people.redhat.com Open in urlscan Pro
209.132.178.26 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://people.redhat.com/~hkario/marvin/
Submission: On October 02 via api (October 2nd 2023, 2:08:17 am UTC) from TR — Scanned from DE

Summary HTTP 6 Redirects Links 41 Behaviour Indicators

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 6 HTTP transactions. The main IP is 209.132.178.26, located in United States and belongs to REDHAT-2, US. The main domain is people.redhat.com. The Cisco Umbrella rank of the primary domain is 990447.
TLS certificate: Issued by DigiCert Global G2 TLS RSA SHA256 202... on August 11th 2023. Valid for: a year.

This is the only time people.redhat.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
4	209.132.178.26 209.132.178.26	22360 (REDHAT-2) (REDHAT-2)
2	2a00:1450:400... 2a00:1450:4001:831::2003	15169 (GOOGLE) (GOOGLE)
6	2

4 209.132.178.26 (United States)

ASN22360 (REDHAT-2, US)

people.redhat.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:831::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	redhat.com people.redhat.com — Cisco Umbrella Rank: 990447	392 KB
2	gstatic.com fonts.gstatic.com	78 KB
6	2

	Domain	Requested by
4	people.redhat.com	people.redhat.com
2	fonts.gstatic.com	people.redhat.com
6	2

This site contains links to these domains. Also see Links.

Domain
robotattack.org
www.openssl.org
nvd.nist.gov
github.com
gnutls.org
hg.mozilla.org
gitlab.com
pkg.go.dev
gmplib.org
minerva.crocs.fi.muni.cz
raccoon-attack.com
tlsfuzzer.readthedocs.io
en.wikipedia.org
eprint.iacr.org
www.ssllabs.com
neuromancer.sk
crocs.fi.muni.cz
www.rfc-editor.org
paulkocher.com
archiv.infsec.ethz.ch
www.usenix.org
www.nds.rub.de
drownattack.com
ieeexplore.ieee.org
creativecommons.org

Subject Issuer	Validity	Valid
people.redhat.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-08-11` - `2024-08-13`	a year	crt.sh
*.gstatic.com GTS CA 1C3	`2023-09-04` - `2023-11-27`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://people.redhat.com/~hkario/marvin/
Frame ID: C6B075AA201867628C899CB7C227C809
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

The Marvin Attack

Page Statistics

6
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

470 kB
Transfer

468 kB
Size

0
Cookies

41 Outgoing links

These are links going to different origins than the main page.

URL: https://robotattack.org/
Title: In 2018

Search URL Search Domain Scan URL

URL: https://www.openssl.org/news/secadv/20230207.txt
Title: Timing Oracle in RSA Decryption

Search URL Search Domain Scan URL

URL: https://nvd.nist.gov/vuln/detail/CVE-2022-4304
Title: CVE-2022-4304

Search URL Search Domain Scan URL

URL: https://github.com/openssl/openssl/pull/13817
Title: Make RSA decryption API safe to use with PKCS#1 v1.5 padding

Search URL Search Domain Scan URL

URL: https://gnutls.org/security-new.html#GNUTLS-SA-2020-07-14
Title: A vulnerability was found that the response times to malformed RSA ciphertexts in ClientKeyExchange differ from response times of ciphertexts with correct PKCS#1 v1.5 padding.

Search URL Search Domain Scan URL

URL: https://nvd.nist.gov/vuln/detail/CVE-2023-0361
Title: CVE-2023-0361

Search URL Search Domain Scan URL

URL: https://hg.mozilla.org/projects/nss/rev/fc05574c739947d615ab0b2b2b564f01c922eccd
Title: Improve constant-timeness in RSA operations.

Search URL Search Domain Scan URL

URL: https://nvd.nist.gov/vuln/detail/CVE-2023-4421
Title: CVE-2023-4421

Search URL Search Domain Scan URL

URL: https://github.com/pyca/cryptography/pull/5507
Title: Attempt to mitigate Bleichenbacher attacks on RSA decryption

Search URL Search Domain Scan URL

URL: https://nvd.nist.gov/vuln/detail/CVE-2020-25659
Title: CVE-2020-25659

Search URL Search Domain Scan URL

URL: https://gitlab.com/m2crypto/m2crypto/-/merge_requests/273
Title: Mitigate the Bleichenbacher timing attacks in the RSA decryption API (CVE-2020-25657)

Search URL Search Domain Scan URL

URL: https://nvd.nist.gov/vuln/detail/CVE-2020-25657
Title: CVE-2020-25657

Search URL Search Domain Scan URL

URL: https://github.com/opencryptoki/openssl-ibmca/blob/master/ChangeLog
Title: Constant-time fixes for RSA PKCS#1 v1.5 and OAEP padding

Search URL Search Domain Scan URL

URL: https://pkg.go.dev/crypto/rsa#DecryptPKCS1v15SessionKey
Title: crypto/rsa DecryptPKCS1v15SessionKey

Search URL Search Domain Scan URL

URL: https://gmplib.org/manual/Integer-Exponentiation
Title: mpz_powm_sec

Search URL Search Domain Scan URL

URL: https://github.com/google/boringssl/commit/be84aeed7
Title: 6 Sep 2023

Search URL Search Domain Scan URL

URL: https://minerva.crocs.fi.muni.cz/
Title: Minerva

Search URL Search Domain Scan URL

URL: https://raccoon-attack.com/
Title: Racoon attack

Search URL Search Domain Scan URL

URL: https://gmplib.org/manual/Low_002dlevel-Functions#Low_002dlevel-functions-for-cryptography
Title: interface well suited for side-channel free programming

Search URL Search Domain Scan URL

URL: https://github.com/tlsfuzzer/tlsfuzzer/blob/master/scripts/test-bleichenbacher-timing-pregenerate.py
Title: script

Search URL Search Domain Scan URL

URL: https://tlsfuzzer.readthedocs.io/en/latest/timing-analysis.html
Title: instructions

Search URL Search Domain Scan URL

URL: https://en.wikipedia.org/wiki/P-value
Title: p-value

Search URL Search Domain Scan URL

URL: https://github.com/tomato42/marvin-toolkit
Title: marvin-toolkit

Search URL Search Domain Scan URL

URL: https://eprint.iacr.org/2023/1442
Title: Cryptology ePrint Archive mirror

Search URL Search Domain Scan URL

URL: https://eprint.iacr.org/2023/1441
Title: Cryptology ePrint Archive mirror

Search URL Search Domain Scan URL

URL: https://en.wikipedia.org/wiki/Independent_and_identically_distributed_random_variables
Title: Independent and Identically Distributed

Search URL Search Domain Scan URL

URL: https://en.wikipedia.org/wiki/Paired_difference_test
Title: paired difference tests

Search URL Search Domain Scan URL

URL: https://www.ssllabs.com/ssltest/
Title: SSLLabs

Search URL Search Domain Scan URL

URL: https://neuromancer.sk/article/26
Title: multitude of tools

Search URL Search Domain Scan URL

URL: https://crocs.fi.muni.cz/_media/publications/pdf/2022-sp-jancar.pdf
Title: developers

Search URL Search Domain Scan URL

URL: https://neuromancer.sk/article/29
Title: researchers

Search URL Search Domain Scan URL

URL: https://www.rfc-editor.org/rfc/rfc5246#page-24
Title: RFC5246

Search URL Search Domain Scan URL

URL: https://paulkocher.com/doc/TimingAttacks.pdf
Title: by Paul Kocher in 1996.

Search URL Search Domain Scan URL

URL: http://archiv.infsec.ethz.ch/education/fs08/secsem/bleichenbacher98.pdf
Title: discovered by Daniel Bleichenbacher in 1998

Search URL Search Domain Scan URL

URL: https://eprint.iacr.org/2003/052
Title: improved the attack and discovered the bad-version oracle in 2003

Search URL Search Domain Scan URL

URL: https://eprint.iacr.org/2012/417
Title: developed a much more efficient Bleichenbacher attack algorithm

Search URL Search Domain Scan URL

URL: https://www.usenix.org/conference/usenixsecurity14/technical-sessions/presentation/meyer
Title: Christopher Meyer and others discovered Bleichenbacher vulnerabilities in JSSE and other products

Search URL Search Domain Scan URL

URL: https://www.nds.rub.de/media/nds/veroeffentlichungen/2015/08/21/Tls13QuicAttacks.pdf
Title: it is possible to use a cross-protocol Bleichenbacher attack against TLS 1.3 and QUIC

Search URL Search Domain Scan URL

URL: https://drownattack.com/
Title: DROWN attack

Search URL Search Domain Scan URL

URL: https://ieeexplore.ieee.org/document/8835216
Title: shown that a lot of cryptographic libraries can be attacked using cache timing attacks

Search URL Search Domain Scan URL

URL: https://creativecommons.org/publicdomain/zero/1.0/
Title: CC0

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request / Show response
people.redhat.com/~hkario/marvin/ 32 KB
32 KB 309ms
97ms Document
text/html 209.132.178.26
REDHAT-2

General

Check archive.org

Show headers Download Go to

Full URL: https://people.redhat.com/~hkario/marvin/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 209.132.178.26 , United States, ASN22360 (REDHAT-2, US),
Reverse DNS
Software: Apache/2.4.37 (Red Hat Enterprise Linux) OpenSSL/1.1.1k /
Resource Hash: 64082999fd0a6a2f44fe7a60a27f0b57f30dcff1a6a4dc1f63d3e5d6f6781509

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Accept-Ranges: bytes
Connection: Keep-Alive
Content-Length: 32628
Content-Type: text/html; charset=UTF-8
Date: Mon, 02 Oct 2023 02:08:12 GMT
ETag: "7f74-6062942b21244"
Keep-Alive: timeout=5, max=100
Last-Modified: Mon, 25 Sep 2023 06:42:22 GMT
Server: Apache/2.4.37 (Red Hat Enterprise Linux) OpenSSL/1.1.1k

GET
H/1.1 200
OK style.css
people.redhat.com/~hkario/marvin/ 3 KB
4 KB 187ms
98ms Stylesheet
text/css 209.132.178.26
REDHAT-2

General

Check archive.org

Show headers Download Go to

Full URL: https://people.redhat.com/~hkario/marvin/style.css
Requested by: Host: people.redhat.com
URL: https://people.redhat.com/~hkario/marvin/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 209.132.178.26 , United States, ASN22360 (REDHAT-2, US),
Reverse DNS
Software: Apache/2.4.37 (Red Hat Enterprise Linux) OpenSSL/1.1.1k /
Resource Hash: ebccfa652d5e7ecc0a2448a68cd56e22b89cfae64a187fd3ad0345bc443e60f9

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://people.redhat.com/~hkario/marvin/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

Date: Mon, 02 Oct 2023 02:08:13 GMT
Last-Modified: Mon, 25 Sep 2023 06:42:23 GMT
Server: Apache/2.4.37 (Red Hat Enterprise Linux) OpenSSL/1.1.1k
ETag: "da6-6062942bca932"
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 3494

GET
H/1.1 200
OK css.css
people.redhat.com/~hkario/marvin/ 9 KB
9 KB 293ms
106ms Stylesheet
text/css 209.132.178.26
REDHAT-2

General

Check archive.org

Show headers Download Go to

Full URL: https://people.redhat.com/~hkario/marvin/css.css
Requested by: Host: people.redhat.com
URL: https://people.redhat.com/~hkario/marvin/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 209.132.178.26 , United States, ASN22360 (REDHAT-2, US),
Reverse DNS
Software: Apache/2.4.37 (Red Hat Enterprise Linux) OpenSSL/1.1.1k /
Resource Hash: 75c79d0a6632747ab627178697461248dcb43f8fa16abce9b9bf09762b4bf365

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://people.redhat.com/~hkario/marvin/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

Date: Mon, 02 Oct 2023 02:08:13 GMT
Last-Modified: Mon, 25 Sep 2023 06:42:20 GMT
Server: Apache/2.4.37 (Red Hat Enterprise Linux) OpenSSL/1.1.1k
ETag: "22f0-60629428e1f19"
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=98
Content-Length: 8944

GET
H/1.1 200
OK marvin.png
people.redhat.com/~hkario/marvin/ 347 KB
347 KB 106ms
106ms Image
image/png 209.132.178.26
REDHAT-2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://people.redhat.com/~hkario/marvin/marvin.png
Requested by: Host: people.redhat.com
URL: https://people.redhat.com/~hkario/marvin/style.css
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 209.132.178.26 , United States, ASN22360 (REDHAT-2, US),
Reverse DNS
Software: Apache/2.4.37 (Red Hat Enterprise Linux) OpenSSL/1.1.1k /
Resource Hash: b047d704cb0372f4ccebd31f25ebfbbbea2134333e0a80b73f1946f117c1c518

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://people.redhat.com/~hkario/marvin/style.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

Date: Mon, 02 Oct 2023 02:08:13 GMT
Last-Modified: Mon, 25 Sep 2023 06:42:21 GMT
Server: Apache/2.4.37 (Red Hat Enterprise Linux) OpenSSL/1.1.1k
ETag: "56bc7-6062942a39734"
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=97
Content-Length: 355271

GET
H2 200 JTUSjIg1_i6t8kCHKm459Wlhyw.woff2
fonts.gstatic.com/s/montserrat/v25/ 30 KB
31 KB 34ms
8ms Font
font/woff2 2a00:1450:4001:831::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/montserrat/v25/JTUSjIg1_i6t8kCHKm459Wlhyw.woff2

Requested by

Host: people.redhat.com
URL: https://people.redhat.com/~hkario/marvin/css.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ae919a7c9f25f0fd97fc18e398ae8e453fcaae487e4a4cb4f896e7fecde4a780

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://people.redhat.com/
Origin: https://people.redhat.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

date: Sat, 30 Sep 2023 06:58:20 GMT
x-content-type-options: nosniff
age: 155393
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 30928
x-xss-protection: 0
last-modified: Mon, 11 Jul 2022 18:57:39 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 29 Sep 2024 06:58:20 GMT

GET
H2 200 memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v35/ 47 KB
47 KB 40ms
15ms Font
font/woff2 2a00:1450:4001:831::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v35/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2

Requested by

Host: people.redhat.com
URL: https://people.redhat.com/~hkario/marvin/css.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7c7818c25a18e8a38553fcbcbc2ad0b5e964103a7d2e494f82815e3f70bf3fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://people.redhat.com/
Origin: https://people.redhat.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

date: Sat, 30 Sep 2023 00:05:10 GMT
x-content-type-options: nosniff
age: 180183
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 48412
x-xss-protection: 0
last-modified: Tue, 02 May 2023 15:08:53 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 29 Sep 2024 00:05:10 GMT

Verdicts & Comments Add Verdict or Comment

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| documentPictureInPicture

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

fonts.gstatic.com
people.redhat.com
209.132.178.26
2a00:1450:4001:831::2003
64082999fd0a6a2f44fe7a60a27f0b57f30dcff1a6a4dc1f63d3e5d6f6781509
75c79d0a6632747ab627178697461248dcb43f8fa16abce9b9bf09762b4bf365
7c7818c25a18e8a38553fcbcbc2ad0b5e964103a7d2e494f82815e3f70bf3fc5
ae919a7c9f25f0fd97fc18e398ae8e453fcaae487e4a4cb4f896e7fecde4a780
b047d704cb0372f4ccebd31f25ebfbbbea2134333e0a80b73f1946f117c1c518
ebccfa652d5e7ecc0a2448a68cd56e22b89cfae64a187fd3ad0345bc443e60f9

people.redhat.com Open in urlscan Pro 209.132.178.26 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page Statistics

6 Requests

100 %HTTPS

50 %IPv6

2 Domains

2 Subdomains

2 IPs

2 Countries

470 kBTransfer

468 kBSize

0 Cookies

41 Outgoing links

Redirected requests

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

1 JavaScript Global Variables

0 Cookies

Indicators

people.redhat.com Open in urlscan Pro
209.132.178.26 Public Scan

Screenshot
Live screenshot

Full Image

6
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

470 kB
Transfer

468 kB
Size

0
Cookies

6 HTTP transactions
0 data transactions