 2018	`2024-02-14` - `2025-03-16`	a year	crt.sh
epsilon.6sense.com Amazon RSA 2048 M02	`2024-10-02` - `2025-10-31`	a year	crt.sh
eps.6sc.co Amazon RSA 2048 M02	`2024-08-29` - `2025-09-27`	a year	crt.sh
v.eps.6sc.co Amazon RSA 2048 M03	`2024-09-06` - `2025-10-05`	a year	crt.sh
hsforms.com WE1	`2024-12-08` - `2025-03-08`	3 months	crt.sh
go.recordedfuture.com WE1	`2024-12-08` - `2025-03-08`	3 months	crt.sh

This page contains 2 frames:

Primary Page: https://www.recordedfuture.com/research/reddelta-chinese-state-sponsored-group-targets-mongolia-taiwan-southeast-asia
Frame ID: 1C9705C1A281378D7B90B8CA97C1A47C
Requests: 112 HTTP requests in this frame

Frame: https://www.googletagmanager.com/static/service_worker/5190/sw_iframe.html?origin=https%3A%2F%2Fwww.recordedfuture.com
Frame ID: A52E5C5EC3B98DE795434A6ED9DDB12A
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Chinese State-Sponsored RedDelta Targeted Taiwan, Mongolia, and Southeast Asia with Adapted PlugX Infection Chain

Detected technologies

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.(?:net|com)

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

HubSpot Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

js\.hs-analytics\.net/analytics

Linkedin Insight Tag (Analytics) Expand

Overall confidence: 100%
Detected patterns

snap\.licdn\.com/li\.lms-analytics/insight\.min\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jsDelivr (CDN) Expand

Overall confidence: 100%
Detected patterns

//cdn\.jsdelivr\.net/

Page Statistics

119
Requests

98 %
HTTPS

43 %
IPv6

28
Domains

42
Subdomains

38
IPs

5
Countries

2458 kB
Transfer

7671 kB
Size

46
Cookies

31 Outgoing links

These are links going to different origins than the main page.

URL: https://app.recordedfuture.com/live/login/
Title: Login

Search URL Search Domain Scan URL

URL: https://go.recordedfuture.com/demo?utm_campaign=rf-research-top-demo-floating-nav-bar-2024&utm_source=recordedfuture&utm_medium=website&utm_content=rf-research-top-demo-floating-nav-bar-2024&utm_term=rf-research-top-demo-floating-nav-bar-2024
Title: Get a demo

Search URL Search Domain Scan URL

URL: https://go.recordedfuture.com/demo/weekly-platform-preview?utm_campaign=rf-weekly-demo-research-pages&utm_source=recordedfuture&utm_medium=website&utm_content=rf-weekly-demo-research-pages&utm_term=rf-weekly-demo-research-pages
Title: Live Demo: Mitigate Emerging Threats with IntelligenceSee how Recorded Future’s Threat Intelligence helps prioritize and mitigate threats with real-world examples and actionable insights. Book Your Demo Today

Search URL Search Domain Scan URL

URL: https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-158a
Title: 1

Search URL Search Domain Scan URL

URL: https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-144a
Title: 2

Search URL Search Domain Scan URL

URL: https://media.defense.gov/2019/Oct/07/2002191601/-1/-1/0/Mitigating%20Recent%20VPN%20Vulnerabilities%20-%20Copy.pdf
Title: 3

Search URL Search Domain Scan URL

URL: https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-258a
Title: 4

Search URL Search Domain Scan URL

URL: https://go.recordedfuture.com/hubfs/reports/cta-cn-2025-0109.pdf
Title: click here

Search URL Search Domain Scan URL

URL: https://app.recordedfuture.com/live/sc/entity/mitre:T1583.003
Title: T1583.003

Search URL Search Domain Scan URL

URL: https://app.recordedfuture.com/live/sc/entity/mitre:T1583.001
Title: T1583.001

Search URL Search Domain Scan URL

URL: https://app.recordedfuture.com/live/sc/entity/mitre:T1566.001
Title: T1566.001

Search URL Search Domain Scan URL

URL: https://app.recordedfuture.com/live/sc/entity/mitre:T1566.002
Title: T1566.002

Search URL Search Domain Scan URL

URL: https://app.recordedfuture.com/live/sc/423fWTXrwJQG
Title: T1204.002

Search URL Search Domain Scan URL

URL: https://app.recordedfuture.com/live/sc/entity/mitre:T1059.001
Title: T1059.001

Search URL Search Domain Scan URL

URL: https://app.recordedfuture.com/live/sc/entity/mitre:T1547.001
Title: T1547.001

Search URL Search Domain Scan URL

URL: https://app.recordedfuture.com/live/sc/entity/mitre:T1574.001
Title: T1574.001

Search URL Search Domain Scan URL

URL: https://app.recordedfuture.com/live/sc/entity/mitre:T1627.001
Title: T1627.001

Search URL Search Domain Scan URL

URL: https://app.recordedfuture.com/live/sc/entity/mitre:T1140
Title: T1140

Search URL Search Domain Scan URL

URL: https://attack.mitre.org/techniques/T1071/001/
Title: T1071.001

Search URL Search Domain Scan URL

URL: https://app.recordedfuture.com/live/sc/entity/mitre:T1218.007
Title: T1218.007

Search URL Search Domain Scan URL

URL: https://app.recordedfuture.com/live/sc/entity/mitre:T1036.005
Title: T1036.005

Search URL Search Domain Scan URL

URL: https://app.recordedfuture.com/live/sc/entity/mitre:T1036.007
Title: T1036.007

Search URL Search Domain Scan URL

URL: https://app.recordedfuture.com/live/sc/5bEFHKSE3jKs
Title: T1082

Search URL Search Domain Scan URL

URL: https://app.recordedfuture.com/live/sc/entity/mitre:T1573.001
Title: T1573.001

Search URL Search Domain Scan URL

URL: https://app.recordedfuture.com/live/sc/entity/mitre:T1132.001
Title: T1132.001

Search URL Search Domain Scan URL

URL: https://app.recordedfuture.com/live/sc/entity/mitre:T1102
Title: T1102

Search URL Search Domain Scan URL

URL: https://go.recordedfuture.com/demo
Title: Get a Demo

Search URL Search Domain Scan URL

URL: https://www.youtube.com/user/RecordedFuture

Search URL Search Domain Scan URL

URL: https://www.facebook.com/RecordedFuture

Search URL Search Domain Scan URL

URL: https://twitter.com/RecordedFuture

Search URL Search Domain Scan URL

URL: https://www.instagram.com/recordedfuture/

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 77

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=3869953%2C26800&time=1736529165878&url=https%3A%2F%2Fwww.recordedfuture.com%2Fresearch%2Freddelta-chinese-state-sponsored-group-targets-mongolia-taiwan-southeast-asia&tm=gtmv2 HTTP 302
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=3869953%2C26800&time=1736529165878&url=https%3A%2F%2Fwww.recordedfuture.com%2Fresearch%2Freddelta-chinese-state-sponsored-group-targets-mongolia-taiwan-southeast-asia&tm=gtmv2&e_ipv6=AQKVV7y1x9fXyQAAAZRRND69Ms_-qSXXuYu5MKhgAupAgCYsDVGBIHPWjBHwU4L3wyDNQkDxOQ

119 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request reddelta-chinese-state-sponsored-group-targets-mongolia-taiwan-southeast-asia Show response
www.recordedfuture.com/research/ 203 KB
43 KB 281ms
252ms Document
text/html 172.64.152.166
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/research/reddelta-chinese-state-sponsored-group-targets-mongolia-taiwan-southeast-asia

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.64.152.166 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Next.js

Resource Hash

72790d4d3fc9b0b8e4cc8ffb2eaf5c951bdb59d7d15ef5100f5211a2b5c372b1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

cache-control: s-maxage=30, stale-while-revalidate
cf-cache-status: DYNAMIC
cf-ray: 8ffe4b31f9da18c5-FRA
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Fri, 10 Jan 2025 17:12:45 GMT
permissions-policy: autoplay=*, geolocation=(self "https://*.recordedfuture.com/"), camera=*, microphone=*, otp-credentials=self, serial=self
referrer-policy: same-origin
server: cloudflare
strict-transport-security: max-age=31536000; includeSubDomains
traceresponse: 00-1819641341c83b59dfe7f94780457dc2-2659ee852b6966bf-01
vary: Accept-Encoding
x-content-type-options: nosniff
x-debug-info: eyJyZXRyaWVzIjowfQ==
x-frame-options: SAMEORIGIN
x-nextjs-cache: STALE
x-platform-server: i-be21b5795622437d8136c8a0cedbd8d0 i-be21b5795622437d8136c8a0cedbd8d0
x-powered-by: Next.js

GET
H2 200 brand_logo_long_black_f2ead5b5c6.svg
cms.recordedfuture.com/uploads/ 4 KB
1 KB 52ms
40ms Image
image/svg+xml 172.64.152.166
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cms.recordedfuture.com/uploads/brand_logo_long_black_f2ead5b5c6.svg?w=640

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/research/reddelta-chinese-state-sponsored-group-targets-mongolia-taiwan-southeast-asia

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.64.152.166 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1d0ca87959e23cb77cff2f1d7fe2337ecc770de12b1d20762373321d7d287183

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"6229d4fa-eab"
age: 165
x-content-type-options: nosniff
expires: Fri, 10 Jan 2025 17:15:00 GMT
traceresponse: 00-1817b98ee8035a81b05c1215cc5691da-742e24787e4bb8ea-01
date: Fri, 10 Jan 2025 17:12:45 GMT
content-type: image/svg+xml
last-modified: Thu, 10 Mar 2022 10:37:46 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: max-age=300
x-debug-info: eyJyZXRyaWVzIjowfQ==
cf-ray: 8ffe4b33ab2618c5-FRA
x-platform-server: i-72f68d9e5fc844fb8d11227fc18ff9f4, i-72f68d9e5fc844fb8d11227fc18ff9f4
server: cloudflare

GET
H2 200 large_reddelta_chinese_state_sponsored_group_targets_mongolia_taiwan_southeast_asia_Main_d14be68739.jpg
cms.recordedfuture.com/uploads/format_webp/ 20 KB
20 KB 51ms
39ms Image
image/webp 172.64.152.166
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cms.recordedfuture.com/uploads/format_webp/large_reddelta_chinese_state_sponsored_group_targets_mongolia_taiwan_southeast_asia_Main_d14be68739.jpg?w=640

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/research/reddelta-chinese-state-sponsored-group-targets-mongolia-taiwan-southeast-asia

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.64.152.166 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

44031e9b11597ac12383fa405a32f9a5b116097f6799e03c21f68aee7d3d2a8f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

cf-cache-status: HIT
etag: "4faa-MHXnkOMW3N+n4TXNitIDSj7rzaM"
age: 165
x-content-type-options: nosniff
traceresponse: 00-18190f92551f62006355b64b3294d0f0-bc805d3314690960-01
date: Fri, 10 Jan 2025 17:12:45 GMT
content-type: image/webp
last-modified: 1736350590936
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: max-age=300, public, s-maxage=300
x-debug-info: eyJyZXRyaWVzIjowfQ==
cf-ray: 8ffe4b33ab2518c5-FRA
x-platform-server: i-bac7380798664d7697b0cf11d33520e7, i-bac7380798664d7697b0cf11d33520e7
accept-ranges: bytes
content-length: 20394
server: cloudflare

GET
H2 200 fonts.css
www.recordedfuture.com/fonts/ 801 B
365 B 34ms
34ms Stylesheet
text/css 172.64.152.166
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/fonts/fonts.css

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/research/reddelta-chinese-state-sponsored-group-targets-mongolia-taiwan-southeast-asia

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.64.152.166 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

72bece826a96fc5ae7f4064962192011f68e39886373ba04e43bdb0c9a1408a0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.recordedfuture.com/research/reddelta-chinese-state-sponsored-group-targets-mongolia-taiwan-southeast-asia

Response headers

content-encoding: gzip
cf-bgj: minify
etag: W/"3ce-1927587a1a0"
age: 7979402
cf-cache-status: HIT
x-content-type-options: nosniff
traceresponse: 00-17fd0ad9e534e02fd6c367c42ef96f96-812eb33aa257335c-01
cf-polished: origSize=974
date: Fri, 10 Jan 2025 17:12:45 GMT
content-type: text/css; charset=UTF-8
last-modified: Thu, 10 Oct 2024 08:24:36 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: public, max-age=31536000, immutable
x-debug-info: eyJyZXRyaWVzIjowfQ==
cf-ray: 8ffe4b339b0318c5-FRA
x-platform-server: i-72f68d9e5fc844fb8d11227fc18ff9f4, i-72f68d9e5fc844fb8d11227fc18ff9f4
server: cloudflare

GET
H2 200 253fca5dc580d0ec.css
www.recordedfuture.com/_next/static/css/ 69 KB
15 KB 26ms
25ms Stylesheet
text/css 172.64.152.166
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/_next/static/css/253fca5dc580d0ec.css

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/research/reddelta-chinese-state-sponsored-group-targets-mongolia-taiwan-southeast-asia

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.64.152.166 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ce86ab0670d33abde9104deb6f30a98c0ee8ccd0b60d9f2299bfce25836bb253

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.recordedfuture.com/research/reddelta-chinese-state-sponsored-group-targets-mongolia-taiwan-southeast-asia

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"114d9-19324d9b786"
age: 3915678
x-content-type-options: nosniff
traceresponse: 00-180b7ac96b24591c3deb5d95b4ec0d6b-fa064a5b1f8f130c-01
date: Fri, 10 Jan 2025 17:12:45 GMT
content-type: text/css; charset=UTF-8
last-modified: Wed, 13 Nov 2024 09:27:48 GMT
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: public, max-age=31536000, immutable
x-debug-info: eyJyZXRyaWVzIjowfQ==
referrer-policy: same-origin
cf-ray: 8ffe4b339b0718c5-FRA
permissions-policy: autoplay=*, geolocation=(self "https://*.recordedfuture.com/"), camera=*, microphone=*, otp-credentials=self, serial=self
x-platform-server: i-bac7380798664d7697b0cf11d33520e7, i-bac7380798664d7697b0cf11d33520e7
server: cloudflare

GET
H2 200 ed5a9e40e8963ad2.css
www.recordedfuture.com/_next/static/css/ 25 KB
6 KB 28ms
28ms Stylesheet
text/css 172.64.152.166
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/_next/static/css/ed5a9e40e8963ad2.css

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/research/reddelta-chinese-state-sponsored-group-targets-mongolia-taiwan-southeast-asia

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.64.152.166 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

389a4592dcfd22840a86f780fe7447ff7be855847081c1c8dea9d97678a8adaf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.recordedfuture.com/research/reddelta-chinese-state-sponsored-group-targets-mongolia-taiwan-southeast-asia

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"64d5-192f6c632e5"
age: 5812102
x-content-type-options: nosniff
traceresponse: 00-1804bdffd918f198757cce900926cc21-311279366c4fc09a-01
date: Fri, 10 Jan 2025 17:12:45 GMT
content-type: text/css; charset=UTF-8
last-modified: Mon, 04 Nov 2024 10:43:57 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: public, max-age=31536000, immutable
x-debug-info: eyJyZXRyaWVzIjowfQ==
cf-ray: 8ffe4b339b0818c5-FRA
x-platform-server: i-bac7380798664d7697b0cf11d33520e7, i-bac7380798664d7697b0cf11d33520e7
server: cloudflare

GET
H2 200 webpack-4f5c83ac324d0e69.js Show response
www.recordedfuture.com/_next/static/chunks/ 5 KB
2 KB 24ms
22ms Script
application/javascript 172.64.152.166
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/_next/static/chunks/webpack-4f5c83ac324d0e69.js

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/research/reddelta-chinese-state-sponsored-group-targets-mongolia-taiwan-southeast-asia

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.64.152.166 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f77871a00c20b189f14626019842f538da2f50f1d562c2338c57fbf7355c5010

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.recordedfuture.com/research/reddelta-chinese-state-sponsored-group-targets-mongolia-taiwan-southeast-asia

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"1579-19324d9b771"
age: 5039020
x-content-type-options: nosniff
traceresponse: 00-18077d1d0684745bcd4a44699ecbc77b-b58a71e5346d0eb4-01
date: Fri, 10 Jan 2025 17:12:45 GMT
content-type: application/javascript; charset=UTF-8
last-modified: Wed, 13 Nov 2024 09:27:48 GMT
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: public, max-age=31536000, immutable
x-debug-info: eyJyZXRyaWVzIjowfQ==
referrer-policy: same-origin
cf-ray: 8ffe4b33ab1018c5-FRA
permissions-policy: autoplay=*, geolocation=(self "https://*.recordedfuture.com/"), camera=*, microphone=*, otp-credentials=self, serial=self
x-platform-server: i-72f68d9e5fc844fb8d11227fc18ff9f4, i-72f68d9e5fc844fb8d11227fc18ff9f4
server: cloudflare

GET
H2 200 framework-467b11a89995b152.js Show response
www.recordedfuture.com/_next/static/chunks/ 138 KB
45 KB 29ms
27ms Script
application/javascript 172.64.152.166
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/_next/static/chunks/framework-467b11a89995b152.js

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/research/reddelta-chinese-state-sponsored-group-targets-mongolia-taiwan-southeast-asia

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.64.152.166 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3d9ec892dee44ec1c6a5778b93c71fbb4357b8dc8e00ba61eb7baeb6b0af79fa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.recordedfuture.com/research/reddelta-chinese-state-sponsored-group-targets-mongolia-taiwan-southeast-asia

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"2270d-18fe8783003"
age: 17121047
x-content-type-options: nosniff
traceresponse: 00-17d6819ab902f4300ec2ca52763e2771-cc42ed1f611d9f10-01
x-cache: HIT
date: Fri, 10 Jan 2025 17:12:45 GMT
content-type: application/javascript; charset=UTF-8
last-modified: Wed, 05 Jun 2024 12:55:41 GMT
x-served-by: cache-fra-eddf8230157-FRA
x-cache-hits: 0
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: public, max-age=31536000, immutable
x-debug-info: eyJyZXRyaWVzIjowfQ==
via: 1.1 varnish
cf-ray: 8ffe4b33ab1218c5-FRA
x-platform-server: i-be21b5795622437d8136c8a0cedbd8d0, i-be21b5795622437d8136c8a0cedbd8d0
accept-ranges: bytes
content-length: 45457
server: cloudflare

GET
H2 200 main-75bdb96a41ba80f4.js Show response
www.recordedfuture.com/_next/static/chunks/ 113 KB
32 KB 27ms
26ms Script
application/javascript 172.64.152.166
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/_next/static/chunks/main-75bdb96a41ba80f4.js

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/research/reddelta-chinese-state-sponsored-group-targets-mongolia-taiwan-southeast-asia

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.64.152.166 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0a556b35758f8a2ade1b662eeec7a45a4739325de831c2eca6cbe1171fbc6bfd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.recordedfuture.com/research/reddelta-chinese-state-sponsored-group-targets-mongolia-taiwan-southeast-asia

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"1c3b0-19324d9b4f4"
age: 3593148
x-content-type-options: nosniff
traceresponse: 00-180ca02063bb4427b130d4c0469314f5-0d7bc1ea1e15412e-01
date: Fri, 10 Jan 2025 17:12:45 GMT
content-type: application/javascript; charset=UTF-8
last-modified: Wed, 13 Nov 2024 09:27:47 GMT
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: public, max-age=31536000, immutable
x-debug-info: eyJyZXRyaWVzIjowfQ==
referrer-policy: same-origin
cf-ray: 8ffe4b33ab1418c5-FRA
permissions-policy: autoplay=*, geolocation=(self "https://*.recordedfuture.com/"), camera=*, microphone=*, otp-credentials=self, serial=self
x-platform-server: i-be21b5795622437d8136c8a0cedbd8d0, i-be21b5795622437d8136c8a0cedbd8d0
server: cloudflare

GET
H2 200 _app-7dce919248be9c19.js Show response
www.recordedfuture.com/_next/static/chunks/pages/ 129 KB
40 KB 37ms
35ms Script
application/javascript 172.64.152.166
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/_next/static/chunks/pages/_app-7dce919248be9c19.js

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/research/reddelta-chinese-state-sponsored-group-targets-mongolia-taiwan-southeast-asia

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.64.152.166 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c75f8c06d78926e0624b04af9e6d0fb3339cb4b52ff00034661ca8f0c29d81c4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.recordedfuture.com/research/reddelta-chinese-state-sponsored-group-targets-mongolia-taiwan-southeast-asia

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"20521-19324d9b519"
age: 3764500
x-content-type-options: nosniff
traceresponse: 00-180c044849b086e348d449c838fce615-1014b3bb98348460-01
date: Fri, 10 Jan 2025 17:12:45 GMT
content-type: application/javascript; charset=UTF-8
last-modified: Wed, 13 Nov 2024 09:27:47 GMT
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: public, max-age=31536000, immutable
x-debug-info: eyJyZXRyaWVzIjowfQ==
referrer-policy: same-origin
cf-ray: 8ffe4b33ab1518c5-FRA
permissions-policy: autoplay=*, geolocation=(self "https://*.recordedfuture.com/"), camera=*, microphone=*, otp-credentials=self, serial=self
x-platform-server: i-bac7380798664d7697b0cf11d33520e7, i-bac7380798664d7697b0cf11d33520e7
server: cloudflare

GET
H2 200 769-f95d08d81b193fa5.js Show response
www.recordedfuture.com/_next/static/chunks/ 262 KB
77 KB 38ms
36ms Script
application/javascript 172.64.152.166
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/_next/static/chunks/769-f95d08d81b193fa5.js

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/research/reddelta-chinese-state-sponsored-group-targets-mongolia-taiwan-southeast-asia

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.64.152.166 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

43f20d0a51f32376a232ae9fbc41e803d09610000eacfe5b851bc46e191be5ff

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.recordedfuture.com/research/reddelta-chinese-state-sponsored-group-targets-mongolia-taiwan-southeast-asia

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"419c1-19324d9b4b0"
age: 3935847
x-content-type-options: nosniff
traceresponse: 00-180b687198df13c7ff14ce7cfc078793-8e7c5c63a68fabeb-01
date: Fri, 10 Jan 2025 17:12:45 GMT
content-type: application/javascript; charset=UTF-8
last-modified: Wed, 13 Nov 2024 09:27:47 GMT
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: public, max-age=31536000, immutable
x-debug-info: eyJyZXRyaWVzIjowfQ==
referrer-policy: same-origin
cf-ray: 8ffe4b33ab1618c5-FRA
permissions-policy: autoplay=*, geolocation=(self "https://*.recordedfuture.com/"), camera=*, microphone=*, otp-credentials=self, serial=self
x-platform-server: i-be21b5795622437d8136c8a0cedbd8d0, i-be21b5795622437d8136c8a0cedbd8d0
server: cloudflare

GET
H2 200 129-82bd73d6c6af04c1.js Show response
www.recordedfuture.com/_next/static/chunks/ 37 KB
12 KB 37ms
36ms Script
application/javascript 172.64.152.166
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/_next/static/chunks/129-82bd73d6c6af04c1.js

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/research/reddelta-chinese-state-sponsored-group-targets-mongolia-taiwan-southeast-asia

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.64.152.166 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5dd46059902b99d86c42588668824486114180f5e1c385cb504a23e53b2d7bef

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.recordedfuture.com/research/reddelta-chinese-state-sponsored-group-targets-mongolia-taiwan-southeast-asia

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"958c-19300c4ff3d"
age: 5553907
x-content-type-options: nosniff
traceresponse: 00-1805a8d3a398367902889f6f7bfb8f12-68222c059ee803ba-01
date: Fri, 10 Jan 2025 17:12:45 GMT
content-type: application/javascript; charset=UTF-8
last-modified: Wed, 06 Nov 2024 09:18:50 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: public, max-age=31536000, immutable
x-debug-info: eyJyZXRyaWVzIjowfQ==
cf-ray: 8ffe4b33ab1818c5-FRA
x-platform-server: i-bac7380798664d7697b0cf11d33520e7, i-bac7380798664d7697b0cf11d33520e7
server: cloudflare

GET
H2 200 911-ff01f8a62625f045.js Show response
www.recordedfuture.com/_next/static/chunks/ 55 KB
19 KB 42ms
41ms Script
application/javascript 172.64.152.166
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/_next/static/chunks/911-ff01f8a62625f045.js

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/research/reddelta-chinese-state-sponsored-group-targets-mongolia-taiwan-southeast-asia

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.64.152.166 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8af77a655a0e1ecfd86c2a3aaf8f3492ed33e1a358be8f4bb0d1794db79aa4fa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.recordedfuture.com/research/reddelta-chinese-state-sponsored-group-targets-mongolia-taiwan-southeast-asia

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"ddd2-19324d9b4d2"
age: 3232914
x-content-type-options: nosniff
traceresponse: 00-180de7c1f0f13c3e8cf2c460ec21e1ba-0bde1ab549c5646a-01
date: Fri, 10 Jan 2025 17:12:45 GMT
content-type: application/javascript; charset=UTF-8
last-modified: Wed, 13 Nov 2024 09:27:47 GMT
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: public, max-age=31536000, immutable
x-debug-info: eyJyZXRyaWVzIjowfQ==
referrer-policy: same-origin
cf-ray: 8ffe4b33ab1918c5-FRA
permissions-policy: autoplay=*, geolocation=(self "https://*.recordedfuture.com/"), camera=*, microphone=*, otp-credentials=self, serial=self
x-platform-server: i-bac7380798664d7697b0cf11d33520e7, i-bac7380798664d7697b0cf11d33520e7
server: cloudflare

GET
H2 200 834-5056ffb50646338d.js Show response
www.recordedfuture.com/_next/static/chunks/ 24 KB
7 KB 37ms
36ms Script
application/javascript 172.64.152.166
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/_next/static/chunks/834-5056ffb50646338d.js

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/research/reddelta-chinese-state-sponsored-group-targets-mongolia-taiwan-southeast-asia

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.64.152.166 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

755cbb35481713edd37666d18946b70a12f74e5606002e123dc2ff63494ab768

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.recordedfuture.com/research/reddelta-chinese-state-sponsored-group-targets-mongolia-taiwan-southeast-asia

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"5e9a-19300c4ffa4"
age: 5319877
x-content-type-options: nosniff
traceresponse: 00-18067dacfcd39d555b93713a139e42b3-6428a7c3228ce6bb-01
date: Fri, 10 Jan 2025 17:12:45 GMT
content-type: application/javascript; charset=UTF-8
last-modified: Wed, 06 Nov 2024 09:18:50 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: public, max-age=31536000, immutable
x-debug-info: eyJyZXRyaWVzIjowfQ==
cf-ray: 8ffe4b33ab1c18c5-FRA
x-platform-server: i-72f68d9e5fc844fb8d11227fc18ff9f4, i-72f68d9e5fc844fb8d11227fc18ff9f4
server: cloudflare

GET
H2 200 295-5f8eb86236394fa9.js Show response
www.recordedfuture.com/_next/static/chunks/ 205 KB
53 KB 36ms
35ms Script
application/javascript 172.64.152.166
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/_next/static/chunks/295-5f8eb86236394fa9.js

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/research/reddelta-chinese-state-sponsored-group-targets-mongolia-taiwan-southeast-asia

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.64.152.166 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

66311bd06cf97e2bb2565e7fabc01797a8912ceee0df81a418437d776a48ca1e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.recordedfuture.com/research/reddelta-chinese-state-sponsored-group-targets-mongolia-taiwan-southeast-asia

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"3337d-192f6c62f51"
age: 5812102
x-content-type-options: nosniff
traceresponse: 00-1804bdffd8d7e060e4bcbccad6f29d35-b19e4a1293258d5d-01
date: Fri, 10 Jan 2025 17:12:45 GMT
content-type: application/javascript; charset=UTF-8
last-modified: Mon, 04 Nov 2024 10:43:56 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: public, max-age=31536000, immutable
x-debug-info: eyJyZXRyaWVzIjowfQ==
cf-ray: 8ffe4b33ab1e18c5-FRA
x-platform-server: i-bac7380798664d7697b0cf11d33520e7, i-bac7380798664d7697b0cf11d33520e7
server: cloudflare

GET
H2 200 267-58d62d3f86e6045f.js Show response
www.recordedfuture.com/_next/static/chunks/ 49 KB
12 KB 34ms
33ms Script
application/javascript 172.64.152.166
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/_next/static/chunks/267-58d62d3f86e6045f.js

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/research/reddelta-chinese-state-sponsored-group-targets-mongolia-taiwan-southeast-asia

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.64.152.166 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b11d832b38ef1b449650b550d5d773aa619c7de86392ffd56a3fa9809f909394

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.recordedfuture.com/research/reddelta-chinese-state-sponsored-group-targets-mongolia-taiwan-southeast-asia

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"c260-19300c4ff4a"
age: 5644430
x-content-type-options: nosniff
traceresponse: 00-1805567efe24a24e921a7a646d4184f8-913db55b159dcd59-01
date: Fri, 10 Jan 2025 17:12:45 GMT
content-type: application/javascript; charset=UTF-8
last-modified: Wed, 06 Nov 2024 09:18:50 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: public, max-age=31536000, immutable
x-debug-info: eyJyZXRyaWVzIjowfQ==
cf-ray: 8ffe4b33ab1f18c5-FRA
x-platform-server: i-bac7380798664d7697b0cf11d33520e7, i-bac7380798664d7697b0cf11d33520e7
server: cloudflare

GET
H2 200 624-816ec4c0386d2868.js Show response
www.recordedfuture.com/_next/static/chunks/ 209 KB
44 KB 36ms
36ms Script
application/javascript 172.64.152.166
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/_next/static/chunks/624-816ec4c0386d2868.js

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/research/reddelta-chinese-state-sponsored-group-targets-mongolia-taiwan-southeast-asia

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.64.152.166 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2220e0cc6f9de566a5ff786452e781dcfb6c1aa4ca94328c8ae75c576b44f5ff

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.recordedfuture.com/research/reddelta-chinese-state-sponsored-group-targets-mongolia-taiwan-southeast-asia

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"345cb-19300c4ff84"
age: 5644430
x-content-type-options: nosniff
traceresponse: 00-1805567efde71efd3324fae80d8203d3-c9336dbef9c5abdb-01
date: Fri, 10 Jan 2025 17:12:45 GMT
content-type: application/javascript; charset=UTF-8
last-modified: Wed, 06 Nov 2024 09:18:50 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: public, max-age=31536000, immutable
x-debug-info: eyJyZXRyaWVzIjowfQ==
cf-ray: 8ffe4b33ab2118c5-FRA
x-platform-server: i-be21b5795622437d8136c8a0cedbd8d0, i-be21b5795622437d8136c8a0cedbd8d0
server: cloudflare

GET
H2 200 %5B%5B...slug%5D%5D-beba267fd48fa5f6.js Show response
www.recordedfuture.com/_next/static/chunks/pages/ 9 KB
3 KB 42ms
41ms Script
application/javascript 172.64.152.166
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/_next/static/chunks/pages/%5B%5B...slug%5D%5D-beba267fd48fa5f6.js

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/research/reddelta-chinese-state-sponsored-group-targets-mongolia-taiwan-southeast-asia

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.64.152.166 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9c4316460910afe59a933654686dcc3122b243ba918a241a380a68769e057b92

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.recordedfuture.com/research/reddelta-chinese-state-sponsored-group-targets-mongolia-taiwan-southeast-asia

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"22e5-192f6c62fd4"
age: 5662550
x-content-type-options: nosniff
traceresponse: 00-1805460441548abdebfd1898efdb4fa0-ee2504ad968e64ea-01
date: Fri, 10 Jan 2025 17:12:45 GMT
content-type: application/javascript; charset=UTF-8
last-modified: Mon, 04 Nov 2024 10:43:56 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: public, max-age=31536000, immutable
x-debug-info: eyJyZXRyaWVzIjowfQ==
cf-ray: 8ffe4b33ab2218c5-FRA
x-platform-server: i-72f68d9e5fc844fb8d11227fc18ff9f4, i-72f68d9e5fc844fb8d11227fc18ff9f4
server: cloudflare

GET
H2 200 _buildManifest.js Show response
www.recordedfuture.com/_next/static/j2JvDgGLGrnhH6NPDpk9f/ 3 KB
1 KB 42ms
41ms Script
application/javascript 172.64.152.166
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/_next/static/j2JvDgGLGrnhH6NPDpk9f/_buildManifest.js

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/research/reddelta-chinese-state-sponsored-group-targets-mongolia-taiwan-southeast-asia

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.64.152.166 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c4353a8c6cb891ab8a68928b47b3e744f4cd6a389d09796c636ec28eaf9f257a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.recordedfuture.com/research/reddelta-chinese-state-sponsored-group-targets-mongolia-taiwan-southeast-asia

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"cf9-19324d9b7e8"
age: 5039020
x-content-type-options: nosniff
traceresponse: 00-18077d1d06dcda1a95dffbc5c0422082-1ea2e480cb0890b5-01
date: Fri, 10 Jan 2025 17:12:45 GMT
content-type: application/javascript; charset=UTF-8
last-modified: Wed, 13 Nov 2024 09:27:48 GMT
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: public, max-age=31536000, immutable
x-debug-info: eyJyZXRyaWVzIjowfQ==
referrer-policy: same-origin
cf-ray: 8ffe4b33ab2318c5-FRA
permissions-policy: autoplay=*, geolocation=(self "https://*.recordedfuture.com/"), camera=*, microphone=*, otp-credentials=self, serial=self
x-platform-server: i-be21b5795622437d8136c8a0cedbd8d0, i-be21b5795622437d8136c8a0cedbd8d0
server: cloudflare

GET
H2 200 _ssgManifest.js Show response
www.recordedfuture.com/_next/static/j2JvDgGLGrnhH6NPDpk9f/ 254 B
335 B 36ms
36ms Script
application/javascript 172.64.152.166
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/_next/static/j2JvDgGLGrnhH6NPDpk9f/_ssgManifest.js

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/research/reddelta-chinese-state-sponsored-group-targets-mongolia-taiwan-southeast-asia

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.64.152.166 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2465da93e78c741f53ad8ff10402fa06775a0d485ab4ab1b02c3ea288fc935e1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.recordedfuture.com/research/reddelta-chinese-state-sponsored-group-targets-mongolia-taiwan-southeast-asia

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"fe-19324d9b7fd"
age: 1529382
x-content-type-options: nosniff
traceresponse: 00-1813f51c3fa0d924a8d33ea19c4c7124-62c067d8f14310ef-01
date: Fri, 10 Jan 2025 17:12:45 GMT
content-type: application/javascript; charset=UTF-8
last-modified: Wed, 13 Nov 2024 09:27:48 GMT
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: public, max-age=31536000, immutable
x-debug-info: eyJyZXRyaWVzIjowfQ==
referrer-policy: same-origin
cf-ray: 8ffe4b33ab2418c5-FRA
permissions-policy: autoplay=*, geolocation=(self "https://*.recordedfuture.com/"), camera=*, microphone=*, otp-credentials=self, serial=self
x-platform-server: i-72f68d9e5fc844fb8d11227fc18ff9f4, i-72f68d9e5fc844fb8d11227fc18ff9f4
server: cloudflare

GET
H2 200 insikt_group_logo_updated_3_300x48_b5390f4ff2.png
cms.recordedfuture.com/uploads/ 2 KB
2 KB 53ms
42ms Image
image/webp 172.64.152.166
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cms.recordedfuture.com/uploads/insikt_group_logo_updated_3_300x48_b5390f4ff2.png

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/research/reddelta-chinese-state-sponsored-group-targets-mongolia-taiwan-southeast-asia

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.64.152.166 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9e8931d138f1dd892cc6f4ccdee98445ed44a9e2d1ad863205657bc2e686a0e0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

cf-bgj: imgq:100,h2pri
etag: "62d6ee8a-88a"
age: 165
cf-cache-status: HIT
x-content-type-options: nosniff
expires: Fri, 10 Jan 2025 17:15:00 GMT
traceresponse: 00-180f9ded45b13432fa7011a3087e5dc1-126c1981b24133a1-01
cf-polished: origFmt=png, origSize=2186
date: Fri, 10 Jan 2025 17:12:45 GMT
content-type: image/webp
content-disposition: inline; filename="insikt_group_logo_updated_3_300x48_b5390f4ff2.webp"
vary: Accept
last-modified: Tue, 19 Jul 2022 17:48:58 GMT
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: max-age=300
x-debug-info: eyJyZXRyaWVzIjowfQ==
cf-ray: 8ffe4b33ab2718c5-FRA
x-platform-server: i-72f68d9e5fc844fb8d11227fc18ff9f4, i-72f68d9e5fc844fb8d11227fc18ff9f4
accept-ranges: bytes
content-length: 1866
server: cloudflare

GET
H2 200 x-social-media-black-icon.svg
www.recordedfuture.com/images/ 456 B
488 B 25ms
25ms Image
image/svg+xml 172.64.152.166
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.recordedfuture.com/images/x-social-media-black-icon.svg

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/_next/static/css/253fca5dc580d0ec.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.64.152.166 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f8837339f39b4de89bcdc5b4705e44d0007a8728881c70d1010f9973dff06306

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.recordedfuture.com/_next/static/css/253fca5dc580d0ec.css

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"1c8-19300bd9dd8"
age: 5485843
x-content-type-options: nosniff
traceresponse: 00-1805e6bb0f197da3fbcf2d24720b2054-21f8b338652965d6-01
date: Fri, 10 Jan 2025 17:12:45 GMT
content-type: image/svg+xml
last-modified: Wed, 06 Nov 2024 09:10:47 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: public, max-age=31536000, immutable
x-debug-info: eyJyZXRyaWVzIjowfQ==
cf-ray: 8ffe4b33db3c18c5-FRA
x-platform-server: i-72f68d9e5fc844fb8d11227fc18ff9f4, i-72f68d9e5fc844fb8d11227fc18ff9f4
server: cloudflare

GET
H2 200 Inter-Regular.ttf
www.recordedfuture.com/fonts/ 303 KB
144 KB 29ms
28ms Font
font/ttf 172.64.152.166
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/fonts/Inter-Regular.ttf

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/fonts/fonts.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.64.152.166 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

494a9c8817786531126dd245c93f8a85aa6afa405c7b8a2e45b667538470ce7a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://www.recordedfuture.com
Referer: https://www.recordedfuture.com/fonts/fonts.css

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"4ba44-19324d20948"
age: 3674635
x-content-type-options: nosniff
traceresponse: 00-180c5603bea74e6657f5a768ddef311e-577017aeaf2870d6-01
date: Fri, 10 Jan 2025 17:12:45 GMT
content-type: font/ttf
last-modified: Wed, 13 Nov 2024 09:19:25 GMT
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: public, max-age=31536000, immutable
x-debug-info: eyJyZXRyaWVzIjowfQ==
referrer-policy: same-origin
cf-ray: 8ffe4b33fb5318c5-FRA
permissions-policy: autoplay=*, geolocation=(self "https://*.recordedfuture.com/"), camera=*, microphone=*, otp-credentials=self, serial=self
x-platform-server: i-bac7380798664d7697b0cf11d33520e7, i-bac7380798664d7697b0cf11d33520e7
server: cloudflare

GET
H2 200 Inter-Bold.ttf
www.recordedfuture.com/fonts/ 309 KB
154 KB 24ms
23ms Font
font/ttf 172.64.152.166
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/fonts/Inter-Bold.ttf

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/fonts/fonts.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.64.152.166 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2ad83f2446566c5ecf7c261cc07884a5d5f71965b5df8fd7bb809f83a42bf470

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://www.recordedfuture.com
Referer: https://www.recordedfuture.com/fonts/fonts.css

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"4d2c4-19275935d88"
age: 7979176
x-content-type-options: nosniff
traceresponse: 00-17fd0b0e94705f01abe2d76b769a1796-2f75db7056ff99dd-01
date: Fri, 10 Jan 2025 17:12:45 GMT
content-type: font/ttf
last-modified: Thu, 10 Oct 2024 08:37:25 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: public, max-age=31536000, immutable
x-debug-info: eyJyZXRyaWVzIjowfQ==
cf-ray: 8ffe4b33fb5418c5-FRA
x-platform-server: i-bac7380798664d7697b0cf11d33520e7, i-bac7380798664d7697b0cf11d33520e7
server: cloudflare

GET
H2 200 icomoon.1743c60a.ttf
www.recordedfuture.com/_next/static/media/ 8 KB
5 KB 29ms
28ms Font
font/ttf 172.64.152.166
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/_next/static/media/icomoon.1743c60a.ttf

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/_next/static/css/253fca5dc580d0ec.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.64.152.166 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e409f15559f814e0d6cd6d062de935a9c1574b2d2413b28145b04850fe2f3a49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://www.recordedfuture.com
Referer: https://www.recordedfuture.com/_next/static/css/253fca5dc580d0ec.css

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"1e74-19300c50291"
age: 5644092
x-content-type-options: nosniff
traceresponse: 00-180556cdcf6fc8fa3b7f63857a2ec529-952db0c0eee0fffd-01
date: Fri, 10 Jan 2025 17:12:45 GMT
content-type: font/ttf
last-modified: Wed, 06 Nov 2024 09:18:51 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: public, max-age=31536000, immutable
x-debug-info: eyJyZXRyaWVzIjowfQ==
cf-ray: 8ffe4b33fb5518c5-FRA
x-platform-server: i-be21b5795622437d8136c8a0cedbd8d0, i-be21b5795622437d8136c8a0cedbd8d0
server: cloudflare

GET
H2 200 Inter-SemiBold.ttf
www.recordedfuture.com/fonts/ 308 KB
153 KB 33ms
32ms Font
font/ttf 172.64.152.166
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/fonts/Inter-SemiBold.ttf

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/fonts/fonts.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.64.152.166 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f036a45770ce2ad43dfee7f4eac8f8b3784608a24ff00c63dd56704434e014e8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://www.recordedfuture.com
Referer: https://www.recordedfuture.com/fonts/fonts.css

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"4d16c-19275935d88"
age: 7979176
x-content-type-options: nosniff
traceresponse: 00-17fd0b0e928ad74129f8ef6ee56b85d7-f1426c8a2977ed5d-01
date: Fri, 10 Jan 2025 17:12:45 GMT
content-type: font/ttf
last-modified: Thu, 10 Oct 2024 08:37:25 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: public, max-age=31536000, immutable
x-debug-info: eyJyZXRyaWVzIjowfQ==
cf-ray: 8ffe4b33fb5618c5-FRA
x-platform-server: i-bac7380798664d7697b0cf11d33520e7, i-bac7380798664d7697b0cf11d33520e7
server: cloudflare

GET
H2 200 Inter-ExtraBold.ttf
www.recordedfuture.com/fonts/ 309 KB
154 KB 41ms
40ms Font
font/ttf 172.64.152.166
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/fonts/Inter-ExtraBold.ttf

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/fonts/fonts.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.64.152.166 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6fb3140db2839cabd3662044ef7791206df377b2211046abc71dd039f05fe082

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://www.recordedfuture.com
Referer: https://www.recordedfuture.com/fonts/fonts.css

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"4d52c-192f6be0fc0"
age: 5735345
x-content-type-options: nosniff
traceresponse: 00-180503cf2a824b267100761bdc42a1fb-68f892ffe985bc2d-01
date: Fri, 10 Jan 2025 17:12:45 GMT
content-type: font/ttf
last-modified: Mon, 04 Nov 2024 10:35:04 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: public, max-age=31536000, immutable
x-debug-info: eyJyZXRyaWVzIjowfQ==
cf-ray: 8ffe4b33fb5818c5-FRA
x-platform-server: i-72f68d9e5fc844fb8d11227fc18ff9f4, i-72f68d9e5fc844fb8d11227fc18ff9f4
server: cloudflare

GET
H2 200 Inter-Medium.ttf
www.recordedfuture.com/fonts/ 307 KB
152 KB 38ms
37ms Font
font/ttf 172.64.152.166
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/fonts/Inter-Medium.ttf

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/fonts/fonts.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.64.152.166 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a0b1f949528f7a3a2d2ff3b6df67c6c1b5cb8f62a2eba6eb5e06adff2d5795f3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://www.recordedfuture.com
Referer: https://www.recordedfuture.com/fonts/fonts.css

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"4cd58-19275935d88"
age: 7979176
x-content-type-options: nosniff
traceresponse: 00-17fd0b0e92d2ed1af0efb1188a500fa0-8531e26fe54e09d2-01
date: Fri, 10 Jan 2025 17:12:45 GMT
content-type: font/ttf
last-modified: Thu, 10 Oct 2024 08:37:25 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: public, max-age=31536000, immutable
x-debug-info: eyJyZXRyaWVzIjowfQ==
cf-ray: 8ffe4b33fb5a18c5-FRA
x-platform-server: i-bac7380798664d7697b0cf11d33520e7, i-bac7380798664d7697b0cf11d33520e7
server: cloudflare

GET
H2 200 resource-sidebars Show response
cms.recordedfuture.com/api/ 2 KB
2 KB 395ms
375ms XHR
application/json 104.18.35.90
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cms.recordedfuture.com/api/resource-sidebars?populate[0]=type&populate[1]=blocks&populate[2]=blocks.image&populate[3]=blocks.image.desktop&populate[4]=blocks.image.tablet&populate[5]=blocks.image.mobile&populate[6]=blocks.link&populate[7]=blocks.link.page&filters[type][key][$eq]=research

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/_next/static/chunks/911-ff01f8a62625f045.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.35.90 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Strapi <strapi.io>

Resource Hash

4a253015fb11b8985ded9e52df42c512cb4d1e39f1b1db1b25275981f0c1a248

Security Headers

Name	Value
Content-Security-Policy	connect-src 'self' https:;img-src 'self' data: blob: https://market-assets.strapi.io;media-src 'self' data: blob:;default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline'
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Accept: application/json, text/plain, */*
Referer

Response headers

content-encoding: gzip
cf-cache-status: DYNAMIC
x-permitted-cross-domain-policies: none
x-content-type-options: nosniff
traceresponse: 00-18196413691d5789213cfa33e6b7ba38-d2faa1d74a099e43-01
date: Fri, 10 Jan 2025 17:12:45 GMT
content-type: application/json; charset=utf-8
vary: Origin
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000; includeSubDomains
content-security-policy: connect-src 'self' https:;img-src 'self' data: blob: https://market-assets.strapi.io;media-src 'self' data: blob:;default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline'
x-dns-prefetch-control: off
x-debug-info: eyJyZXRyaWVzIjowfQ==
referrer-policy: no-referrer
x-download-options: noopen
cf-ray: 8ffe4b34dbe6d391-FRA
x-platform-server: i-72f68d9e5fc844fb8d11227fc18ff9f4, i-72f68d9e5fc844fb8d11227fc18ff9f4
access-control-allow-origin: https://www.recordedfuture.com
x-powered-by: Strapi <strapi.io>
server: cloudflare

GET
H2 200 resources Show response
cms.recordedfuture.com/api/ 27 KB
4 KB 631ms
612ms XHR
application/json 104.18.35.90
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cms.recordedfuture.com/api/resources?populate[0]=cardImage&populate[1]=cardImage.desktop&populate[2]=cardImage.mobile&populate[3]=cardImage.tablet&populate[4]=countryTags&populate[5]=downloadResource&populate[6]=downloadResource.type&populate[7]=eventResource&populate[8]=eventResource.type&populate[9]=industryTags&populate[10]=integrationResource&populate[11]=integrationResource.tags&populate[12]=newsAndResearchResource&populate[13]=newsAndResearchResource.researchPreviewImage&populate[14]=newsAndResearchResource.researchPreviewImageDesktop&populate[15]=newsAndResearchResource.researchPreviewImageMobile&populate[16]=newsAndResearchResource.researchPreviewImageTablet&populate[17]=newsAndResearchResource.type&populate[18]=page&populate[19]=productTags&populate[20]=threatTags&populate[21]=topicTags&populate[22]=language&filters[$or][0][downloadResource][type][key][$in]=&filters[$or][1][eventResource][type][key][$in]=&filters[$or][2][newsAndResearchResource][type][key][$in][0]=research&filters[$and][0][title][$contains]=&filters[$and][1][$or][0][language][name][$in][0]=English&filters[$and][1][$or][1][language][id][$null]=true&filters[$and][2][$or][0][showFrom][$null]=true&filters[$and][2][$or][1][showFrom][$lte]=2025-01-10T17%3A12%3A45Z&pagination%5BpageSize%5D=4&pagination%5Bpage%5D=1&sort%5B0%5D=eventResource.startDate%3Aasc&sort%5B1%5D=publishedAt%3Adesc

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/_next/static/chunks/911-ff01f8a62625f045.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.35.90 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Strapi <strapi.io>

Resource Hash

e2020cff2cc74d8d6a54922cb130623b298b79a4e2e6c9953d2b5a1e98628127

Security Headers

Name	Value
Content-Security-Policy	connect-src 'self' https:;img-src 'self' data: blob: https://market-assets.strapi.io;media-src 'self' data: blob:;default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline'
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Accept: application/json, text/plain, */*
Referer

Response headers

content-encoding: gzip
cf-cache-status: DYNAMIC
x-permitted-cross-domain-policies: none
x-content-type-options: nosniff
traceresponse: 00-1819641368fc8ee575a161c81239ad32-194e7e018ff57674-01
date: Fri, 10 Jan 2025 17:12:46 GMT
content-type: application/json; charset=utf-8
vary: Origin
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000; includeSubDomains
content-security-policy: connect-src 'self' https:;img-src 'self' data: blob: https://market-assets.strapi.io;media-src 'self' data: blob:;default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline'
x-dns-prefetch-control: off
x-debug-info: eyJyZXRyaWVzIjowfQ==
referrer-policy: no-referrer
x-download-options: noopen
cf-ray: 8ffe4b34dbe8d391-FRA
x-platform-server: i-bac7380798664d7697b0cf11d33520e7, i-bac7380798664d7697b0cf11d33520e7
access-control-allow-origin: https://www.recordedfuture.com
x-powered-by: Strapi <strapi.io>
server: cloudflare

GET
H2 200 favicon.ico
www.recordedfuture.com/ 17 KB
926 B 23ms
22ms Other
image/x-icon 172.64.152.166
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/favicon.ico

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.64.152.166 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b73b7e0eaffe020cd9d4eaccd4afc57904bba61c4a3423f8640e4a05abf1b7ca

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.recordedfuture.com/research/reddelta-chinese-state-sponsored-group-targets-mongolia-taiwan-southeast-asia

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"423e-1927587a1a0"
age: 7979893
x-content-type-options: nosniff
traceresponse: 00-17fd0a52811be7c29c5da2e9650bd245-9400bf30b4a57bc0-01
date: Fri, 10 Jan 2025 17:12:45 GMT
content-type: image/x-icon
last-modified: Thu, 10 Oct 2024 08:24:36 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: public, max-age=31536000, immutable
x-debug-info: eyJyZXRyaWVzIjoxOX0=
cf-ray: 8ffe4b34fc2718c5-FRA
x-platform-server: i-72f68d9e5fc844fb8d11227fc18ff9f4, i-72f68d9e5fc844fb8d11227fc18ff9f4
server: cloudflare

GET
H2 200 blog.json Show response
www.recordedfuture.com/_next/data/j2JvDgGLGrnhH6NPDpk9f/ 49 KB
8 KB 338ms
338ms Fetch
application/json 172.64.152.166
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/_next/data/j2JvDgGLGrnhH6NPDpk9f/blog.json?slug=blog

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/_next/static/chunks/main-75bdb96a41ba80f4.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.64.152.166 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

cbac1a1ad4c67436e06b1581a6a22ed8d84018452c31bc01727ce6339a35aa15

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

x-nextjs-data: 1
Referer: https://www.recordedfuture.com/research/reddelta-chinese-state-sponsored-group-targets-mongolia-taiwan-southeast-asia
purpose: prefetch
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

content-encoding: gzip
cf-cache-status: DYNAMIC
etag: "xhvuum6a6212gd"
x-content-type-options: nosniff
traceresponse: 00-1819641369c17ebeffee9f46e80804f3-c400df2e0fe36f77-01
date: Fri, 10 Jan 2025 17:12:45 GMT
content-type: application/json
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: s-maxage=30, stale-while-revalidate
x-nextjs-matched-path: /[[...slug]]
x-debug-info: eyJyZXRyaWVzIjowfQ==
referrer-policy: same-origin
cf-ray: 8ffe4b34fc2c18c5-FRA
permissions-policy: autoplay=*, geolocation=(self "https://*.recordedfuture.com/"), camera=*, microphone=*, otp-credentials=self, serial=self
x-platform-server: i-be21b5795622437d8136c8a0cedbd8d0, i-be21b5795622437d8136c8a0cedbd8d0
x-nextjs-cache: STALE
server: cloudflare

GET
H2 200 careers.json Show response
www.recordedfuture.com/_next/data/j2JvDgGLGrnhH6NPDpk9f/ 53 KB
9 KB 329ms
327ms Fetch
application/json 172.64.152.166
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/_next/data/j2JvDgGLGrnhH6NPDpk9f/careers.json?slug=careers

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/_next/static/chunks/main-75bdb96a41ba80f4.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.64.152.166 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

be9a0760ead0430944b67b348f1dad87abbda56524b3d590ad22d5cb6c80ef90

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

x-nextjs-data: 1
Referer: https://www.recordedfuture.com/research/reddelta-chinese-state-sponsored-group-targets-mongolia-taiwan-southeast-asia
purpose: prefetch
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

content-encoding: gzip
cf-cache-status: DYNAMIC
etag: "hj9uvp2115kw"
x-content-type-options: nosniff
traceresponse: 00-18196413694e5f5c25bc5453473e4010-a12c53422f78fe71-01
date: Fri, 10 Jan 2025 17:12:45 GMT
content-type: application/json
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: s-maxage=30, stale-while-revalidate
x-nextjs-matched-path: /[[...slug]]
x-debug-info: eyJyZXRyaWVzIjowfQ==
referrer-policy: same-origin
cf-ray: 8ffe4b34fc3118c5-FRA
permissions-policy: autoplay=*, geolocation=(self "https://*.recordedfuture.com/"), camera=*, microphone=*, otp-credentials=self, serial=self
x-platform-server: i-be21b5795622437d8136c8a0cedbd8d0, i-be21b5795622437d8136c8a0cedbd8d0
x-nextjs-cache: STALE
server: cloudflare

GET
H2 200 contact.json Show response
www.recordedfuture.com/_next/data/j2JvDgGLGrnhH6NPDpk9f/ 57 KB
10 KB 334ms
333ms Fetch
application/json 172.64.152.166
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/_next/data/j2JvDgGLGrnhH6NPDpk9f/contact.json?slug=contact

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/_next/static/chunks/main-75bdb96a41ba80f4.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.64.152.166 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

54a68362e920c4ab74e9d88c8f8427a25da8c0f99a2de5673f7690c8fad094e2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

x-nextjs-data: 1
Referer: https://www.recordedfuture.com/research/reddelta-chinese-state-sponsored-group-targets-mongolia-taiwan-southeast-asia
purpose: prefetch
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

content-encoding: gzip
cf-cache-status: DYNAMIC
etag: "13swlz9bjnl196n"
x-content-type-options: nosniff
traceresponse: 00-18196413695380f0f3d1ec951ce4a3fb-3b52c3acf6307ddc-01
date: Fri, 10 Jan 2025 17:12:45 GMT
content-type: application/json
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: s-maxage=30, stale-while-revalidate
x-nextjs-matched-path: /[[...slug]]
x-debug-info: eyJyZXRyaWVzIjowfQ==
referrer-policy: same-origin
cf-ray: 8ffe4b34fc3218c5-FRA
permissions-policy: autoplay=*, geolocation=(self "https://*.recordedfuture.com/"), camera=*, microphone=*, otp-credentials=self, serial=self
x-platform-server: i-be21b5795622437d8136c8a0cedbd8d0, i-be21b5795622437d8136c8a0cedbd8d0
x-nextjs-cache: STALE
server: cloudflare

GET
H2 200 index.json Show response
www.recordedfuture.com/_next/data/j2JvDgGLGrnhH6NPDpk9f/ 211 KB
31 KB 340ms
339ms Fetch
application/json 172.64.152.166
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/_next/data/j2JvDgGLGrnhH6NPDpk9f/index.json

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/_next/static/chunks/main-75bdb96a41ba80f4.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.64.152.166 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

893ce6443ac8110135c4b1d33a6790667179a5f47ead899631b2751e02d4e89e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

x-nextjs-data: 1
Referer: https://www.recordedfuture.com/research/reddelta-chinese-state-sponsored-group-targets-mongolia-taiwan-southeast-asia
purpose: prefetch
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

content-encoding: gzip
cf-cache-status: DYNAMIC
etag: "u7ebr2vllh4msb"
x-content-type-options: nosniff
traceresponse: 00-1819641369690fafb5aa6d9016139060-6b8ebfab0c083d8c-01
date: Fri, 10 Jan 2025 17:12:45 GMT
content-type: application/json
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000; includeSubDomains
x-nextjs-matched-path: /[[...slug]]
x-debug-info: eyJyZXRyaWVzIjowfQ==
referrer-policy: same-origin
cf-ray: 8ffe4b34fc3318c5-FRA
permissions-policy: autoplay=*, geolocation=(self "https://*.recordedfuture.com/"), camera=*, microphone=*, otp-credentials=self, serial=self
x-platform-server: i-be21b5795622437d8136c8a0cedbd8d0, i-be21b5795622437d8136c8a0cedbd8d0
x-nextjs-cache: STALE
server: cloudflare

GET
H2 200 intelligence-cloud.json Show response
www.recordedfuture.com/_next/data/j2JvDgGLGrnhH6NPDpk9f/platform/ 82 KB
14 KB 334ms
333ms Fetch
application/json 172.64.152.166
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/_next/data/j2JvDgGLGrnhH6NPDpk9f/platform/intelligence-cloud.json

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/_next/static/chunks/main-75bdb96a41ba80f4.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.64.152.166 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d55373c31bf1034ce674bed98bbfe613f92c66fd38288b50b7b7c583cb7ae272

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

x-nextjs-data: 1
Referer: https://www.recordedfuture.com/research/reddelta-chinese-state-sponsored-group-targets-mongolia-taiwan-southeast-asia
purpose: prefetch
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

content-encoding: gzip
cf-cache-status: DYNAMIC
etag: "vvi5qhnxwv1spf"
x-content-type-options: nosniff
traceresponse: 00-18196413696374666d11532ce679831d-6204d40f7587daab-01
date: Fri, 10 Jan 2025 17:12:45 GMT
content-type: application/json
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: s-maxage=30, stale-while-revalidate
x-nextjs-matched-path: /[[...slug]]
x-debug-info: eyJyZXRyaWVzIjowfQ==
referrer-policy: same-origin
cf-ray: 8ffe4b350c3418c5-FRA
permissions-policy: autoplay=*, geolocation=(self "https://*.recordedfuture.com/"), camera=*, microphone=*, otp-credentials=self, serial=self
x-platform-server: i-72f68d9e5fc844fb8d11227fc18ff9f4, i-72f68d9e5fc844fb8d11227fc18ff9f4
x-nextjs-cache: STALE
server: cloudflare

GET
H2 200 outcomes.json Show response
www.recordedfuture.com/_next/data/j2JvDgGLGrnhH6NPDpk9f/ 81 KB
14 KB 128ms
127ms Fetch
application/json 172.64.152.166
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/_next/data/j2JvDgGLGrnhH6NPDpk9f/outcomes.json?slug=outcomes

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/_next/static/chunks/main-75bdb96a41ba80f4.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.64.152.166 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

806ae9b076fe0067b10a12e758bba7bbbce243a2268c8fd35af32d566810fffd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

x-nextjs-data: 1
Referer: https://www.recordedfuture.com/research/reddelta-chinese-state-sponsored-group-targets-mongolia-taiwan-southeast-asia
purpose: prefetch
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

content-encoding: gzip
cf-cache-status: DYNAMIC
etag: "q4kbac4i061rt3"
x-content-type-options: nosniff
traceresponse: 00-181964135d579235dbe4369adc031b89-a0f4702e6bab74fc-01
date: Fri, 10 Jan 2025 17:12:45 GMT
content-type: application/json
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: s-maxage=30, stale-while-revalidate
x-nextjs-matched-path: /[[...slug]]
x-debug-info: eyJyZXRyaWVzIjowfQ==
referrer-policy: same-origin
cf-ray: 8ffe4b350c3518c5-FRA
permissions-policy: autoplay=*, geolocation=(self "https://*.recordedfuture.com/"), camera=*, microphone=*, otp-credentials=self, serial=self
x-platform-server: i-72f68d9e5fc844fb8d11227fc18ff9f4, i-72f68d9e5fc844fb8d11227fc18ff9f4
x-nextjs-cache: STALE
server: cloudflare

GET
H2 200 client-success.json Show response
www.recordedfuture.com/_next/data/j2JvDgGLGrnhH6NPDpk9f/services-support/ 55 KB
10 KB 340ms
339ms Fetch
application/json 172.64.152.166
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/_next/data/j2JvDgGLGrnhH6NPDpk9f/services-support/client-success.json

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/_next/static/chunks/main-75bdb96a41ba80f4.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.64.152.166 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

83951a1b2b22a4d8348f2fd6dd91d688b4deb5c612944fd74e97745e06fe799e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

x-nextjs-data: 1
Referer: https://www.recordedfuture.com/research/reddelta-chinese-state-sponsored-group-targets-mongolia-taiwan-southeast-asia
purpose: prefetch
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

content-encoding: gzip
cf-cache-status: DYNAMIC
etag: "jsah3amjwi17q4"
x-content-type-options: nosniff
traceresponse: 00-1819641369a582e9a8b202c6b3ed98a9-818a91e812058813-01
date: Fri, 10 Jan 2025 17:12:45 GMT
content-type: application/json
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: s-maxage=30, stale-while-revalidate
x-nextjs-matched-path: /[[...slug]]
x-debug-info: eyJyZXRyaWVzIjowfQ==
referrer-policy: same-origin
cf-ray: 8ffe4b350c3718c5-FRA
permissions-policy: autoplay=*, geolocation=(self "https://*.recordedfuture.com/"), camera=*, microphone=*, otp-credentials=self, serial=self
x-platform-server: i-72f68d9e5fc844fb8d11227fc18ff9f4, i-72f68d9e5fc844fb8d11227fc18ff9f4
x-nextjs-cache: STALE
server: cloudflare

GET
H2 200 research.json Show response
www.recordedfuture.com/_next/data/j2JvDgGLGrnhH6NPDpk9f/ 59 KB
11 KB 342ms
342ms Fetch
application/json 172.64.152.166
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/_next/data/j2JvDgGLGrnhH6NPDpk9f/research.json?slug=research

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/_next/static/chunks/main-75bdb96a41ba80f4.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.64.152.166 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

34b343be8def373aec632945ca27ec369551c2b60621e7c675c6ddcd04e16ece

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

x-nextjs-data: 1
Referer: https://www.recordedfuture.com/research/reddelta-chinese-state-sponsored-group-targets-mongolia-taiwan-southeast-asia
purpose: prefetch
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

content-encoding: gzip
cf-cache-status: DYNAMIC
etag: "cwkrjnmhbm1agf"
x-content-type-options: nosniff
traceresponse: 00-1819641369b946b3a96ff1613b4f035b-a89054776cb76605-01
date: Fri, 10 Jan 2025 17:12:45 GMT
content-type: application/json
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: s-maxage=30, stale-while-revalidate
x-nextjs-matched-path: /[[...slug]]
x-debug-info: eyJyZXRyaWVzIjowfQ==
referrer-policy: same-origin
cf-ray: 8ffe4b350c3818c5-FRA
permissions-policy: autoplay=*, geolocation=(self "https://*.recordedfuture.com/"), camera=*, microphone=*, otp-credentials=self, serial=self
x-platform-server: i-72f68d9e5fc844fb8d11227fc18ff9f4, i-72f68d9e5fc844fb8d11227fc18ff9f4
x-nextjs-cache: STALE
server: cloudflare

GET
H2 200 resources.json Show response
www.recordedfuture.com/_next/data/j2JvDgGLGrnhH6NPDpk9f/ 61 KB
11 KB 334ms
333ms Fetch
application/json 172.64.152.166
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/_next/data/j2JvDgGLGrnhH6NPDpk9f/resources.json?slug=resources

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/_next/static/chunks/main-75bdb96a41ba80f4.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.64.152.166 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a8366f9c2c19799e8aeb0f72c2a05d6ba562f746e6a5ef62e840eb47096220b5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

x-nextjs-data: 1
Referer: https://www.recordedfuture.com/research/reddelta-chinese-state-sponsored-group-targets-mongolia-taiwan-southeast-asia
purpose: prefetch
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

content-encoding: gzip
cf-cache-status: DYNAMIC
etag: "5n4eaq0u2d1cji"
x-content-type-options: nosniff
traceresponse: 00-18196413698f0f9ad700232c08b1d609-4884b8002083ba85-01
date: Fri, 10 Jan 2025 17:12:45 GMT
content-type: application/json
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: s-maxage=30, stale-while-revalidate
x-nextjs-matched-path: /[[...slug]]
x-debug-info: eyJyZXRyaWVzIjowfQ==
referrer-policy: same-origin
cf-ray: 8ffe4b350c3918c5-FRA
permissions-policy: autoplay=*, geolocation=(self "https://*.recordedfuture.com/"), camera=*, microphone=*, otp-credentials=self, serial=self
x-platform-server: i-72f68d9e5fc844fb8d11227fc18ff9f4, i-72f68d9e5fc844fb8d11227fc18ff9f4
x-nextjs-cache: STALE
server: cloudflare

GET
H2 200 company.json Show response
www.recordedfuture.com/_next/data/j2JvDgGLGrnhH6NPDpk9f/ 55 KB
10 KB 328ms
327ms Fetch
application/json 172.64.152.166
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/_next/data/j2JvDgGLGrnhH6NPDpk9f/company.json?slug=company

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/_next/static/chunks/main-75bdb96a41ba80f4.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.64.152.166 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b5eabbfff8be3d18b257dcfddd54c9b5fb428acd77592da29fa11083183c55af

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

x-nextjs-data: 1
Referer: https://www.recordedfuture.com/research/reddelta-chinese-state-sponsored-group-targets-mongolia-taiwan-southeast-asia
purpose: prefetch
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

content-encoding: gzip
cf-cache-status: DYNAMIC
etag: "6ahtqpi5dn176f"
x-content-type-options: nosniff
traceresponse: 00-181964136973a5f72f752def07735985-f3e3871a87a8c666-01
date: Fri, 10 Jan 2025 17:12:45 GMT
content-type: application/json
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: s-maxage=30, stale-while-revalidate
x-nextjs-matched-path: /[[...slug]]
x-debug-info: eyJyZXRyaWVzIjowfQ==
referrer-policy: same-origin
cf-ray: 8ffe4b350c3b18c5-FRA
permissions-policy: autoplay=*, geolocation=(self "https://*.recordedfuture.com/"), camera=*, microphone=*, otp-credentials=self, serial=self
x-platform-server: i-bac7380798664d7697b0cf11d33520e7, i-bac7380798664d7697b0cf11d33520e7
x-nextjs-cache: STALE
server: cloudflare

GET
H2 200 j.php Show response
dev.visualwebsiteoptimizer.com/ 20 KB
7 KB 71ms
32ms XHR
application/javascript 34.107.218.251
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://dev.visualwebsiteoptimizer.com/j.php?a=880669&u=https%3A%2F%2Fwww.recordedfuture.com%2Fresearch%2Freddelta-chinese-state-sponsored-group-targets-mongolia-taiwan-southeast-asia&vn=2.1&x=true

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/research/reddelta-chinese-state-sponsored-group-targets-mongolia-taiwan-southeast-asia

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.107.218.251 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

251.218.107.34.bc.googleusercontent.com

Software

gams1 /

Resource Hash

bce8e4b43235576a724383263dcd8789fe2ee5514575b8850d46aa3ceaee0f52

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=0, no-cache, must-revalidate
timing-allow-origin: *
content-encoding: gzip
access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://www.recordedfuture.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 10 Jan 2025 17:12:45 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: gams1

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 353 KB
116 KB 77ms
37ms Script
application/javascript 2a00:1450:4001:810::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-539N74N

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/research/reddelta-chinese-state-sponsored-group-targets-mongolia-taiwan-southeast-asia

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

d5c1854d0d13557f5e447be2808912494bcf1bfaa0a9abeb0b27a444259ca36f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1080:0"}],}
expires: Fri, 10 Jan 2025 17:12:45 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 10 Jan 2025 17:12:45 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Fri, 10 Jan 2025 15:50:38 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1080:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 118538
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 ed5a9e40e8963ad2.css Show response
www.recordedfuture.com/_next/static/css/ 25 KB
0 0ms
0ms Fetch
text/css 172.64.152.166
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/_next/static/css/ed5a9e40e8963ad2.css

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/_next/static/chunks/main-75bdb96a41ba80f4.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.64.152.166 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

389a4592dcfd22840a86f780fe7447ff7be855847081c1c8dea9d97678a8adaf

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.recordedfuture.com/research/reddelta-chinese-state-sponsored-group-targets-mongolia-taiwan-southeast-asia

Response headers

cache-control: public, max-age=31536000, immutable
content-encoding: gzip
cf-cache-status: HIT
etag: W/"64d5-192f6c632e5"
x-debug-info: eyJyZXRyaWVzIjowfQ==
age: 5812102
x-content-type-options: nosniff
cf-ray: 8ffe4b339b0818c5-FRA
traceresponse: 00-1804bdffd918f198757cce900926cc21-311279366c4fc09a-01
x-platform-server: i-bac7380798664d7697b0cf11d33520e7, i-bac7380798664d7697b0cf11d33520e7
date: Fri, 10 Jan 2025 17:12:45 GMT
content-type: text/css; charset=UTF-8
last-modified: Mon, 04 Nov 2024 10:43:57 GMT
vary: Accept-Encoding
server: cloudflare

GET
H3 200 worker-037b3686a29813ddf37c49bbdbe596a4br.js Show response
dev.visualwebsiteoptimizer.com/cdn/edrv/ 260 KB
63 KB 41ms
18ms XHR
text/javascript 34.107.218.251
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://dev.visualwebsiteoptimizer.com/cdn/edrv/worker-037b3686a29813ddf37c49bbdbe596a4br.js
Requested by: Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/research/reddelta-chinese-state-sponsored-group-targets-mongolia-taiwan-southeast-asia
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.107.218.251 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 251.218.107.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 9877f9c44cb22bd74ca3a23dd8b56bf8527bdbba3b573cc75c59d80ae6b46eff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

x-goog-metageneration: 1
content-encoding: br
x-goog-hash: crc32c=BfgX3A==, md5=9Za4h4Piz8VX2mSFbl9Ucw==
etag: "f596b88783e2cfc557da64856e5f5473"
age: 204493
x-goog-stored-content-encoding: br
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length: 64301
date: Wed, 08 Jan 2025 08:24:32 GMT
last-modified: Wed, 08 Jan 2025 06:25:54 GMT
content-type: text/javascript; charset=UTF-8
x-guploader-uploadid: AFiumC6VZFm_rhf4xAbHigEWelL3LFYQRma9ugU-6nz0VmXIJFcSpbZt0lzWwPzWiADw0vfO
cdn_cache_status: hit
cache-control: public, max-age=31536000
x-goog-storage-class: STANDARD
via: 1.1 google
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1736317554596799
content-length: 64301
content-language: en
server: UploadServer

GET
H3 200 va_gq-49922f4535d1d15cf476dd37801f00acbr.js Show response
dev.visualwebsiteoptimizer.com/cdn/edrv/ 280 KB
72 KB 45ms
23ms XHR
text/javascript 34.107.218.251
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://dev.visualwebsiteoptimizer.com/cdn/edrv/va_gq-49922f4535d1d15cf476dd37801f00acbr.js
Requested by: Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/research/reddelta-chinese-state-sponsored-group-targets-mongolia-taiwan-southeast-asia
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.107.218.251 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 251.218.107.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 3e3cef9a429610e8a12f848cc7b810978847ea39e2a04b32f180bd4c6704f0a2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

x-goog-metageneration: 1
content-encoding: br
x-goog-hash: crc32c=bkHjKg==, md5=uoHnIASvTIEWM8dBW5Y0Cw==
etag: "ba81e72004af4c811633c7415b96340b"
age: 204493
x-goog-stored-content-encoding: br
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length: 73973
date: Wed, 08 Jan 2025 08:24:32 GMT
last-modified: Wed, 08 Jan 2025 06:26:23 GMT
content-type: text/javascript; charset=UTF-8
x-guploader-uploadid: AFiumC5zj9K69-LkDGNMzf0Pghnq9jVbKLKC94mfHWbXD8gaNvmefO9y5hSjgKy7sNIOHoQZ4qJXWDw
cdn_cache_status: hit
cache-control: public, max-age=31536000
x-goog-storage-class: STANDARD
via: 1.1 google
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1736317583313925
content-length: 73973
content-language: en
server: UploadServer

GET
H2 200 v.gif
dev.visualwebsiteoptimizer.com/ 35 B
147 B 142ms
142ms Image
image/gif 34.107.218.251
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dev.visualwebsiteoptimizer.com/v.gif?cd=0&a=880669&d=recordedfuture.com&u=D31F9B668B2CB018B963D6B30FE2AADA2&h=4f49c76a4b77bd49dd7107b3764506be&t=false

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.107.218.251 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

251.218.107.34.bc.googleusercontent.com

Software

gnv02c /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=43200
x-content-type-options: nosniff
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
date: Fri, 10 Jan 2025 17:12:45 GMT
content-type: image/gif
server: gnv02c

GET
H2 200 64dc3ec5-330c-4652-88d3-147ee65e90ba.js Show response
j.6sc.co/j/ 8 KB
8 KB 384ms
324ms Script
application/javascript 2.20.245.211
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to

Full URL: https://j.6sc.co/j/64dc3ec5-330c-4652-88d3-147ee65e90ba.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-539N74N
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.20.245.211 , Netherlands, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS: a2-20-245-211.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 4512d280d6e3770022a6aced807c4b08d410ae107294c0ac19801ad24f6ef0f5

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

x-amz-server-side-encryption: AES256
content-type: application/javascript
cache-control: private, max-age=1800
x-amz-version-id: MbzeuKlSNW9OmZUUgXztIvtYg.jH191L
etag: "3fdac343b2a409e8e59493c09517ac69"
expires: Fri, 10 Jan 2025 17:42:46 GMT
accept-ranges: bytes
content-length: 7759
x-amz-cf-id: acGRDpTPJBDhT_W86KwcgcmKOK6IGVa8vrzjmDrCVqMVTAxOaf42hQ==
date: Fri, 10 Jan 2025 17:12:46 GMT
last-modified: Thu, 25 Jul 2024 13:22:42 GMT
vary: accept-encoding
server: AmazonS3
x-amz-cf-pop: FRA60-P11
x-amz-meta-content-type: application/json

POST
H3 200 collect
www.google.com/ccm/ 0
0 55ms
24ms Ping
text/plain 172.217.16.196
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google.com/ccm/collect?en=page_view&dl=https%3A%2F%2Fwww.recordedfuture.com%2Fresearch%2Freddelta-chinese-state-sponsored-group-targets-mongolia-taiwan-southeast-asia&scrsrc=www.googletagmanager.com&frm=0&rnd=516345369.1736529166&dt=Chinese%20State-Sponsored%20RedDelta%20Targeted%20Taiwan%2C%20Mongolia%2C%20and%20Southeast%20Asia%20with%20Adapted%20PlugX%20Infection%20Chain&auid=899757820.1736529166&navt=n&npa=1&gtm=45He5190v830966511za200&gcd=13l3l3l2l1l1&dma_cps=syphamo&dma=1&tag_exp=101925629~102067555~102067808~102081485~102198178&tft=1736529165724&tfd=642&apve=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-539N74N
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.217.16.196 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra16s65-in-f4.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 422 KB
135 KB 38ms
38ms Script
application/javascript 2a00:1450:4001:810::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-MHTMF48BZH&l=dataLayer&cx=c&gtm=45He5190v830966511za200

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-539N74N

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

b1a5d6fad2f3b9eaca076d0cfd6aa6218720966802543fb73a930c356a670d11

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Fri, 10 Jan 2025 17:12:45 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 10 Jan 2025 17:12:45 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 137926
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 299 KB
103 KB 32ms
32ms Script
application/javascript 2a00:1450:4001:810::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-1003136084&l=dataLayer&cx=c&gtm=45He5190v830966511za200

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-539N74N

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

2d161a2d1638ac0cc482c5ddd3eea0f16516a4fc92b9d3b4924d210ba9117403

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Fri, 10 Jan 2025 17:12:45 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 10 Jan 2025 17:12:45 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Fri, 10 Jan 2025 15:50:38 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 104676
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 uwt.js Show response
static.ads-twitter.com/ 57 KB
16 KB 67ms
15ms Script
application/javascript 199.232.188.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://static.ads-twitter.com/uwt.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-539N74N
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 199.232.188.157 Munich, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: d4963b8afebfa0063b5d17b4c80f49bce702a37ea5c9b91bb3c996bb9dea4b60

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

vary: Accept-Encoding,Host
cache-control: no-cache
content-encoding: gzip
etag: "4328e910de583ad53b3a7a76455af005+gzip+gzip"
accept-ranges: bytes
x-cache: HIT, HIT
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
content-length: 15926
date: Fri, 10 Jan 2025 17:12:45 GMT
x-tw-cdn: FT
last-modified: Tue, 29 Oct 2024 00:10:26 GMT
content-type: application/javascript; charset=utf-8
x-served-by: cache-iad-kiad7000084-IAD, cache-muc13968-MUC
x-amz-server-side-encryption: AES256

GET
H2 200 insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 25 KB
9 KB 45ms
11ms Script
application/javascript 2a02:26f0:480:15::213:7e4a
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to

Full URL

https://snap.licdn.com/li.lms-analytics/insight.min.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-539N74N

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:480:15::213:7e4a Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

Software

Resource Hash

c8879b289784c2f0e524c601ee26bd458ab9d35a527c22ce582904004e47d018

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

cache-control: max-age=42866
content-encoding: gzip
x-cdn: AKAM
x-content-type-options: nosniff
accept-ranges: bytes
content-length: 9404
date: Fri, 10 Jan 2025 17:12:45 GMT
last-modified: Mon, 06 Jan 2025 08:56:54 GMT
content-type: application/javascript;charset=utf-8
vary: Accept-Encoding
x-amz-server-side-encryption: AES256

GET
H2 200 ga.js Show response
ssl.google-analytics.com/ 45 KB
17 KB 58ms
13ms Script
text/javascript 2a00:1450:4001:800::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ssl.google-analytics.com/ga.js

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/research/reddelta-chinese-state-sponsored-group-targets-mongolia-taiwan-southeast-asia

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: gzip
age: 4074
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:215:0"}],}
x-content-type-options: nosniff
expires: Fri, 10 Jan 2025 18:04:51 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 10 Jan 2025 16:04:51 GMT
last-modified: Tue, 12 Dec 2023 18:09:08 GMT
content-type: text/javascript
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:215:0
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 17168
server: Golfe2

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/3.6.0/ 87 KB
31 KB 60ms
15ms Script
text/javascript 2a00:1450:4001:811::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/3.6.0/jquery.min.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-539N74N

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: gzip
age: 266915
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
x-content-type-options: nosniff
expires: Wed, 07 Jan 2026 15:04:10 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 07 Jan 2025 15:04:10 GMT
last-modified: Wed, 10 Mar 2021 14:28:09 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
accept-ranges: bytes
access-control-allow-origin: *
content-length: 31017
x-xss-protection: 0
server: sffe

GET
H3 200 fbevents.js Show response
connect.facebook.net/en_US/ 239 KB
61 KB 24ms
9ms Script
application/x-javascript 157.240.0.6
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/research/reddelta-chinese-state-sponsored-group-targets-mongolia-taiwan-southeast-asia

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.0.6 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-02-fra3.fbcdn.net

Software

Resource Hash

5332fd32d8be28eb2531721220e8c3c561000378988be4b4d7f97568f0b3f224

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;script-src 'nonce-o8zPsVOy' .fbcdn.net .facebook.net blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://.fbcdn.net attachment.fbsbx.com blob: 'self';img-src 'self' data: blob: facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: gzip
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
date: Fri, 10 Jan 2025 17:12:45 GMT
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
priority: u=3,i
x-frame-options: DENY
strict-transport-security: max-age=31536000; preload; includeSubDomains
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;script-src 'nonce-o8zPsVOy' *.fbcdn.net *.facebook.net blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';img-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
cache-control: public, max-age=1200
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=6, rtx=0, c=23, mss=1232, tbw=4488, tp=9, tpl=0, uplat=0, ullat=-1
pragma: public
x-fb-debug: T3urLEz2ZCknyqygzKCX15aoke9IxlE31z4ak3/uTJTuR3Kx2Vztc5JQ0WPocBnyHv/6cRj0yhZueM31ygq2cg==
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top
content-length: 62279
x-xss-protection: 0
origin-agent-cluster: ?1

GET
H2 200 container_nbhoRDM8.js Show response
cdn.matomo.cloud/recordedfuture.matomo.cloud/ 246 KB
66 KB 40ms
10ms Script
application/javascript 2600:9000:2724:7200:c:7d55:b3c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.matomo.cloud/recordedfuture.matomo.cloud/container_nbhoRDM8.js

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/research/reddelta-chinese-state-sponsored-group-targets-mongolia-taiwan-southeast-asia

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2724:7200:c:7d55:b3c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

CloudFront /

Resource Hash

5691e1b21e44ea59a1fcac3fe2bd257b7d988631efb24427f000ffb8d1d933ff

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
x-amz-version-id: ng837MWsZ6VwB5jTCbYW9pBrLnkVMAVM
etag: W/"24782722ac32a053e0f0ff8601889a30"
age: 18514
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: E1RbXxRaVcXN5Awpo4lHtAwR0QS6yto6Cn7-wInKL_3kazouHc2wxw==
date: Fri, 10 Jan 2025 12:04:12 GMT
content-type: application/javascript; charset=utf-8
last-modified: Wed, 11 Dec 2024 01:17:41 GMT
vary: accept-encoding, Origin
strict-transport-security: max-age=31536000
cache-control: max-age=691200
via: 1.1 8c1c3a8ed856f5c19ce3b4158bff94a8.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P12
server: CloudFront

GET
H2 200 matomo.js Show response
cdn.matomo.cloud/recordedfuture.matomo.cloud/ 202 KB
56 KB 39ms
10ms Script
application/javascript 2600:9000:2724:7200:c:7d55:b3c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.matomo.cloud/recordedfuture.matomo.cloud/matomo.js

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/research/reddelta-chinese-state-sponsored-group-targets-mongolia-taiwan-southeast-asia

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2724:7200:c:7d55:b3c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

CloudFront /

Resource Hash

54478b374eaa25070a8f84992537410aea961a1674ff849701805f3d37de2255

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
x-amz-version-id: ZjK59gOpgtq0X3kWLJjRFSfehQQw_jVG
etag: W/"ad68714422a54caa6ea33f7b7fda0062"
age: 18651
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: VmHLn_J0CIuRTljAysAtcSl1AByEWzqKCUaWCWEo7AEStmGtN1fbKA==
date: Fri, 10 Jan 2025 12:01:55 GMT
content-type: application/javascript; charset=utf-8
last-modified: Wed, 11 Dec 2024 01:17:41 GMT
vary: accept-encoding, Origin
strict-transport-security: max-age=31536000
cache-control: max-age=691200
via: 1.1 8c1c3a8ed856f5c19ce3b4158bff94a8.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P12
server: CloudFront

GET
H2 200 252628.js Show response
js.hs-scripts.com/ 2 KB
1 KB 47ms
21ms Script
application/javascript 2606:4700::6810:8dd1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js.hs-scripts.com/252628.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-539N74N

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:8dd1 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

fbb0bbb73d6c5781bc3ca5bbc9641e7e4f18a5dcbe37622286219e57bea542f4

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

access-control-max-age: 3600
content-encoding: gzip
cf-cache-status: HIT
age: 32
x-content-type-options: nosniff
expires: Fri, 10 Jan 2025 17:14:15 GMT
date: Fri, 10 Jan 2025 17:12:45 GMT
x-hubspot-correlation-id: 325cf766-8b20-48cd-abcf-4427287337ab
content-type: application/javascript;charset=utf-8
vary: origin, Accept-Encoding
last-modified: Fri, 10 Jan 2025 17:12:13 GMT
cache-control: public, max-age=90
access-control-allow-credentials: true
cf-ray: 8ffe4b360f554d70-FRA
accept-ranges: bytes
access-control-allow-origin: https://bgpview.io
content-length: 670
server: cloudflare

GET
H2 200 hockeystack.min.js Show response
cdn.jsdelivr.net/npm/hockeystack@latest/ 20 KB
8 KB 109ms
34ms Script
application/javascript 2a04:4e42:600::485
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/hockeystack@latest/hockeystack.min.js

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/research/reddelta-chinese-state-sponsored-group-targets-mongolia-taiwan-southeast-asia

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:600::485 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

ef48d31fa89fc8e074e7fbe3afaab09da2502c259d405625d712594ac4ddcd0e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

access-control-expose-headers: *
content-encoding: br
etag: W/"5092-k+5F6x6GG07I/qtJBnQUrFhbh3Q"
age: 8732
x-content-type-options: nosniff
x-jsd-version-type: version
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
x-cache: HIT, HIT
date: Fri, 10 Jan 2025 17:12:45 GMT
content-type: application/javascript; charset=utf-8
x-served-by: cache-fra-etou8220035-FRA, cache-mad22051-MAD
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=604800, s-maxage=43200
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
content-length: 7449
x-jsd-version: 1.3.191

GET
H2 200 sw_iframe.html
www.googletagmanager.com/static/service_worker/5190/ Frame A52E 0
0 50ms
15ms Document
text/html 2a00:1450:4001:810::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/static/service_worker/5190/sw_iframe.html?origin=https%3A%2F%2Fwww.recordedfuture.com

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-539N74N

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 79757
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 1476
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="analytics-container-tag-serving"
cross-origin-resource-policy: cross-origin
date: Thu, 09 Jan 2025 19:03:28 GMT
expires: Fri, 09 Jan 2026 19:03:28 GMT
last-modified: Thu, 09 Jan 2025 17:38:00 GMT
report-to: {"group":"analytics-container-tag-serving","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/analytics-container-tag-serving"}]}
server: sffe
service-worker-allowed: /static/service_worker
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET 3ebc9a17-8bce-452c-bed3-b3c885c90d84
https://www.recordedfuture.com/ Frame 0
0

GET
H3 200 nc-b168471f1474c206fd3eed5be0cade89br.js Show response
dev.visualwebsiteoptimizer.com/cdn/edrv/ 21 KB
6 KB 20ms
19ms XHR
text/javascript 34.107.218.251
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://dev.visualwebsiteoptimizer.com/cdn/edrv/nc-b168471f1474c206fd3eed5be0cade89br.js
Requested by: Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/research/reddelta-chinese-state-sponsored-group-targets-mongolia-taiwan-southeast-asia
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.107.218.251 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 251.218.107.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 7ab0b19dbf90f7e78c37f36a818cba9edb9249c765e0eb0f1b23b1600c486d4f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

x-goog-metageneration: 1
content-encoding: br
x-goog-hash: crc32c=++AENQ==, md5=elY8LfIB5I+8K6CCmsLKLg==
etag: "7a563c2df201e48fbc2ba0829ac2ca2e"
age: 204492
x-goog-stored-content-encoding: br
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length: 6621
date: Wed, 08 Jan 2025 08:24:33 GMT
last-modified: Wed, 08 Jan 2025 06:27:12 GMT
content-type: text/javascript; charset=UTF-8
x-guploader-uploadid: AFiumC6pobRG_shAjkiglAvRqBzzxRgqD-imPAoPmZvbVvZek9Lflkl1HtZ_BxOSkXTtQCu2
cdn_cache_status: hit
cache-control: public, max-age=31536000
x-goog-storage-class: STANDARD
via: 1.1 google
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1736317632452401
content-length: 6621
content-language: en
server: UploadServer

GET
H3 200 s.gif
dev.visualwebsiteoptimizer.com/ 35 B
54 B 102ms
102ms Image
image/gif 34.107.218.251
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dev.visualwebsiteoptimizer.com/s.gif?account_id=880669&u=D31F9B668B2CB018B963D6B30FE2AADA2&s=1736529165&ed=%7B%22sr%22%3A%221600x1200%22%2C%22sc%22%3A24%2C%22de%22%3A%22UTF-8%22%2C%22ul%22%3A%22de-de%22%2C%22r%22%3A%22%22%2C%22lt%22%3A1736529165774%2C%22tO%22%3A-1%2C%22tz%22%3A%22Europe%2FBerlin%22%7D&cu=https%3A%2F%2Fwww.recordedfuture.com%2Fresearch%2Freddelta-chinese-state-sponsored-group-targets-mongolia-taiwan-southeast-asia&r=0&p=1&cq=0&eTime=1736529165780&v=90e8eeca0

Protocol

Security

QUIC, , AES_128_GCM

Server

34.107.218.251 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

251.218.107.34.bc.googleusercontent.com

Software

gnv02c /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
pragma: no-cache
x-content-type-options: nosniff
via: 1.1 google
expires: Mon, 10 Jan 2005 00:00:01 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
date: Fri, 10 Jan 2025 17:12:45 GMT
content-type: image/gif
server: gnv02c

GET
H3 200 194163687656043 Show response
connect.facebook.net/signals/config/ 80 KB
16 KB 11ms
10ms Script
application/x-javascript 157.240.0.6
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/194163687656043?v=2.9.179&r=stable&domain=www.recordedfuture.com&hme=b8122d5d96cd6f542162ba4f497489972d1ebe228d24c39d34f560e30ae932ce&ex_m=70%2C122%2C107%2C111%2C61%2C4%2C100%2C69%2C16%2C97%2C89%2C51%2C54%2C173%2C176%2C188%2C184%2C185%2C187%2C29%2C101%2C53%2C77%2C186%2C168%2C171%2C181%2C182%2C189%2C132%2C41%2C191%2C192%2C34%2C144%2C15%2C50%2C197%2C196%2C134%2C18%2C40%2C1%2C43%2C65%2C66%2C67%2C71%2C93%2C17%2C14%2C96%2C92%2C91%2C108%2C52%2C110%2C39%2C109%2C30%2C94%2C26%2C169%2C172%2C141%2C86%2C56%2C84%2C33%2C73%2C0%2C95%2C32%2C28%2C82%2C83%2C88%2C47%2C46%2C87%2C37%2C11%2C12%2C13%2C6%2C7%2C25%2C22%2C23%2C57%2C62%2C64%2C75%2C102%2C27%2C76%2C9%2C8%2C80%2C48%2C21%2C104%2C103%2C105%2C98%2C10%2C20%2C3%2C38%2C74%2C19%2C5%2C90%2C81%2C44%2C35%2C85%2C2%2C36%2C63%2C42%2C106%2C45%2C79%2C68%2C112%2C60%2C59%2C31%2C99%2C58%2C55%2C49%2C78%2C72%2C24%2C113

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.0.6 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-02-fra3.fbcdn.net

Software

Resource Hash

c9d27a7e327fea8984b7c447f9c211c15b607f1a63d9bc65c027581e63e3197a

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;script-src 'nonce-3bsh01Vt' .fbcdn.net .facebook.net blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://.fbcdn.net attachment.fbsbx.com blob: 'self';img-src 'self' data: blob: facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: gzip
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
date: Fri, 10 Jan 2025 17:12:45 GMT
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
priority: u=3,i
x-frame-options: DENY
strict-transport-security: max-age=31536000; preload; includeSubDomains
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;script-src 'nonce-3bsh01Vt' *.fbcdn.net *.facebook.net blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';img-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
cache-control: public, max-age=1200
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=7, rtx=0, c=77, mss=1232, tbw=71267, tp=67, tpl=0, uplat=1, ullat=-1
pragma: public
x-fb-debug: Na4xQn99aW0XiL+TYVwl5iZno6dUaEsTTazzvlaYNOJM5KnW/3wTBLG+18IFxzReoYIynZFnQUNnmKZ+oVv3tg==
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top
content-length: 16242
x-xss-protection: 0
origin-agent-cluster: ?1

GET
H2 200 insight.old.min.js Show response
snap.licdn.com/li.lms-analytics/ 40 KB
14 KB 15ms
14ms Script
application/javascript 2a02:26f0:480:15::213:7e4a
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to

Full URL

https://snap.licdn.com/li.lms-analytics/insight.old.min.js

Requested by

Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:480:15::213:7e4a Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

Software

Resource Hash

8a27dc7b44ebe886390bfa0a9beeea36ea5a3f37479f0e0836b6c9b80d9b35ed

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

cache-control: max-age=28539
content-encoding: gzip
x-cdn: AKAM
x-content-type-options: nosniff
accept-ranges: bytes
content-length: 14628
date: Fri, 10 Jan 2025 17:12:45 GMT
last-modified: Mon, 02 Dec 2024 10:13:56 GMT
content-type: application/javascript;charset=utf-8
vary: Accept-Encoding
x-amz-server-side-encryption: AES256

GET
H3 200 settings.js Show response
dev.visualwebsiteoptimizer.com/dcdn/ 29 KB
6 KB 26ms
26ms Script
application/javascript 34.107.218.251
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://dev.visualwebsiteoptimizer.com/dcdn/settings.js?a=880669&settings_type=4&ts=1736429302&dt=desktop&cc=DE

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/research/reddelta-chinese-state-sponsored-group-targets-mongolia-taiwan-southeast-asia

Protocol

Security

QUIC, , AES_128_GCM

Server

34.107.218.251 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

251.218.107.34.bc.googleusercontent.com

Software

gams1 /

Resource Hash

094f4dca90e585eefffb88ef179701edac3997885a315084d30e84cdb1bc70f7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cdn_cache_status: revalidated
cache-control: public, max-age=1800, s-maxage=1800
content-encoding: gzip
etag: W/"1736429302_EA"
age: 0
via: 1.1 google
not-modified: true
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6629
date: Fri, 10 Jan 2025 17:12:45 GMT
content-type: application/javascript; charset=UTF-8
server: gams1

GET
H2 200 __utm.gif
ssl.google-analytics.com/r/ 35 B
410 B 24ms
22ms Image
image/gif 2a00:1450:4001:800::2008
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ssl.google-analytics.com/r/__utm.gif?utmwv=5.7.2&utms=1&utmn=561178054&utmhn=www.recordedfuture.com&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=de-de&utmje=0&utmfl=-&utmdt=Chinese%20State-Sponsored%20RedDelta%20Targeted%20Taiwan%2C%20Mongolia%2C%20and%20Southeast%20Asia%20with%20Adapted%20PlugX%20Infection%20Chain&utmhid=1323274534&utmr=-&utmp=%2Fresearch%2Freddelta-chinese-state-sponsored-group-targets-mongolia-taiwan-southeast-asia&utmht=1736529165810&utmac=UA-XXXYYYZZZ-1&utmcc=__utma%3D93161374.231958658.1736529166.1736529166.1736529166.1%3B%2B__utmz%3D93161374.1736529166.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=210822787&utmredir=1&utmu=qhAgAAAAAAAAAAAAAAAAAAAE~

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:169:0"}],}
x-content-type-options: nosniff
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:169:0
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 35
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 10 Jan 2025 17:12:45 GMT
last-modified: Sun, 17 May 1998 03:00:00 GMT
content-type: image/gif
server: Golfe2

GET
H2 200 adsct
t.co/i/ 43 B
628 B 163ms
138ms Image
image/gif 162.159.140.229
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?bci=3&dv=Europe%2FBerlin%26en-US%2Cen%26Google%20Inc.%26Linux%20x86_64%26255%261600%261200%2628%2624%261600%261200%260%26na&eci=2&event_id=fe8eae56-5c6f-4a9f-a423-54d48ee69415&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=fdf97574-0427-47fc-b69b-693ee0c8d131&tw_document_href=https%3A%2F%2Fwww.recordedfuture.com%2Fresearch%2Freddelta-chinese-state-sponsored-group-targets-mongolia-taiwan-southeast-asia&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=nv0r6&type=javascript&version=2.3.31

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.159.140.229 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

strict-transport-security: max-age=0
x-transaction-id: 56f5f6f4f6e3465a
cache-control: no-cache, no-store, max-age=0
x-connection-hash: 2dc0a829ce4a0885859b7037ca349780ae302415e4e837d4b679d0bb0cc1fd52
cf-cache-status: DYNAMIC
cf-ray: 8ffe4b36abc69a15-FRA
x-response-time: 114
content-length: 43
date: Fri, 10 Jan 2025 17:12:45 GMT
content-type: image/gif;charset=utf-8
perf: 7402827104
server: cloudflare tsa_o

GET
H2 200 adsct
analytics.twitter.com/i/ 43 B
394 B 169ms
116ms Image
image/gif 104.244.42.131
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://analytics.twitter.com/i/adsct?bci=3&dv=Europe%2FBerlin%26en-US%2Cen%26Google%20Inc.%26Linux%20x86_64%26255%261600%261200%2628%2624%261600%261200%260%26na&eci=2&event_id=fe8eae56-5c6f-4a9f-a423-54d48ee69415&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=fdf97574-0427-47fc-b69b-693ee0c8d131&tw_document_href=https%3A%2F%2Fwww.recordedfuture.com%2Fresearch%2Freddelta-chinese-state-sponsored-group-targets-mongolia-taiwan-southeast-asia&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=nv0r6&type=javascript&version=2.3.31

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.131 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

strict-transport-security: max-age=631138519
x-transaction-id: f2526db2fb581dd2
cache-control: no-cache, no-store, max-age=0
x-connection-hash: 17a6fdb7dac0f3138c28568e74598b145959c6b02549fbc21a0322e3d85ba93c
x-response-time: 108
content-length: 43
date: Fri, 10 Jan 2025 17:12:45 GMT
perf: 7402827104
content-type: image/gif;charset=utf-8
server: tsa_o

GET
H3 200 /
www.facebook.com/tr/ 0
19 B 33ms
8ms Image
text/plain 157.240.0.35
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=194163687656043&ev=PageView&dl=https%3A%2F%2Fwww.recordedfuture.com%2Fresearch%2Freddelta-chinese-state-sponsored-group-targets-mongolia-taiwan-southeast-asia&rl=&if=false&ts=1736529165844&sw=1600&sh=1200&v=2.9.179&r=stable&ec=0&o=12318&fbp=fb.1.1736529165843.2754962265412014&cs_est=true&ler=empty&cdl=API_unavailable&it=1736529165789&coo=false&rqm=GET

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.0.35 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

edge-star-mini-shv-02-fra3.facebook.com

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=6, rtx=0, c=23, mss=1232, tbw=4537, tp=10, tpl=0, uplat=0, ullat=0
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin
alt-svc: h3=":443"; ma=86400
content-length: 0
date: Fri, 10 Jan 2025 17:12:45 GMT
content-type: text/plain
server: proxygen-bolt
priority: u=3,i

GET
H3 200 /
www.facebook.com/privacy_sandbox/pixel/register/trigger/ 67 B
194 B 159ms
135ms Image
image/png 157.240.0.35
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/privacy_sandbox/pixel/register/trigger/?id=194163687656043&ev=PageView&dl=https%3A%2F%2Fwww.recordedfuture.com%2Fresearch%2Freddelta-chinese-state-sponsored-group-targets-mongolia-taiwan-southeast-asia&rl=&if=false&ts=1736529165844&sw=1600&sh=1200&v=2.9.179&r=stable&ec=0&o=12318&fbp=fb.1.1736529165843.2754962265412014&cs_est=true&ler=empty&cdl=API_unavailable&it=1736529165789&coo=false&rqm=FGET

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.0.35 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

edge-star-mini-shv-02-fra3.facebook.com

Software

Resource Hash

aa7b6c81e85551eeb5c4809f1e683efa0b780c33d12ddfc2067a1b136803e45a

Security Headers

Name	Value
Content-Security-Policy	default-src data: blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'wasm-unsafe-eval' https://.google-analytics.com .google.com;style-src .fbcdn.net data: .facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com:* wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net .fbsbx.com .fb.com https://.google-analytics.com;font-src data: .facebook.com .fbcdn.net .fbsbx.com https://fonts.gstatic.com;img-src .fbcdn.net .facebook.com data: https://.fbsbx.com facebook.com .cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net .carriersignal.info blob: android-webview-video-poster: .whatsapp.net .fb.com .oculuscdn.com .tenor.co .tenor.com .giphy.com https://paywithmybank.com/ https://.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://.google-analytics.com;media-src .cdninstagram.com blob: .fbcdn.net .fbsbx.com www.facebook.com .facebook.com data: .tenor.co .tenor.com https://.giphy.com;frame-src .facebook.com .fbsbx.com fbsbx.com data: www.instagram.com .fbcdn.net https://paywithmybank.com/ https://.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net .google.com .doubleclick.net;worker-src blob: .facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: zstd
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown&brsid=7458335972769034054"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
date: Fri, 10 Jan 2025 17:12:45 GMT
content-type: image/png
vary: Accept-Encoding
x-fb-debug: lUc1GGl8e1ckRhg5B9fyglWE1Fx8Sf7bONi9mOYN15hNyoHnK7exyhOCqro+G2pNaBvwg3Q0DOAd9liWL8fDrw==
priority: u=3,i
x-frame-options: DENY
strict-transport-security: max-age=15552000; preload
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown&brsid=7458335972769034054", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'wasm-unsafe-eval' https://*.google-analytics.com *.google.com;style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com https://*.google-analytics.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com https://fonts.gstatic.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: *.whatsapp.net *.fb.com *.oculuscdn.com *.tenor.co *.tenor.com *.giphy.com https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://*.google-analytics.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data: *.tenor.co *.tenor.com https://*.giphy.com;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net *.google.com *.doubleclick.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
cache-control: private, no-store, no-cache, must-revalidate
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=6, rtx=0, c=23, mss=1232, tbw=4905, tp=13, tpl=0, uplat=125, ullat=0
cross-origin-opener-policy: same-origin-allow-popups
pragma: no-cache
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), browsing-topics=(self), camera=(self), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(self), clipboard-write=(self), compute-pressure=(), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(self), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(self), midi=(), otp-credentials=(), payment=(), picture-in-picture=(self), private-state-token-issuance=(), publickey-credentials-get=(self), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=(self);report-to="permissions_policy"
document-policy: force-load-at-top
cross-origin-opener-policy-report-only: restrict-properties;report-to="coop_report"
x-xss-protection: 0
origin-agent-cluster: ?1

POST
H2 204 / Show response
px.ads.linkedin.com/wa/ 0
708 B 202ms
121ms XHR
text/plain 2620:1ec:21::14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://px.ads.linkedin.com/wa/
Requested by: Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.old.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Accept: *
Content-Type: text/plain;charset=UTF-8

Response headers

linkedin-action: 1
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: 9405C05D7B1344FE946C3A86B38FC762 Ref B: DUS30EDGE0917 Ref C: 2025-01-10T17:12:45Z
x-li-fabric: prod-lva1
access-control-allow-credentials: true
x-li-uuid: AAYrXTQUl1b6lmggJHTrSQ==
x-li-proto: http/2
access-control-allow-origin: https://www.recordedfuture.com
x-cache: CONFIG_NOCACHE
date: Fri, 10 Jan 2025 17:12:45 GMT
vary: Origin

POST
H2 204 collect
region1.analytics.google.com/g/ 0
0 53ms
18ms Fetch
text/plain 2001:4860:4802:34::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.analytics.google.com/g/collect?v=2&tid=G-MHTMF48BZH&gtm=45je5190v873499763z8830966511za200zb830966511&_p=1736529165596&_gaz=1&gcd=13l3l3l2l1l1&npa=1&dma_cps=syphamo&dma=1&tag_exp=101925629~102067555~102067808~102081485~102198178&cid=1545615323.1736529166&ul=de-de&sr=1600x1200&ir=1&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_eu=EA&_s=1&sid=1736529165&sct=1&seg=0&dl=https%3A%2F%2Fwww.recordedfuture.com%2Fresearch%2Freddelta-chinese-state-sponsored-group-targets-mongolia-taiwan-southeast-asia&dt=Chinese%20State-Sponsored%20RedDelta%20Targeted%20Taiwan%2C%20Mongolia%2C%20and%20Southeast%20Asia%20with%20Adapted%20PlugX%20Infection%20Chain&en=page_view&_fv=1&_nsi=1&_ss=1&tfd=788
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-MHTMF48BZH&l=dataLayer&cx=c&gtm=45He5190v830966511za200
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:136:0
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:136:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://www.recordedfuture.com
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 10 Jan 2025 17:12:45 GMT
content-type: text/plain
server: Golfe2

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
559 B 65ms
21ms Ping
text/plain 2a00:1450:400c:c0a::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-MHTMF48BZH&cid=1545615323.1736529166&gtm=45je5190v873499763z8830966511za200zb830966511&aip=1&dma=1&dma_cps=syphamo&gcd=13l3l3l2l1l1&npa=1&frm=0&tag_exp=101925629~102067555~102067808~102081485~102198178
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-MHTMF48BZH&l=dataLayer&cx=c&gtm=45He5190v830966511za200
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:400c:c0a::9a Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:111:0
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:111:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://www.recordedfuture.com
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 10 Jan 2025 17:12:45 GMT
content-type: text/plain
server: Golfe2

GET
H3 200 ga-audiences
www.google.de/ads/ 42 B
63 B 64ms
41ms Image
image/gif 172.217.23.99
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-MHTMF48BZH&cid=1545615323.1736529166&gtm=45je5190v873499763z8830966511za200zb830966511&aip=1&dma=1&dma_cps=syphamo&gcd=13l3l3l2l1l1&npa=1&frm=0&tag_exp=101925629~102067555~102067808~102081485~102198178&tag_exp=101925629~102067555~102067808~102081485~102198178&z=707906230

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.23.99 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

mil04s23-in-f99.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Fri, 10 Jan 2025 17:12:45 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

POST
H2 204 matomo.php
recordedfuture.matomo.cloud/ 0
179 B 78ms
48ms Ping
text/plain 18.195.235.189
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://recordedfuture.matomo.cloud/matomo.php?action_name=www.recordedfuture.com%2FChinese%20State-Sponsored%20RedDelta%20Targeted%20Taiwan%2C%20Mongolia%2C%20and%20Southeast%20Asia%20with%20Adapted%20PlugX%20Infection%20Chain&idsite=1&rec=1&r=102285&h=18&m=12&s=45&url=https%3A%2F%2Fwww.recordedfuture.com%2Fresearch%2Freddelta-chinese-state-sponsored-group-targets-mongolia-taiwan-southeast-asia&_id=&_idn=1&send_image=0&_refts=0&pv_id=Pwry4v&pf_net=31&pf_srv=251&pf_tfr=119&pf_dm1=117&pf_dm2=73&pf_onl=0&uadata=%7B%22formFactors%22%3A%5B%5D%2C%22fullVersionList%22%3A%5B%5D%2C%22mobile%22%3Afalse%2C%22model%22%3A%22%22%2C%22platform%22%3A%22%22%2C%22platformVersion%22%3A%22%22%7D&pdf=1&qt=0&realp=0&wma=0&fla=0&java=0&ag=0&cookie=1&res=1600x1200

Requested by

Host: cdn.matomo.cloud
URL: https://cdn.matomo.cloud/recordedfuture.matomo.cloud/matomo.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.195.235.189 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-195-235-189.eu-central-1.compute.amazonaws.com

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=utf-8
Referer

Response headers

strict-transport-security: max-age=31536000
access-control-allow-origin: https://www.recordedfuture.com
date: Fri, 10 Jan 2025 17:12:45 GMT
vary: X-Forwarded-Proto,User-Agent
server: Apache
access-control-allow-credentials: true

GET
H2 200 attribution_trigger Show response
px.ads.linkedin.com/ 2 B
815 B 240ms
188ms XHR
application/json 2620:1ec:21::14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://px.ads.linkedin.com/attribution_trigger?pid=3869953%2C26800&time=1736529165878&url=https%3A%2F%2Fwww.recordedfuture.com%2Fresearch%2Freddelta-chinese-state-sponsored-group-targets-mongolia-taiwan-southeast-asia&tm=gtmv2
Requested by: Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.old.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Accept: *
Referer

Response headers

x-li-pop: afd-prod-lor1-x
content-encoding: gzip
x-fs-uuid: 00062b5d341535ca980afba6d0f2b02d
x-msedge-ref: Ref A: 0423A853FC7940AD9ADDB4F9DA8E37D4 Ref B: DUS30EDGE0418 Ref C: 2025-01-10T17:12:45Z
x-li-fabric: prod-lor1
x-restli-protocol-version: 1.0.0
access-control-allow-methods: GET, OPTIONS
x-li-uuid: AAYrXTQVNcqYCvum0PKwLQ==
x-li-proto: http/2
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
date: Fri, 10 Jan 2025 17:12:45 GMT
content-type: application/json
access-control-allow-headers: *

GET
H2

200

collect
px4.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=3869953%2C26800&time=1736529165878&url=https%3A%2F%2Fwww.recordedfuture.com%2Fresearch%2Freddelta-chinese-state-sponsored-group-targets-mongolia-t...
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=3869953%2C26800&time=1736529165878&url=https%3A%2F%2Fwww.recordedfuture.com%2Fresearch%2Freddelta-chinese-state-sponsored-group-targets-mongolia-...

0
267 B

221ms
156ms

Image
application/javascript

13.107.42.14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=3869953%2C26800&time=1736529165878&url=https%3A%2F%2Fwww.recordedfuture.com%2Fresearch%2Freddelta-chinese-state-sponsored-group-targets-mongolia-taiwan-southeast-asia&tm=gtmv2&e_ipv6=AQKVV7y1x9fXyQAAAZRRND69Ms_-qSXXuYu5MKhgAupAgCYsDVGBIHPWjBHwU4L3wyDNQkDxOQ
Protocol: H2
Server: 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

linkedin-action: 1
x-li-pop: afd-prod-ltx1-x
x-msedge-ref: Ref A: 3DCFC6D3CC994FA5BDA8C5D33EB66C59 Ref B: FRAEDGE1422 Ref C: 2025-01-10T17:12:46Z
x-li-fabric: prod-ltx1
x-li-uuid: AAYrXTQYUTYWjyjyYDRYdw==
x-li-proto: http/2
x-cache: CONFIG_NOCACHE
content-length: 0
date: Fri, 10 Jan 2025 17:12:45 GMT
content-type: application/javascript

Redirect headers

linkedin-action: 1
x-li-pop: afd-prod-ltx1-x
nel: {"report_to":"network-errors","max_age":1296000,"success_fraction":0.00066,"failure_fraction":1,"include_subdomains":true}
location: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=3869953%2C26800&time=1736529165878&url=https%3A%2F%2Fwww.recordedfuture.com%2Fresearch%2Freddelta-chinese-state-sponsored-group-targets-mongolia-taiwan-southeast-asia&tm=gtmv2&e_ipv6=AQKVV7y1x9fXyQAAAZRRND69Ms_-qSXXuYu5MKhgAupAgCYsDVGBIHPWjBHwU4L3wyDNQkDxOQ
x-msedge-ref: Ref A: 47B66342175E443AAD46E2BB203A83CF Ref B: DUS30EDGE0917 Ref C: 2025-01-10T17:12:45Z
x-li-fabric: prod-ltx1
report-to: {"group":"network-errors","max_age":2592000,"endpoints":[{"url":"https://www.linkedin.com/li/rep"}],"include_subdomains":true}
x-li-uuid: AAYrXTQU8ezbLE4fBfGLKw==
x-li-proto: http/2
x-cache: CONFIG_NOCACHE
content-length: 0
date: Fri, 10 Jan 2025 17:12:45 GMT

GET
H2 200 configs.php Show response
recordedfuture.matomo.cloud/plugins/HeatmapSessionRecording/ 116 B
297 B 25ms
21ms Script
application/javascript 18.195.235.189
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://recordedfuture.matomo.cloud/plugins/HeatmapSessionRecording/configs.php?idsite=1&trackerid=5XxUQa&url=https%3A%2F%2Fwww.recordedfuture.com%2Fresearch%2Freddelta-chinese-state-sponsored-group-targets-mongolia-taiwan-southeast-asia

Requested by

Host: cdn.matomo.cloud
URL: https://cdn.matomo.cloud/recordedfuture.matomo.cloud/matomo.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.195.235.189 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-195-235-189.eu-central-1.compute.amazonaws.com

Software

Apache /

Resource Hash

17a2a974d4350d0257e82a4f5303dc46f1f1b4d48cc1208f36369c51286212f1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

strict-transport-security: max-age=31536000
content-length: 119
content-encoding: gzip
date: Fri, 10 Jan 2025 17:12:45 GMT
content-type: application/javascript
vary: X-Forwarded-Proto,Accept-Encoding,User-Agent
server: Apache

OPTIONS
H/1.1 204
No Content send
data.hockeystack.com/ Frame 0
0 38ms
11ms Preflight 18.196.170.251
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://data.hockeystack.com/send

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

18.196.170.251 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-196-170-251.eu-central-1.compute.amazonaws.com

Software

nginx/1.24.0 /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://www.recordedfuture.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: content-type
Access-Control-Allow-Methods: GET,HEAD,PUT,PATCH,POST,DELETE
Access-Control-Allow-Origin: https://www.recordedfuture.com
Access-Control-Max-Age: 3600
Connection: keep-alive
Content-Length: 0
Date: Fri, 10 Jan 2025 17:12:45 GMT
Server: nginx/1.24.0
Strict-Transport-Security: max-age=15552000; includeSubDomains
Vary: Origin, Access-Control-Request-Headers
X-Content-Type-Options: nosniff
X-DNS-Prefetch-Control: off
X-Download-Options: noopen
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block

POST
H/1.1 200
OK send
data.hockeystack.com/ 16 B
558 B 30ms
11ms Ping
application/json 18.196.170.251
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://data.hockeystack.com/send

Requested by

Host: cdn.jsdelivr.net
URL: https://cdn.jsdelivr.net/npm/hockeystack@latest/hockeystack.min.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

18.196.170.251 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-196-170-251.eu-central-1.compute.amazonaws.com

Software

nginx/1.24.0 /

Resource Hash

c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type: application/json
Referer

Response headers

Strict-Transport-Security: max-age=15552000; includeSubDomains
X-DNS-Prefetch-Control: off
ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA"
Connection: keep-alive
Access-Control-Allow-Credentials: true
X-Content-Type-Options: nosniff
X-Download-Options: noopen
Access-Control-Allow-Origin: https://www.recordedfuture.com
Content-Length: 16
Date: Fri, 10 Jan 2025 17:12:45 GMT
X-XSS-Protection: 1; mode=block
Content-Type: application/json; charset=utf-8
Vary: Origin
Server: nginx/1.24.0
X-Frame-Options: SAMEORIGIN

GET
H2 200 research_floating_cta_white_d4f9576297.png
cms.recordedfuture.com/uploads/format_webp/ 4 KB
4 KB 23ms
23ms Image
image/webp 172.64.152.166
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cms.recordedfuture.com/uploads/format_webp/research_floating_cta_white_d4f9576297.png?w=640

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.64.152.166 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5815e8873da3e2b96619cc25b5e64ac1c7d55ccaee936e3a8db0ec78a20a65c1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

cf-cache-status: HIT
etag: "e28-PXUcWPXT1NTNbYB3MVR1Ug72qm0"
age: 159
x-content-type-options: nosniff
traceresponse: 00-18161dce79c76769bfdd6557d88c8dce-d9f4ca490a459a8a-01
date: Fri, 10 Jan 2025 17:12:45 GMT
content-type: image/webp
last-modified: 1735567103654
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: max-age=300, public, s-maxage=300
x-debug-info: eyJyZXRyaWVzIjowfQ==
cf-ray: 8ffe4b374dfc18c5-FRA
x-platform-server: i-be21b5795622437d8136c8a0cedbd8d0, i-be21b5795622437d8136c8a0cedbd8d0
accept-ranges: bytes
content-length: 3624
server: cloudflare

GET
H2 200 6si.min.js Show response
j.6sc.co/ 69 KB
19 KB 14ms
14ms Script
application/javascript 2.20.245.211
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to

Full URL

https://j.6sc.co/6si.min.js

Requested by

Host: j.6sc.co
URL: https://j.6sc.co/j/64dc3ec5-330c-4652-88d3-147ee65e90ba.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.20.245.211 , Netherlands, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a2-20-245-211.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

420b8db005b9223c5e1d9ba4140abc2356eac8069735ad8c870fcc8313828de4

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

cache-control: private, proxy-revalidate, max-age=10800
content-encoding: gzip
etag: "6763d3a0-115be"
x-content-type-options: nosniff
expires: Fri, 10 Jan 2025 20:12:46 GMT
accept-ranges: bytes
content-length: 19249
date: Fri, 10 Jan 2025 17:12:46 GMT
content-type: application/javascript
vary: Accept-Encoding
server: nginx/1.14.0 (Ubuntu)
last-modified: Thu, 19 Dec 2024 08:04:48 GMT

GET
H2 200 web-interactives-embed.js Show response
js.hubspot.com/ 84 KB
25 KB 150ms
121ms Script
application/javascript 2606:4700::6810:7574
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js.hubspot.com/web-interactives-embed.js

Requested by

Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/252628.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7574 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a380a9a7fc676bef053e1f3716b212719e3dd4ced09cf58bd961f8903908bbaa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://www.recordedfuture.com
Referer

Response headers

x-request-id: 70d23169-3595-4c73-96ed-c8a2e3832012
content-encoding: gzip
cf-cache-status: EXPIRED
x-amz-version-id: veS.SEia_QBkSUiCuPQ0GehGSVt5V.RX
etag: W/"e731b6707eb6368e593abb6df789d598"
cache-tag: staticjsapp-web-interactives-embed-web-prod,staticjsapp-prod
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=46%2F7a3lxhaANTPkrh%2Br6FFlOvElUHd7MspX21H3xorz6jk2JNI6ikCHU1hAUS9v6yKdqK%2FTgZ4Z1rqKuA7H7hnVJDwPnL063LNqTaMOc%2BvsuXUG%2FFFf0nVQsoecPKRfXog22G9pE9cax8Fnv"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
x-cache: Hit from cloudfront
x-evy-trace-listener: listener_https
x-amz-cf-id: yw2g_k48HaduG3xrxiE80V4I_JrSKpImpYv-rYXImKv0jAorrpWpuQ==
x-hubspot-correlation-id: 70d23169-3595-4c73-96ed-c8a2e3832012
content-type: application/javascript; charset=utf-8
last-modified: Fri, 10 Jan 2025 11:59:29 UTC
x-amz-replication-status: COMPLETED
x-evy-trace-route-service-name: envoyset-translator
cache-control: max-age=600
x-evy-trace-served-by-pod: iad02/app-td/envoy-proxy-856d8787d5-qg7nx
x-envoy-upstream-service-time: 8
x-hs-target-asset: web-interactives-embed/static-2.2140/bundles/project.js
server: cloudflare
x-evy-trace-virtual-host: all
x-amz-server-side-encryption: AES256
access-control-max-age: 3000
access-control-allow-methods: GET
x-hs-cache-status: MISS
date: Fri, 10 Jan 2025 17:12:46 GMT
vary: Origin,Access-Control-Request-Headers,Access-Control-Request-Method,accept-encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
content-security-policy-report-only: frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=web-interactives-embed/static-2.2140/bundles/project.js&cfRay=8ffe4b386a322c01-FRA
via: 1.1 f01dafb3bec9893b47152910d47900a4.cloudfront.net (CloudFront)
cf-ray: 8ffe4b386a322c01-FRA
access-control-allow-origin: *
x-evy-trace-route-configuration: listener_https/all
x-amz-cf-pop: IAD12-P3

GET
H2 200 252628.js Show response
js.hs-analytics.net/analytics/1736529000000/ 69 KB
25 KB 53ms
29ms Script
text/javascript 2606:4700::6810:a0a8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hs-analytics.net/analytics/1736529000000/252628.js
Requested by: Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/252628.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:a0a8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 46b7363d841e5b4ef5addfd1b4040c8db631bc2e62903502afee0053012baf74

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

x-amz-server-side-encryption: AES256
x-request-id: 8ca3899c-8ba5-4209-9f4e-10f53d116b90
content-encoding: gzip
cf-cache-status: HIT
etag: W/"2d25bc9bf49f3ea3dd34254a176f08a5"
x-amz-version-id: null
age: 16
expires: Fri, 10 Jan 2025 17:15:36 GMT
x-evy-trace-listener: listener_https
date: Fri, 10 Jan 2025 17:12:46 GMT
x-hubspot-correlation-id: 8ca3899c-8ba5-4209-9f4e-10f53d116b90
content-type: text/javascript
last-modified: Tue, 22 Oct 2024 20:38:13 GMT
vary: origin, Accept-Encoding
x-amz-id-2: l4D6KiX33ugMkYnh+EH+IOR/76dDRCVpdJAgj3ox3UxHk/R7slqHcZEB0mc7K1b2T3slXfB/8jU=
x-evy-trace-route-service-name: envoyset-translator
cache-control: max-age=300,public
x-evy-trace-served-by-pod: iad02/analytics-js-proxy-td/envoy-proxy-8586d94f84-dwvmr
x-envoy-upstream-service-time: 21
access-control-allow-credentials: false
x-amz-request-id: VTTGWKV776M9G6E1
cf-ray: 8ffe4b386bbd1bdb-FRA
x-evy-trace-route-configuration: listener_https/all
server: cloudflare
x-evy-trace-virtual-host: all

GET
H2 200 collectedforms.js Show response
js.hscollectedforms.net/ 70 KB
25 KB 45ms
19ms Script
application/javascript 2606:4700::6810:6ffe
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js.hscollectedforms.net/collectedforms.js

Requested by

Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/252628.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:6ffe , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e66dfbcc8ba7cd3624126a2d8825bd6216fe0202af9d9f750ab7b02e6ca8fc44

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://www.recordedfuture.com
Referer

Response headers

x-request-id: a090a9bf-229a-4ac7-954d-328cb46767cc
content-encoding: gzip
cf-cache-status: HIT
x-amz-version-id: uvrInopjoN5gevNwHh934Ck4iPjUIIdV
etag: W/"cce97ce600e1081dce3e5e7b5bc08d18"
age: 555
cache-tag: staticjsapp-collected-forms-embed-js-web-prod,staticjsapp-prod
x-content-type-options: nosniff
x-cache: Hit from cloudfront
x-evy-trace-listener: listener_https
x-amz-cf-id: vOUpb9_I-AhgkoFcQ2mKe8t1jLVOBdrgcsC24AUdX1kNv7_oBl-9tw==
x-hubspot-correlation-id: a090a9bf-229a-4ac7-954d-328cb46767cc
content-type: application/javascript; charset=utf-8
last-modified: Tue, 07 Jan 2025 09:36:44 UTC
x-amz-replication-status: COMPLETED
x-evy-trace-route-service-name: envoyset-translator
cache-control: s-maxage=600, max-age=300
x-evy-trace-served-by-pod: iad02/app-td/envoy-proxy-856d8787d5-9vk2x
x-envoy-upstream-service-time: 5
x-hs-target-asset: collected-forms-embed-js/static-1.1283/bundles/project.js
server: cloudflare
x-evy-trace-virtual-host: all
x-amz-server-side-encryption: AES256
access-control-max-age: 3000
access-control-allow-methods: GET
x-hs-cache-status: MISS
date: Fri, 10 Jan 2025 17:12:46 GMT
vary: Origin,Access-Control-Request-Headers,Access-Control-Request-Method,accept-encoding
content-security-policy-report-only: frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=collected-forms-embed-js/static-1.1283/bundles/project.js&cfRay=8ffe3dabddbcbafd-FRA
via: 1.1 bcfffcf7e0fc8cd9cfe4125369a9f036.cloudfront.net (CloudFront)
cf-ray: 8ffe4b386a54d3c2-FRA
access-control-allow-origin: *
x-evy-trace-route-configuration: listener_https/all
x-amz-cf-pop: IAD12-P3

GET
H2 200 leadflows.js Show response
js.hsleadflows.net/ 550 KB
92 KB 47ms
17ms Script
application/javascript 2606:4700::6812:8911
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js.hsleadflows.net/leadflows.js

Requested by

Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/252628.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:8911 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7da57a437a999e2503178063a85ca9557211686f50d7671db0142a2ceb3095d2

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://www.recordedfuture.com
Referer

Response headers

x-request-id: 3cdecf3d-c48a-4cff-9d7a-d3e63b1ac384
content-encoding: gzip
cf-cache-status: HIT
x-amz-version-id: PqQn.3x38ZWRmSYb9J2u1wYA9Etnh36Z
etag: W/"e9829c28fae41e369bd948323746cc37"
cache-tag: staticjsapp-lead-flows-cloudflare-web-prod,staticjsapp-prod
age: 53610
x-content-type-options: nosniff
x-cache: Hit from cloudfront
x-evy-trace-listener: listener_https
x-amz-cf-id: qIH6pFrOBk7l6rXft12lla8F2a2qk5HpVK2G_iyAcGWCrkv8Ia8_AA==
x-hubspot-correlation-id: 3cdecf3d-c48a-4cff-9d7a-d3e63b1ac384
content-type: application/javascript; charset=utf-8
last-modified: Thu, 12 Dec 2024 15:49:15 UTC
x-amz-replication-status: COMPLETED
x-evy-trace-route-service-name: envoyset-translator
cache-control: s-maxage=86400, max-age=0
x-evy-trace-served-by-pod: iad02/app-td/envoy-proxy-856d8787d5-rmctf
x-envoy-upstream-service-time: 10
x-hs-target-asset: lead-flows-js/static-1.2121/bundle/main/lead-flows-release.js
server: cloudflare
x-evy-trace-virtual-host: all
x-amz-server-side-encryption: AES256
access-control-max-age: 3000
access-control-allow-methods: GET
x-hs-cache-status: MISS
date: Fri, 10 Jan 2025 17:12:46 GMT
vary: Origin,Access-Control-Request-Headers,Access-Control-Request-Method,accept-encoding
content-security-policy-report-only: frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=lead-flows-js/static-1.2121/bundle/main/lead-flows-release.js&cfRay=8f171fc1fe61d38a-ARN
via: 1.1 16d910967d343c8da7828222a653755e.cloudfront.net (CloudFront)
cf-ray: 8ffe4b386b925c26-FRA
access-control-allow-origin: *
x-evy-trace-route-configuration: listener_https/all
x-amz-cf-pop: IAD12-P3

GET
H2 200 252628.js Show response
js.hs-banner.com/ 62 KB
19 KB 56ms
26ms Script
text/javascript 2606:4700:4400::ac40:9310
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hs-banner.com/252628.js
Requested by: Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/252628.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::ac40:9310 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: dfb12bb49b914abebe510f3db1d251c4f716a6bc7d756d3cec1e86a3ff5c22d2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

x-evy-trace-virtual-host: all
access-control-max-age: 604800
x-request-id: 1e9f3b4f-d379-4a35-8638-aee9277f415f
access-control-expose-headers: x-last-modified-timestamp, X-HubSpot-NotFound, X-HS-User-Request, Link, Server-Timing
content-encoding: gzip
cf-cache-status: HIT
etag: W/"c52f58bd4ec4f3ccbcb2164c8210fcc7"
x-amz-version-id: GAPviEB0_qVTRwAgcciO.APQcIZeYu3z
age: 15
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
expires: Fri, 10 Jan 2025 17:17:31 GMT
x-evy-trace-listener: listener_https
date: Fri, 10 Jan 2025 17:12:46 GMT
x-hubspot-correlation-id: 1e9f3b4f-d379-4a35-8638-aee9277f415f
content-type: text/javascript; charset=UTF-8
last-modified: Wed, 26 Jun 2024 15:57:47 GMT
vary: origin, Accept-Encoding
x-amz-id-2: Ky/rXUG35/LlioF77jMmOMqAOEjPbadCNkbQTOaLW1YHeNsSWLaiR+f+0ZtO/+Iw6DVRXBZi3QubsYS0Ef2Xtb6U9FKAOERL
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Accept-Charset, Accept-Encoding, X-Override-Internal-Permissions, X-Properties-Source, X-Properties-SourceId, X-Properties-Flag, X-Hubspot-User-Id, X-Hubspot-Trace, X-Hubspot-Callee, X-Hubspot-Offset, X-Hubspot-No-Trace, X-HubSpot-Static-App-Info, X-HubSpot-Messages-Uri, X-HubSpot-Request-Source, X-HubSpot-Request-Reason, Subscription-Billing-Auth-Token, X-App-CSRF, X-Tools-CSRF, Online-Payment-Signing-UUID, X-Source, X-SourceId, X-Origin-UserId, X-Biden-Request-Source, X-HubSpot-CSRF-hubspotapi, X-Force-Cookie-Refresh, X-Force-Cookie-Refresh-No-Cache, X-HS-User-Request, X-Application-Id, X-HS-Referer, X-HubSpot-Correlation-Id
x-evy-trace-route-service-name: envoyset-translator
cache-control: max-age=300,public
timing-allow-origin: *
x-evy-trace-served-by-pod: iad02/analytics-js-proxy-td/envoy-proxy-8586d94f84-742j9
x-envoy-upstream-service-time: 26
access-control-allow-credentials: true
x-amz-request-id: JZD27NFR9Q16FBWF
cf-ray: 8ffe4b386ec437d7-FRA
access-control-allow-origin: https://therecord.media
x-evy-trace-route-configuration: listener_https/all
server: cloudflare
x-amz-server-side-encryption: AES256

GET
H2 200 getuidj Show response
secure.adnxs.com/ 11 B
705 B 61ms
14ms XHR
application/json 185.89.210.141
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/getuidj

Requested by

Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.89.210.141 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

950.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net

Software

nginx/1.23.4 /

Resource Hash

31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

cache-control: no-store, no-cache, private
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 78.159.108.44; 78.159.108.44; 950.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: https://www.recordedfuture.com
an-x-request-uuid: 78350d44-01e1-417f-94fb-cf39f09f554a
content-length: 11
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Fri, 10 Jan 2025 17:12:46 GMT
x-xss-protection: 0
content-type: application/json; charset=utf-8
server: nginx/1.23.4

GET
H/1.1 200
OK / Show response
c.6sc.co/ 7 B
336 B 57ms
8ms XHR
text/html 2.21.65.138
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to

Full URL: https://c.6sc.co/
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2.21.65.138 , Netherlands, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS: a2-21-65-138.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

Access-Control-Max-Age: 86400
Connection: keep-alive
Access-Control-Allow-Credentials: true
Access-Control-Allow-Methods: GET,POST
Access-Control-Allow-Origin: https://www.recordedfuture.com
Content-Length: 7
Date: Fri, 10 Jan 2025 17:12:46 GMT
Content-Type: text/html
Access-Control-Allow-Headers: *

GET
H2 200 / Show response
ipv6.6sc.co/ 21 B
316 B 82ms
14ms XHR
text/html 2a02:26f0:2780:67::217:e394
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to

Full URL: https://ipv6.6sc.co/
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:2780:67::217:e394 , Netherlands, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS
Software: /
Resource Hash: cab5e5b6d7b98d223cafd2ec95a3132238a2b309cceefeb0cf0bc3c3c471f080

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

cache-control: max-age=0, no-cache, no-store
pragma: no-cache
6si-ipv6: 2a00:c98:2f00:20:a::3
expires: Fri, 10 Jan 2025 17:12:46 GMT
server-timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1736529166195_34915476_350016872_11_501_11_14_219";dur=1
access-control-allow-origin: https://www.recordedfuture.com
content-length: 21
date: Fri, 10 Jan 2025 17:12:46 GMT
content-type: text/html
vary: Origin

GET
H2 200 json Show response
forms.hscollectedforms.net/collected-forms/v1/config/ 134 B
641 B 118ms
111ms XHR
application/json 2606:4700::6810:6ffe
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://forms.hscollectedforms.net/collected-forms/v1/config/json?portalId=252628&utk=

Requested by

Host: js.hscollectedforms.net
URL: https://js.hscollectedforms.net/collectedforms.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:6ffe , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a7d394b9daf469f6c4ad62dab48f458ec7006bf90004fe28a06f46c4adb54ee6

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Accept: application/json, text/plain, */*
Referer

Response headers

x-robots-tag: none
access-control-max-age: 180
x-request-id: c5e91c75-c5cb-4f24-8131-e66a8ce90cff
content-encoding: br
cf-cache-status: DYNAMIC
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
x-content-type-options: nosniff
x-evy-trace-listener: listener_https
date: Fri, 10 Jan 2025 17:12:46 GMT
x-hubspot-correlation-id: c5e91c75-c5cb-4f24-8131-e66a8ce90cff
content-type: application/json;charset=utf-8
vary: Accept-Encoding
access-control-allow-headers: *
x-evy-trace-route-service-name: envoyset-translator
cache-control: max-age=0
x-evy-trace-served-by-pod: iad02/app-td/envoy-proxy-856d8787d5-t5rvw
x-envoy-upstream-service-time: 2
cf-ray: 8ffe4b38aae6d3c2-FRA
access-control-allow-origin: https://www.recordedfuture.com
x-evy-trace-route-configuration: listener_https/all
server: cloudflare
x-evy-trace-virtual-host: all

GET
H2 200 __ptq.gif
track.hubspot.com/ 45 B
1 KB 160ms
132ms Image
image/gif 2606:4700::6810:7574
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://track.hubspot.com/__ptq.gif?k=1&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=de-de&bfp=930271884&v=1.1&a=252628&rcu=https%3A%2F%2Fwww.recordedfuture.com%2Fresearch%2Freddelta-chinese-state-sponsored-group-targets-mongolia-taiwan-southeast-asia&pu=https%3A%2F%2Fwww.recordedfuture.com%2Fresearch%2Freddelta-chinese-state-sponsored-group-targets-mongolia-taiwan-southeast-asia&t=Chinese+State-Sponsored+RedDelta+Targeted+Taiwan%2C+Mongolia%2C+and+Southeast+Asia+with+Adapted+PlugX+Infection+Chain&cts=1736529166176&vi=e77843e8990fdd3f9bbd7ee28ea8494d&nc=true&ce=false&cc=0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7574 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

x-robots-tag: none
x-request-id: fc4a4490-b229-44b4-8962-3c8fa3fb5b3c
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GiIOmQRdenmT4nsQ5Rno9xGiLKoWBYhvA8DDVFWdl6N%2BCAbJbq8yTVnR0Gu%2FRCbbSb2Mb5TV33fWY%2Fqw7WP9fvlr6YBcxpdUqggz9gBAsyH36uvsRJ22I37BPdqlCKcPAEYHLS7oVnprmpQtgHWp"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
x-evy-trace-listener: listener_https
p3p: CP="NOI CUR ADM OUR NOR STA NID"
date: Fri, 10 Jan 2025 17:12:46 GMT
x-hubspot-correlation-id: fc4a4490-b229-44b4-8962-3c8fa3fb5b3c
content-type: image/gif
vary: origin, Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-evy-trace-route-service-name: envoyset-translator
cache-control: no-cache, no-store, no-transform
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/analytics-tracking-td/envoy-proxy-c658cb6d4-ktnwt
x-envoy-upstream-service-time: 13
access-control-allow-credentials: false
cf-ray: 8ffe4b38dbc2a01d-FRA
x-evy-trace-route-configuration: listener_https/all
content-length: 45
server: cloudflare
x-evy-trace-virtual-host: all

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
258 B 145ms
101ms Image
image/gif 2.20.245.211
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=f2675e8089b7d209a58fce8ad312f51c&svisitor=null&visitor=c8eac1b0-318f-4652-86cf-3de5bfd30cba&session=171c4910-6efa-4cf9-89e3-49d0a54eb974&event=a_pageload&q=%7B%22pageLoadTime%22%3A%22Fri%2C%2010%20Jan%202025%2017%3A12%3A46%20GMT%22%7D&isIframe=false&m=%7B%22description%22%3A%22Between%20July%202023%20and%20December%202024%2C%20RedDelta%2C%20a%20Chinese%20state-sponsored%20group%2C%20targeted%20Mongolia%2C%20Taiwan%2C%20and%20Southeast%20Asia%20using%20advanced%20spearphishing%20campaigns%20with%20evolving%20infection%20chains%20and%20the%20PlugX%20backdoor.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Chinese%20State-Sponsored%20RedDelta%20Targeted%20Taiwan%2C%20Mongolia%2C%20and%20Southeast%20Asia%20with%20Adapted%20PlugX%20Infection%20Chain%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.recordedfuture.com%2Fresearch%2Freddelta-chinese-state-sponsored-group-targets-mongolia-taiwan-southeast-asia&pageViewId=f0e79ec3-dcd2-4c12-8d7c-3c975a63dfe7&an_uid=0&webTagId=64dc3ec5-330c-4652-88d3-147ee65e90ba&v=1.1.31

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.20.245.211 , Netherlands, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a2-20-245-211.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "60bb2e15-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Fri, 10 Jan 2025 17:12:46 GMT
accept-ranges: bytes
content-length: 43
date: Fri, 10 Jan 2025 17:12:46 GMT
content-type: image/gif
last-modified: Sat, 05 Jun 2021 07:56:05 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 147ms
103ms Image
image/gif 2.20.245.211
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=f2675e8089b7d209a58fce8ad312f51c&svisitor=null&visitor=c8eac1b0-318f-4652-86cf-3de5bfd30cba&session=171c4910-6efa-4cf9-89e3-49d0a54eb974&event=ni%3AasyncSettingsAudit&q=%7B%22settings%22%3A%22%5B%7B%5C%22name%5C%22%3A%5C%22setToken%5C%22%2C%5C%22value%5C%22%3A%5C%22f2675e8089b7d209a58fce8ad312f51c%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Fri%2C%2010%20Jan%202025%2017%3A12%3A46%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22disableCookies%5C%22%2C%5C%22value%5C%22%3A%5C%22false%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Fri%2C%2010%20Jan%202025%2017%3A12%3A46%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setEpsilonKey%5C%22%2C%5C%22value%5C%22%3A%5C%2247c555096cc32557d3e6e7a333d7cb3ea692cee1%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Fri%2C%2010%20Jan%202025%2017%3A12%3A46%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableIPv6Ping%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Fri%2C%2010%20Jan%202025%2017%3A12%3A46%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableIgnorePageUrlHash%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Fri%2C%2010%20Jan%202025%2017%3A12%3A46%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableRetargeting%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Fri%2C%2010%20Jan%202025%2017%3A12%3A46%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setWhiteListFields%5C%22%2C%5C%22value%5C%22%3A%5C%22%5B%5D%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Fri%2C%2010%20Jan%202025%2017%3A12%3A46%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setCustomMetatags%5C%22%2C%5C%22value%5C%22%3A%5C%22%5B%5D%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Fri%2C%2010%20Jan%202025%2017%3A12%3A46%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22storeTagId%5C%22%2C%5C%22value%5C%22%3A%5C%2264dc3ec5-330c-4652-88d3-147ee65e90ba%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Fri%2C%2010%20Jan%202025%2017%3A12%3A46%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableEventTracking%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Fri%2C%2010%20Jan%202025%2017%3A12%3A46%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setCompanyDetailsExpiration%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Fri%2C%2010%20Jan%202025%2017%3A12%3A46%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableMapCookieCapture%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Fri%2C%2010%20Jan%202025%2017%3A12%3A46%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableCompanyDetails%5C%22%2C%5C%22value%5C%22%3A%5C%22%5Btrue%2Cnull%2C3%5D%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Fri%2C%2010%20Jan%202025%2017%3A12%3A46%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%5D%22%7D&isIframe=false&m=%7B%22description%22%3A%22Between%20July%202023%20and%20December%202024%2C%20RedDelta%2C%20a%20Chinese%20state-sponsored%20group%2C%20targeted%20Mongolia%2C%20Taiwan%2C%20and%20Southeast%20Asia%20using%20advanced%20spearphishing%20campaigns%20with%20evolving%20infection%20chains%20and%20the%20PlugX%20backdoor.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Chinese%20State-Sponsored%20RedDelta%20Targeted%20Taiwan%2C%20Mongolia%2C%20and%20Southeast%20Asia%20with%20Adapted%20PlugX%20Infection%20Chain%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.recordedfuture.com%2Fresearch%2Freddelta-chinese-state-sponsored-group-targets-mongolia-taiwan-southeast-asia&pageViewId=f0e79ec3-dcd2-4c12-8d7c-3c975a63dfe7&an_uid=0&webTagId=64dc3ec5-330c-4652-88d3-147ee65e90ba&v=1.1.31

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.20.245.211 , Netherlands, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a2-20-245-211.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "615ccf10-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Fri, 10 Jan 2025 17:12:46 GMT
accept-ranges: bytes
content-length: 43
date: Fri, 10 Jan 2025 17:12:46 GMT
content-type: image/gif
last-modified: Tue, 05 Oct 2021 22:17:52 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 125ms
103ms Image
image/gif 2.20.245.211
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=f2675e8089b7d209a58fce8ad312f51c&svisitor=null&visitor=c8eac1b0-318f-4652-86cf-3de5bfd30cba&session=171c4910-6efa-4cf9-89e3-49d0a54eb974&event=ipv6&q=%7B%22address%22%3A%222a00%3Ac98%3A2f00%3A20%3Aa%3A%3A3%22%7D&isIframe=false&m=%7B%22description%22%3A%22Between%20July%202023%20and%20December%202024%2C%20RedDelta%2C%20a%20Chinese%20state-sponsored%20group%2C%20targeted%20Mongolia%2C%20Taiwan%2C%20and%20Southeast%20Asia%20using%20advanced%20spearphishing%20campaigns%20with%20evolving%20infection%20chains%20and%20the%20PlugX%20backdoor.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Chinese%20State-Sponsored%20RedDelta%20Targeted%20Taiwan%2C%20Mongolia%2C%20and%20Southeast%20Asia%20with%20Adapted%20PlugX%20Infection%20Chain%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.recordedfuture.com%2Fresearch%2Freddelta-chinese-state-sponsored-group-targets-mongolia-taiwan-southeast-asia&pageViewId=f0e79ec3-dcd2-4c12-8d7c-3c975a63dfe7&an_uid=0&webTagId=64dc3ec5-330c-4652-88d3-147ee65e90ba&ipv6=2a00%3Ac98%3A2f00%3A20%3Aa%3A%3A3&v=1.1.31

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.20.245.211 , Netherlands, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a2-20-245-211.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "5e502810-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Fri, 10 Jan 2025 17:12:46 GMT
accept-ranges: bytes
content-length: 43
date: Fri, 10 Jan 2025 17:12:46 GMT
content-type: image/gif
last-modified: Fri, 21 Feb 2020 18:57:20 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H2 200 combinedConfigs Show response
cta-service-cms2.hubspot.com/web-interactives/public/v1/embed/ 61 B
1 KB 145ms
135ms Fetch
application/json 2606:4700::6810:7574
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cta-service-cms2.hubspot.com/web-interactives/public/v1/embed/combinedConfigs?portalId=252628&currentUrl=https%3A%2F%2Fwww.recordedfuture.com%2Fresearch%2Freddelta-chinese-state-sponsored-group-targets-mongolia-taiwan-southeast-asia&utk=e77843e8990fdd3f9bbd7ee28ea8494d&__hstc=57501621.e77843e8990fdd3f9bbd7ee28ea8494d.1736529166175.1736529166175.1736529166175.1&__hssc=57501621.1.1736529166175

Requested by

Host: js.hubspot.com
URL: https://js.hubspot.com/web-interactives-embed.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7574 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

027f9fef93a2d620715de7311a5bf674cb3df18a352d2a0a7266c147c157333f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

x-robots-tag: noindex, follow
access-control-max-age: 180
x-request-id: 103896af-098b-4eb7-92af-a9de5ecf0345
content-encoding: br
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TZn5vGnsz3PXGEE3V%2Fo8wQILD%2FdvjDZbB%2BZr5Xc2PlViqcxTeLPxwCghu4myD4jqhnRm4B%2FjmVLHJoEbBzf%2FrzCKTRPJfosgvun4mf9yAqbm6nzwCna8pNgyN9He32IPO%2BiywsFEwoDcB2keP5%2FBHxa41uq9VTh7OB0%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
access-control-allow-methods: OPTIONS, GET
x-evy-trace-listener: listener_https
date: Fri, 10 Jan 2025 17:12:46 GMT
x-hubspot-correlation-id: 103896af-098b-4eb7-92af-a9de5ecf0345
content-type: application/json;charset=utf-8
vary: origin
access-control-allow-headers: Accept, Accept-Charset, Accept-Encoding, Accept-Language, Content-Type, Host, Origin, Referer, User-Agent
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-evy-trace-route-service-name: envoyset-translator
cache-control: max-age=0, no-cache, no-store
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/star-hubspot-td/envoy-proxy-b967ccf5d-4rwh7
x-envoy-upstream-service-time: 21
access-control-allow-credentials: true
cf-ray: 8ffe4b394abe2c01-FRA
access-control-allow-origin: https://www.recordedfuture.com
x-evy-trace-route-configuration: listener_https/all
server: cloudflare
x-evy-trace-virtual-host: all

POST
H3 200 t
dev.visualwebsiteoptimizer.com/events/ 0
37 B 190ms
189ms Ping
application/javascript 34.107.218.251
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://dev.visualwebsiteoptimizer.com/events/t?en=vwo_syncVisitorProp&a=880669&v=90e8eeca0&_cu=https%3A%2F%2Fwww.recordedfuture.com%2Fresearch%2Freddelta-chinese-state-sponsored-group-targets-mongolia-taiw

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/research/reddelta-chinese-state-sponsored-group-targets-mongolia-taiwan-southeast-asia

Protocol

Security

QUIC, , AES_128_GCM

Server

34.107.218.251 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

251.218.107.34.bc.googleusercontent.com

Software

gnv02c /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
access-control-allow-methods: GET, POST
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 10 Jan 2025 17:12:46 GMT
content-type: application/javascript; charset=UTF-8
server: gnv02c
access-control-allow-headers: X-Device-User-Agent, Vwo-X-Forwarded-For

GET
H2 200 details Show response
epsilon.6sense.com/v3/company/ 760 B
668 B 50ms
33ms XHR
application/json 99.83.231.3
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://epsilon.6sense.com/v3/company/details
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 99.83.231.3 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afe865822f884bb48.awsglobalaccelerator.com
Software: /
Resource Hash: 01dbfcc921d5a74b7b9ac6762a811d03deb96ecedf61f5bc8fb56c25995c34c3

Request headers

Authorization: Token 47c555096cc32557d3e6e7a333d7cb3ea692cee1
X-6s-CustomID: WebTag 64dc3ec5-330c-4652-88d3-147ee65e90ba
Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

access-control-expose-headers: X-6si-Region
timing-allow-origin: https://6sense.com
content-encoding: gzip
x-6si-region
access-control-allow-credentials: true
access-control-allow-origin: https://www.recordedfuture.com
content-length: 404
date: Fri, 10 Jan 2025 17:12:46 GMT
content-type: application/json
vary: Origin, Accept-Encoding

OPTIONS
H2 200 details
epsilon.6sense.com/v3/company/ Frame 0
0 44ms
10ms Preflight 99.83.231.3
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://epsilon.6sense.com/v3/company/details
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 99.83.231.3 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afe865822f884bb48.awsglobalaccelerator.com
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: authorization,x-6s-customid
Access-Control-Request-Method: GET
Origin: https://www.recordedfuture.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: authorization,x-6s-customid
access-control-allow-methods: OPTIONS,GET
access-control-allow-origin: https://www.recordedfuture.com
access-control-expose-headers: X-6si-Region
access-control-max-age: 1800
content-length: 0
date: Fri, 10 Jan 2025 17:12:46 GMT
timing-allow-origin: https://6sense.com
x-6si-region

GET
H2 200 json Show response
forms.hubspot.com/lead-flows-config/v1/config/ 2 KB
2 KB 152ms
144ms XHR
application/json 2606:4700::6810:7574
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://forms.hubspot.com/lead-flows-config/v1/config/json?portalId=252628&utk=e77843e8990fdd3f9bbd7ee28ea8494d&__hstc=57501621.e77843e8990fdd3f9bbd7ee28ea8494d.1736529166175.1736529166175.1736529166175.1&__hssc=57501621.1.1736529166175&currentUrl=https%3A%2F%2Fwww.recordedfuture.com%2Fresearch%2Freddelta-chinese-state-sponsored-group-targets-mongolia-taiwan-southeast-asia

Requested by

Host: js.hsleadflows.net
URL: https://js.hsleadflows.net/leadflows.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7574 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

23c0ce78c2669a29c44b83030e7e2423e410ddedaaba192a050a79a3a1506a3b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

x-robots-tag: none
access-control-max-age: 180
x-request-id: a194332d-ba78-4ed5-ba3f-7265c1225540
content-encoding: gzip
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Ouq56egam8KGuqNQO5dljG4UxdJb%2BEMbWbFmWds4yvJTCnuvlaHlLo5Lao%2Fy%2F1xUVFWV04WJbX7G%2F%2FrEFOxkuKtrFXBPMetMXov4ryo8%2BvrQ%2FTc7ZNIdgFZvf5cnXL%2F%2BqNQ3M1fTvmim5r4rCJKE"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
x-evy-trace-listener: listener_https
date: Fri, 10 Jan 2025 17:12:46 GMT
x-hubspot-correlation-id: a194332d-ba78-4ed5-ba3f-7265c1225540
content-type: application/json;charset=utf-8
vary: origin
access-control-allow-headers: Accept, Accept-Charset, Accept-Encoding, Accept-Language, Content-Type, Host, Origin, Referer, User-Agent
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-evy-trace-route-service-name: envoyset-translator
cache-control: max-age=0, no-cache, no-store
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/star-hubspot-td/envoy-proxy-b967ccf5d-5hjc8
x-envoy-upstream-service-time: 24
access-control-allow-credentials: false
cf-ray: 8ffe4b396ada2c01-FRA
access-control-allow-origin: https://www.recordedfuture.com
x-evy-trace-route-configuration: listener_https/all
content-length: 1084
server: cloudflare
x-evy-trace-virtual-host: all

GET
H2 200 details Show response
eps.6sc.co/v3/company/ 760 B
667 B 26ms
26ms Fetch
application/json 75.2.108.141
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://eps.6sc.co/v3/company/details
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 75.2.108.141 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afe865822f884bb48.awsglobalaccelerator.com
Software: /
Resource Hash: 01dbfcc921d5a74b7b9ac6762a811d03deb96ecedf61f5bc8fb56c25995c34c3

Request headers

Authorization: Token 47c555096cc32557d3e6e7a333d7cb3ea692cee1
X-6s-CustomID: WebTag 64dc3ec5-330c-4652-88d3-147ee65e90ba
EpsilonCookie: null
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

access-control-expose-headers: X-6si-Region
timing-allow-origin: https://6sense.com
content-encoding: gzip
x-6si-region
access-control-allow-credentials: true
access-control-allow-origin: https://www.recordedfuture.com
content-length: 404
date: Fri, 10 Jan 2025 17:12:46 GMT
content-type: application/json
vary: Origin, Accept-Encoding

OPTIONS
H2 200 details
eps.6sc.co/v3/company/ Frame 0
0 44ms
10ms Preflight 75.2.108.141
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://eps.6sc.co/v3/company/details
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 75.2.108.141 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afe865822f884bb48.awsglobalaccelerator.com
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: authorization,epsiloncookie,x-6s-customid
Access-Control-Request-Method: GET
Origin: https://www.recordedfuture.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: authorization,epsiloncookie,x-6s-customid
access-control-allow-methods: OPTIONS,GET
access-control-allow-origin: https://www.recordedfuture.com
access-control-expose-headers: X-6si-Region
access-control-max-age: 1800
content-length: 0
date: Fri, 10 Jan 2025 17:12:46 GMT
timing-allow-origin: https://6sense.com
x-6si-region

OPTIONS
H2 200 v
v.eps.6sc.co/ Frame 0
0 139ms
103ms Preflight
application/json 13.35.58.23
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://v.eps.6sc.co/v
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.35.58.23 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-35-58-23.fra60.r.cloudfront.net
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://www.recordedfuture.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token
access-control-allow-methods: OPTIONS,POST
access-control-allow-origin: *
content-length: 0
content-type: application/json
date: Fri, 10 Jan 2025 17:12:46 GMT
via: 1.1 ebf31a208b1563522327c20ddd946a5c.cloudfront.net (CloudFront)
x-amz-apigw-id: ELo6UHLQIAMEOPA=
x-amz-cf-id: YLRluq5Z8zb5aSWOynnI9_9Rj52AmVT3uMgt9urOIxbK8XmG82h0OA==
x-amz-cf-pop: FRA60-P10
x-amzn-requestid: c94f237a-ac09-49ab-966d-0773d30c0418
x-cache: Miss from cloudfront

POST
H2 200 v Show response
v.eps.6sc.co/ 12 B
521 B 171ms
169ms XHR
application/json 13.35.58.23
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://v.eps.6sc.co/v
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.35.58.23 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-35-58-23.fra60.r.cloudfront.net
Software: /
Resource Hash: 512a4f403d30a587ad5ab0b9fa7b2fd4f078249ee03f9c23c445332838f6a436

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-type: application/json
Referer

Response headers

x-amz-apigw-id: ELo6VHwMoAMESfA=
x-amzn-trace-id: Root=1-6781550e-48cc08f207369a62647cd748;Parent=06404960957da16a;Sampled=0;Lineage=1:56167173:0
access-control-allow-methods: OPTIONS,POST
x-amzn-requestid: 9a15e214-c3b6-450f-b4ce-5cd8456fa157
via: 1.1 ebf31a208b1563522327c20ddd946a5c.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-cache: Miss from cloudfront
content-length: 12
x-amz-cf-id: tITDBT2KOCxRPq7J5Hac5saSmExLxWxDwlaBKqzuIQIlFE91xCpZHg==
date: Fri, 10 Jan 2025 17:12:46 GMT
content-type: application/json
x-amz-cf-pop: FRA60-P10
access-control-allow-headers: Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 102ms
101ms Image
image/gif 2.20.245.211
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to Show image

Full URL

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.20.245.211 , Netherlands, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a2-20-245-211.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "63f020a0-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Fri, 10 Jan 2025 17:12:46 GMT
accept-ranges: bytes
content-length: 43
date: Fri, 10 Jan 2025 17:12:46 GMT
content-type: image/gif
last-modified: Sat, 18 Feb 2023 00:49:36 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H3 200 counters.gif
perf-na1.hsforms.com/embed/v3/ 35 B
958 B 167ms
149ms Image
image/gif 104.19.175.188
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://perf-na1.hsforms.com/embed/v3/counters.gif?key=config-loaded-success&value=1

Protocol

Security

QUIC, , AES_128_GCM

Server

104.19.175.188 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

x-robots-tag: none
x-request-id: f65eee59-aa79-4796-a43b-c8db0f47a2d2
access-control-expose-headers: X-Origin-Hublet
cf-cache-status: MISS
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
x-evy-trace-listener: listener_https
server-timing: cfExtPri
date: Fri, 10 Jan 2025 17:12:46 GMT
x-hubspot-correlation-id: f65eee59-aa79-4796-a43b-c8db0f47a2d2
content-type: image/gif
vary: origin, Accept-Encoding
last-modified: Fri, 10 Jan 2025 17:12:46 GMT
priority: u=3,i
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-evy-trace-route-service-name: envoyset-translator
cache-control: max-age=0, no-cache, no-store
x-evy-trace-served-by-pod: iad02/star-hubspot-td/envoy-proxy-b967ccf5d-8z78f
x-envoy-upstream-service-time: 2
access-control-allow-credentials: false
cf-ray: 8ffe4b3a4f47d398-FRA
accept-ranges: bytes
x-evy-trace-route-configuration: listener_https/all
content-length: 35
server: cloudflare
x-evy-trace-virtual-host: all

GET
H2 200 __ptq.gif
track.hubspot.com/ 45 B
441 B 143ms
143ms Image
image/gif 2606:4700::6810:7574
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://track.hubspot.com/__ptq.gif?k=16&fi=e887dce6-7b34-4ba5-9eac-4d2ca9a2983c&lfi=2694383&ft=1&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=de-de&bfp=930271884&v=1.1&a=252628&rcu=https%3A%2F%2Fwww.recordedfuture.com%2Fresearch%2Freddelta-chinese-state-sponsored-group-targets-mongolia-taiwan-southeast-asia&pu=https%3A%2F%2Fwww.recordedfuture.com%2Fresearch%2Freddelta-chinese-state-sponsored-group-targets-mongolia-taiwan-southeast-asia&t=Chinese+State-Sponsored+RedDelta+Targeted+Taiwan%2C+Mongolia%2C+and+Southeast+Asia+with+Adapted+PlugX+Infection+Chain&cts=1736529166450&vi=e77843e8990fdd3f9bbd7ee28ea8494d&nc=true&u=57501621.e77843e8990fdd3f9bbd7ee28ea8494d.1736529166175.1736529166175.1736529166175.1&b=57501621.1.1736529166175&pt=0&cc=15

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7574 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

x-robots-tag: none
x-request-id: 2548ba52-ee3b-4cb1-98c3-d78275d8fc60
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=W05vGzvJyXc5ywoup3ZTjqK7SOJWJI5duf1erBQmDrIx1sbwMT09DC0blxH7TYRxnyfG2gtWowMAlV8gMFbIJk8VdRvLOQ62hroBl%2BAbgTZ7yP224%2Fcqs5i5FB2KZ3Y5CxO%2BHmj%2B7pJ1Pk%2BxfM%2BS"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
x-evy-trace-listener: listener_https
p3p: CP="NOI CUR ADM OUR NOR STA NID"
date: Fri, 10 Jan 2025 17:12:46 GMT
x-hubspot-correlation-id: 2548ba52-ee3b-4cb1-98c3-d78275d8fc60
content-type: image/gif
vary: origin, Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-evy-trace-route-service-name: envoyset-translator
cache-control: no-cache, no-store, no-transform
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/analytics-tracking-td/envoy-proxy-c658cb6d4-4fj5f
x-envoy-upstream-service-time: 25
access-control-allow-credentials: false
cf-ray: 8ffe4b3a5da0a01d-FRA
x-evy-trace-route-configuration: listener_https/all
content-length: 45
server: cloudflare
x-evy-trace-virtual-host: all

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
258 B 102ms
102ms Image
image/gif 2.20.245.211
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=f2675e8089b7d209a58fce8ad312f51c&svisitor=null&visitor=c8eac1b0-318f-4652-86cf-3de5bfd30cba&session=171c4910-6efa-4cf9-89e3-49d0a54eb974&event=ni%3Aepsv&q=%7B%22or%22%3A%22%22%2C%22nr%22%3A%22%22%2C%22orl%22%3A96%2C%22nrl%22%3A72%2C%22ores%22%3A%22%7B%5C%22company%5C%22%3A%7B%5C%22domain%5C%22%3A%5C%22%5C%22%2C%5C%22name%5C%22%3A%5C%22%5C%22%2C%5C%22region%5C%22%3A%5C%22%5C%22%2C%5C%22country%5C%22%3A%5C%22Germany%5C%22%2C%5C%22state%5C%22%3A%5C%22Hesse%5C%22%2C%5C%22city%5C%22%3A%5C%22Frankfurt%20am%20Main%5C%22%2C%5C%22industry%5C%22%3A%5C%22%5C%22%2C%5C%22companyId%5C%22%3A%5C%22%5C%22%2C%5C%22country_iso_code%5C%22%3A%5C%22DE%5C%22%2C%5C%22address%5C%22%3A%5C%22%5C%22%2C%5C%22zip%5C%22%3A%5C%22%5C%22%2C%5C%22phone%5C%22%3A%5C%22%5C%22%2C%5C%22employee_range%5C%22%3A%5C%22%5C%22%2C%5C%22revenue_range%5C%22%3A%5C%22%5C%22%2C%5C%22employee_count%5C%22%3A%5C%22%5C%22%2C%5C%22annual_revenue%5C%22%3A%5C%22%5C%22%2C%5C%22is_blacklisted%5C%22%3Afalse%2C%5C%22state_code%5C%22%3A%5C%22%5C%22%2C%5C%22is_6qa%5C%22%3Afalse%2C%5C%22geoIP_country%5C%22%3A%5C%22Germany%5C%22%2C%5C%22geoIP_state%5C%22%3A%5C%22Hesse%5C%22%2C%5C%22geoIP_city%5C%22%3A%5C%22Frankfurt%20am%20Main%5C%22%2C%5C%22company_match%5C%22%3A%5C%22Non-actionable%20Match%5C%22%2C%5C%22additional_comment%5C%22%3A%5C%22There%20is%20no%20valid%20B2B%20use%20case%20as%20this%20was%20matched%20to%20something%20other%20than%20a%20company%20name%2Fdomain%20(i.e.%20bot%2C%20host%2C%20noisy%20signal%2C%20etc.)%5C%22%2C%5C%22industry_v2%5C%22%3A%5B%5D%2C%5C%22sic%5C%22%3A%5C%22%5C%22%2C%5C%22sic_description%5C%22%3A%5C%22%5C%22%2C%5C%22naics%5C%22%3A%5C%22%5C%22%2C%5C%22naics_description%5C%22%3A%5C%22%5C%22%7D%2C%5C%22scores%5C%22%3A%5B%5D%2C%5C%22segments%5C%22%3A%7B%5C%22ids%5C%22%3A%5B%5D%2C%5C%22names%5C%22%3A%5B%5D%2C%5C%22list%5C%22%3A%5B%5D%7D%2C%5C%22confidence%5C%22%3A%5C%22NA%5C%22%7D%22%2C%22nres%22%3A%22%7B%5C%22company%5C%22%3A%7B%5C%22domain%5C%22%3A%5C%22%5C%22%2C%5C%22name%5C%22%3A%5C%22%5C%22%2C%5C%22region%5C%22%3A%5C%22%5C%22%2C%5C%22country%5C%22%3A%5C%22Germany%5C%22%2C%5C%22state%5C%22%3A%5C%22Hesse%5C%22%2C%5C%22city%5C%22%3A%5C%22Frankfurt%20am%20Main%5C%22%2C%5C%22industry%5C%22%3A%5C%22%5C%22%2C%5C%22companyId%5C%22%3A%5C%22%5C%22%2C%5C%22country_iso_code%5C%22%3A%5C%22DE%5C%22%2C%5C%22address%5C%22%3A%5C%22%5C%22%2C%5C%22zip%5C%22%3A%5C%22%5C%22%2C%5C%22phone%5C%22%3A%5C%22%5C%22%2C%5C%22employee_range%5C%22%3A%5C%22%5C%22%2C%5C%22revenue_range%5C%22%3A%5C%22%5C%22%2C%5C%22employee_count%5C%22%3A%5C%22%5C%22%2C%5C%22annual_revenue%5C%22%3A%5C%22%5C%22%2C%5C%22is_blacklisted%5C%22%3Afalse%2C%5C%22state_code%5C%22%3A%5C%22%5C%22%2C%5C%22is_6qa%5C%22%3Afalse%2C%5C%22geoIP_country%5C%22%3A%5C%22Germany%5C%22%2C%5C%22geoIP_state%5C%22%3A%5C%22Hesse%5C%22%2C%5C%22geoIP_city%5C%22%3A%5C%22Frankfurt%20am%20Main%5C%22%2C%5C%22company_match%5C%22%3A%5C%22Non-actionable%20Match%5C%22%2C%5C%22additional_comment%5C%22%3A%5C%22There%20is%20no%20valid%20B2B%20use%20case%20as%20this%20was%20matched%20to%20something%20other%20than%20a%20company%20name%2Fdomain%20(i.e.%20bot%2C%20host%2C%20noisy%20signal%2C%20etc.)%5C%22%2C%5C%22industry_v2%5C%22%3A%5B%5D%2C%5C%22sic%5C%22%3A%5C%22%5C%22%2C%5C%22sic_description%5C%22%3A%5C%22%5C%22%2C%5C%22naics%5C%22%3A%5C%22%5C%22%2C%5C%22naics_description%5C%22%3A%5C%22%5C%22%7D%2C%5C%22scores%5C%22%3A%5B%5D%2C%5C%22segments%5C%22%3A%7B%5C%22ids%5C%22%3A%5B%5D%2C%5C%22names%5C%22%3A%5B%5D%2C%5C%22list%5C%22%3A%5B%5D%7D%2C%5C%22confidence%5C%22%3A%5C%22NA%5C%22%7D%22%2C%22match%22%3Atrue%7D&isIframe=false&m=%7B%22description%22%3A%22Between%20July%202023%20and%20December%202024%2C%20RedDelta%2C%20a%20Chinese%20state-sponsored%20group%2C%20targeted%20Mongolia%2C%20Taiwan%2C%20and%20Southeast%20Asia%20using%20advanced%20spearphishing%20campaigns%20with%20evolving%20infection%20chains%20and%20the%20PlugX%20backdoor.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Chinese%20State-Sponsored%20RedDelta%20Targeted%20Taiwan%2C%20Mongolia%2C%20and%20Southeast%20Asia%20with%20Adapted%20PlugX%20Infection%20Chain%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.recordedfuture.com%2Fresearch%2Freddelta-chinese-state-sponsored-group-targets-mongolia-taiwan-southeast-asia&pageViewId=f0e79ec3-dcd2-4c12-8d7c-3c975a63dfe7&an_uid=0&webTagId=64dc3ec5-330c-4652-88d3-147ee65e90ba&ipv6=2a00%3Ac98%3A2f00%3A20%3Aa%3A%3A3&v=1.1.31

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.20.245.211 , Netherlands, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a2-20-245-211.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "63f02dad-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Fri, 10 Jan 2025 17:12:46 GMT
accept-ranges: bytes
content-length: 43
date: Fri, 10 Jan 2025 17:12:46 GMT
content-type: image/gif
last-modified: Sat, 18 Feb 2023 01:45:17 GMT
server: nginx/1.14.0 (Ubuntu)

OPTIONS
H2 200 v
v.eps.6sc.co/ Frame 0
0 113ms
112ms Preflight
application/json 13.35.58.23
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://v.eps.6sc.co/v
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.35.58.23 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-35-58-23.fra60.r.cloudfront.net
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://www.recordedfuture.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token
access-control-allow-methods: OPTIONS,POST
access-control-allow-origin: *
content-length: 0
content-type: application/json
date: Fri, 10 Jan 2025 17:12:46 GMT
via: 1.1 ebf31a208b1563522327c20ddd946a5c.cloudfront.net (CloudFront)
x-amz-apigw-id: ELo6VEIoIAMEV-g=
x-amz-cf-id: uZmjpMtBSUtM7YhmWc5acZF4KRErxo8wSeAQ2uipo96uqPUQE1_EuQ==
x-amz-cf-pop: FRA60-P10
x-amzn-requestid: a44e8fca-ee6e-4139-95ae-16b0161ae303
x-cache: Miss from cloudfront

POST
H2 200 v Show response
v.eps.6sc.co/ 12 B
521 B 276ms
275ms XHR
application/json 13.35.58.23
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://v.eps.6sc.co/v
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.35.58.23 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-35-58-23.fra60.r.cloudfront.net
Software: /
Resource Hash: 512a4f403d30a587ad5ab0b9fa7b2fd4f078249ee03f9c23c445332838f6a436

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-type: application/json
Referer

Response headers

x-amz-apigw-id: ELo6WGcRoAMEkRA=
x-amzn-trace-id: Root=1-6781550e-1bc684af4935a6313f3f4059;Parent=136baab5b11ebdf6;Sampled=0;Lineage=1:56167173:0
access-control-allow-methods: OPTIONS,POST
x-amzn-requestid: 8807e902-227e-4544-ae8e-5ddeb0c2bbd6
via: 1.1 ebf31a208b1563522327c20ddd946a5c.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-cache: Miss from cloudfront
content-length: 12
x-amz-cf-id: JXrRYJcKD9HGcRh_PgZXp18IhlpdrfNIVSym1looBT4SlKF9WX51Vw==
date: Fri, 10 Jan 2025 17:12:46 GMT
content-type: application/json
x-amz-cf-pop: FRA60-P10
access-control-allow-headers: Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
258 B 99ms
99ms Image
image/gif 2.20.245.211
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=6sense-temp-analytics&svisitor=null&visitor=c8eac1b0-318f-4652-86cf-3de5bfd30cba&session=171c4910-6efa-4cf9-89e3-49d0a54eb974&event=https%3A%2F%2Feps.6sc.co&q=%7B%22name%22%3A%22https%3A%2F%2Feps.6sc.co%2Fv3%2Fcompany%2Fdetails%22%2C%22entryType%22%3A%22resource%22%2C%22startTime%22%3A1301.8999996185303%2C%22duration%22%3A71.30000019073486%2C%22initiatorType%22%3A%22fetch%22%2C%22deliveryType%22%3A%22%22%2C%22nextHopProtocol%22%3A%22%22%2C%22renderBlockingStatus%22%3A%22non-blocking%22%2C%22workerStart%22%3A0%2C%22redirectStart%22%3A0%2C%22redirectEnd%22%3A0%2C%22fetchStart%22%3A1301.8999996185303%2C%22domainLookupStart%22%3A0%2C%22domainLookupEnd%22%3A0%2C%22connectStart%22%3A0%2C%22secureConnectionStart%22%3A0%2C%22connectEnd%22%3A0%2C%22requestStart%22%3A0%2C%22responseStart%22%3A0%2C%22firstInterimResponseStart%22%3A0%2C%22responseEnd%22%3A1373.1999998092651%2C%22transferSize%22%3A0%2C%22encodedBodySize%22%3A0%2C%22decodedBodySize%22%3A0%2C%22responseStatus%22%3A200%2C%22serverTiming%22%3A%5B%5D%2C%22metadata%22%3A%7B%22region%22%3A%22header-blocked%22%2C%22ores%22%3A%22%7B%5C%22company%5C%22%3A%7B%5C%22domain%5C%22%3A%5C%22%5C%22%2C%5C%22name%5C%22%3A%5C%22%5C%22%2C%5C%22region%5C%22%3A%5C%22%5C%22%2C%5C%22country%5C%22%3A%5C%22Germany%5C%22%2C%5C%22state%5C%22%3A%5C%22Hesse%5C%22%2C%5C%22city%5C%22%3A%5C%22Frankfurt%20am%20Main%5C%22%2C%5C%22industry%5C%22%3A%5C%22%5C%22%2C%5C%22companyId%5C%22%3A%5C%22%5C%22%2C%5C%22country_iso_code%5C%22%3A%5C%22DE%5C%22%2C%5C%22address%5C%22%3A%5C%22%5C%22%2C%5C%22zip%5C%22%3A%5C%22%5C%22%2C%5C%22phone%5C%22%3A%5C%22%5C%22%2C%5C%22employee_range%5C%22%3A%5C%22%5C%22%2C%5C%22revenue_range%5C%22%3A%5C%22%5C%22%2C%5C%22employee_count%5C%22%3A%5C%22%5C%22%2C%5C%22annual_revenue%5C%22%3A%5C%22%5C%22%2C%5C%22is_blacklisted%5C%22%3Afalse%2C%5C%22state_code%5C%22%3A%5C%22%5C%22%2C%5C%22is_6qa%5C%22%3Afalse%2C%5C%22geoIP_country%5C%22%3A%5C%22Germany%5C%22%2C%5C%22geoIP_state%5C%22%3A%5C%22Hesse%5C%22%2C%5C%22geoIP_city%5C%22%3A%5C%22Frankfurt%20am%20Main%5C%22%2C%5C%22company_match%5C%22%3A%5C%22Non-actionable%20Match%5C%22%2C%5C%22additional_comment%5C%22%3A%5C%22There%20is%20no%20valid%20B2B%20use%20case%20as%20this%20was%20matched%20to%20something%20other%20than%20a%20company%20name%2Fdomain%20(i.e.%20bot%2C%20host%2C%20noisy%20signal%2C%20etc.)%5C%22%2C%5C%22industry_v2%5C%22%3A%5B%5D%2C%5C%22sic%5C%22%3A%5C%22%5C%22%2C%5C%22sic_description%5C%22%3A%5C%22%5C%22%2C%5C%22naics%5C%22%3A%5C%22%5C%22%2C%5C%22naics_description%5C%22%3A%5C%22%5C%22%7D%2C%5C%22scores%5C%22%3A%5B%5D%2C%5C%22segments%5C%22%3A%7B%5C%22ids%5C%22%3A%5B%5D%2C%5C%22names%5C%22%3A%5B%5D%2C%5C%22list%5C%22%3A%5B%5D%7D%2C%5C%22confidence%5C%22%3A%5C%22NA%5C%22%7D%22%2C%22nres%22%3A%22%7B%5C%22company%5C%22%3A%7B%5C%22domain%5C%22%3A%5C%22%5C%22%2C%5C%22name%5C%22%3A%5C%22%5C%22%2C%5C%22region%5C%22%3A%5C%22%5C%22%2C%5C%22country%5C%22%3A%5C%22Germany%5C%22%2C%5C%22state%5C%22%3A%5C%22Hesse%5C%22%2C%5C%22city%5C%22%3A%5C%22Frankfurt%20am%20Main%5C%22%2C%5C%22industry%5C%22%3A%5C%22%5C%22%2C%5C%22companyId%5C%22%3A%5C%22%5C%22%2C%5C%22country_iso_code%5C%22%3A%5C%22DE%5C%22%2C%5C%22address%5C%22%3A%5C%22%5C%22%2C%5C%22zip%5C%22%3A%5C%22%5C%22%2C%5C%22phone%5C%22%3A%5C%22%5C%22%2C%5C%22employee_range%5C%22%3A%5C%22%5C%22%2C%5C%22revenue_range%5C%22%3A%5C%22%5C%22%2C%5C%22employee_count%5C%22%3A%5C%22%5C%22%2C%5C%22annual_revenue%5C%22%3A%5C%22%5C%22%2C%5C%22is_blacklisted%5C%22%3Afalse%2C%5C%22state_code%5C%22%3A%5C%22%5C%22%2C%5C%22is_6qa%5C%22%3Afalse%2C%5C%22geoIP_country%5C%22%3A%5C%22Germany%5C%22%2C%5C%22geoIP_state%5C%22%3A%5C%22Hesse%5C%22%2C%5C%22geoIP_city%5C%22%3A%5C%22Frankfurt%20am%20Main%5C%22%2C%5C%22company_match%5C%22%3A%5C%22Non-actionable%20Match%5C%22%2C%5C%22additional_comment%5C%22%3A%5C%22There%20is%20no%20valid%20B2B%20use%20case%20as%20this%20was%20matched%20to%20something%20other%20than%20a%20company%20name%2Fdomain%20(i.e.%20bot%2C%20host%2C%20noisy%20signal%2C%20etc.)%5C%22%2C%5C%22industry_v2%5C%22%3A%5B%5D%2C%5C%22sic%5C%22%3A%5C%22%5C%22%2C%5C%22sic_description%5C%22%3A%5C%22%5C%22%2C%5C%22naics%5C%22%3A%5C%22%5C%22%2C%5C%22naics_description%5C%22%3A%5C%22%5C%22%7D%2C%5C%22scores%5C%22%3A%5B%5D%2C%5C%22segments%5C%22%3A%7B%5C%22ids%5C%22%3A%5B%5D%2C%5C%22names%5C%22%3A%5B%5D%2C%5C%22list%5C%22%3A%5B%5D%7D%2C%5C%22confidence%5C%22%3A%5C%22NA%5C%22%7D%22%7D%7D&isIframe=false&m=%7B%22endpoint%22%3A%22epsilon.6sense.com%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.recordedfuture.com%2Fresearch%2Freddelta-chinese-state-sponsored-group-targets-mongolia-taiwan-southeast-asia&pageViewId=&d=1&v=1.1.31

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.20.245.211 , Netherlands, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a2-20-245-211.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "60bb2e15-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Fri, 10 Jan 2025 17:12:46 GMT
accept-ranges: bytes
content-length: 43
date: Fri, 10 Jan 2025 17:12:46 GMT
content-type: image/gif
last-modified: Sat, 05 Jun 2021 07:56:05 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 102ms
102ms Image
image/gif 2.20.245.211
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=f2675e8089b7d209a58fce8ad312f51c&svisitor=null&visitor=c8eac1b0-318f-4652-86cf-3de5bfd30cba&session=171c4910-6efa-4cf9-89e3-49d0a54eb974&event=active_time_track&q=%7B%22currentTime%22%3A%22Fri%2C%2010%20Jan%202025%2017%3A12%3A47%20GMT%22%2C%22lastTrackTime%22%3A%22Fri%2C%2010%20Jan%202025%2017%3A12%3A46%20GMT%22%2C%22timeSpent%22%3A%221002%22%2C%22totalTimeSpent%22%3A%221002%22%7D&isIframe=false&m=%7B%22description%22%3A%22Between%20July%202023%20and%20December%202024%2C%20RedDelta%2C%20a%20Chinese%20state-sponsored%20group%2C%20targeted%20Mongolia%2C%20Taiwan%2C%20and%20Southeast%20Asia%20using%20advanced%20spearphishing%20campaigns%20with%20evolving%20infection%20chains%20and%20the%20PlugX%20backdoor.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Chinese%20State-Sponsored%20RedDelta%20Targeted%20Taiwan%2C%20Mongolia%2C%20and%20Southeast%20Asia%20with%20Adapted%20PlugX%20Infection%20Chain%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.recordedfuture.com%2Fresearch%2Freddelta-chinese-state-sponsored-group-targets-mongolia-taiwan-southeast-asia&pageViewId=f0e79ec3-dcd2-4c12-8d7c-3c975a63dfe7&an_uid=0&webTagId=64dc3ec5-330c-4652-88d3-147ee65e90ba&ipv6=2a00%3Ac98%3A2f00%3A20%3Aa%3A%3A3&v=1.1.31

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.20.245.211 , Netherlands, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a2-20-245-211.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "615ccf10-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Fri, 10 Jan 2025 17:12:47 GMT
accept-ranges: bytes
content-length: 43
date: Fri, 10 Jan 2025 17:12:47 GMT
content-type: image/gif
last-modified: Tue, 05 Oct 2021 22:17:52 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H3 200 iphone-cd1.jpg
go.recordedfuture.com/hubfs/ 83 KB
85 KB 107ms
40ms Image
image/webp 199.60.103.2
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://go.recordedfuture.com/hubfs/iphone-cd1.jpg

Protocol

Security

QUIC, , AES_128_GCM

Server

199.60.103.2 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare London, LLC, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ab221b9e81a8439634c9f73c15c96457f75d3632fea1f6256fa4833acc6a314a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

x-robots-tag: all
cf-cache-status: HIT
etag: "f5c3d1b581a50e5c3637310137a43f0e"
age: 154222
cache-tag: F-99167145604,P-252628,FLS-ALL
x-amz-version-id: CyJHfLHHqfqm77ShwrX4xZ78eMxn5Xvx
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8LU4FDyk9D9F94JjH1wu85935%2Fx7xrGG6cNIBJWVz3yaICuPnfPuZxSjbW%2BpiD4C7FgxQaOM%2FDsdpDCdo1K6xrSjr25tP0avumQ7FjjS7FxdWGFN4huNG2JWm2tzYKIVvlCXUjoxdA%3D%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
x-cache: RefreshHit from cloudfront
x-amz-cf-id: zg_p7CfvsDuCdoLyBkYyLgsh0O8FeOGm9cuFzsfbnXy9-_ZTjTuebw==
content-type: image/webp
content-disposition: inline; filename="iphone-cd1.webp"
last-modified: Thu, 19 Jan 2023 16:01:07 GMT
priority: u=3,i
x-amz-meta-index-tag: all
x-amz-replication-status: COMPLETED
edge-cache-tag: F-99167145604,P-252628,FLS-ALL
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
server-timing: cfExtPri
x-amz-request-id: M21KXRGZYMEW2ZWB
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
accept-ranges: bytes
x-amz-meta-cache-tag: F-99167145604,P-252628,FLS-ALL
content-length: 85082
x-hs-alternate-content-type: text/plain
server: cloudflare
x-amz-server-side-encryption: AES256
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
cf-bgj: imgq:85,h2pri
access-control-allow-methods: GET
x-amz-storage-class: INTELLIGENT_TIERING
cf-polished: qual=85, origFmt=jpeg, origSize=229013
date: Fri, 10 Jan 2025 17:12:47 GMT
vary: Accept, Accept-Encoding
x-amz-id-2: wdoCCSuVVU+lra7hcmuaQzU7URfkS1ZAP368WHxSasaYPntWo8yBEYOke/3xtVG6YM+y5/eij92DrzXLjDY/myb9GtQ+eiSo
strict-transport-security: max-age=31536000
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
timing-allow-origin: d8fk70yj6xfhx.cloudfront.net
via: 1.1 f2a51982e289d888963f4f93b48c5f22.cloudfront.net (CloudFront)
cf-ray: 8ffe4b4109dd8fd0-FRA
access-control-allow-origin: *
x-amz-cf-pop: FRA60-P7
x-amz-meta-created-unix-time-millis: 1674144065940

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
258 B 103ms
103ms Image
image/gif 2.20.245.211
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to Show image

Full URL

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.20.245.211 , Netherlands, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a2-20-245-211.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "63f02dad-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Fri, 10 Jan 2025 17:12:48 GMT
accept-ranges: bytes
content-length: 43
date: Fri, 10 Jan 2025 17:12:48 GMT
content-type: image/gif
last-modified: Sat, 18 Feb 2023 01:45:17 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
258 B 100ms
100ms Image
image/gif 2.20.245.211
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=f2675e8089b7d209a58fce8ad312f51c&svisitor=null&visitor=c8eac1b0-318f-4652-86cf-3de5bfd30cba&session=171c4910-6efa-4cf9-89e3-49d0a54eb974&event=active_time_track&q=%7B%22currentTime%22%3A%22Fri%2C%2010%20Jan%202025%2017%3A12%3A48%20GMT%22%2C%22lastTrackTime%22%3A%22Fri%2C%2010%20Jan%202025%2017%3A12%3A47%20GMT%22%2C%22timeSpent%22%3A%221000%22%2C%22totalTimeSpent%22%3A%222002%22%7D&isIframe=false&m=%7B%22description%22%3A%22Between%20July%202023%20and%20December%202024%2C%20RedDelta%2C%20a%20Chinese%20state-sponsored%20group%2C%20targeted%20Mongolia%2C%20Taiwan%2C%20and%20Southeast%20Asia%20using%20advanced%20spearphishing%20campaigns%20with%20evolving%20infection%20chains%20and%20the%20PlugX%20backdoor.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Chinese%20State-Sponsored%20RedDelta%20Targeted%20Taiwan%2C%20Mongolia%2C%20and%20Southeast%20Asia%20with%20Adapted%20PlugX%20Infection%20Chain%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.recordedfuture.com%2Fresearch%2Freddelta-chinese-state-sponsored-group-targets-mongolia-taiwan-southeast-asia&pageViewId=f0e79ec3-dcd2-4c12-8d7c-3c975a63dfe7&an_uid=0&webTagId=64dc3ec5-330c-4652-88d3-147ee65e90ba&ipv6=2a00%3Ac98%3A2f00%3A20%3Aa%3A%3A3&v=1.1.31

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.20.245.211 , Netherlands, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a2-20-245-211.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "63f02dad-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Fri, 10 Jan 2025 17:12:48 GMT
accept-ranges: bytes
content-length: 43
date: Fri, 10 Jan 2025 17:12:48 GMT
content-type: image/gif
last-modified: Sat, 18 Feb 2023 01:45:17 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 102ms
101ms Image
image/gif 2.20.245.211
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=f2675e8089b7d209a58fce8ad312f51c&svisitor=null&visitor=c8eac1b0-318f-4652-86cf-3de5bfd30cba&session=171c4910-6efa-4cf9-89e3-49d0a54eb974&event=active_time_track&q=%7B%22currentTime%22%3A%22Fri%2C%2010%20Jan%202025%2017%3A12%3A49%20GMT%22%2C%22lastTrackTime%22%3A%22Fri%2C%2010%20Jan%202025%2017%3A12%3A48%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%223003%22%7D&isIframe=false&m=%7B%22description%22%3A%22Between%20July%202023%20and%20December%202024%2C%20RedDelta%2C%20a%20Chinese%20state-sponsored%20group%2C%20targeted%20Mongolia%2C%20Taiwan%2C%20and%20Southeast%20Asia%20using%20advanced%20spearphishing%20campaigns%20with%20evolving%20infection%20chains%20and%20the%20PlugX%20backdoor.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Chinese%20State-Sponsored%20RedDelta%20Targeted%20Taiwan%2C%20Mongolia%2C%20and%20Southeast%20Asia%20with%20Adapted%20PlugX%20Infection%20Chain%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.recordedfuture.com%2Fresearch%2Freddelta-chinese-state-sponsored-group-targets-mongolia-taiwan-southeast-asia&pageViewId=f0e79ec3-dcd2-4c12-8d7c-3c975a63dfe7&an_uid=0&webTagId=64dc3ec5-330c-4652-88d3-147ee65e90ba&ipv6=2a00%3Ac98%3A2f00%3A20%3Aa%3A%3A3&v=1.1.31

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.20.245.211 , Netherlands, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a2-20-245-211.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "63f020a0-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Fri, 10 Jan 2025 17:12:49 GMT
accept-ranges: bytes
content-length: 43
date: Fri, 10 Jan 2025 17:12:49 GMT
content-type: image/gif
last-modified: Sat, 18 Feb 2023 00:49:36 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 102ms
102ms Image
image/gif 2.20.245.211
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=f2675e8089b7d209a58fce8ad312f51c&svisitor=null&visitor=c8eac1b0-318f-4652-86cf-3de5bfd30cba&session=171c4910-6efa-4cf9-89e3-49d0a54eb974&event=active_time_track&q=%7B%22currentTime%22%3A%22Fri%2C%2010%20Jan%202025%2017%3A12%3A50%20GMT%22%2C%22lastTrackTime%22%3A%22Fri%2C%2010%20Jan%202025%2017%3A12%3A49%20GMT%22%2C%22timeSpent%22%3A%221000%22%2C%22totalTimeSpent%22%3A%224003%22%7D&isIframe=false&m=%7B%22description%22%3A%22Between%20July%202023%20and%20December%202024%2C%20RedDelta%2C%20a%20Chinese%20state-sponsored%20group%2C%20targeted%20Mongolia%2C%20Taiwan%2C%20and%20Southeast%20Asia%20using%20advanced%20spearphishing%20campaigns%20with%20evolving%20infection%20chains%20and%20the%20PlugX%20backdoor.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Chinese%20State-Sponsored%20RedDelta%20Targeted%20Taiwan%2C%20Mongolia%2C%20and%20Southeast%20Asia%20with%20Adapted%20PlugX%20Infection%20Chain%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.recordedfuture.com%2Fresearch%2Freddelta-chinese-state-sponsored-group-targets-mongolia-taiwan-southeast-asia&pageViewId=f0e79ec3-dcd2-4c12-8d7c-3c975a63dfe7&an_uid=0&webTagId=64dc3ec5-330c-4652-88d3-147ee65e90ba&ipv6=2a00%3Ac98%3A2f00%3A20%3Aa%3A%3A3&v=1.1.31

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.20.245.211 , Netherlands, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a2-20-245-211.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "615ccf10-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Fri, 10 Jan 2025 17:12:50 GMT
accept-ranges: bytes
content-length: 43
date: Fri, 10 Jan 2025 17:12:50 GMT
content-type: image/gif
last-modified: Tue, 05 Oct 2021 22:17:52 GMT
server: nginx/1.14.0 (Ubuntu)

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: www.recordedfuture.com
URL: blob:https://www.recordedfuture.com/3ebc9a17-8bce-452c-bed3-b3c885c90d84

Verdicts & Comments Add Verdict or Comment

136 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

46 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.recordedfuture.com/	1969-12-31 23:59:59	Name: _cfuvid Value: nWIbGWJeToHNQkqwLMvEOTmDtCa7ZmyaFzmkBEJRyLg-1736529165259-0.0.1.1-604800000
.recordedfuture.com/	1970-01-21 11:09:11	Name: _vwo_uuid_v2 Value: D31F9B668B2CB018B963D6B30FE2AADA2\|4f49c76a4b77bd49dd7107b3764506be
.recordedfuture.com/	1970-01-21 04:31:45	Name: _gcl_au Value: 1.1.899757820.1736529166
.recordedfuture.com/	1970-01-21 11:08:06	Name: _vwo_uuid Value: D31F9B668B2CB018B963D6B30FE2AADA2
.recordedfuture.com/	1970-01-21 03:05:21	Name: _vwo_ds Value: 3%241736529165%3A98.45184964%3A%3A
.recordedfuture.com/	1970-01-21 02:22:10	Name: _vwo_sn Value: 0%3A1%3A%3A%3A1
.hs-scripts.com/	1970-01-21 02:22:10	Name: __cf_bm Value: coo72nbFCJc4auDCAPITYvm1DusYANPIb9pB5jqeP1s-1736529165-1.0.1.1-e1JMq3.QqEZa_CAP0RYzY4aUvMEKL3H3aZ_sOD6sd1jlsNkM_NE9av0GIDkzADxwXzV08z9Z2d0N_Ay8xlaoCw
.recordedfuture.com/	1970-01-21 04:46:09	Name: _vis_opt_s Value: 1%7C
.recordedfuture.com/	1969-12-31 23:59:59	Name: _vis_opt_test_cookie Value: 1
.recordedfuture.com/	1970-01-21 11:58:09	Name: __utma Value: 93161374.231958658.1736529166.1736529166.1736529166.1
.recordedfuture.com/	1969-12-31 23:59:59	Name: __utmc Value: 93161374
.recordedfuture.com/	1970-01-21 06:44:57	Name: __utmz Value: 93161374.1736529166.1.1.utmcsr=(direct)\|utmccn=(direct)\|utmcmd=(none)
.recordedfuture.com/	1970-01-21 02:22:09	Name: __utmt_sfga Value: 1
.recordedfuture.com/	1970-01-21 02:22:10	Name: __utmb Value: 93161374.1.10.1736529166
.recordedfuture.com/	1970-01-21 04:31:45	Name: _fbp Value: fb.1.1736529165843.2754962265412014
.recordedfuture.com/	1970-01-21 11:58:09	Name: _ga Value: GA1.1.1545615323.1736529166
.t.co/	1970-01-21 11:58:09	Name: muc_ads Value: 54aab684-e717-45cd-af88-faaba2eb106e
.t.co/	1970-01-21 02:22:10	Name: __cf_bm Value: 1c5mZ.4ZQABqMrF8nRm9WjRDqSPhUnVdnnSl3CrzMgQ-1736529165-1.0.1.1-eS9oaGaMlQzmDFwpCARwvXlxIuZhcESrOtVPUd1TSMRyHL2tNLxIPBArvUuCD6T5rbZR_.i.V5HIWoJAxZDjkA
.twitter.com/	1970-01-21 11:58:09	Name: personalization_id Value: "v1_85OQ5y1MRwKND4jICJinGg=="
.linkedin.com/	1970-01-21 11:07:45	Name: bcookie Value: "v=2&7d9358f1-6afc-4b34-8af7-cf937df1952f"
.linkedin.com/	1970-01-21 06:41:21	Name: li_gc Value: MTswOzE3MzY1MjkxNjY7MjswMjFP5RuLXfQFpjk1kImqMCv9LMr48DA4QzHhBGPpXzEkFA==
.linkedin.com/	1970-01-21 02:23:35	Name: lidc Value: "b=TGST03:s=T:r=T:a=T:p=T:g=3400:u=1:x=1:i=1736529166:t=1736615566:v=2:sig=AQGYx4Xg1kR5J_FO4vYXVtV6c1CyJGRk"
.hs-analytics.net/	1970-01-21 02:22:10	Name: __cf_bm Value: orf4D7MHaLwjLwjpgDBwNqNfzDaOheDMCP.OMQQ3QJ8-1736529166-1.0.1.1-sKW97BLQW6dYE07SvAmifjqGfaIXXqJrQXS8VRa3SDfVzSixBT2PEQoFN4zRBBLvilvMa0NWvpmlyA8wF8Cs3Q
.hs-banner.com/	1970-01-21 02:22:10	Name: __cf_bm Value: kNkBaPmJ2ArlsnChauhNgE2dZYFFfFZkIhQRLLS9BDU-1736529166-1.0.1.1-oOhsMv6yMNIi89DT9kYTDu7XPYD1_ubBDPC6_EPNBluuEXOMNs5eRW4f_._WdRTfxy1J3kUOvW60Rqlu8XpunA
.recordedfuture.com/	1970-01-21 06:41:21	Name: __hstc Value: 57501621.e77843e8990fdd3f9bbd7ee28ea8494d.1736529166175.1736529166175.1736529166175.1
.recordedfuture.com/	1970-01-21 06:41:21	Name: hubspotutk Value: e77843e8990fdd3f9bbd7ee28ea8494d
.recordedfuture.com/	1969-12-31 23:59:59	Name: __hssrc Value: 1
.recordedfuture.com/	1970-01-21 02:22:10	Name: __hssc Value: 57501621.1.1736529166175
.adnxs.com/	1970-01-21 11:58:09	Name: receive-cookie-deprecation Value: 1
www.recordedfuture.com/	1970-01-21 02:32:13	Name: _an_uid Value: 0
www.recordedfuture.com/	1970-01-21 11:58:09	Name: _gd_visitor Value: c8eac1b0-318f-4652-86cf-3de5bfd30cba
www.recordedfuture.com/	1970-01-21 02:22:23	Name: _gd_session Value: 171c4910-6efa-4cf9-89e3-49d0a54eb974
.hubspot.com/	1970-01-21 02:22:10	Name: __cf_bm Value: _xpVuK3LgU_36Ra5vmpnhY8LXMk7Sm6Iwj7bcSYsceA-1736529166-1.0.1.1-lvDDVUcPyv0GgPlQRKTQSHyY1EmWGUX.znV1QZaEpUFJX6fnFzso.ozzxmx7WW73UZSUnp3d2YarSb0NKoKRBw
.hubspot.com/	1969-12-31 23:59:59	Name: _cfuvid Value: Il32ZmDjFWEzwW9EDxJLecsKlVXF_r8u9oxiNcbQin4-1736529166334-0.0.1.1-604800000
.recordedfuture.com/	1970-01-21 11:58:09	Name: _ga_MHTMF48BZH Value: GS1.1.1736529165.1.0.1736529166.59.0.0
.hsforms.com/	1970-01-21 02:22:10	Name: __cf_bm Value: uuPPO2_L17gUGFCOFjY0oA6dUwz9HihzWs2lMBXkPZ0-1736529166-1.0.1.1-_MYqR6Ac3AQ4oKRTQEoMqmZO9qNkDRD9wHRIgTpdgDgci6jl5h2OSBPHLZx5jd6x4dL4G.1AWbTaLfBn4t0glA
.hsforms.com/	1969-12-31 23:59:59	Name: _cfuvid Value: Sy2UzvsogLUQ6rp2a5DU4tYGRt1eQS.y8Sve1rovSAs-1736529166581-0.0.1.1-604800000
.go.recordedfuture.com/	1970-01-21 02:22:10	Name: __cf_bm Value: fjZ_LMvIBGU3MCwuSVvtC2mXp4U5N2pIGEwrAjGxhxo-1736529167-1.0.1.1-pI_BOuPiIUidPfXJngyURlr_Zte96TxxXc9bMp1LVuAzfXGI7XJEfTBiNMOiy5YLqQBvza1p6.huBH7qYSNa9w
.go.recordedfuture.com/	1969-12-31 23:59:59	Name: _cfuvid Value: VtWyp1goA6_9zz7vIDQ9nRt52M_qx1RKX7Q8CGOeMV0-1736529167554-0.0.1.1-604800000
.recordedfuture.com/	1970-01-21 02:23:35	Name: source Value: (direct)
.recordedfuture.com/	1970-01-21 02:23:35	Name: medium Value: (none)
.recordedfuture.com/	1970-01-21 02:23:35	Name: content Value: undefined
.recordedfuture.com/	1970-01-21 02:23:35	Name: keyword Value: undefined
.recordedfuture.com/	1970-01-21 02:23:35	Name: campaign Value:
.recordedfuture.com/	1970-01-21 02:23:35	Name: landing_page Value: /research/reddelta-chinese-state-sponsored-group-targets-mongolia-taiwan-southeast-asia
.recordedfuture.com/	1970-01-21 02:23:35	Name: conversion_page Value: /research/reddelta-chinese-state-sponsored-group-targets-mongolia-taiwan-southeast-asia

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
analytics.twitter.com
b.6sc.co
c.6sc.co
cdn.jsdelivr.net
cdn.matomo.cloud
cms.recordedfuture.com
connect.facebook.net
cta-service-cms2.hubspot.com
data.hockeystack.com
dev.visualwebsiteoptimizer.com
eps.6sc.co
epsilon.6sense.com
forms.hscollectedforms.net
forms.hubspot.com
go.recordedfuture.com
ipv6.6sc.co
j.6sc.co
js.hs-analytics.net
js.hs-banner.com
js.hs-scripts.com
js.hscollectedforms.net
js.hsleadflows.net
js.hubspot.com
perf-na1.hsforms.com
px.ads.linkedin.com
px4.ads.linkedin.com
recordedfuture.matomo.cloud
region1.analytics.google.com
secure.adnxs.com
snap.licdn.com
ssl.google-analytics.com
static.ads-twitter.com
stats.g.doubleclick.net
t.co
track.hubspot.com
v.eps.6sc.co
www.facebook.com
www.google.com
www.google.de
www.googletagmanager.com
www.recordedfuture.com
www.recordedfuture.com
104.18.35.90
104.19.175.188
104.244.42.131
13.107.42.14
13.35.58.23
157.240.0.35
157.240.0.6
162.159.140.229
172.217.16.196
172.217.23.99
172.64.152.166
18.195.235.189
18.196.170.251
185.89.210.141
199.232.188.157
199.60.103.2
2.20.245.211
2.21.65.138
2001:4860:4802:34::36
2600:9000:2724:7200:c:7d55:b3c0:93a1
2606:4700:4400::ac40:9310
2606:4700::6810:6ffe
2606:4700::6810:7574
2606:4700::6810:8dd1
2606:4700::6810:a0a8
2606:4700::6812:8911
2620:1ec:21::14
2a00:1450:4001:800::2008
2a00:1450:4001:810::2008
2a00:1450:4001:811::200a
2a00:1450:400c:c0a::9a
2a02:26f0:2780:67::217:e394
2a02:26f0:480:15::213:7e4a
2a04:4e42:600::485
34.107.218.251
75.2.108.141
99.83.231.3
01dbfcc921d5a74b7b9ac6762a811d03deb96ecedf61f5bc8fb56c25995c34c3
027f9fef93a2d620715de7311a5bf674cb3df18a352d2a0a7266c147c157333f
094f4dca90e585eefffb88ef179701edac3997885a315084d30e84cdb1bc70f7
0a556b35758f8a2ade1b662eeec7a45a4739325de831c2eca6cbe1171fbc6bfd
1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f
17a2a974d4350d0257e82a4f5303dc46f1f1b4d48cc1208f36369c51286212f1
1d0ca87959e23cb77cff2f1d7fe2337ecc770de12b1d20762373321d7d287183
2220e0cc6f9de566a5ff786452e781dcfb6c1aa4ca94328c8ae75c576b44f5ff
23c0ce78c2669a29c44b83030e7e2423e410ddedaaba192a050a79a3a1506a3b
2465da93e78c741f53ad8ff10402fa06775a0d485ab4ab1b02c3ea288fc935e1
2ad83f2446566c5ecf7c261cc07884a5d5f71965b5df8fd7bb809f83a42bf470
2d161a2d1638ac0cc482c5ddd3eea0f16516a4fc92b9d3b4924d210ba9117403
31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d
34b343be8def373aec632945ca27ec369551c2b60621e7c675c6ddcd04e16ece
389a4592dcfd22840a86f780fe7447ff7be855847081c1c8dea9d97678a8adaf
3d9ec892dee44ec1c6a5778b93c71fbb4357b8dc8e00ba61eb7baeb6b0af79fa
3e3cef9a429610e8a12f848cc7b810978847ea39e2a04b32f180bd4c6704f0a2
420b8db005b9223c5e1d9ba4140abc2356eac8069735ad8c870fcc8313828de4
43f20d0a51f32376a232ae9fbc41e803d09610000eacfe5b851bc46e191be5ff
44031e9b11597ac12383fa405a32f9a5b116097f6799e03c21f68aee7d3d2a8f
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
4512d280d6e3770022a6aced807c4b08d410ae107294c0ac19801ad24f6ef0f5
46b7363d841e5b4ef5addfd1b4040c8db631bc2e62903502afee0053012baf74
494a9c8817786531126dd245c93f8a85aa6afa405c7b8a2e45b667538470ce7a
4a253015fb11b8985ded9e52df42c512cb4d1e39f1b1db1b25275981f0c1a248
512a4f403d30a587ad5ab0b9fa7b2fd4f078249ee03f9c23c445332838f6a436
5332fd32d8be28eb2531721220e8c3c561000378988be4b4d7f97568f0b3f224
54478b374eaa25070a8f84992537410aea961a1674ff849701805f3d37de2255
54a68362e920c4ab74e9d88c8f8427a25da8c0f99a2de5673f7690c8fad094e2
5691e1b21e44ea59a1fcac3fe2bd257b7d988631efb24427f000ffb8d1d933ff
5815e8873da3e2b96619cc25b5e64ac1c7d55ccaee936e3a8db0ec78a20a65c1
5dd46059902b99d86c42588668824486114180f5e1c385cb504a23e53b2d7bef
66311bd06cf97e2bb2565e7fabc01797a8912ceee0df81a418437d776a48ca1e
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
6fb3140db2839cabd3662044ef7791206df377b2211046abc71dd039f05fe082
72790d4d3fc9b0b8e4cc8ffb2eaf5c951bdb59d7d15ef5100f5211a2b5c372b1
72bece826a96fc5ae7f4064962192011f68e39886373ba04e43bdb0c9a1408a0
755cbb35481713edd37666d18946b70a12f74e5606002e123dc2ff63494ab768
7ab0b19dbf90f7e78c37f36a818cba9edb9249c765e0eb0f1b23b1600c486d4f
7da57a437a999e2503178063a85ca9557211686f50d7671db0142a2ceb3095d2
806ae9b076fe0067b10a12e758bba7bbbce243a2268c8fd35af32d566810fffd
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
83951a1b2b22a4d8348f2fd6dd91d688b4deb5c612944fd74e97745e06fe799e
893ce6443ac8110135c4b1d33a6790667179a5f47ead899631b2751e02d4e89e
8a27dc7b44ebe886390bfa0a9beeea36ea5a3f37479f0e0836b6c9b80d9b35ed
8af77a655a0e1ecfd86c2a3aaf8f3492ed33e1a358be8f4bb0d1794db79aa4fa
9877f9c44cb22bd74ca3a23dd8b56bf8527bdbba3b573cc75c59d80ae6b46eff
9c4316460910afe59a933654686dcc3122b243ba918a241a380a68769e057b92
9e8931d138f1dd892cc6f4ccdee98445ed44a9e2d1ad863205657bc2e686a0e0
a0b1f949528f7a3a2d2ff3b6df67c6c1b5cb8f62a2eba6eb5e06adff2d5795f3
a380a9a7fc676bef053e1f3716b212719e3dd4ced09cf58bd961f8903908bbaa
a7d394b9daf469f6c4ad62dab48f458ec7006bf90004fe28a06f46c4adb54ee6
a8366f9c2c19799e8aeb0f72c2a05d6ba562f746e6a5ef62e840eb47096220b5
aa7b6c81e85551eeb5c4809f1e683efa0b780c33d12ddfc2067a1b136803e45a
ab221b9e81a8439634c9f73c15c96457f75d3632fea1f6256fa4833acc6a314a
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
b11d832b38ef1b449650b550d5d773aa619c7de86392ffd56a3fa9809f909394
b1a5d6fad2f3b9eaca076d0cfd6aa6218720966802543fb73a930c356a670d11
b5eabbfff8be3d18b257dcfddd54c9b5fb428acd77592da29fa11083183c55af
b73b7e0eaffe020cd9d4eaccd4afc57904bba61c4a3423f8640e4a05abf1b7ca
bce8e4b43235576a724383263dcd8789fe2ee5514575b8850d46aa3ceaee0f52
be9a0760ead0430944b67b348f1dad87abbda56524b3d590ad22d5cb6c80ef90
c4353a8c6cb891ab8a68928b47b3e744f4cd6a389d09796c636ec28eaf9f257a
c75f8c06d78926e0624b04af9e6d0fb3339cb4b52ff00034661ca8f0c29d81c4
c8879b289784c2f0e524c601ee26bd458ab9d35a527c22ce582904004e47d018
c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97
c9d27a7e327fea8984b7c447f9c211c15b607f1a63d9bc65c027581e63e3197a
cab5e5b6d7b98d223cafd2ec95a3132238a2b309cceefeb0cf0bc3c3c471f080
cbac1a1ad4c67436e06b1581a6a22ed8d84018452c31bc01727ce6339a35aa15
ce86ab0670d33abde9104deb6f30a98c0ee8ccd0b60d9f2299bfce25836bb253
d4963b8afebfa0063b5d17b4c80f49bce702a37ea5c9b91bb3c996bb9dea4b60
d55373c31bf1034ce674bed98bbfe613f92c66fd38288b50b7b7c583cb7ae272
d5c1854d0d13557f5e447be2808912494bcf1bfaa0a9abeb0b27a444259ca36f
dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
dfb12bb49b914abebe510f3db1d251c4f716a6bc7d756d3cec1e86a3ff5c22d2
e2020cff2cc74d8d6a54922cb130623b298b79a4e2e6c9953d2b5a1e98628127
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e409f15559f814e0d6cd6d062de935a9c1574b2d2413b28145b04850fe2f3a49
e66dfbcc8ba7cd3624126a2d8825bd6216fe0202af9d9f750ab7b02e6ca8fc44
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
ef48d31fa89fc8e074e7fbe3afaab09da2502c259d405625d712594ac4ddcd0e
f036a45770ce2ad43dfee7f4eac8f8b3784608a24ff00c63dd56704434e014e8
f77871a00c20b189f14626019842f538da2f50f1d562c2338c57fbf7355c5010
f8837339f39b4de89bcdc5b4705e44d0007a8728881c70d1010f9973dff06306
fbb0bbb73d6c5781bc3ca5bbc9641e7e4f18a5dcbe37622286219e57bea542f4
fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

www.recordedfuture.com Open in urlscan Pro 172.64.152.166 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

119 Requests

98 %HTTPS

43 %IPv6

28 Domains

42 Subdomains

38 IPs

5 Countries

2458 kBTransfer

7671 kBSize

46 Cookies

31 Outgoing links

Redirected requests

119 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

www.recordedfuture.com Open in urlscan Pro
172.64.152.166 Public Scan

Screenshot
Live screenshot

Full Image

119
Requests

98 %
HTTPS

43 %
IPv6

28
Domains

42
Subdomains

38
IPs

5
Countries

2458 kB
Transfer

7671 kB
Size

46
Cookies

119 HTTP transactions
0 data transactions