therecord.media Open in urlscan Pro
2606:4700:4400::6812:20b5  Public Scan

23 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

81 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
1 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request iran-company-providing-ransomware-infrastructure Show response therecord.media/	54 KB 12 KB	176ms 133ms	Document text/html	2606:4700:4400::6812:20b5 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://therecord.media/iran-company-providing-ransomware-infrastructure Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:4400::6812:20b5 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Next.js Resource Hash bfc675a2fa7daeb85db7791c94251ddd980ba4bb31dc5b8fb191c8bd922b2b69 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers age 0 cache-control s-maxage=60, stale-while-revalidate cf-cache-status DYNAMIC cf-ray 7f02d1b018d31e66-FRA content-encoding br content-type text/html; charset=utf-8 date Wed, 02 Aug 2023 02:16:29 GMT permissions-policy geolocation=(self "https://*.recordedfuture.com/") server cloudflare strict-transport-security max-age=31536000; includeSubDomains traceresponse 00-17775f10572e4924efcd81999d89c2e5-2e0c01045b60cb02-00 vary Accept-Encoding via 1.1 varnish, 1.1 varnish x-cache HIT, HIT x-cache-hits 142, 1 x-debug-info eyJyZXRyaWVzIjowfQ== x-platform-cluster 6l7w2dvltmj6g-production-vohbr3y x-platform-processor xgztqld4evaw2suiwyeszt2fga x-platform-router pzzg6kk2mvryq2jfoxqht4lu3u x-powered-by Next.js x-served-by cache-iad-kiad7000086-IAD, cache-fra-eddf8230029-FRA
GET H2	200	pexels_manuel_geissinger_325229_9d53dcfebb.jpg cms.therecord.media/uploads/	49 KB 49 KB	343ms 324ms	Image image/jpeg	2606:4700:4400::6812:20b5 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://cms.therecord.media/uploads/pexels_manuel_geissinger_325229_9d53dcfebb.jpg?w=1920 Requested by Host: therecord.media URL: https://therecord.media/iran-company-providing-ransomware-infrastructure Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:4400::6812:20b5 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 66c99c9b4330f87780506be75344ec77861c9d12bac1db616bcda9768e79d924 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://therecord.media/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36 Response headers date Wed, 02 Aug 2023 02:16:29 GMT strict-transport-security max-age=31536000; includeSubDomains cf-cache-status DYNAMIC traceresponse 00-17776f5394de7c09f8b24fce8fecce61-9832b7b0ebbbc1ec-00 x-platform-processor yzs7ggztuurocnodlgeyqu6sde content-length 49992 last-modified Tue, 01 Aug 2023 17:27:45 GMT server cloudflare etag "64c94091-c348" vary Accept-Encoding x-platform-cluster r6uchqjqwmfqi-production-vohbr3y content-type image/jpeg cache-control max-age=300 x-debug-info eyJyZXRyaWVzIjowfQ== accept-ranges bytes cf-ray 7f02d1b109c91e66-FRA x-platform-router qk5ll65emgqnxbcwb6fko7g64m expires Wed, 02 Aug 2023 02:21:29 GMT
GET H2	200	DSC_0283_1_a6f4e4e315.jpg cms.therecord.media/uploads/	1 MB 1 MB	343ms 324ms	Image image/jpeg	2606:4700:4400::6812:20b5 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://cms.therecord.media/uploads/DSC_0283_1_a6f4e4e315.jpg?w=1920 Requested by Host: therecord.media URL: https://therecord.media/iran-company-providing-ransomware-infrastructure Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:4400::6812:20b5 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 04c7bd8acf65fb3710235e4be01a7c4d661638f9917c4c56a818fbcc89990fb1 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://therecord.media/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36 Response headers date Wed, 02 Aug 2023 02:16:29 GMT strict-transport-security max-age=31536000; includeSubDomains cf-cache-status DYNAMIC traceresponse 00-17776f5395028f5a117fa8e9e43ddcd3-ca0ff05367331bb2-00 x-platform-processor yzs7ggztuurocnodlgeyqu6sde content-length 1438874 last-modified Wed, 07 Jun 2023 14:35:08 GMT server cloudflare etag "6480959c-15f49a" vary Accept-Encoding x-platform-cluster r6uchqjqwmfqi-production-vohbr3y content-type image/jpeg cache-control max-age=300 x-debug-info eyJyZXRyaWVzIjowfQ== accept-ranges bytes cf-ray 7f02d1b109c51e66-FRA x-platform-router qk5ll65emgqnxbcwb6fko7g64m expires Wed, 02 Aug 2023 02:21:29 GMT
GET H2	200	The_Record_Centered_9b27d79125.svg cms.therecord.media/uploads/	7 KB 3 KB	340ms 322ms	Image image/svg+xml	2606:4700:4400::6812:20b5 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://cms.therecord.media/uploads/The_Record_Centered_9b27d79125.svg?w=1920 Requested by Host: therecord.media URL: https://therecord.media/iran-company-providing-ransomware-infrastructure Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:4400::6812:20b5 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 54c76c41df5975085389626fc4c3920abdc817d033688ab9d9a98a362ad2f2e7 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://therecord.media/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36 Response headers date Wed, 02 Aug 2023 02:16:29 GMT strict-transport-security max-age=31536000; includeSubDomains content-encoding br cf-cache-status DYNAMIC traceresponse 00-17776f5394dd174504b90a8460e7dec3-ac74052efad15818-00 x-platform-processor yzs7ggztuurocnodlgeyqu6sde last-modified Thu, 12 Jan 2023 17:06:51 GMT server cloudflare etag W/"63c03e2b-1c5f" vary Accept-Encoding x-platform-cluster r6uchqjqwmfqi-production-vohbr3y content-type image/svg+xml cache-control max-age=300 x-debug-info eyJyZXRyaWVzIjowfQ== cf-ray 7f02d1b109c81e66-FRA x-platform-router qk5ll65emgqnxbcwb6fko7g64m expires Wed, 02 Aug 2023 02:21:29 GMT
GET H2	200	2bef7a7062791382.css therecord.media/_next/static/css/	55 KB 11 KB	28ms 27ms	Stylesheet text/css	2606:4700:4400::6812:20b5 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://therecord.media/_next/static/css/2bef7a7062791382.css Requested by Host: therecord.media URL: https://therecord.media/iran-company-providing-ransomware-infrastructure Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:4400::6812:20b5 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash f30589d022e5188750a266bf379789ace026df4171a2c22236e9f665c84f0edb Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://therecord.media/iran-company-providing-ransomware-infrastructure User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36 Response headers date Wed, 02 Aug 2023 02:16:29 GMT via 1.1 varnish, 1.1 varnish content-encoding br strict-transport-security max-age=31536000; includeSubDomains cf-cache-status DYNAMIC age 1268602 traceresponse 00-1772ed8a07c4d55056e6c13c17c523a8-bd2d2eaef0e9ef36-00 x-cache HIT, HIT x-platform-processor xgztqld4evaw2suiwyeszt2fga x-served-by cache-iad-kiad7000087-IAD, cache-fra-eddf8230127-FRA last-modified Thu, 13 Jul 2023 07:34:13 GMT server cloudflare etag W/"dd4b-1894e2bfd98" x-platform-cluster 6l7w2dvltmj6g-production-vohbr3y vary Accept-Encoding content-type text/css; charset=UTF-8 cache-control public, max-age=31536000, immutable x-debug-info eyJyZXRyaWVzIjowfQ== permissions-policy geolocation=(self "https://*.recordedfuture.com/") cf-ray 7f02d1b0e99b1e66-FRA x-platform-router pzzg6kk2mvryq2jfoxqht4lu3u x-cache-hits 5757, 3
GET H2	200	ef46db3751d8e999.css therecord.media/_next/static/css/	0 235 B	22ms 22ms	Stylesheet text/css	2606:4700:4400::6812:20b5 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://therecord.media/_next/static/css/ef46db3751d8e999.css Requested by Host: therecord.media URL: https://therecord.media/iran-company-providing-ransomware-infrastructure Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:4400::6812:20b5 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://therecord.media/iran-company-providing-ransomware-infrastructure User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36 Response headers date Wed, 02 Aug 2023 02:16:29 GMT via 1.1 varnish, 1.1 varnish strict-transport-security max-age=31536000; includeSubDomains cf-cache-status DYNAMIC age 938585 traceresponse 00-177419b04f8f0cec640b7b43995cb7f0-0f6a68c3a856c3d3-00 x-cache HIT, HIT x-platform-processor xgztqld4evaw2suiwyeszt2fga content-length 0 x-served-by cache-iad-kiad7000084-IAD, cache-fra-eddf8230049-FRA last-modified Thu, 20 Jul 2023 09:03:56 GMT server cloudflare etag W/"0-189728aa5bc" x-platform-cluster 6l7w2dvltmj6g-production-vohbr3y vary Accept-Encoding content-type text/css; charset=UTF-8 cache-control public, max-age=31536000, immutable x-debug-info eyJyZXRyaWVzIjowfQ== permissions-policy geolocation=(self "https://*.recordedfuture.com/") accept-ranges bytes cf-ray 7f02d1b0e99c1e66-FRA x-platform-router pzzg6kk2mvryq2jfoxqht4lu3u x-cache-hits 3594, 3
GET H2	200	Current_RAAS_48c2646397.png cms.therecord.media/uploads/	57 KB 57 KB	341ms 323ms	Image image/png	2606:4700:4400::6812:20b5 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://cms.therecord.media/uploads/Current_RAAS_48c2646397.png Requested by Host: therecord.media URL: https://therecord.media/iran-company-providing-ransomware-infrastructure Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:4400::6812:20b5 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 0b442e2e6ab2c0e4771864748ed30d50c8741e89fb0dd57c61b88b17a0be2f13 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://therecord.media/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36 Response headers date Wed, 02 Aug 2023 02:16:29 GMT strict-transport-security max-age=31536000; includeSubDomains cf-cache-status DYNAMIC traceresponse 00-17776f5394d8328666f0197d8aa37441-a612b4eedfec89cb-00 x-platform-processor yzs7ggztuurocnodlgeyqu6sde content-length 58062 last-modified Tue, 01 Aug 2023 17:35:14 GMT server cloudflare etag "64c94252-e2ce" vary Accept-Encoding x-platform-cluster r6uchqjqwmfqi-production-vohbr3y content-type image/png cache-control max-age=300 x-debug-info eyJyZXRyaWVzIjowfQ== accept-ranges bytes cf-ray 7f02d1b109c41e66-FRA x-platform-router qk5ll65emgqnxbcwb6fko7g64m expires Wed, 02 Aug 2023 02:21:29 GMT
GET H2	200	rocket-loader.min.js Show response therecord.media/cdn-cgi/scripts/7d0fa10a/cloudflare-static/	12 KB 4 KB	9ms 8ms	Script application/javascript	2606:4700:4400::6812:20b5 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://therecord.media/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js Requested by Host: therecord.media URL: https://therecord.media/iran-company-providing-ransomware-infrastructure Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:4400::6812:20b5 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash ccf00d1923b0131a10e0c6d26f95e5dee6ebf8621a27e83c5a2f68a2e0093142 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY Request headers accept-language de-DE,de;q=0.9 Referer https://therecord.media/iran-company-providing-ransomware-infrastructure User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36 Response headers date Wed, 02 Aug 2023 02:16:29 GMT strict-transport-security max-age=31536000; includeSubDomains x-content-type-options nosniff last-modified Fri, 28 Jul 2023 12:04:41 GMT server cloudflare content-encoding gzip etag W/"64c3aed9-302c" vary Accept-Encoding x-frame-options DENY content-type application/javascript cache-control max-age=172800, public cf-ray 7f02d1b0f99e1e66-FRA expires Fri, 04 Aug 2023 02:16:29 GMT
GET H2	200	_middlewareManifest.js Show response therecord.media/_next/static/Qp27NUJEh0WTliiSUfaJp/	92 B 242 B	32ms 31ms	Script application/javascript	2606:4700:4400::6812:20b5 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://therecord.media/_next/static/Qp27NUJEh0WTliiSUfaJp/_middlewareManifest.js Requested by Host: therecord.media URL: https://therecord.media/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:4400::6812:20b5 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash de5341313a4dc5d982ca50ae4a491e84bc5e80b0f439d87f05fc3973c1b7e59a Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://therecord.media/iran-company-providing-ransomware-infrastructure User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36 Response headers date Wed, 02 Aug 2023 02:16:29 GMT via 1.1 varnish, 1.1 varnish content-encoding br strict-transport-security max-age=31536000; includeSubDomains cf-cache-status DYNAMIC age 484094 traceresponse 00-1775b709bd06154101dc780b2ed21463-dc2d2a32a4645ef2-00 x-cache HIT, HIT x-platform-processor xgztqld4evaw2suiwyeszt2fga x-served-by cache-iad-kcgs7200077-IAD, cache-fra-eddf8230028-FRA last-modified Thu, 27 Jul 2023 11:48:00 GMT server cloudflare etag W/"5c-189972d5f2c" x-platform-cluster 6l7w2dvltmj6g-production-vohbr3y vary Accept-Encoding content-type application/javascript; charset=UTF-8 cache-control public, max-age=31536000, immutable x-debug-info eyJyZXRyaWVzIjo0fQ== permissions-policy geolocation=(self "https://*.recordedfuture.com/") cf-ray 7f02d1b13a011e66-FRA x-platform-router pzzg6kk2mvryq2jfoxqht4lu3u x-cache-hits 9, 1
GET H2	200	_ssgManifest.js Show response therecord.media/_next/static/Qp27NUJEh0WTliiSUfaJp/	99 B 317 B	26ms 25ms	Script application/javascript	2606:4700:4400::6812:20b5 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://therecord.media/_next/static/Qp27NUJEh0WTliiSUfaJp/_ssgManifest.js Requested by Host: therecord.media URL: https://therecord.media/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:4400::6812:20b5 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 11bc5c5457d219bd5836c09acf8b0b335ff4b6be3cb66d60e9478b09967c5029 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://therecord.media/iran-company-providing-ransomware-infrastructure User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36 Response headers date Wed, 02 Aug 2023 02:16:29 GMT via 1.1 varnish, 1.1 varnish content-encoding br strict-transport-security max-age=31536000; includeSubDomains cf-cache-status DYNAMIC age 484096 traceresponse 00-1775b70a8877d8dfc28b720b21b18bef-51df35603b942df3-00 x-cache HIT, HIT x-platform-processor xgztqld4evaw2suiwyeszt2fga x-served-by cache-iad-kiad7000165-IAD, cache-fra-eddf8230032-FRA last-modified Thu, 27 Jul 2023 11:48:00 GMT server cloudflare etag W/"63-189972d5f2c" x-platform-cluster 6l7w2dvltmj6g-production-vohbr3y vary Accept-Encoding content-type application/javascript; charset=UTF-8 cache-control public, max-age=31536000, immutable x-debug-info eyJyZXRyaWVzIjoyfQ== permissions-policy geolocation=(self "https://*.recordedfuture.com/") cf-ray 7f02d1b13a031e66-FRA x-platform-router pzzg6kk2mvryq2jfoxqht4lu3u x-cache-hits 1, 3
GET H2	200	_buildManifest.js Show response therecord.media/_next/static/Qp27NUJEh0WTliiSUfaJp/	1 KB 659 B	25ms 24ms	Script application/javascript	2606:4700:4400::6812:20b5 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://therecord.media/_next/static/Qp27NUJEh0WTliiSUfaJp/_buildManifest.js Requested by Host: therecord.media URL: https://therecord.media/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:4400::6812:20b5 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 4f6d6d0a2eaf47df93ad5e3c35cb37bb9ef4882db4ff6a5ee229689d92cf72aa Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://therecord.media/iran-company-providing-ransomware-infrastructure User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36 Response headers date Wed, 02 Aug 2023 02:16:29 GMT via 1.1 varnish, 1.1 varnish content-encoding br strict-transport-security max-age=31536000; includeSubDomains cf-cache-status DYNAMIC age 484096 traceresponse 00-1775b70a8affdd472f1532a81588f0d7-b3f8082fc8b248d3-00 x-cache HIT, HIT x-platform-processor xgztqld4evaw2suiwyeszt2fga x-served-by cache-iad-kjyo7100105-IAD, cache-fra-eddf8230132-FRA last-modified Thu, 27 Jul 2023 11:48:00 GMT server cloudflare etag W/"4b7-189972d5f2c" x-platform-cluster 6l7w2dvltmj6g-production-vohbr3y vary Accept-Encoding content-type application/javascript; charset=UTF-8 cache-control public, max-age=31536000, immutable x-debug-info eyJyZXRyaWVzIjoyfQ== permissions-policy geolocation=(self "https://*.recordedfuture.com/") cf-ray 7f02d1b13a041e66-FRA x-platform-router pzzg6kk2mvryq2jfoxqht4lu3u x-cache-hits 7, 1
GET H2	200	%5B%5B...slug%5D%5D-44126d6d7009e535.js Show response therecord.media/_next/static/chunks/pages/	71 KB 16 KB	32ms 31ms	Script application/javascript	2606:4700:4400::6812:20b5 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://therecord.media/_next/static/chunks/pages/%5B%5B...slug%5D%5D-44126d6d7009e535.js Requested by Host: therecord.media URL: https://therecord.media/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:4400::6812:20b5 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash bb5f6d1a5c2aa9c5e446b44ed4c15904099cb0be45521d52e7bd997a77842843 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://therecord.media/iran-company-providing-ransomware-infrastructure User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36 Response headers date Wed, 02 Aug 2023 02:16:29 GMT via 1.1 varnish, 1.1 varnish content-encoding br strict-transport-security max-age=31536000; includeSubDomains cf-cache-status DYNAMIC age 484097 traceresponse 00-1775b709d5139e47cd00972248d4962f-7ca2e8aef5a87713-00 x-cache HIT, HIT x-platform-processor xgztqld4evaw2suiwyeszt2fga x-served-by cache-iad-kjyo7100142-IAD, cache-fra-eddf8230055-FRA last-modified Thu, 27 Jul 2023 11:48:00 GMT server cloudflare etag W/"11c75-189972d5f31" x-platform-cluster 6l7w2dvltmj6g-production-vohbr3y vary Accept-Encoding content-type application/javascript; charset=UTF-8 cache-control public, max-age=31536000, immutable x-debug-info eyJyZXRyaWVzIjozfQ== permissions-policy geolocation=(self "https://*.recordedfuture.com/") cf-ray 7f02d1b13a051e66-FRA x-platform-router pzzg6kk2mvryq2jfoxqht4lu3u x-cache-hits 9, 1
GET H2	200	660-2f98ce714a723138.js Show response therecord.media/_next/static/chunks/	965 KB 251 KB	35ms 34ms	Script application/javascript	2606:4700:4400::6812:20b5 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://therecord.media/_next/static/chunks/660-2f98ce714a723138.js Requested by Host: therecord.media URL: https://therecord.media/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:4400::6812:20b5 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash d59678d4894700c8b25fdc2f3e8458b35a6e22c0d99e6cb88e47416f562a3b72 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://therecord.media/iran-company-providing-ransomware-infrastructure User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36 Response headers date Wed, 02 Aug 2023 02:16:29 GMT via 1.1 varnish, 1.1 varnish content-encoding br strict-transport-security max-age=31536000; includeSubDomains cf-cache-status DYNAMIC age 1327981 traceresponse 00-1772b788d7414c0d5a73ed6e08575961-9497fdb6412e5464-00 x-cache HIT, HIT x-platform-processor xgztqld4evaw2suiwyeszt2fga x-served-by cache-iad-kjyo7100027-IAD, cache-fra-etou8220020-FRA last-modified Thu, 13 Jul 2023 07:34:13 GMT server cloudflare etag W/"f15ba-1894e2bfd8e" x-platform-cluster 6l7w2dvltmj6g-production-vohbr3y vary Accept-Encoding content-type application/javascript; charset=UTF-8 cache-control public, max-age=31536000, immutable x-debug-info eyJyZXRyaWVzIjowfQ== permissions-policy geolocation=(self "https://*.recordedfuture.com/") cf-ray 7f02d1b13a061e66-FRA x-platform-router pzzg6kk2mvryq2jfoxqht4lu3u x-cache-hits 20165, 1
GET H2	200	_app-2024e4aaf5b4a59e.js Show response therecord.media/_next/static/chunks/pages/	114 KB 38 KB	32ms 31ms	Script application/javascript	2606:4700:4400::6812:20b5 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://therecord.media/_next/static/chunks/pages/_app-2024e4aaf5b4a59e.js Requested by Host: therecord.media URL: https://therecord.media/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:4400::6812:20b5 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 04b586d07a484c8434549bce3719c6b222f543da3992280d7d0e5aba73e58cc7 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://therecord.media/iran-company-providing-ransomware-infrastructure User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36 Response headers date Wed, 02 Aug 2023 02:16:29 GMT via 1.1 varnish, 1.1 varnish content-encoding br strict-transport-security max-age=31536000; includeSubDomains cf-cache-status DYNAMIC age 991434 traceresponse 00-1773e99f6220fcc0dc8834227d8597db-43c08bf0b6e87850-00 x-cache HIT, HIT x-platform-processor xgztqld4evaw2suiwyeszt2fga x-served-by cache-iad-kjyo7100055-IAD, cache-fra-eddf8230118-FRA last-modified Thu, 20 Jul 2023 09:03:56 GMT server cloudflare etag W/"1c769-189728aa5b8" x-platform-cluster 6l7w2dvltmj6g-production-vohbr3y vary Accept-Encoding content-type application/javascript; charset=UTF-8 cache-control public, max-age=31536000, immutable x-debug-info eyJyZXRyaWVzIjowfQ== permissions-policy geolocation=(self "https://*.recordedfuture.com/") cf-ray 7f02d1b13a071e66-FRA x-platform-router pzzg6kk2mvryq2jfoxqht4lu3u x-cache-hits 2035, 3
GET H2	200	main-a054bbf31fb90f6a.js Show response therecord.media/_next/static/chunks/	98 KB 27 KB	27ms 26ms	Script application/javascript	2606:4700:4400::6812:20b5 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://therecord.media/_next/static/chunks/main-a054bbf31fb90f6a.js Requested by Host: therecord.media URL: https://therecord.media/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:4400::6812:20b5 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e1885518498078290fc8152f0618b843ebfa8df10726b4571b11ec0355be9ee3 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://therecord.media/iran-company-providing-ransomware-infrastructure User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36 Response headers date Wed, 02 Aug 2023 02:16:29 GMT via 1.1 varnish, 1.1 varnish content-encoding br strict-transport-security max-age=31536000; includeSubDomains cf-cache-status DYNAMIC age 3496765 traceresponse 00-176b03096f05d66c95e234d7a1bd428e-7f6ca679a1913124-00 x-cache HIT, HIT x-platform-processor xgztqld4evaw2suiwyeszt2fga x-served-by cache-iad-kiad7000135-IAD, cache-fra-eddf8230063-FRA last-modified Wed, 21 Jun 2023 14:40:39 GMT server cloudflare etag W/"186c8-188de667f80" x-platform-cluster 6l7w2dvltmj6g-production-vohbr3y vary Accept-Encoding content-type application/javascript; charset=UTF-8 cache-control public, max-age=31536000, immutable x-debug-info eyJyZXRyaWVzIjowfQ== permissions-policy geolocation=(self "https://*.recordedfuture.com/") cf-ray 7f02d1b13a081e66-FRA x-platform-router pzzg6kk2mvryq2jfoxqht4lu3u x-cache-hits 1579, 3
GET H2	200	framework-5f4595e5518b5600.js Show response therecord.media/_next/static/chunks/	127 KB 42 KB	29ms 28ms	Script application/javascript	2606:4700:4400::6812:20b5 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://therecord.media/_next/static/chunks/framework-5f4595e5518b5600.js Requested by Host: therecord.media URL: https://therecord.media/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:4400::6812:20b5 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 8e89e1175a6145d737446d673ffa073f4c469c8fe3972f5287b1e7e9b241282b Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://therecord.media/iran-company-providing-ransomware-infrastructure User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36 Response headers date Wed, 02 Aug 2023 02:16:29 GMT via 1.1 varnish, 1.1 varnish content-encoding br strict-transport-security max-age=31536000; includeSubDomains cf-cache-status DYNAMIC age 2488615 traceresponse 00-176e97f1b6a6fb39fdde35de79bc4ef1-20f7c790fd5d9472-00 x-cache HIT, HIT x-platform-processor xgztqld4evaw2suiwyeszt2fga x-served-by cache-iad-kcgs7200081-IAD, cache-fra-eddf8230118-FRA last-modified Mon, 03 Jul 2023 09:20:54 GMT server cloudflare etag W/"1fbbb-1891b0e10f7" x-platform-cluster 6l7w2dvltmj6g-production-vohbr3y vary Accept-Encoding content-type application/javascript; charset=UTF-8 cache-control public, max-age=31536000, immutable x-debug-info eyJyZXRyaWVzIjowfQ== permissions-policy geolocation=(self "https://*.recordedfuture.com/") cf-ray 7f02d1b13a091e66-FRA x-platform-router pzzg6kk2mvryq2jfoxqht4lu3u x-cache-hits 13314, 4
GET H2	200	webpack-5752944655d749a0.js Show response therecord.media/_next/static/chunks/	2 KB 1 KB	23ms 23ms	Script application/javascript	2606:4700:4400::6812:20b5 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://therecord.media/_next/static/chunks/webpack-5752944655d749a0.js Requested by Host: therecord.media URL: https://therecord.media/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:4400::6812:20b5 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash f084f40ddabbf16c59e0d2e8c13f2b2c927121892f452bdd87395df212e93635 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://therecord.media/iran-company-providing-ransomware-infrastructure User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36 Response headers date Wed, 02 Aug 2023 02:16:29 GMT via 1.1 varnish, 1.1 varnish content-encoding br strict-transport-security max-age=31536000; includeSubDomains cf-cache-status DYNAMIC age 1269067 traceresponse 00-1772ed1daf4ba5a5465619a0c8c7a707-ed08227a363906f5-00 x-cache HIT, HIT x-platform-processor xgztqld4evaw2suiwyeszt2fga x-served-by cache-iad-kjyo7100179-IAD, cache-fra-eddf8230025-FRA last-modified Thu, 13 Jul 2023 07:34:13 GMT server cloudflare etag W/"673-1894e2bfd96" x-platform-cluster 6l7w2dvltmj6g-production-vohbr3y vary Accept-Encoding content-type application/javascript; charset=UTF-8 cache-control public, max-age=31536000, immutable x-debug-info eyJyZXRyaWVzIjowfQ== permissions-policy geolocation=(self "https://*.recordedfuture.com/") cf-ray 7f02d1b13a0a1e66-FRA x-platform-router pzzg6kk2mvryq2jfoxqht4lu3u x-cache-hits 9156, 2
GET H2	200	Inter-SemiBold.ttf therecord.media/fonts/	308 KB 150 KB	182ms 182ms	Font font/ttf	2606:4700:4400::6812:20b5 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://therecord.media/fonts/Inter-SemiBold.ttf Requested by Host: therecord.media URL: https://therecord.media/_next/static/css/2bef7a7062791382.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:4400::6812:20b5 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash f036a45770ce2ad43dfee7f4eac8f8b3784608a24ff00c63dd56704434e014e8 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer https://therecord.media/_next/static/css/2bef7a7062791382.css Origin https://therecord.media accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36 Response headers date Wed, 02 Aug 2023 02:16:29 GMT via 1.1 varnish, 1.1 varnish content-encoding br strict-transport-security max-age=31536000; includeSubDomains cf-cache-status DYNAMIC age 0 traceresponse 00-17776f538b47ceb6f38bb95e185ff699-ba951fd4f584e868-00 x-cache MISS, MISS x-platform-processor xgztqld4evaw2suiwyeszt2fga x-served-by cache-iad-kiad7000102-IAD, cache-fra-eddf8230031-FRA last-modified Thu, 27 Jul 2023 11:43:12 GMT server cloudflare etag W/"4d16c-1899728f880" x-platform-cluster 6l7w2dvltmj6g-production-vohbr3y vary Accept-Encoding content-type font/ttf cache-control public, max-age=0 x-debug-info eyJyZXRyaWVzIjowfQ== permissions-policy geolocation=(self "https://*.recordedfuture.com/") cf-ray 7f02d1b14a0f1e66-FRA x-platform-router pzzg6kk2mvryq2jfoxqht4lu3u x-cache-hits 0, 0
GET H2	200	icomoon.ttf therecord.media/icons/fonts/	5 KB 3 KB	135ms 134ms	Font font/ttf	2606:4700:4400::6812:20b5 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://therecord.media/icons/fonts/icomoon.ttf?l2zjlc Requested by Host: therecord.media URL: https://therecord.media/_next/static/css/2bef7a7062791382.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:4400::6812:20b5 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e2ea411b32eb0f8f7ecee62a4a599e510c68d51c04b0246e436a50ea016b70e6 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer https://therecord.media/_next/static/css/2bef7a7062791382.css Origin https://therecord.media accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36 Response headers date Wed, 02 Aug 2023 02:16:29 GMT via 1.1 varnish, 1.1 varnish content-encoding br strict-transport-security max-age=31536000; includeSubDomains cf-cache-status DYNAMIC age 0 traceresponse 00-17776f538b74f11106a122bf5759eba4-12669a70f8c72439-00 x-cache MISS, MISS x-platform-processor xgztqld4evaw2suiwyeszt2fga x-served-by cache-iad-kjyo7100149-IAD, cache-fra-eddf8230122-FRA last-modified Thu, 27 Jul 2023 11:43:12 GMT server cloudflare etag W/"1304-1899728f880" x-platform-cluster 6l7w2dvltmj6g-production-vohbr3y vary Accept-Encoding content-type font/ttf cache-control public, max-age=0 x-debug-info eyJyZXRyaWVzIjowfQ== permissions-policy geolocation=(self "https://*.recordedfuture.com/") cf-ray 7f02d1b14a101e66-FRA x-platform-router pzzg6kk2mvryq2jfoxqht4lu3u x-cache-hits 0, 0
GET H2	200	Inter-Medium.ttf therecord.media/fonts/	307 KB 149 KB	177ms 176ms	Font font/ttf	2606:4700:4400::6812:20b5 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://therecord.media/fonts/Inter-Medium.ttf Requested by Host: therecord.media URL: https://therecord.media/_next/static/css/2bef7a7062791382.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:4400::6812:20b5 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash a0b1f949528f7a3a2d2ff3b6df67c6c1b5cb8f62a2eba6eb5e06adff2d5795f3 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer https://therecord.media/_next/static/css/2bef7a7062791382.css Origin https://therecord.media accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36 Response headers date Wed, 02 Aug 2023 02:16:29 GMT via 1.1 varnish, 1.1 varnish content-encoding br strict-transport-security max-age=31536000; includeSubDomains cf-cache-status DYNAMIC age 0 traceresponse 00-17776f538b839ffed8b586bee84ca12f-55ee0c933ce04595-00 x-cache MISS, MISS x-platform-processor xgztqld4evaw2suiwyeszt2fga x-served-by cache-iad-kiad7000051-IAD, cache-fra-eddf8230036-FRA last-modified Thu, 27 Jul 2023 11:43:12 GMT server cloudflare etag W/"4cd58-1899728f880" x-platform-cluster 6l7w2dvltmj6g-production-vohbr3y vary Accept-Encoding content-type font/ttf cache-control public, max-age=0 x-debug-info eyJyZXRyaWVzIjowfQ== permissions-policy geolocation=(self "https://*.recordedfuture.com/") cf-ray 7f02d1b14a121e66-FRA x-platform-router pzzg6kk2mvryq2jfoxqht4lu3u x-cache-hits 0, 0
GET H2	200	Inter-Bold.ttf therecord.media/fonts/	309 KB 151 KB	185ms 185ms	Font font/ttf	2606:4700:4400::6812:20b5 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://therecord.media/fonts/Inter-Bold.ttf Requested by Host: therecord.media URL: https://therecord.media/_next/static/css/2bef7a7062791382.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:4400::6812:20b5 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 2ad83f2446566c5ecf7c261cc07884a5d5f71965b5df8fd7bb809f83a42bf470 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer https://therecord.media/_next/static/css/2bef7a7062791382.css Origin https://therecord.media accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36 Response headers date Wed, 02 Aug 2023 02:16:29 GMT via 1.1 varnish, 1.1 varnish content-encoding br strict-transport-security max-age=31536000; includeSubDomains cf-cache-status DYNAMIC age 0 traceresponse 00-17776f538b923c6678ff77a68c14a8bf-edc19355751ea52c-00 x-cache MISS, MISS x-platform-processor xgztqld4evaw2suiwyeszt2fga x-served-by cache-iad-kjyo7100134-IAD, cache-fra-eddf8230100-FRA last-modified Thu, 27 Jul 2023 11:43:12 GMT server cloudflare etag W/"4d2c4-1899728f880" x-platform-cluster 6l7w2dvltmj6g-production-vohbr3y vary Accept-Encoding content-type font/ttf cache-control public, max-age=0 x-debug-info eyJyZXRyaWVzIjowfQ== permissions-policy geolocation=(self "https://*.recordedfuture.com/") cf-ray 7f02d1b14a131e66-FRA x-platform-router pzzg6kk2mvryq2jfoxqht4lu3u x-cache-hits 0, 0
GET H2	200	Inter-Regular.ttf therecord.media/fonts/	303 KB 140 KB	203ms 202ms	Font font/ttf	2606:4700:4400::6812:20b5 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://therecord.media/fonts/Inter-Regular.ttf Requested by Host: therecord.media URL: https://therecord.media/_next/static/css/2bef7a7062791382.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:4400::6812:20b5 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 494a9c8817786531126dd245c93f8a85aa6afa405c7b8a2e45b667538470ce7a Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer https://therecord.media/_next/static/css/2bef7a7062791382.css Origin https://therecord.media accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36 Response headers date Wed, 02 Aug 2023 02:16:29 GMT via 1.1 varnish, 1.1 varnish content-encoding br strict-transport-security max-age=31536000; includeSubDomains cf-cache-status DYNAMIC age 0 traceresponse 00-17776f538c58f962c9cae7d5fb87cd23-00348243c843fa52-00 x-cache MISS, MISS x-platform-processor xgztqld4evaw2suiwyeszt2fga x-served-by cache-iad-kiad7000092-IAD, cache-fra-etou8220034-FRA last-modified Thu, 27 Jul 2023 11:43:12 GMT server cloudflare etag W/"4ba44-1899728f880" x-platform-cluster 6l7w2dvltmj6g-production-vohbr3y vary Accept-Encoding content-type font/ttf cache-control public, max-age=0 x-debug-info eyJyZXRyaWVzIjowfQ== permissions-policy geolocation=(self "https://*.recordedfuture.com/") cf-ray 7f02d1b14a141e66-FRA x-platform-router pzzg6kk2mvryq2jfoxqht4lu3u x-cache-hits 0, 0
GET H2	200	Inter-ExtraBold.ttf therecord.media/fonts/	309 KB 151 KB	187ms 187ms	Font font/ttf	2606:4700:4400::6812:20b5 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://therecord.media/fonts/Inter-ExtraBold.ttf Requested by Host: therecord.media URL: https://therecord.media/_next/static/css/2bef7a7062791382.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:4400::6812:20b5 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 6fb3140db2839cabd3662044ef7791206df377b2211046abc71dd039f05fe082 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer https://therecord.media/_next/static/css/2bef7a7062791382.css Origin https://therecord.media accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36 Response headers date Wed, 02 Aug 2023 02:16:29 GMT via 1.1 varnish, 1.1 varnish content-encoding br strict-transport-security max-age=31536000; includeSubDomains cf-cache-status DYNAMIC age 0 traceresponse 00-17776f538bbd3a3f84905f48c3bff081-21c0c86bd6b4798c-00 x-cache MISS, MISS x-platform-processor xgztqld4evaw2suiwyeszt2fga x-served-by cache-iad-kiad7000107-IAD, cache-fra-eddf8230120-FRA last-modified Thu, 27 Jul 2023 11:43:12 GMT server cloudflare etag W/"4d52c-1899728f880" x-platform-cluster 6l7w2dvltmj6g-production-vohbr3y vary Accept-Encoding content-type font/ttf cache-control public, max-age=0 x-debug-info eyJyZXRyaWVzIjowfQ== permissions-policy geolocation=(self "https://*.recordedfuture.com/") cf-ray 7f02d1b14a161e66-FRA x-platform-router pzzg6kk2mvryq2jfoxqht4lu3u x-cache-hits 0, 0
GET H2	200	gtm.js Show response www.googletagmanager.com/	163 KB 61 KB	42ms 21ms	Script application/javascript	2a00:1450:4001:830::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtm.js?id=GTM-PVJ5W86 Requested by Host: therecord.media URL: https://therecord.media/iran-company-providing-ransomware-infrastructure Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:830::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 1f70bb6c689ceffda689cd0c1c8aa313f75fe6c1d89b410a88363476341a1346 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://therecord.media/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36 Response headers date Wed, 02 Aug 2023 02:16:30 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 61653 x-xss-protection 0 last-modified Wed, 02 Aug 2023 00:22:19 GMT server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Wed, 02 Aug 2023 02:16:30 GMT
GET H2	200	matomo.js Show response cdn.matomo.cloud/recordedfuture.matomo.cloud/	199 KB 58 KB	44ms 8ms	Script application/javascript	2600:9000:223f:e400:c:7d55:b3c0:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://cdn.matomo.cloud/recordedfuture.matomo.cloud/matomo.js Requested by Host: therecord.media URL: https://therecord.media/iran-company-providing-ransomware-infrastructure Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:223f:e400:c:7d55:b3c0:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash 6fb145f1185850a1f9937c5d5afb3260adbcef791d0a94e1c09b54aa00808982 Request headers accept-language de-DE,de;q=0.9 Referer https://therecord.media/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36 Response headers date Wed, 02 Aug 2023 00:08:26 GMT x-amz-version-id T3VVylcW4ZUVSABprJtJmBafSdXY4jAi content-encoding gzip via 1.1 0c39e892d8c809025c8f47425847f680.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P5 age 7684 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront x-amz-replication-status COMPLETED last-modified Tue, 07 Feb 2023 02:15:06 GMT server AmazonS3 etag W/"3e98a39e2d8f2b464999b40df3c2172d" vary Accept-Encoding content-type application/javascript; charset=utf-8 cache-control max-age=691200 x-amz-cf-id apgfkgEkwEG8gRvYOZaY-dfz-wr57grTkx9WmszeaLd77LARg1X5SA==
GET H2	200	container_41sBJe2I.js Show response cdn.matomo.cloud/recordedfuture.matomo.cloud/	27 KB 9 KB	42ms 6ms	Script application/javascript	2600:9000:223f:e400:c:7d55:b3c0:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://cdn.matomo.cloud/recordedfuture.matomo.cloud/container_41sBJe2I.js Requested by Host: therecord.media URL: https://therecord.media/iran-company-providing-ransomware-infrastructure Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:223f:e400:c:7d55:b3c0:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash 58b7835fb7b6028146a46edd3ef238b71759d0a5d597ce39f90b7de730899e92 Request headers accept-language de-DE,de;q=0.9 Referer https://therecord.media/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36 Response headers date Wed, 02 Aug 2023 00:10:00 GMT x-amz-version-id Xp.qiLs.ZhMcRdIRto4WxBiX5kNGHcfO content-encoding gzip via 1.1 0c39e892d8c809025c8f47425847f680.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P5 age 7591 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront x-amz-replication-status COMPLETED last-modified Mon, 17 Apr 2023 04:07:33 GMT server AmazonS3 etag W/"839ec9cd752c4e512960109f6ac6b404" vary Accept-Encoding content-type application/javascript; charset=utf-8 cache-control max-age=691200 x-amz-cf-id NTk1AEpUN5_0nDb0NZY0BYwEa9UONCkalwBgiZXeKyWXBXr_DqrVrA==
GET H2	200	articles Show response cms.therecord.media/api/	10 KB 3 KB	493ms 476ms	XHR application/json	2606:4700:4400::6812:20b5 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cms.therecord.media/api/articles?populate[0]=categories&populate[1]=categories.page&populate[2]=editor&populate[3]=editor.page&populate[4]=image&populate[5]=image.desktop&populate[6]=image.tablet&populate[7]=image.mobile&populate[8]=tags&populate[9]=tags.page&populate[10]=page&filters[id][$ne]=3336&filters[date][$lte]=2023-08-01T17%3A24%3A00.000Z&filters[page][id][$notNull]=true&filters[page][publishedAt][$notNull]=true&filters[$and][0][$or][0][showFrom][$null]=true&filters[$and][0][$or][1][showFrom][$lte]=2023-08-02T02%3A16%3A30%2B00%3A00&filters[$and][1][$or][0][listingShowFrom][$null]=true&filters[$and][1][$or][1][listingShowFrom][$lte]=2023-08-02T02%3A16%3A30%2B00%3A00&pagination%5BpageSize%5D=1&sort%5B0%5D=date%3Adesc Requested by Host: therecord.media URL: https://therecord.media/_next/static/chunks/660-2f98ce714a723138.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:4400::6812:20b5 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Strapi <strapi.io> Resource Hash 0ede05ed6ad6de2cb0395b388216c3eef434e750757b4d33300ff65767cdd8dd Security Headers Name Value Content-Security-Policy connect-src 'self' https:;img-src 'self' data: blob: https://market-assets.strapi.io;media-src 'self' data: blob:;default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;frame-ancestors 'self';object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline' Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN Request headers Accept application/json, text/plain, */* Referer https://therecord.media/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36 Response headers date Wed, 02 Aug 2023 02:16:31 GMT content-security-policy connect-src 'self' https:;img-src 'self' data: blob: https://market-assets.strapi.io;media-src 'self' data: blob:;default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;frame-ancestors 'self';object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline' x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains cf-cache-status DYNAMIC x-permitted-cross-domain-policies none content-encoding br traceresponse 00-17776f53d5b36c7c9a76dfc5d92b162f-afe1d28ad97647f0-00 x-powered-by Strapi <strapi.io> x-dns-prefetch-control off x-platform-processor yzs7ggztuurocnodlgeyqu6sde referrer-policy no-referrer server cloudflare expect-ct max-age=0 vary Origin x-frame-options SAMEORIGIN content-type application/json; charset=utf-8 access-control-allow-origin https://therecord.media x-download-options noopen x-debug-info eyJyZXRyaWVzIjowfQ== access-control-allow-credentials true x-platform-cluster r6uchqjqwmfqi-production-vohbr3y cf-ray 7f02d1b7de4990ec-FRA x-platform-router qk5ll65emgqnxbcwb6fko7g64m
GET H2	200	articles Show response cms.therecord.media/api/	12 KB 4 KB	407ms 390ms	XHR application/json	2606:4700:4400::6812:20b5 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cms.therecord.media/api/articles?populate[0]=categories&populate[1]=categories.page&populate[2]=editor&populate[3]=editor.page&populate[4]=image&populate[5]=image.desktop&populate[6]=image.tablet&populate[7]=image.mobile&populate[8]=tags&populate[9]=tags.page&populate[10]=page&filters[id][$ne]=3336&filters[date][$gte]=2023-08-01T17%3A24%3A00.000Z&filters[page][id][$notNull]=true&filters[page][publishedAt][$notNull]=true&filters[$and][0][$or][0][showFrom][$null]=true&filters[$and][0][$or][1][showFrom][$lte]=2023-08-02T02%3A16%3A30%2B00%3A00&filters[$and][1][$or][0][listingShowFrom][$null]=true&filters[$and][1][$or][1][listingShowFrom][$lte]=2023-08-02T02%3A16%3A30%2B00%3A00&pagination%5BpageSize%5D=1&sort%5B0%5D=date%3Aasc Requested by Host: therecord.media URL: https://therecord.media/_next/static/chunks/660-2f98ce714a723138.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:4400::6812:20b5 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Strapi <strapi.io> Resource Hash 36d1532d843a8c6fd3adbb05a0a80a213057706726a2e9bfffaaf95db89830fa Security Headers Name Value Content-Security-Policy connect-src 'self' https:;img-src 'self' data: blob: https://market-assets.strapi.io;media-src 'self' data: blob:;default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;frame-ancestors 'self';object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline' Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN Request headers Accept application/json, text/plain, */* Referer https://therecord.media/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36 Response headers date Wed, 02 Aug 2023 02:16:31 GMT content-security-policy connect-src 'self' https:;img-src 'self' data: blob: https://market-assets.strapi.io;media-src 'self' data: blob:;default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;frame-ancestors 'self';object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline' x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains cf-cache-status DYNAMIC x-permitted-cross-domain-policies none content-encoding br traceresponse 00-17776f53d5b0e2af17b20be8a7775967-46777cbb753377da-00 x-powered-by Strapi <strapi.io> x-dns-prefetch-control off x-platform-processor yzs7ggztuurocnodlgeyqu6sde referrer-policy no-referrer server cloudflare expect-ct max-age=0 vary Origin x-frame-options SAMEORIGIN content-type application/json; charset=utf-8 access-control-allow-origin https://therecord.media x-download-options noopen x-debug-info eyJyZXRyaWVzIjowfQ== access-control-allow-credentials true x-platform-cluster r6uchqjqwmfqi-production-vohbr3y cf-ray 7f02d1b7de4b90ec-FRA x-platform-router qk5ll65emgqnxbcwb6fko7g64m
GET H2	200	articles Show response cms.therecord.media/api/	2 KB 2 KB	396ms 380ms	XHR application/json	2606:4700:4400::6812:20b5 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cms.therecord.media/api/articles?fields[0]=title&fields[1]=date&fields[2]=publishedAt&filters[isBrief][$eq]=true&filters[page][id][$notNull]=true&filters[page][publishedAt][$notNull]=true&filters[$and][0][$or][0][showFrom][$null]=true&filters[$and][0][$or][1][showFrom][$lte]=2023-08-02T02%3A16%3A30%2B00%3A00&filters[$and][1][$or][0][listingShowFrom][$null]=true&filters[$and][1][$or][1][listingShowFrom][$lte]=2023-08-02T02%3A16%3A30%2B00%3A00&populate[page][fields][0]=slug&sort[0]=date%3Adesc&pagination[limit]=9 Requested by Host: therecord.media URL: https://therecord.media/_next/static/chunks/660-2f98ce714a723138.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:4400::6812:20b5 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Strapi <strapi.io> Resource Hash b7936eff735727ab3b35ca3f7a03290a9a55f1ace2705f398a32b60091eb7fca Security Headers Name Value Content-Security-Policy connect-src 'self' https:;img-src 'self' data: blob: https://market-assets.strapi.io;media-src 'self' data: blob:;default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;frame-ancestors 'self';object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline' Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN Request headers Accept application/json, text/plain, */* Referer https://therecord.media/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36 Response headers date Wed, 02 Aug 2023 02:16:31 GMT content-security-policy connect-src 'self' https:;img-src 'self' data: blob: https://market-assets.strapi.io;media-src 'self' data: blob:;default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;frame-ancestors 'self';object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline' x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains cf-cache-status DYNAMIC x-permitted-cross-domain-policies none content-encoding br traceresponse 00-17776f53d5c28c539f8592a98c561240-ebc54e778a1f6d37-00 x-powered-by Strapi <strapi.io> x-dns-prefetch-control off x-platform-processor yzs7ggztuurocnodlgeyqu6sde referrer-policy no-referrer server cloudflare expect-ct max-age=0 vary Origin x-frame-options SAMEORIGIN content-type application/json; charset=utf-8 access-control-allow-origin https://therecord.media x-download-options noopen x-debug-info eyJyZXRyaWVzIjowfQ== access-control-allow-credentials true x-platform-cluster r6uchqjqwmfqi-production-vohbr3y cf-ray 7f02d1b7de4c90ec-FRA x-platform-router qk5ll65emgqnxbcwb6fko7g64m
GET H2	200	research Show response www.recordedfuture.com/feed/	522 KB 151 KB	73ms 34ms	Fetch text/xml	104.18.43.111 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.recordedfuture.com/feed/research Requested by Host: therecord.media URL: https://therecord.media/_next/static/chunks/660-2f98ce714a723138.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.18.43.111 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 1f017d0b2622dbce788d82187f9912060e2570559a9873d232ab4dde0b071a10 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers Accept application/rss+xml Referer https://therecord.media/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36 Response headers date Wed, 02 Aug 2023 02:16:30 GMT content-encoding gzip via 1.1 varnish strict-transport-security max-age=31536000; includeSubDomains x-platform-server i-72f68d9e5fc844fb8d11227fc18ff9f4, i-72f68d9e5fc844fb8d11227fc18ff9f4 x-content-type-options nosniff cf-cache-status DYNAMIC age 1342 traceresponse 00-17776e1b3958749c5d4b085e2a54b73a-6aed6498bbc230a0-00 x-cache HIT foo bar content-length 154324 x-served-by cache-fra-etou8220099-FRA server cloudflare vary Accept-Encoding content-type text/xml access-control-allow-origin * x-debug-info eyJyZXRyaWVzIjowfQ== accept-ranges bytes cf-ray 7f02d1b80eed3642-FRA x-cache-hits 1
GET H2	200	news.json Show response therecord.media/_next/data/Qp27NUJEh0WTliiSUfaJp/news/	7 KB 2 KB	195ms 194ms	Fetch application/json	2606:4700:4400::6812:20b5 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://therecord.media/_next/data/Qp27NUJEh0WTliiSUfaJp/news/news.json Requested by Host: therecord.media URL: https://therecord.media/_next/static/chunks/main-a054bbf31fb90f6a.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:4400::6812:20b5 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e515fae5eb95e97eace461e82219d00b6aa68cc8f8986ca8d0a6016f6357632c Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://therecord.media/iran-company-providing-ransomware-infrastructure User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36 Response headers date Wed, 02 Aug 2023 02:16:30 GMT via 1.1 varnish, 1.1 varnish content-encoding br strict-transport-security max-age=31536000; includeSubDomains cf-cache-status DYNAMIC age 1 traceresponse 00-17775f16e60bbad1de8d8a39230fc562-3f7214d4448d0a85-00 x-cache HIT, HIT x-platform-processor xgztqld4evaw2suiwyeszt2fga x-served-by cache-iad-kiad7000118-IAD, cache-fra-eddf8230103-FRA server cloudflare etag W/"1c3e-M5QmY/ghHH+JgeuqDKZu9xrbXWc" x-platform-cluster 6l7w2dvltmj6g-production-vohbr3y vary Accept-Encoding content-type application/json cache-control s-maxage=60, stale-while-revalidate x-debug-info eyJyZXRyaWVzIjowfQ== permissions-policy geolocation=(self "https://*.recordedfuture.com/") cf-ray 7f02d1b81fa71e66-FRA x-platform-router pzzg6kk2mvryq2jfoxqht4lu3u x-cache-hits 9, 1
GET H2	200	jonathan-greig.json Show response therecord.media/_next/data/Qp27NUJEh0WTliiSUfaJp/author/	9 KB 3 KB	18ms 17ms	Fetch application/json	2606:4700:4400::6812:20b5 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://therecord.media/_next/data/Qp27NUJEh0WTliiSUfaJp/author/jonathan-greig.json Requested by Host: therecord.media URL: https://therecord.media/_next/static/chunks/main-a054bbf31fb90f6a.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:4400::6812:20b5 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash a693d12e5abd0922df686244cfcfc0a8cd5f955890d1f1649855af5f9455e7d1 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://therecord.media/iran-company-providing-ransomware-infrastructure User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36 Response headers date Wed, 02 Aug 2023 02:16:30 GMT via 1.1 varnish, 1.1 varnish content-encoding br strict-transport-security max-age=31536000; includeSubDomains cf-cache-status DYNAMIC age 34 traceresponse 00-17775f09d5edf2ea895a296802337cb3-f580b3c62a09ddad-00 x-cache HIT, HIT x-platform-processor xgztqld4evaw2suiwyeszt2fga x-served-by cache-iad-kcgs7200076-IAD, cache-fra-eddf8230029-FRA server cloudflare etag W/"22c9-oZlu3P0I5VgVQQwZI2LfqNjicKg" x-platform-cluster 6l7w2dvltmj6g-production-vohbr3y vary Accept-Encoding content-type application/json cache-control s-maxage=60, stale-while-revalidate x-debug-info eyJyZXRyaWVzIjowfQ== permissions-policy geolocation=(self "https://*.recordedfuture.com/") cf-ray 7f02d1b81faa1e66-FRA x-platform-router pzzg6kk2mvryq2jfoxqht4lu3u x-cache-hits 34, 1
GET H2	200	subscribe.json Show response therecord.media/_next/data/Qp27NUJEh0WTliiSUfaJp/	8 KB 2 KB	22ms 21ms	Fetch application/json	2606:4700:4400::6812:20b5 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://therecord.media/_next/data/Qp27NUJEh0WTliiSUfaJp/subscribe.json Requested by Host: therecord.media URL: https://therecord.media/_next/static/chunks/main-a054bbf31fb90f6a.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:4400::6812:20b5 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 6da14bec1a9e2278d22b26fe8a886ec9b1a4989a8fded69c2cf284ba9c50a54e Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://therecord.media/iran-company-providing-ransomware-infrastructure User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36 Response headers date Wed, 02 Aug 2023 02:16:30 GMT via 1.1 varnish, 1.1 varnish content-encoding br strict-transport-security max-age=31536000; includeSubDomains cf-cache-status DYNAMIC age 42 traceresponse 00-17775f06c7e8712cc7d4ceb5390d1176-6467410e34c920a7-00 x-cache HIT, HIT x-platform-processor xgztqld4evaw2suiwyeszt2fga x-served-by cache-iad-kcgs7200046-IAD, cache-fra-eddf8230102-FRA server cloudflare etag W/"1f1e-ql1y5/RpnoKpPwIsr5BrFtT3GHE" x-platform-cluster 6l7w2dvltmj6g-production-vohbr3y vary Accept-Encoding content-type application/json cache-control s-maxage=60, stale-while-revalidate x-debug-info eyJyZXRyaWVzIjowfQ== permissions-policy geolocation=(self "https://*.recordedfuture.com/") cf-ray 7f02d1b81fab1e66-FRA x-platform-router pzzg6kk2mvryq2jfoxqht4lu3u x-cache-hits 811, 1
GET H2	200	contact.json Show response therecord.media/_next/data/Qp27NUJEh0WTliiSUfaJp/	8 KB 2 KB	23ms 22ms	Fetch application/json	2606:4700:4400::6812:20b5 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://therecord.media/_next/data/Qp27NUJEh0WTliiSUfaJp/contact.json Requested by Host: therecord.media URL: https://therecord.media/_next/static/chunks/main-a054bbf31fb90f6a.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:4400::6812:20b5 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 136cb3f11fc2e29e006bfab246a19d46ce4601813fe384a478c0d889c5246936 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://therecord.media/iran-company-providing-ransomware-infrastructure User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36 Response headers date Wed, 02 Aug 2023 02:16:30 GMT via 1.1 varnish, 1.1 varnish content-encoding br strict-transport-security max-age=31536000; includeSubDomains cf-cache-status DYNAMIC age 37 traceresponse 00-17775f09d7e05365e65a785c9919cd49-e46d4a3cdbea1d81-00 x-cache HIT, HIT x-platform-processor xgztqld4evaw2suiwyeszt2fga x-served-by cache-iad-kiad7000116-IAD, cache-fra-eddf8230030-FRA server cloudflare etag W/"2157-aiFkxBCn31di//NdotsmDXmU6vU" x-platform-cluster 6l7w2dvltmj6g-production-vohbr3y vary Accept-Encoding content-type application/json cache-control s-maxage=60, stale-while-revalidate x-debug-info eyJyZXRyaWVzIjowfQ== permissions-policy geolocation=(self "https://*.recordedfuture.com/") cf-ray 7f02d1b81fad1e66-FRA x-platform-router pzzg6kk2mvryq2jfoxqht4lu3u x-cache-hits 5, 1
GET H2	200	podcast.json Show response therecord.media/_next/data/Qp27NUJEh0WTliiSUfaJp/	144 KB 30 KB	29ms 29ms	Fetch application/json	2606:4700:4400::6812:20b5 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://therecord.media/_next/data/Qp27NUJEh0WTliiSUfaJp/podcast.json Requested by Host: therecord.media URL: https://therecord.media/_next/static/chunks/main-a054bbf31fb90f6a.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:4400::6812:20b5 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash a3921a9a1d9e4dac734575ed2a180638d0b947a77e0c2bd0e41a86ec2de2f9a6 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://therecord.media/iran-company-providing-ransomware-infrastructure User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36 Response headers date Wed, 02 Aug 2023 02:16:30 GMT via 1.1 varnish, 1.1 varnish content-encoding br strict-transport-security max-age=31536000; includeSubDomains cf-cache-status DYNAMIC age 37 traceresponse 00-17775f06c8a43e1eb40bba5d46f8a0b7-be07f78b7771b919-00 x-cache HIT, HIT x-platform-processor xgztqld4evaw2suiwyeszt2fga x-served-by cache-iad-kiad7000104-IAD, cache-fra-eddf8230063-FRA server cloudflare etag W/"240ee-5Vp5NTPCfgwlTwrR7BvA8Pw8wfk" x-platform-cluster 6l7w2dvltmj6g-production-vohbr3y vary Accept-Encoding content-type application/json cache-control s-maxage=60, stale-while-revalidate x-debug-info eyJyZXRyaWVzIjowfQ== permissions-policy geolocation=(self "https://*.recordedfuture.com/") cf-ray 7f02d1b81fae1e66-FRA x-platform-router pzzg6kk2mvryq2jfoxqht4lu3u x-cache-hits 747, 1
GET H2	200	about.json Show response therecord.media/_next/data/Qp27NUJEh0WTliiSUfaJp/	41 KB 7 KB	22ms 21ms	Fetch application/json	2606:4700:4400::6812:20b5 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://therecord.media/_next/data/Qp27NUJEh0WTliiSUfaJp/about.json Requested by Host: therecord.media URL: https://therecord.media/_next/static/chunks/main-a054bbf31fb90f6a.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:4400::6812:20b5 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash a2ae3e95e1b84a4b0fc701ef9a931487c221fe2e6e6f35154bcc7eea510c66ce Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://therecord.media/iran-company-providing-ransomware-infrastructure User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36 Response headers date Wed, 02 Aug 2023 02:16:30 GMT via 1.1 varnish, 1.1 varnish content-encoding br strict-transport-security max-age=31536000; includeSubDomains cf-cache-status DYNAMIC age 38 traceresponse 00-17775f06ca4e7e70d8d3d7b101ea596b-72ae5217d1b24be8-00 x-cache HIT, HIT x-platform-processor xgztqld4evaw2suiwyeszt2fga x-served-by cache-iad-kcgs7200044-IAD, cache-fra-eddf8230070-FRA server cloudflare etag W/"a50a-Wk+OrSANbYKxayMGA0F5J6/tdQU" x-platform-cluster 6l7w2dvltmj6g-production-vohbr3y vary Accept-Encoding content-type application/json cache-control s-maxage=60, stale-while-revalidate x-debug-info eyJyZXRyaWVzIjowfQ== permissions-policy geolocation=(self "https://*.recordedfuture.com/") cf-ray 7f02d1b81fb01e66-FRA x-platform-router pzzg6kk2mvryq2jfoxqht4lu3u x-cache-hits 743, 2
GET H2	200	technology.json Show response therecord.media/_next/data/Qp27NUJEh0WTliiSUfaJp/news/	7 KB 2 KB	28ms 27ms	Fetch application/json	2606:4700:4400::6812:20b5 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://therecord.media/_next/data/Qp27NUJEh0WTliiSUfaJp/news/technology.json Requested by Host: therecord.media URL: https://therecord.media/_next/static/chunks/main-a054bbf31fb90f6a.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:4400::6812:20b5 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash d9752f3b9483cfd4aa01c2dcd9a6b84e803c394c8cc1ac61044e79a5e1a8e9bc Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://therecord.media/iran-company-providing-ransomware-infrastructure User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36 Response headers date Wed, 02 Aug 2023 02:16:30 GMT via 1.1 varnish, 1.1 varnish content-encoding br strict-transport-security max-age=31536000; includeSubDomains cf-cache-status DYNAMIC age 38 traceresponse 00-17775f06cc31840a9d99d16b6f663fd4-3a04bb4c64d9ad63-00 x-cache HIT, HIT x-platform-processor xgztqld4evaw2suiwyeszt2fga x-served-by cache-iad-kcgs7200148-IAD, cache-fra-eddf8230070-FRA server cloudflare etag W/"1c59-nLeNSvTt8sO3XrUHQJ8Kjafq4dQ" x-platform-cluster 6l7w2dvltmj6g-production-vohbr3y vary Accept-Encoding content-type application/json cache-control s-maxage=60, stale-while-revalidate x-debug-info eyJyZXRyaWVzIjowfQ== permissions-policy geolocation=(self "https://*.recordedfuture.com/") cf-ray 7f02d1b81fb21e66-FRA x-platform-router pzzg6kk2mvryq2jfoxqht4lu3u x-cache-hits 6, 1
GET H2	200	people.json Show response therecord.media/_next/data/Qp27NUJEh0WTliiSUfaJp/news/	7 KB 2 KB	18ms 18ms	Fetch application/json	2606:4700:4400::6812:20b5 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://therecord.media/_next/data/Qp27NUJEh0WTliiSUfaJp/news/people.json Requested by Host: therecord.media URL: https://therecord.media/_next/static/chunks/main-a054bbf31fb90f6a.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:4400::6812:20b5 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash f334c22396ecf4ae51d62373bd6154edb5c098deea2e1a83fe21d4ec0afcbf17 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://therecord.media/iran-company-providing-ransomware-infrastructure User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36 Response headers date Wed, 02 Aug 2023 02:16:30 GMT via 1.1 varnish, 1.1 varnish content-encoding br strict-transport-security max-age=31536000; includeSubDomains cf-cache-status DYNAMIC age 43 traceresponse 00-17776656ff0088290da6aa48ab50e11c-1ce9bacf9f8677b6-00 x-cache HIT, HIT x-platform-processor xgztqld4evaw2suiwyeszt2fga x-served-by cache-iad-kiad7000129-IAD, cache-fra-eddf8230029-FRA server cloudflare etag W/"1c45-5Xz583Dh6V478wRuOP0GjuepT6M" x-platform-cluster 6l7w2dvltmj6g-production-vohbr3y vary Accept-Encoding content-type application/json cache-control s-maxage=60, stale-while-revalidate x-debug-info eyJyZXRyaWVzIjowfQ== permissions-policy geolocation=(self "https://*.recordedfuture.com/") cf-ray 7f02d1b81fb51e66-FRA x-platform-router pzzg6kk2mvryq2jfoxqht4lu3u x-cache-hits 1422, 1
GET H2	200	nation-state.json Show response therecord.media/_next/data/Qp27NUJEh0WTliiSUfaJp/news/	7 KB 2 KB	26ms 26ms	Fetch application/json	2606:4700:4400::6812:20b5 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://therecord.media/_next/data/Qp27NUJEh0WTliiSUfaJp/news/nation-state.json Requested by Host: therecord.media URL: https://therecord.media/_next/static/chunks/main-a054bbf31fb90f6a.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:4400::6812:20b5 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 246f98dbb5c6f4eeba6ceb5dc6bd0fc29ef7e6f587bfd273e91f505ef5d1fa15 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://therecord.media/iran-company-providing-ransomware-infrastructure User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36 Response headers date Wed, 02 Aug 2023 02:16:30 GMT via 1.1 varnish, 1.1 varnish content-encoding br strict-transport-security max-age=31536000; includeSubDomains cf-cache-status DYNAMIC age 42 traceresponse 00-17776656ffec8f9701c1f3796b9eb483-a212fe5f2ba533a9-00 x-cache HIT, HIT x-platform-processor xgztqld4evaw2suiwyeszt2fga x-served-by cache-iad-kjyo7100154-IAD, cache-fra-eddf8230058-FRA server cloudflare etag W/"1c62-Xk68GV9sRTiHOPqbtP2jW7uI0t0" x-platform-cluster 6l7w2dvltmj6g-production-vohbr3y vary Accept-Encoding content-type application/json cache-control s-maxage=60, stale-while-revalidate x-debug-info eyJyZXRyaWVzIjowfQ== permissions-policy geolocation=(self "https://*.recordedfuture.com/") cf-ray 7f02d1b81fb71e66-FRA x-platform-router pzzg6kk2mvryq2jfoxqht4lu3u x-cache-hits 1461, 1
GET H2	200	cybercrime.json Show response therecord.media/_next/data/Qp27NUJEh0WTliiSUfaJp/news/	7 KB 2 KB	22ms 22ms	Fetch application/json	2606:4700:4400::6812:20b5 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://therecord.media/_next/data/Qp27NUJEh0WTliiSUfaJp/news/cybercrime.json Requested by Host: therecord.media URL: https://therecord.media/_next/static/chunks/main-a054bbf31fb90f6a.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:4400::6812:20b5 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash b19c64187ce24161ae34475d263da949864edc290d68db24697bf566ce31b625 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://therecord.media/iran-company-providing-ransomware-infrastructure User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36 Response headers date Wed, 02 Aug 2023 02:16:30 GMT via 1.1 varnish, 1.1 varnish content-encoding br strict-transport-security max-age=31536000; includeSubDomains cf-cache-status DYNAMIC age 59 traceresponse 00-17776656fc5b00a64e9cf190260ef350-159d80582efd2068-00 x-cache HIT, HIT x-platform-processor xgztqld4evaw2suiwyeszt2fga x-served-by cache-iad-kjyo7100108-IAD, cache-fra-eddf8230031-FRA server cloudflare etag W/"1c59-AAV+mJtHjWBPsIvUeKirEXb17FA" x-platform-cluster 6l7w2dvltmj6g-production-vohbr3y vary Accept-Encoding content-type application/json cache-control s-maxage=60, stale-while-revalidate x-debug-info eyJyZXRyaWVzIjowfQ== permissions-policy geolocation=(self "https://*.recordedfuture.com/") cf-ray 7f02d1b81fb81e66-FRA x-platform-router pzzg6kk2mvryq2jfoxqht4lu3u x-cache-hits 1515, 1
GET H2	200	leadership.json Show response therecord.media/_next/data/Qp27NUJEh0WTliiSUfaJp/news/	7 KB 2 KB	23ms 23ms	Fetch application/json	2606:4700:4400::6812:20b5 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://therecord.media/_next/data/Qp27NUJEh0WTliiSUfaJp/news/leadership.json Requested by Host: therecord.media URL: https://therecord.media/_next/static/chunks/main-a054bbf31fb90f6a.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:4400::6812:20b5 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 8a35f85deafee7d35b61593efeaf5cce2207a300a82122d19059cf161ec60c80 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://therecord.media/iran-company-providing-ransomware-infrastructure User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36 Response headers date Wed, 02 Aug 2023 02:16:30 GMT via 1.1 varnish, 1.1 varnish content-encoding br strict-transport-security max-age=31536000; includeSubDomains cf-cache-status DYNAMIC age 42 traceresponse 00-17776656ff10eaaf9dc9c8283572f2fd-0b6804d28b493d7b-00 x-cache HIT, HIT x-platform-processor xgztqld4evaw2suiwyeszt2fga x-served-by cache-iad-kjyo7100092-IAD, cache-fra-eddf8230102-FRA server cloudflare etag W/"1c59-KuDdWdF8XrEcxtNZDbdbDjolA+Y" x-platform-cluster 6l7w2dvltmj6g-production-vohbr3y vary Accept-Encoding content-type application/json cache-control s-maxage=60, stale-while-revalidate x-debug-info eyJyZXRyaWVzIjowfQ== permissions-policy geolocation=(self "https://*.recordedfuture.com/") cf-ray 7f02d1b82fc01e66-FRA x-platform-router pzzg6kk2mvryq2jfoxqht4lu3u x-cache-hits 1415, 1
GET H2	200	index.json Show response therecord.media/_next/data/Qp27NUJEh0WTliiSUfaJp/	48 KB 13 KB	24ms 24ms	Fetch application/json	2606:4700:4400::6812:20b5 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://therecord.media/_next/data/Qp27NUJEh0WTliiSUfaJp/index.json Requested by Host: therecord.media URL: https://therecord.media/_next/static/chunks/main-a054bbf31fb90f6a.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:4400::6812:20b5 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash addcfe5ae4e853b1acf7d1b46bbf4d5f6fca0e7371f3aa67fa3de5ecb15057a6 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://therecord.media/iran-company-providing-ransomware-infrastructure User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36 Response headers date Wed, 02 Aug 2023 02:16:30 GMT via 1.1 varnish, 1.1 varnish content-encoding br strict-transport-security max-age=31536000; includeSubDomains cf-cache-status DYNAMIC age 46 traceresponse 00-17776ea74847cf320bd6703b0a4ea18c-0f699e87a0296917-00 x-cache HIT, HIT x-platform-processor xgztqld4evaw2suiwyeszt2fga x-served-by cache-iad-kjyo7100087-IAD, cache-fra-eddf8230029-FRA server cloudflare etag W/"c1ea-hlDwqe4otZGuZBNS2f5yWbjkBjg" x-platform-cluster 6l7w2dvltmj6g-production-vohbr3y vary Accept-Encoding content-type application/json cache-control s-maxage=60, stale-while-revalidate x-debug-info eyJyZXRyaWVzIjowfQ== permissions-policy geolocation=(self "https://*.recordedfuture.com/") cf-ray 7f02d1b82fc21e66-FRA x-platform-router pzzg6kk2mvryq2jfoxqht4lu3u x-cache-hits 11, 1
POST H2	204	matomo.php recordedfuture.matomo.cloud/	0 167 B	94ms 55ms	Ping text/plain	18.195.235.189 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://recordedfuture.matomo.cloud/matomo.php?action_name=therecord.media%2FIranian%20cloud%20company%20accused%20of%20hosting%20cybercriminals%2C%20nation-state%20hackers&idsite=2&rec=1&r=434462&h=2&m=16&s=30&url=https%3A%2F%2Ftherecord.media%2Firan-company-providing-ransomware-infrastructure&_id=321c3d9a488857b8&_idn=1&send_image=0&_refts=0&pdf=1&qt=0&realp=0&wma=0&fla=0&java=0&ag=0&cookie=1&res=1600x1200&pv_id=Pse3VT&fa_pv=1&fa_fp[0][fa_vid]=mGrFnz&fa_fp[0][fa_fv]=1&pf_net=43&pf_srv=134&pf_tfr=1&pf_dm1=5&pf_dm2=947&pf_onl=2&uadata=%7B%22fullVersionList%22%3A%5B%5D%2C%22mobile%22%3Afalse%2C%22model%22%3A%22%22%2C%22platform%22%3A%22%22%2C%22platformVersion%22%3A%22%22%7D Requested by Host: cdn.matomo.cloud URL: https://cdn.matomo.cloud/recordedfuture.matomo.cloud/matomo.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.195.235.189 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-195-235-189.eu-central-1.compute.amazonaws.com Software Apache / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://therecord.media/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36 Content-Type application/x-www-form-urlencoded; charset=utf-8 Response headers access-control-allow-origin https://therecord.media date Wed, 02 Aug 2023 02:16:30 GMT access-control-allow-credentials true server Apache vary X-Forwarded-Port-Override,X-Forwarded-Proto-Override,User-Agent
GET H2	200	64dc3ec5-330c-4652-88d3-147ee65e90ba.js Show response j.6sc.co/j/	4 KB 2 KB	55ms 16ms	Script application/javascript	2.17.100.184 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://j.6sc.co/j/64dc3ec5-330c-4652-88d3-147ee65e90ba.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-PVJ5W86 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a2-17-100-184.deploy.static.akamaitechnologies.com Software AmazonS3 / Resource Hash 7b0b9f163454a2d476c3930174ed354b5d661060c2a2581e434f8b0b74392d76 Request headers accept-language de-DE,de;q=0.9 Referer https://therecord.media/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36 Response headers x-amz-version-id XiK7k1K4G4_9UcBg2.S65sIFd54SfIcU content-encoding gzip date Wed, 02 Aug 2023 02:16:30 GMT x-amz-cf-pop FRA60-P1 x-amz-server-side-encryption AES256 x-amz-meta-content-type application/json content-length 1176 pragma no-cache last-modified Fri, 31 Mar 2023 18:59:38 GMT server AmazonS3 etag "29e881d3528b8d3d0ef42c057d73a114" vary Accept-Encoding content-type application/javascript cache-control max-age=0, no-cache, no-store accept-ranges bytes x-amz-cf-id yX_4ZF7mrxly1P1_sq96t8ZaLdFaHqQYBAMzRwDI4QNghPbHYZSoEA== expires Wed, 02 Aug 2023 02:16:30 GMT
GET H2	200	6si.min.js Show response j.6sc.co/	48 KB 14 KB	43ms 7ms	Script application/javascript	2.17.100.184 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://j.6sc.co/6si.min.js Requested by Host: therecord.media URL: https://therecord.media/iran-company-providing-ransomware-infrastructure Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a2-17-100-184.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash ae3536ecd79c98f87387cee9060be3053e0eb8fe0871e7336554812ef8138772 Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://therecord.media/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36 Response headers pragma no-cache date Wed, 02 Aug 2023 02:16:30 GMT content-encoding gzip x-content-type-options nosniff last-modified Thu, 20 Jul 2023 16:27:10 GMT server nginx/1.14.0 (Ubuntu) etag "64b9605e-bf6f" vary Accept-Encoding content-type application/javascript cache-control private, no-cache, proxy-revalidate accept-ranges bytes content-length 14190 expires Wed, 02 Aug 2023 02:16:30 GMT
GET H2	200	js Show response www.googletagmanager.com/gtag/	263 KB 88 KB	18ms 17ms	Script application/javascript	2a00:1450:4001:830::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=G-EYNZBT8ZP2&l=dataLayer&cx=c Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-PVJ5W86 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:830::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash e4d934d9765f69fc45072b999ca2055e8ef7e7eb4898e48b01e8990cfda2de38 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://therecord.media/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36 Response headers date Wed, 02 Aug 2023 02:16:30 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true cross-origin-resource-policy cross-origin access-control-allow-headers Cache-Control content-length 89538 x-xss-protection 0 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 expires Wed, 02 Aug 2023 02:16:30 GMT
GET H2	200	analytics.js Show response www.google-analytics.com/	52 KB 21 KB	40ms 7ms	Script text/javascript	2a00:1450:4001:82f::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/analytics.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-PVJ5W86 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:82f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://therecord.media/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36 Response headers strict-transport-security max-age=10886400; includeSubDomains; preload content-encoding gzip x-content-type-options nosniff date Wed, 02 Aug 2023 01:44:24 GMT last-modified Mon, 12 Jun 2023 18:23:07 GMT server Golfe2 age 1926 vary Accept-Encoding content-type text/javascript cache-control public, max-age=7200 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 20994 expires Wed, 02 Aug 2023 03:44:24 GMT
GET H2	200	252628.js Show response js.hs-scripts.com/	1 KB 1 KB	394ms 372ms	Script application/javascript	2606:4700::6812:853b CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js.hs-scripts.com/252628.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-PVJ5W86 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:853b , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash b208ef49ba62597cf389fa884be66dd0beb6534233e8896491a82c504e827fc2 Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://therecord.media/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36 Response headers date Wed, 02 Aug 2023 02:16:31 GMT content-encoding br x-content-type-options nosniff cf-cache-status EXPIRED x-evy-trace-route-service-name envoyset-translator x-hubspot-correlation-id f0388cd3-7ed3-4390-9e1d-95e09cd42bae x-envoy-upstream-service-time 2 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id f0388cd3-7ed3-4390-9e1d-95e09cd42bae last-modified Wed, 02 Aug 2023 02:13:55 GMT server cloudflare x-trace 2B2E219489ABF24B4B26DD9B153B01A3D1657ADBBC000000000000000000 vary origin, Accept-Encoding access-control-max-age 3600 content-type application/javascript;charset=utf-8 access-control-allow-origin https://therecord.media x-evy-trace-virtual-host all cache-control public, max-age=60 access-control-allow-credentials true x-evy-trace-served-by-pod iad02/hubapi-td/envoy-proxy-598c95b5b7-jknpv cf-ray 7f02d1b87de82bde-FRA expires Wed, 02 Aug 2023 02:17:31 GMT
GET H2	200	configs.php Show response recordedfuture.matomo.cloud/plugins/HeatmapSessionRecording/	116 B 291 B	24ms 14ms	Script application/javascript	18.195.235.189 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://recordedfuture.matomo.cloud/plugins/HeatmapSessionRecording/configs.php?idsite=2&trackerid=7vh8z0&url=https%3A%2F%2Ftherecord.media%2Firan-company-providing-ransomware-infrastructure Requested by Host: cdn.matomo.cloud URL: https://cdn.matomo.cloud/recordedfuture.matomo.cloud/matomo.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.195.235.189 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-195-235-189.eu-central-1.compute.amazonaws.com Software Apache / Resource Hash cda6294f23938e7f6993f3f239e44087b99837681abc334eebf7837f1f77300f Request headers accept-language de-DE,de;q=0.9 Referer https://therecord.media/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36 Response headers date Wed, 02 Aug 2023 02:16:30 GMT content-encoding gzip server Apache content-length 119 vary X-Forwarded-Port-Override,X-Forwarded-Proto-Override,Accept-Encoding,User-Agent content-type application/javascript
GET DATA	200 OK	truncated /	42 B 0		Image image/gif
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36 Response headers Content-Type image/gif
POST H2	204	collect region1.analytics.google.com/g/	0 253 B	36ms 13ms	Ping text/plain	2001:4860:4802:32::36 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://region1.analytics.google.com/g/collect?v=2&tid=G-EYNZBT8ZP2&gtm=45je37v0&_p=1302522093&_gaz=1&cid=2036918357.1690942591&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=1&sid=1690942590&sct=1&seg=0&dl=https%3A%2F%2Ftherecord.media%2Firan-company-providing-ransomware-infrastructure&dt=Iranian%20cloud%20company%20accused%20of%20hosting%20cybercriminals%2C%20nation-state%20hackers&en=page_view&_fv=1&_nsi=1&_ss=1 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=G-EYNZBT8ZP2&l=dataLayer&cx=c Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language de-DE,de;q=0.9 Referer https://therecord.media/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36 Response headers pragma no-cache date Wed, 02 Aug 2023 02:16:30 GMT server Golfe2 content-type text/plain access-control-allow-origin https://therecord.media cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 0 expires Fri, 01 Jan 1990 00:00:00 GMT
POST H2	204	collect stats.g.doubleclick.net/g/	0 253 B	78ms 25ms	Ping text/plain	2a00:1450:400c:c00::9a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://stats.g.doubleclick.net/g/collect?v=2&tid=G-EYNZBT8ZP2&cid=2036918357.1690942591&gtm=45je37v0&aip=1 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=G-EYNZBT8ZP2&l=dataLayer&cx=c Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:400c:c00::9a Brussels, Belgium, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language de-DE,de;q=0.9 Referer https://therecord.media/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36 Response headers pragma no-cache date Wed, 02 Aug 2023 02:16:31 GMT server Golfe2 content-type text/plain access-control-allow-origin https://therecord.media cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	ga-audiences www.google.de/ads/	42 B 408 B	41ms 17ms	Image image/gif	2a00:1450:4001:827::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-EYNZBT8ZP2&cid=2036918357.1690942591&gtm=45je37v0&aip=1&z=1090281704 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://therecord.media/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36 Response headers pragma no-cache date Wed, 02 Aug 2023 02:16:30 GMT x-content-type-options nosniff server cafe content-type image/gif p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	image therecord.media/_next/	62 KB 62 KB	158ms 157ms	Image image/webp	2606:4700:4400::6812:20b5 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://therecord.media/_next/image?url=https%3A%2F%2Fcms.recordedfuture.com%2Fuploads%2Fbluebravo_adapts_to_target_diplomatic_entities_with_graphicalproton_malware_main_header_aa4e8487a2.jpg&w=1920&q=75 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:4400::6812:20b5 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 37b9ec6d79e98b0715364517d6c903c15efc88ef935ccd43b6ba4fc5428e7e92 Security Headers Name Value Content-Security-Policy script-src 'none'; frame-src 'none'; sandbox; Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://therecord.media/iran-company-providing-ransomware-infrastructure User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36 Response headers date Wed, 02 Aug 2023 02:16:31 GMT content-security-policy script-src 'none'; frame-src 'none'; sandbox; via 1.1 varnish, 1.1 varnish strict-transport-security max-age=31536000; includeSubDomains cf-cache-status DYNAMIC age 0 traceresponse 00-17776f53dbe04990f16cfaa1bcb97806-a5a9efbe9d3ccfe5-00 x-cache MISS, MISS x-nextjs-cache HIT x-platform-processor xgztqld4evaw2suiwyeszt2fga content-disposition inline; filename="bluebravo_adapts_to_target_diplomatic_entities_with_graphicalproton_malware_main_header_aa4e8487a2.webp" content-length 63000 x-served-by cache-iad-kcgs7200167-IAD, cache-fra-eddf8230030-FRA server cloudflare etag N7nsbXnpiwcVNkUX1skDwV78iO+TXM1DtrpPxUKOfpI= x-platform-cluster 6l7w2dvltmj6g-production-vohbr3y vary Accept content-type image/webp cache-control public, max-age=0, must-revalidate x-debug-info eyJyZXRyaWVzIjowfQ== permissions-policy geolocation=(self "https://*.recordedfuture.com/") accept-ranges bytes cf-ray 7f02d1b9b9101e66-FRA x-platform-router pzzg6kk2mvryq2jfoxqht4lu3u x-cache-hits 0, 0
GET H2	200	image therecord.media/_next/	33 KB 34 KB	143ms 142ms	Image image/webp	2606:4700:4400::6812:20b5 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://therecord.media/_next/image?url=https%3A%2F%2Fcms.recordedfuture.com%2Fuploads%2Fputins_potential_successors_part_2_aleksey_dyumin_7dbea78c42.jpg&w=1920&q=75 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:4400::6812:20b5 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash b5631ce64f8ba3192a9941c26d882aa7d13c7a36d3f40b89c30fcade6def01ac Security Headers Name Value Content-Security-Policy script-src 'none'; frame-src 'none'; sandbox; Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://therecord.media/iran-company-providing-ransomware-infrastructure User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36 Response headers date Wed, 02 Aug 2023 02:16:31 GMT content-security-policy script-src 'none'; frame-src 'none'; sandbox; via 1.1 varnish, 1.1 varnish strict-transport-security max-age=31536000; includeSubDomains cf-cache-status DYNAMIC age 0 traceresponse 00-17776f53dbee30e825b395985c342750-8d914aa7af7a4a29-00 x-cache MISS, MISS x-nextjs-cache HIT x-platform-processor xgztqld4evaw2suiwyeszt2fga content-disposition inline; filename="putins_potential_successors_part_2_aleksey_dyumin_7dbea78c42.webp" content-length 34112 x-served-by cache-iad-kiad7000157-IAD, cache-fra-eddf8230031-FRA server cloudflare etag tWMc5k+LoxkqmUHCbYgqp9E8ejbT9AuJww-K3m3vAaw= x-platform-cluster 6l7w2dvltmj6g-production-vohbr3y vary Accept content-type image/webp cache-control public, max-age=0, must-revalidate x-debug-info eyJyZXRyaWVzIjowfQ== permissions-policy geolocation=(self "https://*.recordedfuture.com/") accept-ranges bytes cf-ray 7f02d1b9b9111e66-FRA x-platform-router pzzg6kk2mvryq2jfoxqht4lu3u x-cache-hits 0, 0
GET H2	200	image therecord.media/_next/	139 KB 140 KB	172ms 172ms	Image image/webp	2606:4700:4400::6812:20b5 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://therecord.media/_next/image?url=https%3A%2F%2Fcms.recordedfuture.com%2Fuploads%2F2023_0710_Blog_China_s_Targeting_of_International_Companies_in_Geopolitical_Competition_Main_Feature_7e6549facc.jpg&w=1920&q=75 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:4400::6812:20b5 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 4e4982cc8291d2497cfa5956d4bf01b7ffba61425a9e2f5276e30f7c2ecbdf07 Security Headers Name Value Content-Security-Policy script-src 'none'; frame-src 'none'; sandbox; Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://therecord.media/iran-company-providing-ransomware-infrastructure User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36 Response headers date Wed, 02 Aug 2023 02:16:31 GMT content-security-policy script-src 'none'; frame-src 'none'; sandbox; via 1.1 varnish, 1.1 varnish strict-transport-security max-age=31536000; includeSubDomains cf-cache-status DYNAMIC age 0 traceresponse 00-17776f53dc0d8ccb2207f37bc9025b49-81a9f43e680748eb-00 x-cache MISS, MISS x-nextjs-cache HIT x-platform-processor xgztqld4evaw2suiwyeszt2fga content-disposition inline; filename="2023_0710_Blog_China_s_Targeting_of_International_Companies_in_Geopolitical_Competition_Main_Feature_7e6549facc.webp" content-length 142794 x-served-by cache-iad-kiad7000052-IAD, cache-fra-eddf8230063-FRA server cloudflare etag TkmCzIKR0kl8+llW1L8Bt-+6YUJani9SduMPfC7L3wc= x-platform-cluster 6l7w2dvltmj6g-production-vohbr3y vary Accept content-type image/webp cache-control public, max-age=0, must-revalidate x-debug-info eyJyZXRyaWVzIjowfQ== permissions-policy geolocation=(self "https://*.recordedfuture.com/") accept-ranges bytes cf-ray 7f02d1b9b9131e66-FRA x-platform-router pzzg6kk2mvryq2jfoxqht4lu3u x-cache-hits 0, 0
GET H2	200	6si.min.js Show response j.6sc.co/	48 KB 14 KB	7ms 7ms	Script application/javascript	2.17.100.184 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://j.6sc.co/6si.min.js Requested by Host: j.6sc.co URL: https://j.6sc.co/j/64dc3ec5-330c-4652-88d3-147ee65e90ba.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a2-17-100-184.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash ae3536ecd79c98f87387cee9060be3053e0eb8fe0871e7336554812ef8138772 Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://therecord.media/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36 Response headers pragma no-cache date Wed, 02 Aug 2023 02:16:31 GMT content-encoding gzip x-content-type-options nosniff last-modified Thu, 20 Jul 2023 16:27:10 GMT server nginx/1.14.0 (Ubuntu) etag "64b9605e-bf6f" vary Accept-Encoding content-type application/javascript cache-control private, no-cache, proxy-revalidate accept-ranges bytes content-length 14190 expires Wed, 02 Aug 2023 02:16:31 GMT
GET H2	200	getuidj Show response secure.adnxs.com/	11 B 574 B	27ms 6ms	XHR application/json	37.252.171.149 ASN-APPNEX
General Check archive.org Show headers Download Go to Full URL https://secure.adnxs.com/getuidj Requested by Host: j.6sc.co URL: https://j.6sc.co/6si.min.js Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 37.252.171.149 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US), Reverse DNS 984.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net Software nginx/1.21.3 / Resource Hash 31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d Security Headers Name Value X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://therecord.media/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36 Response headers pragma no-cache date Wed, 02 Aug 2023 02:16:31 GMT an-x-request-uuid 6f848911-62d8-4f34-9edb-a7f9971f0ac9 server nginx/1.21.3 accept-ch Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness p3p policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" content-type application/json; charset=utf-8 access-control-allow-origin https://therecord.media cache-control no-store, no-cache, private access-control-allow-credentials true x-proxy-origin 138.199.38.133; 138.199.38.133; 984.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com content-length 11 x-xss-protection 0 expires Sat, 15 Nov 2008 16:00:00 GMT
GET H2	200	/ Show response c.6sc.co/	7 B 192 B	7ms 7ms	XHR text/html	2.17.100.184 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://c.6sc.co/ Requested by Host: j.6sc.co URL: https://j.6sc.co/6si.min.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a2-17-100-184.deploy.static.akamaitechnologies.com Software / Resource Hash fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a Request headers accept-language de-DE,de;q=0.9 Referer https://therecord.media/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36 Response headers date Wed, 02 Aug 2023 02:16:31 GMT access-control-max-age 86400 access-control-allow-methods GET,POST content-type text/html access-control-allow-origin https://therecord.media access-control-allow-credentials true access-control-allow-headers * content-length 7
GET H2	200	/ Show response ipv6.6sc.co/	36 B 330 B	41ms 7ms	XHR text/html	2a02:26f0:7100::210:172 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://ipv6.6sc.co/ Requested by Host: j.6sc.co URL: https://j.6sc.co/6si.min.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:7100::210:172 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software / Resource Hash 41e165d14c79e74c40fd0901d74a111d14ac94662b75ee811e52f984627f2a25 Request headers accept-language de-DE,de;q=0.9 Referer https://therecord.media/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36 Response headers pragma no-cache date Wed, 02 Aug 2023 02:16:31 GMT vary Origin content-type text/html access-control-allow-origin https://therecord.media cache-control max-age=0, no-cache, no-store 6si-ipv6 2a02:6ea0:c71b:0:1011:ce2c:763f:584f server-timing cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="469706_34603374_655589915_19_638_5_0_219";dur=1 content-length 36 expires Wed, 02 Aug 2023 02:16:31 GMT
POST H2	200	collect Show response www.google-analytics.com/j/	15 B 220 B	14ms 14ms	XHR text/plain	2a00:1450:4001:82f::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/j/collect?v=1&_v=j101&a=1302522093&t=pageview&_s=1&dl=https%3A%2F%2Ftherecord.media%2Firan-company-providing-ransomware-infrastructure&ul=en-us&de=UTF-8&dt=Iranian%20cloud%20company%20accused%20of%20hosting%20cybercriminals%2C%20nation-state%20hackers&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YADAAEABAAAAACAAI~&jid=274839466&gjid=391909098&cid=2036918357.1690942591&tid=UA-9153858-16&_gid=2141636130.1690942591&_r=1&_slc=1&gtm=45He37v0n81PVJ5W86&z=1891701682 Requested by Host: www.google-analytics.com URL: https://www.google-analytics.com/analytics.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:82f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash c6421f609cd61551ff948070601ddc54727d75ed1d42b77a65f349438ceab3c3 Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://therecord.media/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Wed, 02 Aug 2023 02:16:31 GMT x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 content-type text/plain access-control-allow-origin https://therecord.media cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 15 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	/ Show response c.6sc.co/	7 B 192 B	7ms 7ms	XHR text/html	2.17.100.184 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://c.6sc.co/ Requested by Host: j.6sc.co URL: https://j.6sc.co/6si.min.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a2-17-100-184.deploy.static.akamaitechnologies.com Software / Resource Hash fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a Request headers accept-language de-DE,de;q=0.9 Referer https://therecord.media/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36 Response headers date Wed, 02 Aug 2023 02:16:31 GMT access-control-max-age 86400 access-control-allow-methods GET,POST content-type text/html access-control-allow-origin https://therecord.media access-control-allow-credentials true access-control-allow-headers * content-length 7
GET H2	200	/ Show response ipv6.6sc.co/	36 B 330 B	24ms 7ms	XHR text/html	2a02:26f0:7100::210:172 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://ipv6.6sc.co/ Requested by Host: j.6sc.co URL: https://j.6sc.co/6si.min.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:7100::210:172 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software / Resource Hash 41e165d14c79e74c40fd0901d74a111d14ac94662b75ee811e52f984627f2a25 Request headers accept-language de-DE,de;q=0.9 Referer https://therecord.media/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36 Response headers pragma no-cache date Wed, 02 Aug 2023 02:16:31 GMT vary Origin content-type text/html access-control-allow-origin https://therecord.media cache-control max-age=0, no-cache, no-store 6si-ipv6 2a02:6ea0:c71b:0:1011:ce2c:763f:584f server-timing cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="469706_34603374_655589916_19_630_5_0_219";dur=1 content-length 36 expires Wed, 02 Aug 2023 02:16:31 GMT
GET H2	200	ef46db3751d8e999.css Show response therecord.media/_next/static/css/	0 258 B	19ms 19ms	Fetch text/css	2606:4700:4400::6812:20b5 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://therecord.media/_next/static/css/ef46db3751d8e999.css Requested by Host: therecord.media URL: https://therecord.media/_next/static/chunks/main-a054bbf31fb90f6a.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:4400::6812:20b5 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://therecord.media/iran-company-providing-ransomware-infrastructure User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36 Response headers date Wed, 02 Aug 2023 02:16:31 GMT via 1.1 varnish, 1.1 varnish strict-transport-security max-age=31536000; includeSubDomains cf-cache-status DYNAMIC age 938586 traceresponse 00-177419b04f8f0cec640b7b43995cb7f0-0f6a68c3a856c3d3-00 x-cache HIT, HIT x-platform-processor xgztqld4evaw2suiwyeszt2fga content-length 0 x-served-by cache-iad-kiad7000084-IAD, cache-fra-eddf8230049-FRA last-modified Thu, 20 Jul 2023 09:03:56 GMT server cloudflare etag W/"0-189728aa5bc" x-platform-cluster 6l7w2dvltmj6g-production-vohbr3y vary Accept-Encoding content-type text/css; charset=UTF-8 cache-control public, max-age=31536000, immutable x-debug-info eyJyZXRyaWVzIjowfQ== permissions-policy geolocation=(self "https://*.recordedfuture.com/") accept-ranges bytes cf-ray 7f02d1b9d9271e66-FRA x-platform-router pzzg6kk2mvryq2jfoxqht4lu3u x-cache-hits 3594, 4
GET H3	200	js Show response www.googletagmanager.com/gtag/	230 KB 80 KB	22ms 22ms	Script application/javascript	2a00:1450:4001:830::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=G-F540L9EG7D&cx=c&_slc=1 Requested by Host: www.google-analytics.com URL: https://www.google-analytics.com/analytics.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:830::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 523cc5ec9df8383f6474963762e452f0c871da12272b8894439141c7102f5418 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://therecord.media/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36 Response headers date Wed, 02 Aug 2023 02:16:31 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true cross-origin-resource-policy cross-origin access-control-allow-headers Cache-Control content-length 82113 x-xss-protection 0 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 expires Wed, 02 Aug 2023 02:16:31 GMT
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 485 B	199ms 199ms	Image image/gif	2.17.100.184 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=f2675e8089b7d209a58fce8ad312f51c&svisitor=null&visitor=acb817d0-8178-4564-82e9-226444fdb156&session=d8201a4b-717a-4bb1-8479-69298ac52bac&event=a_pageload&q=%7B%22pageLoadTime%22%3A%22Wed%2C%2002%20Aug%202023%2002%3A16%3A30%20GMT%22%2C%22settings%22%3A%22%5B%7B%5C%22name%5C%22%3A%5C%22enableEventTracking%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Wed%2C%2002%20Aug%202023%2002%3A16%3A30%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setToken%5C%22%2C%5C%22value%5C%22%3A%5C%22f2675e8089b7d209a58fce8ad312f51c%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Wed%2C%2002%20Aug%202023%2002%3A16%3A30%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setEpsilonKey%5C%22%2C%5C%22value%5C%22%3A%5C%22edabaa1866fe08952dde1be9ff37302d63145f08%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Wed%2C%2002%20Aug%202023%2002%3A16%3A30%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setEndpoint%5C%22%2C%5C%22value%5C%22%3A%5C%22b.6sc.co%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Wed%2C%2002%20Aug%202023%2002%3A16%3A30%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableCompanyDetails%5C%22%2C%5C%22value%5C%22%3A%5C%22%5Btrue%2Cnull%2C3%5D%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Wed%2C%2002%20Aug%202023%2002%3A16%3A30%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setToken%5C%22%2C%5C%22value%5C%22%3A%5C%22f2675e8089b7d209a58fce8ad312f51c%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Wed%2C%2002%20Aug%202023%2002%3A16%3A30%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setEpsilonKey%5C%22%2C%5C%22value%5C%22%3A%5C%2247c555096cc32557d3e6e7a333d7cb3ea692cee1%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Wed%2C%2002%20Aug%202023%2002%3A16%3A30%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableRetargeting%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Wed%2C%2002%20Aug%202023%2002%3A16%3A30%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setCustomMetatags%5C%22%2C%5C%22value%5C%22%3A%5C%22%5B%5D%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Wed%2C%2002%20Aug%202023%2002%3A16%3A30%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22storeTagId%5C%22%2C%5C%22value%5C%22%3A%5C%2264dc3ec5-330c-4652-88d3-147ee65e90ba%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Wed%2C%2002%20Aug%202023%2002%3A16%3A30%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableEventTracking%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Wed%2C%2002%20Aug%202023%2002%3A16%3A30%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableCompanyDetails%5C%22%2C%5C%22value%5C%22%3A%5C%22%5Btrue%2Cnull%2C3%5D%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Wed%2C%2002%20Aug%202023%2002%3A16%3A30%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%5D%22%7D&isIframe=false&m=%7B%22description%22%3A%22An%20Iranian%20technology%20company%20is%20providing%20infrastructure%20services%20to%20ransomware%20gangs%20and%20an%20array%20of%20nation-state%20hackers%2C%20researchers%20have%20found.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Iranian%20cloud%20company%20accused%20of%20hosting%20cybercriminals%2C%20nation-state%20hackers%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Ftherecord.media%2Firan-company-providing-ransomware-infrastructure&pageViewId=106eaa28-aebc-42e9-89be-591918e65906&an_uid=0&webTagId=64dc3ec5-330c-4652-88d3-147ee65e90ba&v=1.1.5 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a2-17-100-184.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://therecord.media/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36 Response headers date Wed, 02 Aug 2023 02:16:31 GMT x-content-type-options nosniff content-length 43 pragma no-cache last-modified Sat, 05 Jun 2021 07:56:05 GMT server nginx/1.14.0 (Ubuntu) etag "60bb2e15-2b" access-control-max-age 86400 access-control-allow-methods GET,POST content-type image/gif access-control-allow-origin cache-control private, no-cache, no-cache=Set-Cookie, proxy-revalidate access-control-allow-credentials true accept-ranges bytes access-control-allow-headers * expires Wed, 19 Apr 2000 11:43:00 GMT
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 484 B	193ms 193ms	Image image/gif	2.17.100.184 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=f2675e8089b7d209a58fce8ad312f51c&svisitor=null&visitor=acb817d0-8178-4564-82e9-226444fdb156&session=d8201a4b-717a-4bb1-8479-69298ac52bac&event=ipv6&q=%7B%22address%22%3A%222a02%3A6ea0%3Ac71b%3A0%3A1011%3Ace2c%3A763f%3A584f%22%7D&isIframe=false&m=%7B%22description%22%3A%22An%20Iranian%20technology%20company%20is%20providing%20infrastructure%20services%20to%20ransomware%20gangs%20and%20an%20array%20of%20nation-state%20hackers%2C%20researchers%20have%20found.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Iranian%20cloud%20company%20accused%20of%20hosting%20cybercriminals%2C%20nation-state%20hackers%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Ftherecord.media%2Firan-company-providing-ransomware-infrastructure&pageViewId=106eaa28-aebc-42e9-89be-591918e65906&an_uid=0&webTagId=64dc3ec5-330c-4652-88d3-147ee65e90ba&v=1.1.5 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a2-17-100-184.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://therecord.media/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36 Response headers date Wed, 02 Aug 2023 02:16:31 GMT x-content-type-options nosniff content-length 43 pragma no-cache last-modified Sat, 18 Feb 2023 00:49:36 GMT server nginx/1.14.0 (Ubuntu) etag "63f020a0-2b" access-control-max-age 86400 access-control-allow-methods GET,POST content-type image/gif access-control-allow-origin cache-control private, no-cache, no-cache=Set-Cookie, proxy-revalidate access-control-allow-credentials true accept-ranges bytes access-control-allow-headers * expires Wed, 19 Apr 2000 11:43:00 GMT
POST H2	204	collect region1.google-analytics.com/g/	0 54 B	15ms 14ms	Ping text/plain	2001:4860:4802:32::36 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://region1.google-analytics.com/g/collect?v=2&tid=G-F540L9EG7D&gtm=45je37v0&_p=1302522093&ul=en-us&sr=1600x1200&cid=2036918357.1690942591&ir=1&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_eu=EBAI&_s=1&dl=https%3A%2F%2Ftherecord.media%2Firan-company-providing-ransomware-infrastructure&dt=Iranian%20cloud%20company%20accused%20of%20hosting%20cybercriminals%2C%20nation-state%20hackers&sid=1690942591&sct=1&seg=0&en=page_view&_fv=1&_ss=1&_ee=1 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=G-F540L9EG7D&cx=c&_slc=1 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language de-DE,de;q=0.9 Referer https://therecord.media/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36 Response headers pragma no-cache date Wed, 02 Aug 2023 02:16:31 GMT server Golfe2 content-type text/plain access-control-allow-origin https://therecord.media cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 0 expires Fri, 01 Jan 1990 00:00:00 GMT
OPTIONS H2	200	details epsilon.6sense.com/v3/company/	0 0	57ms 13ms	Preflight	18.197.22.0 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://epsilon.6sense.com/v3/company/details Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 18.197.22.0 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-197-22-0.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash Request headers Accept */* Access-Control-Request-Headers authorization,x-6s-customid Access-Control-Request-Method GET Origin https://therecord.media Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36 Response headers access-control-allow-credentials true access-control-allow-headers authorization,x-6s-customid access-control-allow-methods OPTIONS,GET access-control-allow-origin https://therecord.media access-control-max-age 1800 date Wed, 02 Aug 2023 02:16:31 GMT server nginx
GET H2	200	details Show response epsilon.6sense.com/v3/company/	746 B 583 B	25ms 11ms	XHR application/json	18.197.22.0 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://epsilon.6sense.com/v3/company/details Requested by Host: j.6sc.co URL: https://j.6sc.co/6si.min.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 18.197.22.0 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-197-22-0.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash 9b2dc2a6592abd91e0dee577ef85461138e643d96bf3f3756f7c6d856d8d5e8b Request headers Referer https://therecord.media/ accept-language de-DE,de;q=0.9 Authorization Token 47c555096cc32557d3e6e7a333d7cb3ea692cee1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36 X-6s-CustomID WebTag 64dc3ec5-330c-4652-88d3-147ee65e90ba Response headers date Wed, 02 Aug 2023 02:16:31 GMT content-encoding gzip server nginx vary Accept-Encoding content-type application/json access-control-allow-origin https://therecord.media access-control-allow-credentials true content-length 399
GET H2	200	252628.js Show response js.hs-banner.com/	60 KB 16 KB	41ms 16ms	Script text/javascript	2606:4700::6812:18c4 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js.hs-banner.com/252628.js Requested by Host: js.hs-scripts.com URL: https://js.hs-scripts.com/252628.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:18c4 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 9239f316beef45cfc6ba7c2b31298e0da40af5924c7c20894960238ede334d68 Request headers accept-language de-DE,de;q=0.9 Referer https://therecord.media/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36 Response headers date Wed, 02 Aug 2023 02:16:31 GMT x-amz-version-id 1DTjZqz8w6c0vLd7dsrtWpmr4CMJx9XZ content-encoding br cf-cache-status HIT x-amz-request-id E4HP2Q5BSGBBNFVN age 245 x-amz-server-side-encryption AES256 x-amz-id-2 wEEbu1BCSXYegN0688WQ5rOFav5pd2fhSGOMr26PEaDL54qASkcK/PZP2fE1bWIYFtkOQPVKmxs4+7Mca4MwmrQXBq4PUYsFRImorzG2E3k= last-modified Mon, 17 Apr 2023 14:55:34 GMT server cloudflare etag W/"07022bb1d6cfa926ffae0fefc0ebffb7" access-control-max-age 604800 access-control-allow-methods GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD content-type text/javascript; charset=UTF-8 access-control-allow-origin https://securitytrails.com access-control-expose-headers x-last-modified-timestamp, X-HubSpot-NotFound, X-HS-User-Request, Link, Server-Timing cache-control max-age=300, public access-control-allow-credentials true vary origin, Accept-Encoding timing-allow-origin * access-control-allow-headers Origin, X-Requested-With, Content-Type, Accept, Accept-Charset, Accept-Encoding, X-Override-Internal-Permissions, X-Properties-Source, X-Properties-SourceId, X-Properties-Flag, X-Hubspot-User-Id, X-Hubspot-Trace, X-Hubspot-Callee, X-Hubspot-Offset, X-Hubspot-No-Trace, X-HubSpot-Static-App-Info, X-HubSpot-Messages-Uri, X-HubSpot-Request-Source, X-HubSpot-Request-Reason, Subscription-Billing-Auth-Token, X-App-CSRF, X-Tools-CSRF, Online-Payment-Signing-UUID, X-Source, X-SourceId, X-Origin-UserId, X-Biden-Request-Source, X-HubSpot-CSRF-hubspotapi, X-Force-Cookie-Refresh, X-Force-Cookie-Refresh-No-Cache, X-HS-User-Request, X-Application-Id, X-HS-Referer, X-HubSpot-Correlation-Id cf-ray 7f02d1bae9cc30f4-FRA expires Wed, 02 Aug 2023 02:17:26 GMT
GET H2	200	leadflows.js Show response js.hsleadflows.net/	539 KB 86 KB	40ms 13ms	Script application/javascript	2606:4700::6811:816e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js.hsleadflows.net/leadflows.js Requested by Host: js.hs-scripts.com URL: https://js.hs-scripts.com/252628.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6811:816e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 34e8744466c5ff918e7c5dc146e8dec70cfcdbdd60b773f2bcaa5e5409d7512b Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://therecord.media/ Origin https://therecord.media accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36 Response headers content-encoding br age 24791 x-evy-trace-route-service-name envoyset-translator x-amz-server-side-encryption AES256 content-security-policy-report-only frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=lead-flows-js/static-1.1223/bundle/main/lead-flows-release.js&cfRay=7f00747bde29920e-FRA x-amz-replication-status COMPLETED x-evy-trace-listener listener_https etag W/"ec18ee4dbbad7ceab888c3cda4eb9705" vary Accept-Encoding,Origin,Access-Control-Request-Headers,Access-Control-Request-Method access-control-allow-methods GET content-type application/javascript; charset=utf-8 access-control-allow-origin * x-evy-trace-virtual-host all cache-control s-maxage=86400, max-age=0 x-hs-target-asset lead-flows-js/static-1.1223/bundle/main/lead-flows-release.js date Wed, 02 Aug 2023 02:16:31 GMT x-amz-version-id RJnwkomo1rBqmkgtVuuzVEpsjxOWMbB. via 1.1 9d2dee9b44718f249b789987d2cbe62c.cloudfront.net (CloudFront) x-content-type-options nosniff cf-cache-status HIT x-amz-cf-pop IAD12-P3 x-hubspot-correlation-id edfef135-5a5f-4af4-9369-78abaf28415c x-cache Hit from cloudfront cache-tag staticjsapp-lead-flows-cloudflare-web-prod,staticjsapp-prod x-envoy-upstream-service-time 9 x-evy-trace-route-configuration listener_https/all x-request-id edfef135-5a5f-4af4-9369-78abaf28415c last-modified Tue, 18 Jul 2023 09:47:02 UTC server cloudflare access-control-max-age 3000 x-hs-cache-status MISS x-evy-trace-served-by-pod iad02/app-td/envoy-proxy-57ff77fcd-xhv87 cf-ray 7f02d1bafc4b1c40-FRA x-amz-cf-id GbJtkJMLkou6u-Qs237-t7lQlTNoRDCFbqu5yN7cT6fcQL5DQhZfSw==
GET H2	200	252628.js Show response js.hs-analytics.net/analytics/1690942500000/	67 KB 21 KB	161ms 142ms	Script text/javascript	2606:4700::6810:8cce CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js.hs-analytics.net/analytics/1690942500000/252628.js Requested by Host: js.hs-scripts.com URL: https://js.hs-scripts.com/252628.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:8cce , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash a3de1c2755def9517e7bde89c278860cbc98b57291765f12f291e3832e9866d0 Request headers accept-language de-DE,de;q=0.9 Referer https://therecord.media/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36 Response headers date Wed, 02 Aug 2023 02:16:31 GMT x-amz-version-id null content-encoding br cf-cache-status MISS x-amz-request-id HG8WF8N3VYGTQ9C9 x-evy-trace-route-service-name envoyset-translator x-amz-server-side-encryption AES256 x-hubspot-correlation-id 38afd454-4547-458a-b9a8-716f29c81192 x-envoy-upstream-service-time 20 x-amz-id-2 XgQbvCV9H8hWbqx318whYO+ZCVRb6nIVIVZhiFDLalNEYKYZWC5OFZ9pi+sQ7L6K2Viof0x5uh0= x-evy-trace-listener listener_https x-request-id 38afd454-4547-458a-b9a8-716f29c81192 x-evy-trace-route-configuration listener_https/all last-modified Thu, 20 Jul 2023 15:53:38 GMT server cloudflare etag W/"c365920d73adc4a3c91a99b921d37ee4" vary origin, Accept-Encoding content-type text/javascript x-evy-trace-virtual-host all x-evy-trace-served-by-pod iad02/analytics-js-proxy-td/envoy-proxy-7dbb6c8f49-ns2gd cache-control max-age=300,public access-control-allow-credentials false cf-ray 7f02d1baea223a5c-FRA expires Wed, 02 Aug 2023 02:21:31 GMT
GET H3	200	collect www.google-analytics.com/	35 B 55 B	7ms 6ms	Image image/gif	2a00:1450:4001:82f::200e GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google-analytics.com/collect?v=1&_v=j101&a=1302522093&t=event&ni=1&_s=1&dl=https%3A%2F%2Ftherecord.media%2Firan-company-providing-ransomware-infrastructure&ul=en-us&de=UTF-8&dt=Iranian%20cloud%20company%20accused%20of%20hosting%20cybercriminals%2C%20nation-state%20hackers&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=6si_company_details&ea=6si_data_loaded&_u=aADAAEABAAAAACAAI~&jid=&gjid=&cid=2036918357.1690942591&tid=UA-9153858-16&_gid=2141636130.1690942591&gtm=45He37v0n81PVJ5W86&cd1=&cd2=&cd3=&cd4=&cd5=&cd8=&z=1224216791 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:82f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015 Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://therecord.media/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36 Response headers pragma no-cache date Tue, 01 Aug 2023 13:18:46 GMT x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 age 46665 content-type image/gif access-control-allow-origin * cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 35 expires Mon, 01 Jan 1990 00:00:00 GMT
GET H2	200	__ptq.gif track.hubspot.com/	45 B 1 KB	163ms 146ms	Image image/gif	2606:4700::6813:9b53 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://track.hubspot.com/__ptq.gif?k=1&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=600004306&v=1.1&a=252628&pu=https%3A%2F%2Ftherecord.media%2Firan-company-providing-ransomware-infrastructure&t=Iranian+cloud+company+accused+of+hosting+cybercriminals%2C+nation-state+hackers&cts=1690942591335&vi=95db6c214b6e66d8fe94945fb3a8057b&nc=true&u=156209188.95db6c214b6e66d8fe94945fb3a8057b.1690942591332.1690942591332.1690942591332.1&b=156209188.1.1690942591333&pt=0&cc=15 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6813:9b53 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://therecord.media/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36 Response headers date Wed, 02 Aug 2023 02:16:31 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status DYNAMIC nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} x-evy-trace-route-service-name envoyset-translator x-hubspot-correlation-id 0e76396f-00d5-48d1-b399-6d5802904f73 p3p CP="NOI CUR ADM OUR NOR STA NID" x-envoy-upstream-service-time 10 alt-svc h3=":443"; ma=86400 content-length 45 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id 0e76396f-00d5-48d1-b399-6d5802904f73 server cloudflare vary origin, Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mpNmKDNIDXluhWmAl5xEoj0iGmiFaxPiLpnGPpFQXSYxSBybG7avyhOH3RlszzwSx63Mdcy7KX7SN2mJF3Za1%2FUoLMc6UeRgKldyQNAV3Qc7GbgIxucSoSufCU%2FWjhQ6UZt8CVU%2FOJkcaNMSyBI2"}],"group":"cf-nel","max_age":604800} content-type image/gif x-evy-trace-served-by-pod iad02/analytics-tracking-td/envoy-proxy-5f6448c676-j9299 x-evy-trace-virtual-host all cache-control no-cache, no-store, no-transform access-control-allow-credentials false cf-ray 7f02d1bbfcab3a7c-FRA x-robots-tag none
GET H2	200	json Show response forms.hubspot.com/lead-flows-config/v1/config/	2 KB 2 KB	215ms 182ms	XHR application/json	2606:4700::6813:9b53 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://forms.hubspot.com/lead-flows-config/v1/config/json?portalId=252628&utk=95db6c214b6e66d8fe94945fb3a8057b&__hstc=156209188.95db6c214b6e66d8fe94945fb3a8057b.1690942591332.1690942591332.1690942591332.1&__hssc=156209188.1.1690942591333&currentUrl=https%3A%2F%2Ftherecord.media%2Firan-company-providing-ransomware-infrastructure Requested by Host: js.hsleadflows.net URL: https://js.hsleadflows.net/leadflows.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6813:9b53 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 6063274625f294b5cc863f258e2e6f7c35b090e32cd714dce910babe7c889d9e Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://therecord.media/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36 Response headers date Wed, 02 Aug 2023 02:16:31 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status DYNAMIC nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} x-evy-trace-route-service-name envoyset-translator x-hubspot-correlation-id 7ca6cadc-ecd7-41ba-af33-4c4b081d191f content-encoding br x-envoy-upstream-service-time 69 alt-svc h3=":443"; ma=86400 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id 7ca6cadc-ecd7-41ba-af33-4c4b081d191f server cloudflare vary origin access-control-allow-methods GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD content-type application/json;charset=utf-8 access-control-allow-origin https://therecord.media x-evy-trace-virtual-host all access-control-max-age 180 access-control-allow-credentials false cache-control max-age=0, no-cache, no-store report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=YSbEs0M3%2BsRWZkl5Oxatj72o%2Fkbo2evrV%2B5dfzgkP9Zmw8KLJerCl166Mz3mYoRUOTp6hrG2GYD3pA8HxNQVEJN7Ag2AKUFX8XdAY058REiTLp%2BOfb%2FDs93vTuCSzFbtuZ8GU84iViru%2BiPjCjB%2B"}],"group":"cf-nel","max_age":604800} x-robots-tag none access-control-allow-headers Accept, Accept-Charset, Accept-Encoding, Accept-Language, Content-Type, Host, Origin, Referer, User-Agent cf-ray 7f02d1bc1ab7bbda-FRA x-evy-trace-served-by-pod iad02/star-hubspot-td/envoy-proxy-759c64d45c-f4t27
GET H2	200	__ptq.gif track.hubspot.com/	45 B 443 B	125ms 125ms	Image image/gif	2606:4700::6813:9b53 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://track.hubspot.com/__ptq.gif?k=16&fi=1b047a85-2db0-47ce-a965-8fa2de5a991b&lfi=2694169&ft=1&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=600004306&v=1.1&a=252628&pu=https%3A%2F%2Ftherecord.media%2Firan-company-providing-ransomware-infrastructure&t=Iranian+cloud+company+accused+of+hosting+cybercriminals%2C+nation-state+hackers&cts=1690942591562&vi=95db6c214b6e66d8fe94945fb3a8057b&nc=true&u=156209188.95db6c214b6e66d8fe94945fb3a8057b.1690942591332.1690942591332.1690942591332.1&b=156209188.1.1690942591333&pt=0&cc=15 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6813:9b53 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://therecord.media/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36 Response headers date Wed, 02 Aug 2023 02:16:31 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status DYNAMIC nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} x-evy-trace-route-service-name envoyset-translator x-hubspot-correlation-id c76e980b-85a0-4113-9ac2-24afb1bcce5a p3p CP="NOI CUR ADM OUR NOR STA NID" x-envoy-upstream-service-time 6 alt-svc h3=":443"; ma=86400 content-length 45 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id c76e980b-85a0-4113-9ac2-24afb1bcce5a server cloudflare vary origin, Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2FT0Ra%2FKaCG%2BcJ9dX7ShVj9E6BD%2BtTI09LlSJxmVq%2BYQT9VZBBIESahCjlvgAGaCIZgLkWvGXwMD%2FZ5mN39yiZlixyHy8hkUo4%2B7AZvcyVSyOMtT5baedN0RNlV5wXXZGgo23FWk4g528FxbuLz4l"}],"group":"cf-nel","max_age":604800} content-type image/gif x-evy-trace-served-by-pod iad02/analytics-tracking-td/envoy-proxy-5f6448c676-2c4rt x-evy-trace-virtual-host all cache-control no-cache, no-store, no-transform access-control-allow-credentials false cf-ray 7f02d1bd4da83a7c-FRA x-robots-tag none
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 484 B	195ms 194ms	Image image/gif	2.17.100.184 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=f2675e8089b7d209a58fce8ad312f51c&svisitor=null&visitor=acb817d0-8178-4564-82e9-226444fdb156&session=d8201a4b-717a-4bb1-8479-69298ac52bac&event=active_time_track&q=%7B%22currentTime%22%3A%22Wed%2C%2002%20Aug%202023%2002%3A16%3A31%20GMT%22%2C%22lastTrackTime%22%3A%22Wed%2C%2002%20Aug%202023%2002%3A16%3A30%20GMT%22%2C%22timeSpent%22%3A%221002%22%2C%22totalTimeSpent%22%3A%221002%22%7D&isIframe=false&m=%7B%22description%22%3A%22An%20Iranian%20technology%20company%20is%20providing%20infrastructure%20services%20to%20ransomware%20gangs%20and%20an%20array%20of%20nation-state%20hackers%2C%20researchers%20have%20found.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Iranian%20cloud%20company%20accused%20of%20hosting%20cybercriminals%2C%20nation-state%20hackers%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Ftherecord.media%2Firan-company-providing-ransomware-infrastructure&pageViewId=106eaa28-aebc-42e9-89be-591918e65906&an_uid=0&webTagId=64dc3ec5-330c-4652-88d3-147ee65e90ba&v=1.1.5 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a2-17-100-184.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://therecord.media/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36 Response headers date Wed, 02 Aug 2023 02:16:32 GMT x-content-type-options nosniff content-length 43 pragma no-cache last-modified Sat, 18 Feb 2023 00:49:36 GMT server nginx/1.14.0 (Ubuntu) etag "63f020a0-2b" access-control-max-age 86400 access-control-allow-methods GET,POST content-type image/gif access-control-allow-origin cache-control private, no-cache, no-cache=Set-Cookie, proxy-revalidate access-control-allow-credentials true accept-ranges bytes access-control-allow-headers * expires Wed, 19 Apr 2000 11:43:00 GMT
GET H2	200	iphone-cd1.jpg go.recordedfuture.com/hubfs/	83 KB 85 KB	90ms 34ms	Image image/webp	2606:2c40::c73c:6702 CLOUDFLARESPECTRU...
General Check archive.org Show headers Download Go to Show image Full URL https://go.recordedfuture.com/hubfs/iphone-cd1.jpg Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:2c40::c73c:6702 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash ab221b9e81a8439634c9f73c15c96457f75d3632fea1f6256fa4833acc6a314a Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=31536000 Request headers accept-language de-DE,de;q=0.9 Referer https://therecord.media/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36 Response headers content-security-policy upgrade-insecure-requests x-amz-meta-cache-tag F-99167145604,P-252628,FLS-ALL age 447957 x-amz-request-id RJZ9XC481ZAW6S1G x-amz-server-side-encryption AES256 edge-cache-tag F-99167145604,P-252628,FLS-ALL x-amz-replication-status COMPLETED x-hs-https-only worker content-disposition inline; filename="iphone-cd1.webp" x-hs-cf-lambda us-east-1.EnforceAclForReads 2 cf-bgj imgq:85,h2pri etag "f5c3d1b581a50e5c3637310137a43f0e" vary Accept, Accept-Encoding access-control-allow-methods GET content-type image/webp access-control-allow-origin * x-amz-meta-created-unix-time-millis 1674144065940 cache-control s-maxage=1814400, max-age=1209600, stale-while-revalidate=900 x-robots-tag all x-hs-cf-lambda-enforce us-east-1.EnforceAclForReads 2 date Wed, 02 Aug 2023 02:16:32 GMT strict-transport-security max-age=31536000 via 1.1 ee57e278d5f96045a012c4c3d8da58f8.cloudfront.net (CloudFront) cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} x-amz-version-id CyJHfLHHqfqm77ShwrX4xZ78eMxn5Xvx x-amz-cf-pop CDG53-C1 x-hs-alternate-content-type text/plain cf-polished qual=85, origFmt=jpeg, origSize=229013 x-cache RefreshHit from cloudfront cache-tag F-99167145604,P-252628,FLS-ALL x-amz-meta-index-tag all x-amz-storage-class INTELLIGENT_TIERING alt-svc h3=":443"; ma=86400 content-length 85082 x-amz-id-2 Uu5CgJxqg+/aj84XhRR867QQNoNB7hrryOTNY37HDVBVEEpYLyJqitc7wTftMzxIYuXEyxycPhUlKRMG1XD8ywzlv9UZ0Suq last-modified Thu, 19 Jan 2023 16:01:07 GMT server cloudflare report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DNrgNZjsr3KfiY0KucmN5Sd6u3x8b%2Bk491IPiqcCUgdZQosU2dfgZ%2FKeq%2FbUKNJeJJrgiJg916ql4pwTaplQLSDLC32HGCJQi87qObG06TBe5DZFhFQUaknOi7hQy8JIQMxQJhbLVZEAQCPBq8LpoPbzuQ%3D%3D"}],"group":"cf-nel","max_age":604800} accept-ranges bytes cf-ray 7f02d1c3eb4a3a9c-FRA x-amz-cf-id nsmw7KccN2z4IIQFIU3GgufPK_75n3me0G86yP8b97odL2EUB7E7_g==
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 484 B	196ms 196ms	Image image/gif	2.17.100.184 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=f2675e8089b7d209a58fce8ad312f51c&svisitor=null&visitor=acb817d0-8178-4564-82e9-226444fdb156&session=d8201a4b-717a-4bb1-8479-69298ac52bac&event=active_time_track&q=%7B%22currentTime%22%3A%22Wed%2C%2002%20Aug%202023%2002%3A16%3A33%20GMT%22%2C%22lastTrackTime%22%3A%22Wed%2C%2002%20Aug%202023%2002%3A16%3A31%20GMT%22%2C%22timeSpent%22%3A%221003%22%2C%22totalTimeSpent%22%3A%222005%22%7D&isIframe=false&m=%7B%22description%22%3A%22An%20Iranian%20technology%20company%20is%20providing%20infrastructure%20services%20to%20ransomware%20gangs%20and%20an%20array%20of%20nation-state%20hackers%2C%20researchers%20have%20found.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Iranian%20cloud%20company%20accused%20of%20hosting%20cybercriminals%2C%20nation-state%20hackers%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Ftherecord.media%2Firan-company-providing-ransomware-infrastructure&pageViewId=106eaa28-aebc-42e9-89be-591918e65906&an_uid=0&webTagId=64dc3ec5-330c-4652-88d3-147ee65e90ba&v=1.1.5 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a2-17-100-184.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://therecord.media/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36 Response headers date Wed, 02 Aug 2023 02:16:33 GMT x-content-type-options nosniff content-length 43 pragma no-cache last-modified Sat, 18 Feb 2023 00:49:36 GMT server nginx/1.14.0 (Ubuntu) etag "63f020a0-2b" access-control-max-age 86400 access-control-allow-methods GET,POST content-type image/gif access-control-allow-origin cache-control private, no-cache, no-cache=Set-Cookie, proxy-revalidate access-control-allow-credentials true accept-ranges bytes access-control-allow-headers * expires Wed, 19 Apr 2000 11:43:00 GMT
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 485 B	193ms 192ms	Image image/gif	2.17.100.184 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=f2675e8089b7d209a58fce8ad312f51c&svisitor=null&visitor=acb817d0-8178-4564-82e9-226444fdb156&session=d8201a4b-717a-4bb1-8479-69298ac52bac&event=active_time_track&q=%7B%22currentTime%22%3A%22Wed%2C%2002%20Aug%202023%2002%3A16%3A34%20GMT%22%2C%22lastTrackTime%22%3A%22Wed%2C%2002%20Aug%202023%2002%3A16%3A33%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%223006%22%7D&isIframe=false&m=%7B%22description%22%3A%22An%20Iranian%20technology%20company%20is%20providing%20infrastructure%20services%20to%20ransomware%20gangs%20and%20an%20array%20of%20nation-state%20hackers%2C%20researchers%20have%20found.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Iranian%20cloud%20company%20accused%20of%20hosting%20cybercriminals%2C%20nation-state%20hackers%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Ftherecord.media%2Firan-company-providing-ransomware-infrastructure&pageViewId=106eaa28-aebc-42e9-89be-591918e65906&an_uid=0&webTagId=64dc3ec5-330c-4652-88d3-147ee65e90ba&v=1.1.5 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a2-17-100-184.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://therecord.media/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36 Response headers date Wed, 02 Aug 2023 02:16:34 GMT x-content-type-options nosniff content-length 43 pragma no-cache last-modified Sat, 18 Feb 2023 01:45:17 GMT server nginx/1.14.0 (Ubuntu) etag "63f02dad-2b" access-control-max-age 86400 access-control-allow-methods GET,POST content-type image/gif access-control-allow-origin cache-control private, no-cache, no-cache=Set-Cookie, proxy-revalidate access-control-allow-credentials true accept-ranges bytes access-control-allow-headers * expires Wed, 19 Apr 2000 11:43:00 GMT
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 484 B	198ms 197ms	Image image/gif	2.17.100.184 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=f2675e8089b7d209a58fce8ad312f51c&svisitor=null&visitor=acb817d0-8178-4564-82e9-226444fdb156&session=d8201a4b-717a-4bb1-8479-69298ac52bac&event=active_time_track&q=%7B%22currentTime%22%3A%22Wed%2C%2002%20Aug%202023%2002%3A16%3A35%20GMT%22%2C%22lastTrackTime%22%3A%22Wed%2C%2002%20Aug%202023%2002%3A16%3A34%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%224007%22%7D&isIframe=false&m=%7B%22description%22%3A%22An%20Iranian%20technology%20company%20is%20providing%20infrastructure%20services%20to%20ransomware%20gangs%20and%20an%20array%20of%20nation-state%20hackers%2C%20researchers%20have%20found.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Iranian%20cloud%20company%20accused%20of%20hosting%20cybercriminals%2C%20nation-state%20hackers%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Ftherecord.media%2Firan-company-providing-ransomware-infrastructure&pageViewId=106eaa28-aebc-42e9-89be-591918e65906&an_uid=0&webTagId=64dc3ec5-330c-4652-88d3-147ee65e90ba&v=1.1.5 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a2-17-100-184.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://therecord.media/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36 Response headers date Wed, 02 Aug 2023 02:16:35 GMT x-content-type-options nosniff content-length 43 pragma no-cache last-modified Fri, 21 Feb 2020 18:57:20 GMT server nginx/1.14.0 (Ubuntu) etag "5e502810-2b" access-control-max-age 86400 access-control-allow-methods GET,POST content-type image/gif access-control-allow-origin cache-control private, no-cache, no-cache=Set-Cookie, proxy-revalidate access-control-allow-credentials true accept-ranges bytes access-control-allow-headers * expires Wed, 19 Apr 2000 11:43:00 GMT