www.group-ib.com Open in urlscan Pro
3.72.181.255  Public Scan

22 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

1. https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Page URL
2. https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Page URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 101

• https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=4496601&time=1692910199143&url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&tm=gtmv2 HTTP 302
• https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=4496601&time=1692910199143&url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&tm=gtmv2&cookiesTest=true HTTP 302
• https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D4496601%26time%3D1692910199143%26url%3Dhttps%253A%252F%252Fwww.group-ib.com%252Fblog%252Fcve-2023-38831-winrar-zero-day%252F%26tm%3Dgtmv2%26cookiesTest%3Dtrue%26liSync%3Dtrue HTTP 302
• https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=4496601&time=1692910199143&url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&tm=gtmv2&cookiesTest=true&liSync=true HTTP 302
• https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=4496601&time=1692910199143&url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&tm=gtmv2&cookiesTest=true&liSync=true&e_ipv6=AQLPxyQw7PgEeQAAAYopT6TPEVRn7-1TtTtuqJ0TwDjuC9zJ03aECk9-kYIEnkzJ

Request Chain 103

• https://mc.yandex.com/sync_cookie_image_check HTTP 302
• https://mc.yandex.ru/sync_cookie_image_start?redirect_domain=mc.yandex.com&token=10105.omWYI1wFpuhTpTwMgEKrUy-Isn6ck-cl4r8HK8mAKxSktVbEUB--NeEmmZpJnDOB.ar4SsJenPEI-04leWbswb03LBQU%2C HTTP 302
• https://mc.yandex.com/sync_cookie_image_decide?token=10105.Qe7TXPPjX6nFWuSNydIQ6QQaIBfK86n1mCCYTgNSPPX7hfwQ7tcGvo931Zy0i-IwTHzK0NUhCJrIz2nwdWqhlqFyJTugYNrlqRQPnbWToFM%2C.tppYfzJFFgmhyKJr42ffKHqLxSA%2C

Request Chain 120

• https://mc.yandex.com/watch/26812653?wmode=7&page-url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&charset=utf-8&site-info=%7B%22shareVersion%22%3A2%2C%22strategy%22%3A%22d%2Fn%2Fq%2Fr%2Fs%2Ft%22%7D&uah=chm%0A%3F0&browser-info=pv%3A1%3Avf%3Aeygqx1x5sixaiiugyrqh3hb%3Afp%3A830%3Afu%3A1%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A1093%3Acn%3A1%3Adp%3A0%3Als%3A1091298705691%3Ahid%3A971870371%3Az%3A60%3Ai%3A20230824214959%3Aet%3A1692910199%3Ac%3A1%3Arn%3A72626395%3Arqn%3A1%3Au%3A1692910199469179042%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Awv%3A2%3Ads%3A0%2C0%2C81%2C56%2C0%2C0%2C%2C1114%2C52%2C%2C%2C%2C1305%3Aco%3A0%3Acpf%3A1%3Ans%3A1692910197276%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1692910200%3At%3ATraders%27%20dollars%20in%20danger%3A%20CVE-2023-38831%20zero-day%20vulnerability%20in%20WinRAR%20exploited%20by%20cybercriminals%20to%20target%20traders%20%7C%20Group-IB%20Blog&t=gdpr(14)clc(0-0-0)rqnt(1)aw(1)ti(1) HTTP 302
• https://mc.yandex.com/watch/26812653/1?wmode=7&page-url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&charset=utf-8&site-info=%7B%22shareVersion%22%3A2%2C%22strategy%22%3A%22d%2Fn%2Fq%2Fr%2Fs%2Ft%22%7D&uah=chm%0A%3F0&browser-info=pv%3A1%3Avf%3Aeygqx1x5sixaiiugyrqh3hb%3Afp%3A830%3Afu%3A1%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A1093%3Acn%3A1%3Adp%3A0%3Als%3A1091298705691%3Ahid%3A971870371%3Az%3A60%3Ai%3A20230824214959%3Aet%3A1692910199%3Ac%3A1%3Arn%3A72626395%3Arqn%3A1%3Au%3A1692910199469179042%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Awv%3A2%3Ads%3A0%2C0%2C81%2C56%2C0%2C0%2C%2C1114%2C52%2C%2C%2C%2C1305%3Aco%3A0%3Acpf%3A1%3Ans%3A1692910197276%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1692910200%3At%3ATraders%27%20dollars%20in%20danger%3A%20CVE-2023-38831%20zero-day%20vulnerability%20in%20WinRAR%20exploited%20by%20cybercriminals%20to%20target%20traders%20%7C%20Group-IB%20Blog&t=gdpr%2814%29clc%280-0-0%29rqnt%281%29aw%281%29ti%281%29&redirnss=1

Request Chain 123

• https://mc.yandex.com/sync_cookie_image_check_secondary HTTP 302
• https://mc.yandex.ru/sync_cookie_image_start_secondary?redirect_domain=mc.yandex.com&token=10105.VNMckq2a6fEr4r6AgDp5vlhBshDOimzkIWSIlJRXgD44dWCK74LdhzRj6VXA34rl.668S9gjWkoe6bk3izHTtJ_2sQ9k%2C HTTP 302
• https://mc.yandex.com/sync_cookie_image_decide_secondary?token=10105.mt0V0zkT1CNVJLX5Q91YkjqVSXMVkXsjpy8-ZKVQs6pnvOnBFCtaoJOfXjd6k1RjrVDBEccyQ3y61fYNUDRKR46fWRKYTJT75xz2OjsX_wU%2C.LPLea0pPMmvddxvz4kiVZEGMw38%2C

105 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
27 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	403	/ Show response www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/	7 KB 7 KB	318ms 56ms	Document text/html	3.72.181.255 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-72-181-255.eu-central-1.compute.amazonaws.com Software / Resource Hash 34de17ac1bf040d56f0be4c35cb916ede68c6a119347007caf8560722f6de959 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 accept-language en-GB,en;q=0.9 Response headers cache-control no-cache, no-store, must-revalidate content-type text/html date Thu, 24 Aug 2023 20:49:55 GMT
GET H/1.1	200 OK	bt-autoinject.js Show response fhp-de-js.group-ib.com/d/	344 KB 136 KB	256ms 112ms	Script text/javascript	136.243.23.20 HETZNER-AS
General Check archive.org Show headers Download Go to Full URL https://fhp-de-js.group-ib.com/d/bt-autoinject.js Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 136.243.23.20 Falkenstein, Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS static.20.23.243.136.clients.your-server.de Software nginx / Resource Hash 186f4687fbc944b53731a6598a3841002310a44ab3ce7d7bb2335f021b9b4d1c Request headers accept-language en-GB,en;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 Response headers Date Thu, 24 Aug 2023 20:49:55 GMT Content-Encoding gzip Server nginx Transfer-Encoding chunked Vary Accept-Encoding Content-Type text/javascript; charset=UTF-8 Access-Control-Allow-Methods GET, POST, OPTIONS x-envoy-upstream-service-time 1 Access-Control-Allow-Credentials true Connection keep-alive Access-Control-Allow-Headers Accept,DNT,Keep-Alive,User-Agent,If-Modified-Since,Cache-Control,Content-Type,Origin,ETag,If-None-Match,X-Cfids,Authorization
GET DATA	200 OK	truncated /	482 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 230f5786b4b6249c5d903a700b4c1bd570b0919bae854208c553928bdb04edb5 Request headers accept-language en-GB,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	4 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 8a0108e08f5fb2ecb6e6e7fca756f70d8703f27bd143300372aa54dee80eb035 Request headers accept-language en-GB,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 Response headers Content-Type image/png
GET H2	200	idgib-w-61354c22-16cc-40a8-a871-6901f1a76e24 Show response www.group-ib.com/api/fl/	205 B 662 B	64ms 63ms	XHR application/json	3.72.181.255 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://www.group-ib.com/api/fl/idgib-w-61354c22-16cc-40a8-a871-6901f1a76e24 Requested by Host: fhp-de-js.group-ib.com URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-72-181-255.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash 10f58adf6117b6563f5b9d0d992065a38885b8100af9e4d02ee5014a967e3a74 Request headers Referer https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ accept-language en-GB,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 x-cfids - Response headers date Thu, 24 Aug 2023 20:49:55 GMT content-encoding gzip server nginx etag W/"UeLlOIrw1b0s36Xp7oEFWGMVzkdkVGa4mYpKno7aD/uObb59BODf/mkfpnxYTNrG/SeMqHx/viPCF7ULiW7sXoPCdrZlUMKDQfedFjsOVW7Yjhp+rb6+35N5CFRO3QZW1omjbIhgOGsNgJAbKRmMxPHc" vary Accept-Encoding content-type application/json; charset=utf-8 cache-control no-cache x-envoy-upstream-service-time 0
POST H2	200	fl Show response www.group-ib.com/api/	665 B 984 B	125ms 125ms	XHR application/json	3.72.181.255 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://www.group-ib.com/api/fl?u=44765f40-4296-11ee-952f-221c0dcfc0b5&cfidsgib-w-61354c22-16cc-40a8-a871-6901f1a76e24=UeLlOIrw1b0s36Xp7oEFWGMVzkdkVGa4mYpKno7aD%2FuObb59BODf%2FmkfpnxYTNrG%2FSeMqHx%2FviPCF7ULiW7sXoPCdrZlUMKDQfedFjsOVW7Yjhp%2Brb6%2B35N5CFRO3QZW1omjbIhgOGsNgJAbKRmMxPHc Requested by Host: fhp-de-js.group-ib.com URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-72-181-255.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash 90626fb98e8a9bf81ba1196119929d8d26c6a2ad87aab8542711d0fee1e250a2 Request headers Referer https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ accept-language en-GB,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers date Thu, 24 Aug 2023 20:49:57 GMT content-encoding gzip server nginx vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/json; charset=utf-8 access-control-allow-origin https://www.group-ib.com cache-control no-store access-control-allow-credentials true x-envoy-upstream-service-time 2 access-control-allow-headers Accept,DNT,Keep-Alive,User-Agent,If-Modified-Since,Cache-Control,Content-Type,Origin,ETag,If-None-Match,X-Cfids,Authorization
POST H2	200	fl www.group-ib.com/api/	665 B 692 B	65ms 65ms	Ping application/json	3.72.181.255 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://www.group-ib.com/api/fl?u=44765f40-4296-11ee-952f-221c0dcfc0b5&cfidsgib-w-61354c22-16cc-40a8-a871-6901f1a76e24=09XHR%2FzeG5CRYX0Cwp%2FKc4HBHmXkeCOX7HnyFi6SwALxdnM64j4oMsJrdCfxIDAuyPXsq%2F49bQRFcneX0bjlWAuW4zW06a0Ap%2FCuP6uQCto2%2ByWzx%2FmqMb485OBpK416U9GGbqyRSy2DZpif8RpzZc%2BeyrZOOd%2BNdjh6 Requested by Host: fhp-de-js.group-ib.com URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-72-181-255.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash Request headers Referer https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ accept-language en-GB,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers date Thu, 24 Aug 2023 20:49:57 GMT content-encoding gzip server nginx vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/json; charset=utf-8 access-control-allow-origin https://www.group-ib.com cache-control no-store access-control-allow-credentials true x-envoy-upstream-service-time 1 access-control-allow-headers Accept,DNT,Keep-Alive,User-Agent,If-Modified-Since,Cache-Control,Content-Type,Origin,ETag,If-None-Match,X-Cfids,Authorization
GET H2	200	Primary Request / Show response www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/	117 KB 28 KB	81ms 80ms	Document text/html	3.72.181.255 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-72-181-255.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash dc851215d517c6598c869b7370aade5a745b67b1b3f73c7bc14d7a98b6dc5ba6 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers Referer https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 accept-language en-GB,en;q=0.9 Response headers accept-ranges bytes access-control-allow-origin https://www.group-ib.com cache-control private, max-age=3600 content-encoding gzip content-length 28523 content-security-policy frame-ancestors 'self'; content-type text/html; charset=UTF-8 date Thu, 24 Aug 2023 20:49:57 GMT etag "6e7e-603ad633b1761" last-modified Thu, 24 Aug 2023 16:04:49 GMT permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() referrer-policy strict-origin-when-cross-origin server nginx strict-transport-security max-age=31536000; includeSubDomains vary X-Forwarded-Proto,Accept-Encoding,Cookie x-content-type-options nosniff x-frame-options sameorigin x-xss-protection 1; mode=block
GET H/1.1	200 OK	bt-autoinject.js Show response fhp-de-js.group-ib.com/d/	344 KB 136 KB	137ms 132ms	Script text/javascript	136.243.23.20 HETZNER-AS
General Check archive.org Show headers Download Go to Full URL https://fhp-de-js.group-ib.com/d/bt-autoinject.js Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 136.243.23.20 Falkenstein, Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS static.20.23.243.136.clients.your-server.de Software nginx / Resource Hash 186f4687fbc944b53731a6598a3841002310a44ab3ce7d7bb2335f021b9b4d1c Request headers accept-language en-GB,en;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 Response headers Date Thu, 24 Aug 2023 20:49:57 GMT Content-Encoding gzip Server nginx Transfer-Encoding chunked Vary Accept-Encoding Content-Type text/javascript; charset=UTF-8 Access-Control-Allow-Methods GET, POST, OPTIONS x-envoy-upstream-service-time 1 Access-Control-Allow-Credentials true Connection keep-alive Access-Control-Allow-Headers Accept,DNT,Keep-Alive,User-Agent,If-Modified-Since,Cache-Control,Content-Type,Origin,ETag,If-None-Match,X-Cfids,Authorization
GET H2	200	lazyload.min.js Show response www.group-ib.com/wp-content/plugins/w3-total-cache/pub/js/	6 KB 2 KB	84ms 78ms	Script application/x-javascript	3.72.181.255 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://www.group-ib.com/wp-content/plugins/w3-total-cache/pub/js/lazyload.min.js Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-72-181-255.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash 1a54a1907a6443e3c81608130bfed4546eb0ce5d0c8897e1d7a3b43d89ecc367 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language en-GB,en;q=0.9 Referer https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Thu, 24 Aug 2023 20:49:57 GMT strict-transport-security max-age=31536000; includeSubDomains content-length 2356 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Thu, 29 Jun 2023 07:01:06 GMT server nginx etag "1883-5ff3f43abc651-gzip" vary X-Forwarded-Proto,Accept-Encoding x-frame-options sameorigin content-type application/x-javascript access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes expires Thu, 24 Aug 2023 21:19:57 GMT
GET H2	200	swiper-bundle.min.js Show response website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/js/	140 KB 39 KB	332ms 155ms	Script application/x-javascript	2600:9000:20c3:b200:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/js/swiper-bundle.min.js Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:20c3:b200:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash b624e1e378abe009ef0de69a698b0a3e734af47efcdbd6816d5fcb8fc64c8bfe Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language en-GB,en;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Thu, 24 Aug 2023 20:49:57 GMT via 1.1 4ba99d04800d29b58ab9861f60991a2a.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop MUC50-C1 x-cache Miss from cloudfront content-length 39504 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Mon, 05 Sep 2022 07:41:14 GMT server nginx etag "22ede-5e7e9344df9f2-gzip" x-frame-options sameorigin vary Accept-Encoding content-type application/x-javascript access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id Noe9hkJO1HkbyaBR7jgXuVwELskFieQ32PXPOUSF0dH2nR5RNh_UHQ== expires Thu, 24 Aug 2023 21:19:57 GMT
GET H2	200	classic-themes.min.css website.cdn.group-ib.com/wp-includes/css/	217 B 1008 B	316ms 140ms	Stylesheet text/css	2600:9000:20c3:b200:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://website.cdn.group-ib.com/wp-includes/css/classic-themes.min.css Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:20c3:b200:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 5a5f39391fbf5b06db84b8f9716d53de575ee97a627d2c5f12f79a991a671eb5 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language en-GB,en;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Thu, 24 Aug 2023 20:49:57 GMT via 1.1 4ba99d04800d29b58ab9861f60991a2a.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop MUC50-C1 x-cache Miss from cloudfront content-length 189 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Fri, 11 Nov 2022 11:58:50 GMT server nginx etag "d9-5ed309cf15c82-gzip" x-frame-options sameorigin vary Accept-Encoding content-type text/css access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id olqyqG8XnQcAyRg__9qp_ntnDDnRnPTyD7DK6f5a97RlpE7B5N9Obw== expires Thu, 24 Aug 2023 21:19:57 GMT
GET H2	200	dashicons.min.css website.cdn.group-ib.com/wp-includes/css/	58 KB 36 KB	400ms 224ms	Stylesheet text/css	2600:9000:20c3:b200:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://website.cdn.group-ib.com/wp-includes/css/dashicons.min.css Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:20c3:b200:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash c21e5a2b32c47bc5f9d9efc97bc0e29fd081946d1d3ebffc5621cfafb1d3960e Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language en-GB,en;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Thu, 24 Aug 2023 20:49:57 GMT via 1.1 4ba99d04800d29b58ab9861f60991a2a.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop MUC50-C1 x-cache Miss from cloudfront content-length 35730 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Fri, 10 Jun 2022 07:03:36 GMT server nginx etag "e688-5e112897ec200-gzip" x-frame-options sameorigin vary Accept-Encoding content-type text/css access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id -Iqx3VLibZOSCemqalssxuvbecVWyPzDshl02b1jUoaTGAWOsfXasA== expires Thu, 24 Aug 2023 21:19:57 GMT
GET H2	200	frontend.min.css www.group-ib.com/wp-content/plugins/post-views-counter/css/	215 B 251 B	86ms 82ms	Stylesheet text/css	3.72.181.255 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://www.group-ib.com/wp-content/plugins/post-views-counter/css/frontend.min.css Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-72-181-255.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash ed70c2cf61d0f24d03299ffc5896c7abd86bb858501987dc10e3afec086c01df Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language en-GB,en;q=0.9 Referer https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Thu, 24 Aug 2023 20:49:57 GMT strict-transport-security max-age=31536000; includeSubDomains content-length 160 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Wed, 26 Apr 2023 07:26:40 GMT server nginx etag "d7-5fa38293ec798-gzip" vary X-Forwarded-Proto,Accept-Encoding x-frame-options sameorigin content-type text/css access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes expires Thu, 24 Aug 2023 21:19:57 GMT
GET H2	200	jquery.min.js Show response website.cdn.group-ib.com/wp-includes/js/jquery/	88 KB 31 KB	431ms 256ms	Script application/x-javascript	2600:9000:20c3:b200:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://website.cdn.group-ib.com/wp-includes/js/jquery/jquery.min.js Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:20c3:b200:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash cc7403bab52ed166e24ea9324241045af370be482f5b594468f4a6ac6e7e7981 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language en-GB,en;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Thu, 24 Aug 2023 20:49:57 GMT via 1.1 4ba99d04800d29b58ab9861f60991a2a.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop MUC50-C1 x-cache Miss from cloudfront content-length 30995 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Fri, 11 Nov 2022 11:58:50 GMT server nginx etag "15e54-5ed309cf21802-gzip" x-frame-options sameorigin vary Accept-Encoding content-type application/x-javascript access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id 5lkn3TyAbXfB-i_qutcdxs2jPOYrIYC_qn5aPgRFNd5PiAzBss9yBA== expires Thu, 24 Aug 2023 21:19:57 GMT
GET H2	200	single-blog-post.css website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/	270 KB 39 KB	345ms 170ms	Stylesheet text/css	2600:9000:20c3:b200:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:20c3:b200:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 058f96c988d29c99c5280ba827afe3a7723847ab645fe6e7be0fcb3e7a347884 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language en-GB,en;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Thu, 24 Aug 2023 20:49:57 GMT via 1.1 4ba99d04800d29b58ab9861f60991a2a.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop MUC50-C1 x-cache Miss from cloudfront content-length 38918 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Thu, 24 Aug 2023 20:49:49 GMT server nginx etag "438c4-603b15e82b729-gzip" x-frame-options sameorigin vary Accept-Encoding content-type text/css access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id 3BEB1tZfBP2PdJXOncnJQTp9LjfeR9VYG00r0kbAesJCcq0ZVI7RuA== expires Thu, 24 Aug 2023 21:19:57 GMT
GET H2	200	v2.js Show response js-eu1.hsforms.net/forms/	526 KB 165 KB	222ms 62ms	Script application/javascript	172.65.255.172 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js-eu1.hsforms.net/forms/v2.js Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.65.255.172 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 69ff013760515696c54749156ae5dba9f130fa01e2e355fec69a26e6d87f1892 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language en-GB,en;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 Response headers content-encoding br x-evy-trace-route-service-name envoyset-translator age 348 x-amz-server-side-encryption AES256 content-security-policy-report-only frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=forms-embed/static-1.3611/bundles/project-v2.js&cfRay=7fbac34cd7339597-AMS x-amz-replication-status COMPLETED x-evy-trace-listener listener_https etag W/"c4734e241af5f9cffb4ae77e895d98aa" vary Accept-Encoding content-type application/javascript; charset=utf-8 access-control-allow-origin * x-evy-trace-virtual-host all cache-control s-maxage=600, max-age=300 x-hs-target-asset forms-embed/static-1.3611/bundles/project-v2.js date Thu, 24 Aug 2023 20:49:57 GMT x-amz-version-id t9RM7Hi5NxkmmXBn8QlzNFQ1kBe.nFZ5 via 1.1 3f52d342c56014599dee37446f6c9f2e.cloudfront.net (CloudFront) x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} strict-transport-security max-age=31536000; includeSubDomains; preload x-amz-cf-pop FRA56-P2 x-hubspot-correlation-id 2a592a48-5b45-4ff6-8a47-53249d906855 x-cache Hit from cloudfront cache-tag staticjsapp-forms-embed-v2-web-prod,staticjsapp-prod x-envoy-upstream-service-time 6 alt-svc h3=":443"; ma=86400 x-evy-trace-route-configuration listener_https/all x-request-id 2a592a48-5b45-4ff6-8a47-53249d906855 last-modified Thu, 24 Aug 2023 09:52:45 UTC server cloudflare report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=TxkVzQPZV%2BVehcrl6RhgBXJoLjwBuPzMkHTfsAFWkYjpiiQAegojHBPo88xB%2BqUksYA0YGze%2BXLilUeNkdv0AdHB6mFzRbpVeK%2BNyD0whUucv1h3RfWFRWNdIorFiq%2Fn6fvKLw%3D%3D"}],"group":"cf-nel","max_age":604800} x-hs-cache-status HIT x-evy-trace-served-by-pod fra04/app-td/envoy-proxy-5b45bc9bc5-8ct2c cf-ray 7fbe76fecae81b74-DUB x-amz-cf-id 8ASck2ThWZu5ZJ7wox_Ht802qFIcOSieeWQcT0TqxbJ-hUGJpuRbww==
GET H2	200	main.js Show response website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/js/	211 KB 46 KB	85ms 84ms	Script application/x-javascript	2600:9000:20c3:b200:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/js/main.js Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:20c3:b200:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 9e74da602eceae93875543dd9a235f2fbbbca8c254c125bcb733fa6a0486c9bd Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language en-GB,en;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Thu, 24 Aug 2023 20:49:57 GMT via 1.1 4ba99d04800d29b58ab9861f60991a2a.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop MUC50-C1 x-cache Miss from cloudfront content-length 45806 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Fri, 04 Aug 2023 09:55:26 GMT server nginx etag "34b3c-60215e5662e3c-gzip" x-frame-options sameorigin vary Accept-Encoding content-type application/x-javascript access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id lfD4h6NUK2McJLYaBfJSVTU9laj2OerllsrHTFsdXcjclO8ySeUS8g== expires Thu, 24 Aug 2023 21:19:57 GMT
GET H2	200	fancybox.umd.js Show response website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/libs/fancybox/	103 KB 30 KB	414ms 281ms	Script application/x-javascript	2600:9000:20c3:b200:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/libs/fancybox/fancybox.umd.js Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:20c3:b200:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 942e02acf640c0308f65e057a8afaed63dfaf995034cda9cfc75532a1009ec72 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language en-GB,en;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Thu, 24 Aug 2023 20:49:57 GMT via 1.1 4ba99d04800d29b58ab9861f60991a2a.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop MUC50-C1 x-cache Miss from cloudfront content-length 29634 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Mon, 05 Sep 2022 07:24:28 GMT server nginx etag "19ca6-5e7e8f85cb376-gzip" x-frame-options sameorigin vary Accept-Encoding content-type application/x-javascript access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id 26VALAnjJKnoHDGHSY7vgINASn_ZcJTGXQounH_cHfvhNMjhlIsCJQ== expires Thu, 24 Aug 2023 21:19:57 GMT
GET H2	200	frontend.min.js Show response www.group-ib.com/wp-content/plugins/post-views-counter/js/	1 KB 691 B	68ms 67ms	Script application/x-javascript	3.72.181.255 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://www.group-ib.com/wp-content/plugins/post-views-counter/js/frontend.min.js Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-72-181-255.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash 12475fdd5d48640d7ad60670a2342f02cf560b8cd977cf8e7e624e6a22576f82 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language en-GB,en;q=0.9 Referer https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Thu, 24 Aug 2023 20:49:57 GMT strict-transport-security max-age=31536000; includeSubDomains content-length 628 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Wed, 26 Apr 2023 07:26:40 GMT server nginx etag "484-5fa38293ec798-gzip" vary X-Forwarded-Proto,Accept-Encoding x-frame-options sameorigin content-type application/x-javascript access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes expires Thu, 24 Aug 2023 21:19:57 GMT
GET H2	200	25755956.js Show response js-eu1.hs-scripts.com/	2 KB 1 KB	299ms 123ms	Script application/javascript	172.65.208.22 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js-eu1.hs-scripts.com/25755956.js Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.65.208.22 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 9cee96cb81e3b5a9362e2d1bbe9318f5866066b1401bceb6e78ab9bba692df8f Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language en-GB,en;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 Response headers date Thu, 24 Aug 2023 20:49:58 GMT content-encoding br x-content-type-options nosniff cf-cache-status EXPIRED x-evy-trace-route-service-name envoyset-translator x-hubspot-correlation-id 9bff114d-172a-4c93-9881-a4565edd59a0 x-envoy-upstream-service-time 4 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id 9bff114d-172a-4c93-9881-a4565edd59a0 last-modified Thu, 24 Aug 2023 20:48:54 GMT server cloudflare x-trace 2BF44DAF46C98673A24D821E34784DB1575EA904A6000000000000000000 vary origin, Accept-Encoding access-control-max-age 3600 content-type application/javascript;charset=utf-8 access-control-allow-origin https://www.group-ib.com x-evy-trace-virtual-host all cache-control public, max-age=30 access-control-allow-credentials true x-evy-trace-served-by-pod fra04/hubapi-td/envoy-proxy-74f74b4b68-9zkqb cf-ray 7fbe77022acd1b84-DUB
GET DATA	200 OK	truncated /	488 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash eeefe3b59f1d383b3836ff89f85276bfda0b0f702fb8e8f2d26346d4e65e484a Request headers accept-language en-GB,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	4 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash f78925d3143d6cc56a5828edb4915412a4926b4aefaf870644989f8885158869 Request headers accept-language en-GB,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 Response headers Content-Type image/png
GET H2	200	idgib-w-61354c22-16cc-40a8-a871-6901f1a76e24 Show response www.group-ib.com/api/fl/	217 B 665 B	64ms 63ms	XHR application/json	3.72.181.255 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://www.group-ib.com/api/fl/idgib-w-61354c22-16cc-40a8-a871-6901f1a76e24 Requested by Host: fhp-de-js.group-ib.com URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-72-181-255.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash 4eda92c7c5f7dfce07d9b7979f00aa608138c5c507a9b40e79fb204e5f149576 Request headers X-GIB-GSSCgib-w-61354c22-16cc-40a8-a871-6901f1a76e24 aiAdlGTfiR/VFj8UZaEqUhl6CDaWnyxd2YPKdvYV06a0Y61I312CjRamfhGrb91orGVuwsfTVyNKY1UyMOkUR7mD3pFRk3GOkZ+wrGmjKU/JzGinxkA7f34wWMp6oRmxuAXPtZwJ1QVBrI5aGLmBo/y8hlhCKqxBjdbx1KkPbOvAm8Xz6ak0kV+RXyNmXlKrs2AcII+eMhsEN1ZnYBIP5K5EtLa+rFBTzgs2zipkirRme4SRYsleA5cnn7O0zA== Referer https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ accept-language en-GB,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 X-GIB-FGSSCgib-w-61354c22-16cc-40a8-a871-6901f1a76e24 NGj1c3d9906c31dcb77848afc8934b5b12358569 x-cfids 09XHR/zeG5CRYX0Cwp/Kc4HBHmXkeCOX7HnyFi6SwALxdnM64j4oMsJrdCfxIDAuyPXsq/49bQRFcneX0bjlWAuW4zW06a0Ap/CuP6uQCto2+yWzx/mqMb485OBpK416U9GGbqyRSy2DZpif8RpzZc+eyrZOOd+Ndjh6 Response headers date Thu, 24 Aug 2023 20:49:57 GMT content-encoding gzip server nginx etag W/"EAQ1g61No9EeZpLuhWuHCaYZn9K0WNZBC86MjB5KE99OTkTnHN0EV0/I2eXz8jwIzdWq4yt8AVrVsNgmipgtfz88Pj5avQ0OD4LSgJcPCUdY12DYPhwkVxctX6S5Y0BG3GAAubkeanH9kg5/sQhnuD3j3f85F2oT+AJ/" vary Accept-Encoding content-type application/json; charset=utf-8 cache-control no-cache x-envoy-upstream-service-time 0
GET H2	200	G-font-Medium.otf website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/fonts/G-font/	60 KB 35 KB	240ms 102ms	Font application/x-font-otf	2600:9000:20c3:b200:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/fonts/G-font/G-font-Medium.otf Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:20c3:b200:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 1efe16c9efbadde5e242d88a315eca3906a55669fcd4882a904fbc723306a4e4 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers Referer https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css Origin https://www.group-ib.com accept-language en-GB,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Thu, 24 Aug 2023 20:49:58 GMT via 1.1 7497b6df995aa2d58f27a725f51d6240.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop MUC50-C1 x-cache Miss from cloudfront content-length 35382 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 28 Jun 2022 07:55:26 GMT server nginx etag "eed4-5e27d5c025780-gzip" x-frame-options sameorigin vary Accept-Encoding content-type application/x-font-otf access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id MYWRALY9D72W2JWm2k9288b22sB79f3NVMcsVSh0ESgUfLAz-E_VAQ== expires Thu, 24 Aug 2023 21:19:58 GMT
GET H2	200	G-font-Regular.otf website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/fonts/G-font/	47 KB 31 KB	228ms 90ms	Font application/x-font-otf	2600:9000:20c3:b200:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/fonts/G-font/G-font-Regular.otf Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:20c3:b200:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 6cee0fb06339ba13e1f15d044e0e4904bbeeb7fbe4351e3f102b6d80b2465061 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers Referer https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css Origin https://www.group-ib.com accept-language en-GB,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Thu, 24 Aug 2023 20:49:58 GMT via 1.1 7497b6df995aa2d58f27a725f51d6240.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop MUC50-C1 x-cache Miss from cloudfront content-length 30798 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 28 Jun 2022 07:55:26 GMT server nginx etag "bbf8-5e27d5c025780-gzip" x-frame-options sameorigin vary Accept-Encoding content-type application/x-font-otf access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id D2bVSEwGIlMYvVQyY5tBAY3K6kydNfqgtxVEmMwtgHV1W8oonDb_EA== expires Thu, 24 Aug 2023 21:19:58 GMT
GET H/1.1	200 OK	json Show response forms-eu1.hsforms.com/embed/v3/form/25755956/044e7558-8073-478a-ad3c-5807dd76840f/	9 KB 3 KB	341ms 112ms	XHR application/json	172.65.232.43 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://forms-eu1.hsforms.com/embed/v3/form/25755956/044e7558-8073-478a-ad3c-5807dd76840f/json?hs_static_app=forms-embed&hs_static_app_version=1.3611&X-HubSpot-Static-App-Info=forms-embed-1.3611 Requested by Host: fhp-de-js.group-ib.com URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 172.65.232.43 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 2cf4e11297ecc093f20a76fa577c94b4bd35ad0d089c6b6f329af7d61bc3ec77 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Accept application/json, text/plain, */* Referer https://www.group-ib.com/ accept-language en-GB,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 Response headers X-Origin-Hublet eu1 Date Thu, 24 Aug 2023 20:49:58 GMT Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff CF-Cache-Status DYNAMIC Content-Encoding br x-evy-trace-route-service-name envoyset-translator X-HubSpot-Correlation-Id 9421753b-9129-4b1d-9b7f-bd3dd6ee526f Transfer-Encoding chunked x-envoy-upstream-service-time 8 Connection keep-alive alt-svc h3=":443"; ma=86400 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id 9421753b-9129-4b1d-9b7f-bd3dd6ee526f Server cloudflare X-Trace 2BDF8348039340DB01EB739B697A16663CF3235444000000000000000000 Vary origin Access-Control-Allow-Methods OPTIONS, GET Content-Type application/json;charset=utf-8 Access-Control-Allow-Origin https://www.group-ib.com x-evy-trace-virtual-host all Access-Control-Expose-Headers X-Origin-Hublet Access-Control-Max-Age 180 Access-Control-Allow-Credentials false Cache-Control max-age=0, no-cache, no-store X-Robots-Tag none Access-Control-Allow-Headers * CF-RAY 7fbe7702c87334cc-DUB x-evy-trace-served-by-pod fra04/star-hubspot-td/envoy-proxy-79bb87d888-nv9kd
GET H2	200	cross.svg website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/	342 B 1 KB	88ms 87ms	Image image/svg+xml	2600:9000:20c3:b200:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/cross.svg Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:20c3:b200:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash dfb059f8aa219769088fd6c85d85aae789f1e72bfe3d314748f1f3ccfffffb1c Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language en-GB,en;q=0.9 Referer https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Thu, 24 Aug 2023 20:49:58 GMT via 1.1 4ba99d04800d29b58ab9861f60991a2a.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop MUC50-C1 x-cache Miss from cloudfront content-length 207 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 28 Jun 2022 07:55:26 GMT server nginx etag "156-5e27d5c025780-gzip" x-frame-options sameorigin vary Accept-Encoding content-type image/svg+xml access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id -YwtFTREdveUSCboFYdgQhYlna9G7AyWzRuyWpw2ZzlwVTTLG3w5Zg== expires Thu, 24 Aug 2023 21:19:58 GMT
GET H/1.1	200 OK	json Show response forms-eu1.hsforms.com/embed/v3/form/25755956/4dbceae1-75ae-423a-9c12-dee8f1ca3345/	112 KB 30 KB	292ms 117ms	XHR application/json	172.65.232.43 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://forms-eu1.hsforms.com/embed/v3/form/25755956/4dbceae1-75ae-423a-9c12-dee8f1ca3345/json?hs_static_app=forms-embed&hs_static_app_version=1.3611&X-HubSpot-Static-App-Info=forms-embed-1.3611 Requested by Host: fhp-de-js.group-ib.com URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 172.65.232.43 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 74dbd3df0773f089e7937d29be9c33c67ad5c06523b5b03a0a7253801a44a360 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Accept application/json, text/plain, */* Referer https://www.group-ib.com/ accept-language en-GB,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 Response headers X-Origin-Hublet eu1 Date Thu, 24 Aug 2023 20:49:58 GMT Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff CF-Cache-Status DYNAMIC Content-Encoding br x-evy-trace-route-service-name envoyset-translator X-HubSpot-Correlation-Id e9ebf45c-5c35-4bd9-91f8-f12ada6d0bdd Transfer-Encoding chunked x-envoy-upstream-service-time 15 Connection keep-alive alt-svc h3=":443"; ma=86400 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id e9ebf45c-5c35-4bd9-91f8-f12ada6d0bdd Server cloudflare X-Trace 2BB7D25D831518C0E7217BF3EBDA98A35C6C86F9B0000000000000000000 Vary origin Access-Control-Allow-Methods OPTIONS, GET Content-Type application/json;charset=utf-8 Access-Control-Allow-Origin https://www.group-ib.com x-evy-trace-virtual-host all Access-Control-Expose-Headers X-Origin-Hublet Access-Control-Max-Age 180 Access-Control-Allow-Credentials false Cache-Control max-age=0, no-cache, no-store X-Robots-Tag none Access-Control-Allow-Headers * CF-RAY 7fbe7702cb6b60c2-DUB x-evy-trace-served-by-pod fra04/star-hubspot-td/envoy-proxy-79bb87d888-vvgjb
GET DATA	200 OK	truncated /	64 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 01caf20e667c8e300960582162f912d9405e9895c32cff1a9ee95511fd509a2c Request headers accept-language en-GB,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 Response headers Content-Type image/svg+xml
GET H2	200	dropdown_before.svg website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/	154 B 973 B	103ms 103ms	Image image/svg+xml	2600:9000:20c3:b200:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/dropdown_before.svg Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:20c3:b200:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 574ab1a3d7b47add5d43a927f62c87698264f63572acd70b42081dd4a1dc5ced Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language en-GB,en;q=0.9 Referer https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Thu, 24 Aug 2023 20:49:58 GMT via 1.1 4ba99d04800d29b58ab9861f60991a2a.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop MUC50-C1 x-cache Miss from cloudfront content-length 150 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 28 Jun 2022 07:55:26 GMT server nginx etag "9a-5e27d5c025780-gzip" x-frame-options sameorigin vary Accept-Encoding content-type image/svg+xml access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id nOY_HlZdK-kNQE6jIx-CSo4R27CYzqau2AgOxSd2I9itzxD9oWsUHw== expires Thu, 24 Aug 2023 21:19:58 GMT
GET H2	200	link-arrow.svg website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/	409 B 1 KB	106ms 106ms	Image image/svg+xml	2600:9000:20c3:b200:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/link-arrow.svg Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:20c3:b200:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash e91c5731358570d3e4cd684118251d243fc799059648b152403dcd775ceba632 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language en-GB,en;q=0.9 Referer https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Thu, 24 Aug 2023 20:49:58 GMT via 1.1 4ba99d04800d29b58ab9861f60991a2a.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop MUC50-C1 x-cache Miss from cloudfront content-length 267 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 28 Jun 2022 07:55:26 GMT server nginx etag "199-5e27d5c025780-gzip" x-frame-options sameorigin vary Accept-Encoding content-type image/svg+xml access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id 6cmHEP4drYTWxYOob_BpFjZxPJAK8_mlpZHfki7-VXMORiJLIscuSA== expires Thu, 24 Aug 2023 21:19:58 GMT
GET DATA	200 OK	truncated /	68 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 1f464ef7c0b366ff00e2f023cb6b48112306212648e451ddf16be40c2b99d639 Request headers accept-language en-GB,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	69 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 81cc2a3a0c0b6e8335f5f3143390b8b6f036dc573e73d3f4b5742482f0bdca73 Request headers accept-language en-GB,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	68 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 5762b8cb4c89773a8c77ac55e3a4e44d93ddda7e99a2a258bc8a72a4ba6af1ae Request headers accept-language en-GB,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	68 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 3e6c764f74f1d74abbb2534395f96ea1b9dbac478db34ad5fb65c1895b3f66ab Request headers accept-language en-GB,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	68 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 02d4a767b3ef79071575684568b601dca750d3419f3b23681d56d6847b214da9 Request headers accept-language en-GB,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	68 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash ebce2864885d6e1a8de23facad4a8f6b8972da1872f1be9a44fceac5fc4958df Request headers accept-language en-GB,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 Response headers Content-Type image/svg+xml
GET H2	200	Close.svg www.group-ib.com/wp-content/themes/gib-theme/assets/images/	227 B 264 B	155ms 108ms	Image image/svg+xml	3.72.181.255 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://www.group-ib.com/wp-content/themes/gib-theme/assets/images/Close.svg Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-72-181-255.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash 31d1c5bd0cd38e6e6b8eb944944df273044e826c7d3daacbe602caead3068c7a Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language en-GB,en;q=0.9 Referer https://website.cdn.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Thu, 24 Aug 2023 20:49:58 GMT strict-transport-security max-age=31536000; includeSubDomains content-length 180 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 29 Nov 2022 12:14:21 GMT server nginx etag "e3-5ee9aed8bc981-gzip" vary Accept-Encoding x-frame-options sameorigin content-type image/svg+xml access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes expires Thu, 24 Aug 2023 21:19:58 GMT
GET H2	200	file_copy.svg www.group-ib.com/wp-content/themes/gib-theme/assets/images/	668 B 496 B	153ms 106ms	Image image/svg+xml	3.72.181.255 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://www.group-ib.com/wp-content/themes/gib-theme/assets/images/file_copy.svg Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-72-181-255.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash f367bbc4429fc9fb0a93045245aef519a000ab275549645cddecb3f953e0a05f Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language en-GB,en;q=0.9 Referer https://website.cdn.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Thu, 24 Aug 2023 20:49:58 GMT strict-transport-security max-age=31536000; includeSubDomains content-length 352 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Mon, 28 Nov 2022 13:01:55 GMT server nginx etag "29c-5ee8779d1a6cb-gzip" vary Accept-Encoding x-frame-options sameorigin content-type image/svg+xml access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes expires Thu, 24 Aug 2023 21:19:58 GMT
GET H2	200	success.svg www.group-ib.com/wp-content/themes/gib-theme/assets/images/	386 B 359 B	154ms 107ms	Image image/svg+xml	3.72.181.255 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://www.group-ib.com/wp-content/themes/gib-theme/assets/images/success.svg Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-72-181-255.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash fa4859289ded4c674dcee233811758743116b1d7ce4e9f0c0e7e259391504c43 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language en-GB,en;q=0.9 Referer https://website.cdn.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Thu, 24 Aug 2023 20:49:58 GMT strict-transport-security max-age=31536000; includeSubDomains content-length 254 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 29 Nov 2022 11:07:05 GMT server nginx etag "182-5ee99fd05f106-gzip" vary Accept-Encoding x-frame-options sameorigin content-type image/svg+xml access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes expires Thu, 24 Aug 2023 21:19:58 GMT
GET H2	200	list-dot.svg www.group-ib.com/wp-content/themes/gib-theme/assets/images/	313 B 290 B	155ms 110ms	Image image/svg+xml	3.72.181.255 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://www.group-ib.com/wp-content/themes/gib-theme/assets/images/list-dot.svg Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-72-181-255.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash 6b0775723ccade5ca3170fcc6a321c5b4768a5dc2b7c83b8b8b595407a2f0018 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language en-GB,en;q=0.9 Referer https://website.cdn.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Thu, 24 Aug 2023 20:49:58 GMT strict-transport-security max-age=31536000; includeSubDomains content-length 205 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Thu, 08 Sep 2022 12:02:57 GMT server nginx etag "139-5e82935d2238c-gzip" vary Accept-Encoding x-frame-options sameorigin content-type image/svg+xml access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes expires Thu, 24 Aug 2023 21:19:58 GMT
GET H2	200	Dropdown-right.svg website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/	503 B 1 KB	131ms 86ms	Image image/svg+xml	2600:9000:20c3:b200:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/Dropdown-right.svg Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:20c3:b200:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 4d4a484a100e469b6e3dcf880a37755086e246cc291bab46e3edd4529e3d5d6a Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language en-GB,en;q=0.9 Referer https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Thu, 24 Aug 2023 20:49:58 GMT via 1.1 4ba99d04800d29b58ab9861f60991a2a.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop MUC50-C1 x-cache Miss from cloudfront content-length 307 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Fri, 16 Dec 2022 09:56:36 GMT server nginx etag "1f7-5efeefc3ee1d1-gzip" x-frame-options sameorigin vary Accept-Encoding content-type image/svg+xml access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id jyhvHgd62WVfPpCJl8eKglJK8-8oVUGm8iFaDkSvH1ZMisQFyFf60w== expires Thu, 24 Aug 2023 21:19:58 GMT
GET H2	200	G-font-Bold.otf website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/fonts/G-font/	49 KB 32 KB	149ms 123ms	Font application/x-font-otf	2600:9000:20c3:b200:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/fonts/G-font/G-font-Bold.otf Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:20c3:b200:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 8d15a221986226efe4f742f390f46f9d5ae8b2008a6edd40e10ff121ef9cca9b Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers Referer https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css Origin https://www.group-ib.com accept-language en-GB,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Thu, 24 Aug 2023 20:49:58 GMT via 1.1 7497b6df995aa2d58f27a725f51d6240.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop MUC50-C1 x-cache Miss from cloudfront content-length 31918 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 28 Jun 2022 07:55:26 GMT server nginx etag "c320-5e27d5c025780-gzip" x-frame-options sameorigin vary Accept-Encoding content-type application/x-font-otf access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id 4wS4vUcdlMSmS_5h26CnMBR8rl7RAsLFDAByFWbD5P93H7RcX-uAmw== expires Thu, 24 Aug 2023 21:19:58 GMT
GET DATA	200 OK	truncated /	68 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 45b67b4f9681b4259ccd362c99bbc9f5f2a9fa1351b260b112d1f4bdcfa36f29 Request headers accept-language en-GB,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	68 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash a3103e03b292b982b45a28a9054f1035c0fc7e5079c254e114c2c22defcb6edb Request headers accept-language en-GB,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	68 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 735f81dd07d1be528a1109302dabc97c7c8b467d60d7184d3a09dc4817703388 Request headers accept-language en-GB,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	70 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 4d3e9d61c84a9a3d9e67408de91640d9960ade0384f91137b41b2db7242cee46 Request headers accept-language en-GB,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	68 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash eb34f496dadbb9a36d46f7cb1f331a7b8d128cbbf92bc8bf166fcd4b8bd4cc50 Request headers accept-language en-GB,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	69 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash c794a1b7e43ae801fa6d36ccda0cf1d344cd1dd8ab9d14d89b52c32236193265 Request headers accept-language en-GB,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	68 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash b3ceb8713eaee6c95dffc5e4b1c6187675d8ba16f58f73fc30b5c5ae762f0ad7 Request headers accept-language en-GB,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	68 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 403ac797af2f41dca43b737054d3751629920850b59f433b5b5076ea20e32a07 Request headers accept-language en-GB,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	69 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 32942cb255fb7f8c412c42973599e2e32cf4899df5a9dfe0b6173640fa9d6f70 Request headers accept-language en-GB,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	68 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 248468001ca64ad036ae965b6ce2de991bea9e8d4d59342fd3389a2e05fea523 Request headers accept-language en-GB,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	69 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 93b716bdb2ddaeaf8424a1834eb09925889a1911ce6bac298b4f4e9fedbb4f4b Request headers accept-language en-GB,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	68 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 688c32f4de8bd2a7dd5917bae5ddce56a28223db4953c3c701977b8b2e358eb9 Request headers accept-language en-GB,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	68 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash b486dfa94fde5b7e78a90b34417c9f976057f55b862dcdb3c7e41dfd7c5e93e3 Request headers accept-language en-GB,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	68 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash a57f1ad414e426849b2d9f404fa861248d9b65d927ca32c337f11b022acce8aa Request headers accept-language en-GB,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	69 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash cf38411843332cbc47ca7d9974d8edc2d12850a698bba900795c2eaa6e12f9f3 Request headers accept-language en-GB,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 Response headers Content-Type image/svg+xml
GET H2	200	Material-Icons.woff2 website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/fonts/Material-Icons/	125 KB 126 KB	78ms 78ms	Font application/font-woff2	2600:9000:20c3:b200:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/fonts/Material-Icons/Material-Icons.woff2 Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:20c3:b200:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 8265f64786397d6b832d1ca0aafdf149ad84e72759fffa9f7272e91a0fb015d1 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers Referer https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css Origin https://www.group-ib.com accept-language en-GB,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Thu, 24 Aug 2023 20:49:58 GMT via 1.1 7497b6df995aa2d58f27a725f51d6240.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop MUC50-C1 x-cache Miss from cloudfront x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Mon, 12 Sep 2022 13:11:21 GMT server nginx etag "1f560-5e87aa1cf30ee-gzip" x-frame-options sameorigin vary Accept-Encoding content-type application/font-woff2 access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id jzf0vFbrcXVKgJ9fx95kxGlb3HQgy4LLUeoMH7C4gMVcuHALmtrgCw== expires Thu, 24 Aug 2023 21:19:58 GMT
GET DATA	200 OK	truncated /	68 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 34e0bb5c5ed1184e6452cf7562faf332af1a26e95e50e035ff0a9f7065e6df9e Request headers accept-language en-GB,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 Response headers Content-Type image/svg+xml
GET H/1.1	200 OK	json Show response forms-eu1.hsforms.com/embed/v3/form/25755956/55a22738-d5a5-43f9-9c1c-fa4c1a6eb349/	8 KB 3 KB	112ms 104ms	XHR application/json	172.65.232.43 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://forms-eu1.hsforms.com/embed/v3/form/25755956/55a22738-d5a5-43f9-9c1c-fa4c1a6eb349/json?hs_static_app=forms-embed&hs_static_app_version=1.3611&X-HubSpot-Static-App-Info=forms-embed-1.3611 Requested by Host: fhp-de-js.group-ib.com URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 172.65.232.43 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash a9efb27a7560bf410e265e722fb4dfd35de96479790f728ca19da654a54e2117 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Accept application/json, text/plain, */* Referer https://www.group-ib.com/ accept-language en-GB,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 Response headers X-Origin-Hublet eu1 Date Thu, 24 Aug 2023 20:49:58 GMT Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff CF-Cache-Status DYNAMIC Content-Encoding br x-evy-trace-route-service-name envoyset-translator X-HubSpot-Correlation-Id 7ef1afa7-85be-4028-9998-1624a3e3d9d2 Transfer-Encoding chunked x-envoy-upstream-service-time 7 Connection keep-alive alt-svc h3=":443"; ma=86400 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id 7ef1afa7-85be-4028-9998-1624a3e3d9d2 Server cloudflare X-Trace 2BAA87B94555736F7F7021DC3AE415878365755178000000000000000000 Vary origin Access-Control-Allow-Methods OPTIONS, GET Content-Type application/json;charset=utf-8 Access-Control-Allow-Origin https://www.group-ib.com x-evy-trace-virtual-host all Access-Control-Expose-Headers X-Origin-Hublet Access-Control-Max-Age 180 Access-Control-Allow-Credentials false Cache-Control max-age=0, no-cache, no-store X-Robots-Tag none Access-Control-Allow-Headers * CF-RAY 7fbe7703fca760c2-DUB x-evy-trace-served-by-pod fra04/star-hubspot-td/envoy-proxy-79bb87d888-ldcjz
GET H2	200	gtm.js Show response www.googletagmanager.com/	262 KB 85 KB	212ms 71ms	Script application/javascript	2a00:1450:4001:813::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtm.js?id=GTM-PW7265 Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:813::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 4c31c3aa5159e24600fb58f802cb4eccacd40818a54cea4b37301640f3d353a7 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers accept-language en-GB,en;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 Response headers date Thu, 24 Aug 2023 20:49:58 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 86239 x-xss-protection 0 last-modified Thu, 24 Aug 2023 18:02:13 GMT server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Thu, 24 Aug 2023 20:49:58 GMT
GET H2	200	fb.js Show response js-eu1.hsadspixel.net/	6 KB 3 KB	239ms 60ms	Script application/javascript	172.65.219.229 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js-eu1.hsadspixel.net/fb.js Requested by Host: js-eu1.hs-scripts.com URL: https://js-eu1.hs-scripts.com/25755956.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.65.219.229 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 36a58b231f4bd34d323b5a7da9caf1a2706ecc87ca22a822763b96659043017e Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language en-GB,en;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 Response headers date Thu, 24 Aug 2023 20:49:58 GMT x-amz-version-id jPXu6qi.g7uxBjG4s6uCQIhIPiNAy8nk via 1.1 6faa38f38a1fee24a829fec7c748876c.cloudfront.net (CloudFront) x-content-type-options nosniff cf-cache-status HIT x-amz-cf-pop FRA56-P2 age 117 x-amz-server-side-encryption AES256 x-evy-trace-route-service-name envoyset-translator content-security-policy-report-only frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=adsscriptloaderstatic/static-1.396/bundles/pixels-release.js&cfRay=7f445ef9da9260f2-DUB x-cache Hit from cloudfront x-hubspot-correlation-id 98eb3ac6-98fc-4af2-ac7e-0ce52b912846 cache-tag staticjsapp-AdsScriptLoaderCloudflare-web-prod,staticjsapp-prod content-encoding br x-envoy-upstream-service-time 4 x-amz-replication-status COMPLETED x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id 98eb3ac6-98fc-4af2-ac7e-0ce52b912846 last-modified Mon, 07 Aug 2023 08:57:08 UTC server cloudflare etag W/"c80164a2fdf0ea90248ff107d11fb350" vary Accept-Encoding content-type application/javascript; charset=utf-8 x-hs-cache-status MISS x-evy-trace-virtual-host all cache-control max-age=600 x-evy-trace-served-by-pod fra04/app-td/envoy-proxy-5b45bc9bc5-w8lzh cf-ray 7fbe77055b4660d3-DUB x-amz-cf-id o-a8kFteWW8dGxauugAWyG5y441ekntb_p33GvOz58IJkFYWz9uq7A== x-hs-target-asset adsscriptloaderstatic/static-1.396/bundles/pixels-release.js
GET H2	200	collectedforms.js Show response js-eu1.hscollectedforms.net/	69 KB 25 KB	234ms 66ms	Script application/javascript	172.65.192.122 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js-eu1.hscollectedforms.net/collectedforms.js Requested by Host: js-eu1.hs-scripts.com URL: https://js-eu1.hs-scripts.com/25755956.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.65.192.122 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 026c249acda71b64fe2510542d88ae26073694f89b595b1fd0e9f3ad501bf6b4 Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://www.group-ib.com/ Origin https://www.group-ib.com accept-language en-GB,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 Response headers content-encoding br age 103 x-evy-trace-route-service-name envoyset-translator x-amz-server-side-encryption AES256 content-security-policy-report-only frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=collected-forms-embed-js/static-1.394/bundles/project.js&cfRay=7f445847e84b1b9c-DUB x-amz-replication-status COMPLETED x-evy-trace-listener listener_https etag W/"6fb5b8aa66d730f2a49b41a9c712ffa7" vary Accept-Encoding content-type application/javascript; charset=utf-8 access-control-allow-origin * x-evy-trace-virtual-host all cache-control s-maxage=600, max-age=300 x-hs-target-asset collected-forms-embed-js/static-1.394/bundles/project.js date Thu, 24 Aug 2023 20:49:58 GMT x-amz-version-id EcjZkyUfgxNGQ.xnv1Vqq9Oda2f1T.dE via 1.1 93b8205e2f07a7099af2e6fd126d9658.cloudfront.net (CloudFront) x-content-type-options nosniff cf-cache-status HIT x-amz-cf-pop FRA56-P2 x-hubspot-correlation-id 617aed9b-29e6-4e42-8e90-9b7fd39e356f x-cache Hit from cloudfront cache-tag staticjsapp-collected-forms-embed-js-web-prod,staticjsapp-prod x-envoy-upstream-service-time 2 x-evy-trace-route-configuration listener_https/all x-request-id 617aed9b-29e6-4e42-8e90-9b7fd39e356f last-modified Wed, 09 Aug 2023 09:05:38 UTC server cloudflare x-hs-cache-status HIT x-evy-trace-served-by-pod fra04/app-td/envoy-proxy-5b45bc9bc5-w8lzh cf-ray 7fbe77054b9734e3-DUB x-amz-cf-id AbMt9Cwx7zzwCMgCWxES35FbrXx7VOT9P_BzX6-_gB-e9gZ8DAYjag==
GET H2	200	25755956.js Show response js-eu1.hs-analytics.net/analytics/1692909900000/	66 KB 21 KB	229ms 68ms	Script text/javascript	172.65.238.60 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js-eu1.hs-analytics.net/analytics/1692909900000/25755956.js Requested by Host: js-eu1.hs-scripts.com URL: https://js-eu1.hs-scripts.com/25755956.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.65.238.60 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 92a2a1ad72d4811d1c79b6fb44e50c193f2d514b2fe36e946577d80c6254ce4f Request headers accept-language en-GB,en;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 Response headers date Thu, 24 Aug 2023 20:49:58 GMT content-encoding br cf-cache-status HIT x-amz-request-id 6RWKTHVCD5AAGR49 x-evy-trace-route-service-name envoyset-translator x-amz-server-side-encryption AES256 x-hubspot-correlation-id 0cf52e7d-dbec-433d-abaf-bc6f035bc4ad age 101 x-envoy-upstream-service-time 15 x-amz-id-2 vu+Sq61xH5a8BOlQwlf+VkLldfJhS5L2xFad3QDpLO65TNgFbf9deVnDnThzh0R87QpZIFGXBts= x-evy-trace-listener listener_https x-request-id 0cf52e7d-dbec-433d-abaf-bc6f035bc4ad x-evy-trace-route-configuration listener_https/all last-modified Wed, 16 Aug 2023 15:02:57 GMT server cloudflare etag W/"eaed25f45513b2c42381986283dfda58" vary origin, Accept-Encoding content-type text/javascript x-evy-trace-virtual-host all x-evy-trace-served-by-pod fra04/analytics-js-proxy-td/envoy-proxy-85d65fb994-k9w6j cache-control max-age=300,public access-control-allow-credentials false cf-ray 7fbe77053e711b95-DUB expires Thu, 24 Aug 2023 20:53:17 GMT
GET H2	200	banner.js Show response js-eu1.hs-banner.com/v2/25755956/	66 KB 20 KB	248ms 72ms	Script text/javascript	172.65.202.201 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js-eu1.hs-banner.com/v2/25755956/banner.js Requested by Host: js-eu1.hs-scripts.com URL: https://js-eu1.hs-scripts.com/25755956.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.65.202.201 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 3c50f1c516cf27ff52158aac863d91ba5830941b9d3aea9e65543e03b314c4e3 Request headers accept-language en-GB,en;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 Response headers date Thu, 24 Aug 2023 20:49:58 GMT x-amz-version-id MkwRuEgSV1gVokMUKLT0Gwcd5mQpUsYy content-encoding br cf-cache-status HIT x-amz-request-id NRH9P5GEFKQK2C0K x-evy-trace-route-service-name envoyset-translator x-amz-server-side-encryption AES256 x-hubspot-correlation-id 5a739018-435b-4ae3-96d9-269ab1dd5485 age 103 x-envoy-upstream-service-time 16 x-amz-id-2 clHdUSbI2+bskjGmwDyd5MvO1qUNwtQdmriFOCLs1JfPdJ4n25MhWsgBUe7wvLMyroOQToh1YF0= x-evy-trace-listener listener_https x-request-id 5a739018-435b-4ae3-96d9-269ab1dd5485 x-evy-trace-route-configuration listener_https/all last-modified Mon, 31 Jul 2023 22:17:58 GMT server cloudflare etag W/"0242d29ee7f336c2ab610f4370070def" access-control-max-age 604800 access-control-allow-methods GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD content-type text/javascript; charset=UTF-8 access-control-allow-origin https://www.facct.ru x-evy-trace-virtual-host all access-control-expose-headers x-last-modified-timestamp, X-HubSpot-NotFound, X-HS-User-Request, Link, Server-Timing cache-control max-age=300,public access-control-allow-credentials true x-evy-trace-served-by-pod fra04/analytics-js-proxy-td/envoy-proxy-85d65fb994-mmx2s vary origin, Accept-Encoding timing-allow-origin * access-control-allow-headers Origin, X-Requested-With, Content-Type, Accept, Accept-Charset, Accept-Encoding, X-Override-Internal-Permissions, X-Properties-Source, X-Properties-SourceId, X-Properties-Flag, X-Hubspot-User-Id, X-Hubspot-Trace, X-Hubspot-Callee, X-Hubspot-Offset, X-Hubspot-No-Trace, X-HubSpot-Static-App-Info, X-HubSpot-Messages-Uri, X-HubSpot-Request-Source, X-HubSpot-Request-Reason, Subscription-Billing-Auth-Token, X-App-CSRF, X-Tools-CSRF, Online-Payment-Signing-UUID, X-Source, X-SourceId, X-Origin-UserId, X-Biden-Request-Source, X-HubSpot-CSRF-hubspotapi, X-Force-Cookie-Refresh, X-Force-Cookie-Refresh-No-Cache, X-HS-User-Request, X-Application-Id, X-HS-Referer, X-HubSpot-Correlation-Id cf-ray 7fbe770559551b7c-DUB expires Thu, 24 Aug 2023 20:53:15 GMT
GET H2	200	insight.min.js Show response website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/js/	8 KB 4 KB	93ms 72ms	Script application/x-javascript	2600:9000:20c3:b200:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/js/insight.min.js Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:20c3:b200:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 14f2ec002b176e0dee403cb7dd4ef2274a1353080e1e3e4084678770f4c15b9c Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language en-GB,en;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Thu, 24 Aug 2023 20:49:58 GMT via 1.1 4ba99d04800d29b58ab9861f60991a2a.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop MUC50-C1 x-cache Miss from cloudfront content-length 3085 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Fri, 15 Jul 2022 14:12:57 GMT server nginx etag "1e5a-5e3d89d6a8c40-gzip" x-frame-options sameorigin vary Accept-Encoding content-type application/x-javascript access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id b4JOqEJEg_2ZF801Z53wWqvOldV8w3YEpxNUhEGr-3aZgITBl-l8Hw== expires Thu, 24 Aug 2023 21:19:58 GMT
GET H/1.1	200 OK	json Show response forms-eu1.hsforms.com/embed/v3/form/25755956/eb903dab-0ef3-43b5-bdeb-71372e6ad0f0/	7 KB 3 KB	119ms 108ms	XHR application/json	172.65.232.43 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://forms-eu1.hsforms.com/embed/v3/form/25755956/eb903dab-0ef3-43b5-bdeb-71372e6ad0f0/json?hs_static_app=forms-embed&hs_static_app_version=1.3611&X-HubSpot-Static-App-Info=forms-embed-1.3611 Requested by Host: fhp-de-js.group-ib.com URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 172.65.232.43 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash ef271ec7b33b45a6e7560e6670f034d8be356adf059fbd404ef72e21ba116adf Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Accept application/json, text/plain, */* Referer https://www.group-ib.com/ accept-language en-GB,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 Response headers X-Origin-Hublet eu1 Date Thu, 24 Aug 2023 20:49:58 GMT Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff CF-Cache-Status DYNAMIC Content-Encoding br x-evy-trace-route-service-name envoyset-translator X-HubSpot-Correlation-Id 2c4bc249-5218-4021-aba3-77d9e6cca3bd Transfer-Encoding chunked x-envoy-upstream-service-time 7 Connection keep-alive alt-svc h3=":443"; ma=86400 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id 2c4bc249-5218-4021-aba3-77d9e6cca3bd Server cloudflare X-Trace 2BB2EF7FD45E8A65A65375695EBA6BF828C305C1CA000000000000000000 Vary origin Access-Control-Allow-Methods OPTIONS, GET Content-Type application/json;charset=utf-8 Access-Control-Allow-Origin https://www.group-ib.com x-evy-trace-virtual-host all Access-Control-Expose-Headers X-Origin-Hublet Access-Control-Max-Age 180 Access-Control-Allow-Credentials false Cache-Control max-age=0, no-cache, no-store X-Robots-Tag none Access-Control-Allow-Headers * CF-RAY 7fbe77045a7b34cc-DUB x-evy-trace-served-by-pod fra04/star-hubspot-td/envoy-proxy-79bb87d888-ldcjz
GET H2	200	main-logo.svg www.group-ib.com/wp-content/themes/gib-theme/assets/images/	3 KB 2 KB	142ms 134ms	Image image/svg+xml	3.72.181.255 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://www.group-ib.com/wp-content/themes/gib-theme/assets/images/main-logo.svg Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-72-181-255.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash 589c9a6a159cf2ecc8555bc4457827f21002eaec9a24e3bc54401ed0b4d30ac8 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language en-GB,en;q=0.9 Referer https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Thu, 24 Aug 2023 20:49:58 GMT strict-transport-security max-age=31536000; includeSubDomains content-length 1527 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Mon, 30 Jan 2023 11:16:06 GMT server nginx etag "d82-5f379576be685-gzip" vary Accept-Encoding x-frame-options sameorigin content-type image/svg+xml access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes expires Thu, 24 Aug 2023 21:19:58 GMT
GET H2	200	ti.png website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/	6 KB 7 KB	238ms 230ms	Image image/png	2600:9000:20c3:b200:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/ti.png Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:20c3:b200:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash f0e3a799744c0c67782742af2c13b85f769b58abd04800a04853d26f60cf7314 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language en-GB,en;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; date Thu, 24 Aug 2023 20:49:58 GMT x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains via 1.1 4ba99d04800d29b58ab9861f60991a2a.cloudfront.net (CloudFront) x-amz-cf-pop MUC50-C1 x-cache Miss from cloudfront content-length 5919 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 28 Jun 2022 07:55:26 GMT server nginx etag "171f-5e27d5c025780" x-frame-options sameorigin content-type image/png access-control-allow-origin https://www.group-ib.com cache-control no-cache, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id tS2_1b_1FvkE10ylwAnXOBaqRrSYnx3oEDiG2f0GGF3DvYqlcpcVMg== expires Thu, 24 Aug 2023 20:49:57 GMT
GET H2	200	asm.png website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/	6 KB 7 KB	237ms 230ms	Image image/png	2600:9000:20c3:b200:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/asm.png Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:20c3:b200:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 997d49d316b533985208f14602a1ff15a76bf6a567afbb6b6980629ca8d78bab Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language en-GB,en;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; date Thu, 24 Aug 2023 20:49:58 GMT x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains via 1.1 4ba99d04800d29b58ab9861f60991a2a.cloudfront.net (CloudFront) x-amz-cf-pop MUC50-C1 x-cache Miss from cloudfront content-length 5941 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 28 Jun 2022 07:55:26 GMT server nginx etag "1735-5e27d5c025780" x-frame-options sameorigin content-type image/png access-control-allow-origin https://www.group-ib.com cache-control no-cache, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id yzaF8a-IdQK7VkzkwJk4gUX3tVI0Y8VztqKPHJAq2xcUZ3EGZjnXkg== expires Thu, 24 Aug 2023 20:49:57 GMT
GET H2	200	fp.png website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/	8 KB 8 KB	98ms 91ms	Image image/png	2600:9000:20c3:b200:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/fp.png Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:20c3:b200:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 15534f98c260c3c3caaedf53335d912010b2de1731477a9fd4dbea89fb4995d9 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language en-GB,en;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; date Thu, 24 Aug 2023 20:49:58 GMT x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains via 1.1 4ba99d04800d29b58ab9861f60991a2a.cloudfront.net (CloudFront) x-amz-cf-pop MUC50-C1 x-cache Miss from cloudfront content-length 7844 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 28 Jun 2022 07:55:26 GMT server nginx etag "1ea4-5e27d5c025780" x-frame-options sameorigin content-type image/png access-control-allow-origin https://www.group-ib.com cache-control no-cache, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id lzcEzPaGd35hvSjZFhr0sr4L2ARA6dVBEp8MVwzKXrY3tBadPbdUVA== expires Thu, 24 Aug 2023 20:49:57 GMT
GET H2	200	drp.png website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/	5 KB 6 KB	224ms 217ms	Image image/png	2600:9000:20c3:b200:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/drp.png Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:20c3:b200:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash a300a894e169169882504968fae71958a87e0a4322e2aee1b6b0bbd63fd9621f Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language en-GB,en;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; date Thu, 24 Aug 2023 20:49:58 GMT x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains via 1.1 4ba99d04800d29b58ab9861f60991a2a.cloudfront.net (CloudFront) x-amz-cf-pop MUC50-C1 x-cache Miss from cloudfront content-length 5398 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 28 Jun 2022 07:55:26 GMT server nginx etag "1516-5e27d5c025780" x-frame-options sameorigin content-type image/png access-control-allow-origin https://www.group-ib.com cache-control no-cache, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id sCNJlQrA10j_A-Y5lIefpcY_IxbBLgAJkN6ZvT4M3yMjpw3oC8fLeA== expires Thu, 24 Aug 2023 20:49:57 GMT
GET H2	200	mxdr.png website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/	6 KB 7 KB	235ms 229ms	Image image/png	2600:9000:20c3:b200:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/mxdr.png Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:20c3:b200:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 2be8ce2b065360537771ed230d5d72cbd84758ec127ffa035e6d260ed14af5b0 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language en-GB,en;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; date Thu, 24 Aug 2023 20:49:58 GMT x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains via 1.1 4ba99d04800d29b58ab9861f60991a2a.cloudfront.net (CloudFront) x-amz-cf-pop MUC50-C1 x-cache Miss from cloudfront content-length 6506 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 28 Jun 2022 07:55:26 GMT server nginx etag "196a-5e27d5c025780" x-frame-options sameorigin content-type image/png access-control-allow-origin https://www.group-ib.com cache-control no-cache, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id R49BEe9HVPhRk8xr1sN-KhfuNJArZFE3bYQThNvpxK0kVQZbBOYrwQ== expires Thu, 24 Aug 2023 20:49:57 GMT
GET H2	200	bep.png website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/	6 KB 7 KB	300ms 293ms	Image image/png	2600:9000:20c3:b200:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/bep.png Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:20c3:b200:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 7574ba97d4ee7e81bd60873a52a31ff13359f246d0ac492ef2dabf96233a99e6 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language en-GB,en;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; date Thu, 24 Aug 2023 20:49:58 GMT x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains via 1.1 4ba99d04800d29b58ab9861f60991a2a.cloudfront.net (CloudFront) x-amz-cf-pop MUC50-C1 x-cache Miss from cloudfront content-length 6362 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 28 Jun 2022 07:55:26 GMT server nginx etag "18da-5e27d5c025780" x-frame-options sameorigin content-type image/png access-control-allow-origin https://www.group-ib.com cache-control no-cache, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id qn5Lli6QRx-WNqsbhUcITagXtrVX4hoRbOVd2vwcmUT_OFCS8oa_cQ== expires Thu, 24 Aug 2023 20:49:57 GMT
GET H2	200	share-black.svg www.group-ib.com/wp-content/themes/gib-theme/assets/images/	1 KB 857 B	155ms 149ms	Image image/svg+xml	3.72.181.255 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://www.group-ib.com/wp-content/themes/gib-theme/assets/images/share-black.svg Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-72-181-255.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash 3689e488f5478e26f0347353ad608ccd66e4d62992021c51d9db93f89d43c880 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language en-GB,en;q=0.9 Referer https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Thu, 24 Aug 2023 20:49:58 GMT strict-transport-security max-age=31536000; includeSubDomains content-length 500 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 22 Nov 2022 11:16:45 GMT server nginx etag "468-5ee0d4eb0feca-gzip" vary Accept-Encoding x-frame-options sameorigin content-type image/svg+xml access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes expires Thu, 24 Aug 2023 21:19:58 GMT
GET H2	200	wb_sunny-black.svg www.group-ib.com/wp-content/themes/gib-theme/assets/images/	724 B 470 B	143ms 137ms	Image image/svg+xml	3.72.181.255 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://www.group-ib.com/wp-content/themes/gib-theme/assets/images/wb_sunny-black.svg Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-72-181-255.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash cc5dcea4d483d798630d7fe0846a1b784618aa3d4f86bdfa655083d81750322a Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language en-GB,en;q=0.9 Referer https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Thu, 24 Aug 2023 20:49:58 GMT strict-transport-security max-age=31536000; includeSubDomains content-length 385 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 22 Nov 2022 11:16:45 GMT server nginx etag "2d4-5ee0d4eb0feca-gzip" vary Accept-Encoding x-frame-options sameorigin content-type image/svg+xml access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes expires Thu, 24 Aug 2023 21:19:58 GMT
GET H2	200	moon.svg www.group-ib.com/wp-content/themes/gib-theme/assets/images/	627 B 505 B	145ms 139ms	Image image/svg+xml	3.72.181.255 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://www.group-ib.com/wp-content/themes/gib-theme/assets/images/moon.svg Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-72-181-255.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash dedf6c9294a8b9e4b13b1575641071e45c8e61235bd154d19103fd2893ccd708 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language en-GB,en;q=0.9 Referer https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Thu, 24 Aug 2023 20:49:58 GMT strict-transport-security max-age=31536000; includeSubDomains content-length 361 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Thu, 24 Nov 2022 12:37:03 GMT server nginx etag "273-5ee36a9860213-gzip" vary Accept-Encoding x-frame-options sameorigin content-type image/svg+xml access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes expires Thu, 24 Aug 2023 21:19:58 GMT
GET H2	200	zero-day-blog.webp website.cdn.group-ib.com/wp-content/uploads/	537 KB 538 KB	97ms 91ms	Image image/webp	2600:9000:20c3:b200:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/uploads/zero-day-blog.webp Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:20c3:b200:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash bdf12ec840a34387693613f68d9c92c83777c5318d5d1ff7d0392930297ede69 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language en-GB,en;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; date Thu, 24 Aug 2023 20:49:58 GMT x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains via 1.1 4ba99d04800d29b58ab9861f60991a2a.cloudfront.net (CloudFront) x-amz-cf-pop MUC50-C1 x-cache Miss from cloudfront content-length 549864 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 15 Aug 2023 07:54:45 GMT server nginx etag "863e8-602f17e0c7095" x-frame-options sameorigin content-type image/webp access-control-allow-origin https://www.group-ib.com cache-control no-cache, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id o7ps_IUQuj6jqLiIMiO_ztMoGQIz9QZjekHfPD6XtalMMi8jMbHm9A== expires Thu, 24 Aug 2023 20:49:57 GMT
GET H2	200	polovinkin-1.png website.cdn.group-ib.com/wp-content/uploads/	49 KB 50 KB	239ms 233ms	Image image/png	2600:9000:20c3:b200:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/uploads/polovinkin-1.png Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:20c3:b200:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash e2bc964baa3f3b79d9ef59a46164809bde86d6550a4de912535d056e514ae152 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language en-GB,en;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; date Thu, 24 Aug 2023 20:49:58 GMT x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains via 1.1 4ba99d04800d29b58ab9861f60991a2a.cloudfront.net (CloudFront) x-amz-cf-pop MUC50-C1 x-cache Miss from cloudfront content-length 50537 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Fri, 14 Apr 2023 09:15:22 GMT server nginx etag "c569-5f94847e19d03" x-frame-options sameorigin content-type image/png access-control-allow-origin https://www.group-ib.com cache-control no-cache, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id mhrUmBHXJ2q6NJWVmzUYw_pFqwhJ3lm72j6AsguBRVPFQL7yiQqMlQ== expires Thu, 24 Aug 2023 20:49:57 GMT
GET H2	200	hunting-rituals_red.jpg website.cdn.group-ib.com/wp-content/uploads/	127 KB 128 KB	236ms 231ms	Image image/jpeg	2600:9000:20c3:b200:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/uploads/hunting-rituals_red.jpg Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:20c3:b200:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash a8db2c5feaeae215fc02c7a068b7c1f624adf29f5344f1ed90e5eaac466f6517 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language en-GB,en;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; date Thu, 24 Aug 2023 20:49:58 GMT x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains via 1.1 4ba99d04800d29b58ab9861f60991a2a.cloudfront.net (CloudFront) x-amz-cf-pop MUC50-C1 x-cache Miss from cloudfront content-length 129927 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Wed, 16 Aug 2023 12:43:11 GMT server nginx etag "1fb87-60309a367a354" x-frame-options sameorigin content-type image/jpeg access-control-allow-origin https://www.group-ib.com cache-control no-cache, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id 1uZOroA9ypJsl3cx0iThbWyGc8r-RBpSKZHWbpMDiec6OHX8IPgHPQ== expires Thu, 24 Aug 2023 20:49:57 GMT
GET H2	200	blog-5-1.webp website.cdn.group-ib.com/wp-content/uploads/	40 KB 41 KB	222ms 216ms	Image image/webp	2600:9000:20c3:b200:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/uploads/blog-5-1.webp Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:20c3:b200:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash c679027fe5cab17a74a6f5ac35c8ca4a2420c10e6b36afea1b871541eb4c1efb Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language en-GB,en;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; date Thu, 24 Aug 2023 20:49:58 GMT x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains via 1.1 4ba99d04800d29b58ab9861f60991a2a.cloudfront.net (CloudFront) x-amz-cf-pop MUC50-C1 x-cache Miss from cloudfront content-length 41466 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Wed, 09 Aug 2023 12:59:40 GMT server nginx etag "a1fa-6027d0d78c1ea" x-frame-options sameorigin content-type image/webp access-control-allow-origin https://www.group-ib.com cache-control no-cache, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id -4pC5J0H8P4mD_Ak-ofZeBI0mSl5qRU9GLj7ibV4ComuVkR4d512FQ== expires Thu, 24 Aug 2023 20:49:57 GMT
GET H2	200	club2.jpg website.cdn.group-ib.com/wp-content/uploads/	108 KB 109 KB	213ms 208ms	Image image/jpeg	2600:9000:20c3:b200:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/uploads/club2.jpg Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:20c3:b200:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash a7ff98df5ac03f371e8c54845d430665497d1bc372eb4f5fa129ed68dd42ef45 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language en-GB,en;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; date Thu, 24 Aug 2023 20:49:58 GMT x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains via 1.1 4ba99d04800d29b58ab9861f60991a2a.cloudfront.net (CloudFront) x-amz-cf-pop MUC50-C1 x-cache Miss from cloudfront content-length 110287 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Thu, 03 Aug 2023 09:50:44 GMT server nginx etag "1aecf-60201b6bc2b4e" x-frame-options sameorigin content-type image/jpeg access-control-allow-origin https://www.group-ib.com cache-control no-cache, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id kKF9JuXsuchd9TYKj6Hqf-AlIVA2OHr8CW5jFmvygHkJJyGRNHjhRw== expires Thu, 24 Aug 2023 20:49:57 GMT
GET H2	200	tag.js Show response mc.yandex.ru/metrika/	216 KB 74 KB	374ms 183ms	Script application/javascript	2a02:6b8::1:119 GLOBAL_DC
General Check archive.org Show headers Download Go to Full URL https://mc.yandex.ru/metrika/tag.js Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/js/main.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI), Reverse DNS Software / Resource Hash fd4c6ff2e56afccc04586f39418bb8f2d6003dee723968161440bc425a183758 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers accept-language en-GB,en;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 Response headers date Thu, 24 Aug 2023 20:49:58 GMT content-encoding br strict-transport-security max-age=31536000 last-modified Tue, 22 Aug 2023 14:02:29 GMT accept-ch Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA etag "64e495c5-127ae" content-type application/javascript access-control-allow-origin * cache-control max-age=3600 timing-allow-origin * content-length 75694 expires Thu, 24 Aug 2023 21:49:58 GMT
POST		admin-ajax.php www.group-ib.com/wp-admin/	0 0
GET H/1.1	200 OK	counters.gif forms.hsforms.com/embed/v3/	35 B 1017 B	282ms 162ms	Image image/gif	2606:4700::6811:cff9 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://forms.hsforms.com/embed/v3/counters.gif?key=forms-embed-v2-DEFINITION_SUCCESS&count=1 Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6811:cff9 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language en-GB,en;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 Response headers Date Thu, 24 Aug 2023 20:49:58 GMT Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff CF-Cache-Status DYNAMIC x-evy-trace-route-service-name envoyset-translator X-HubSpot-Correlation-Id c3ce4d97-8d6b-4a47-9f56-961987cbcaab x-envoy-upstream-service-time 15 Connection keep-alive alt-svc h3=":443"; ma=86400 Content-Length 35 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id c3ce4d97-8d6b-4a47-9f56-961987cbcaab Server cloudflare X-Trace 2B14BA84D4ACD9E7E185C0DB1EDC61ABFFEFE09BA9000000000000000000 Vary origin Content-Type image/gif x-evy-trace-virtual-host all x-evy-trace-served-by-pod iad02/star-hubspot-td/envoy-proxy-7f89ffc67f-tkdzf Access-Control-Expose-Headers X-Origin-Hublet Cache-Control max-age=0, no-cache, no-store Access-Control-Allow-Credentials false X-Robots-Tag none CF-RAY 7fbe77063d6a773b-LHR
GET H2	200	twitter-64.svg website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/	1 KB 1 KB	194ms 174ms	Image image/svg+xml	2600:9000:20c3:b200:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/twitter-64.svg Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:20c3:b200:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash ae9dad69229703dfa3b6d226c4c7d692e2f2809bf2475f22612824c2f7602efc Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language en-GB,en;q=0.9 Referer https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Thu, 24 Aug 2023 20:49:58 GMT via 1.1 4ba99d04800d29b58ab9861f60991a2a.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop MUC50-C1 x-cache Miss from cloudfront content-length 554 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 29 Nov 2022 07:39:21 GMT server nginx etag "426-5ee9716179e8a-gzip" x-frame-options sameorigin vary Accept-Encoding content-type image/svg+xml access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id j8noI-hVS78OLLkUQS-LnqRPoGj7DZuuW3eEtDsEUyfTF5Nb3QajjA== expires Thu, 24 Aug 2023 21:19:58 GMT
GET H2	200	twitter-lbg.svg website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/	2 KB 2 KB	197ms 177ms	Image image/svg+xml	2600:9000:20c3:b200:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/twitter-lbg.svg Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:20c3:b200:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 294fdc878aa8c42b19edc18d385880ad886397846aca640c305f3eb53a965e13 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language en-GB,en;q=0.9 Referer https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Thu, 24 Aug 2023 20:49:58 GMT via 1.1 4ba99d04800d29b58ab9861f60991a2a.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop MUC50-C1 x-cache Miss from cloudfront content-length 742 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 29 Nov 2022 07:39:21 GMT server nginx etag "8f2-5ee9716179e8a-gzip" x-frame-options sameorigin vary Accept-Encoding content-type image/svg+xml access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id Vg-wY2gNzqXhp6ahIWZHrQohORUu2hTA8fE-eMrJ4_b2BldpKzXjZw== expires Thu, 24 Aug 2023 21:19:58 GMT
GET H2	200	linkedin-64.svg website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/	919 B 1 KB	196ms 177ms	Image image/svg+xml	2600:9000:20c3:b200:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/linkedin-64.svg Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:20c3:b200:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash f4991587d5312981e74087707ed399bd3820d83f773e7773c013ce00d6835f28 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language en-GB,en;q=0.9 Referer https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Thu, 24 Aug 2023 20:49:58 GMT via 1.1 4ba99d04800d29b58ab9861f60991a2a.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop MUC50-C1 x-cache Miss from cloudfront content-length 470 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 29 Nov 2022 07:39:21 GMT server nginx etag "397-5ee9716179e8a-gzip" x-frame-options sameorigin vary Accept-Encoding content-type image/svg+xml access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id lXhczreRWfnrtUXdvYhxr2-ylK0pG8fvAvfdx-SucGT9e20-C9Q5oQ== expires Thu, 24 Aug 2023 21:19:58 GMT
GET H2	200	linkedin-lbg.svg website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/	2 KB 1 KB	195ms 176ms	Image image/svg+xml	2600:9000:20c3:b200:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/linkedin-lbg.svg Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:20c3:b200:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash c33709a20ca4cd516d65b07a79c1d75445892fcb6d8c6f3871a47ab38d85e075 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language en-GB,en;q=0.9 Referer https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Thu, 24 Aug 2023 20:49:58 GMT via 1.1 4ba99d04800d29b58ab9861f60991a2a.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop MUC50-C1 x-cache Miss from cloudfront content-length 639 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 29 Nov 2022 07:39:21 GMT server nginx etag "7ca-5ee9716179e8a-gzip" x-frame-options sameorigin vary Accept-Encoding content-type image/svg+xml access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id o94aFItjPFe3EmudKdQWiVAvBtPjNBFPvgN0nQQUvfEmnBuyg-InAA== expires Thu, 24 Aug 2023 21:19:58 GMT
GET H2	200	telegram-64.svg website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/	1 KB 2 KB	194ms 134ms	Image image/svg+xml	2600:9000:20c3:b200:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/telegram-64.svg Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:20c3:b200:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash cdc4d10b6b74ad79b55333b9882e854f054ee8b9953c6203dc46c68dc74eb0fb Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language en-GB,en;q=0.9 Referer https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Thu, 24 Aug 2023 20:49:58 GMT via 1.1 4ba99d04800d29b58ab9861f60991a2a.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop MUC50-C1 x-cache Miss from cloudfront content-length 787 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 29 Nov 2022 07:39:21 GMT server nginx etag "5fc-5ee9716179e8a-gzip" x-frame-options sameorigin vary Accept-Encoding content-type image/svg+xml access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id e16NUboLRjGWkR2W4VI1wAbmeD34V9KsBpSv91DoJc0XzDkoeEJ95Q== expires Thu, 24 Aug 2023 21:19:58 GMT
GET H2	200	telegram-lbg.svg website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/	3 KB 2 KB	194ms 134ms	Image image/svg+xml	2600:9000:20c3:b200:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/telegram-lbg.svg Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:20c3:b200:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash ac57c7130d61697977d2ed1796c27eefed8249083472716e474e5604b20636aa Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language en-GB,en;q=0.9 Referer https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Thu, 24 Aug 2023 20:49:58 GMT via 1.1 4ba99d04800d29b58ab9861f60991a2a.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop MUC50-C1 x-cache Miss from cloudfront content-length 949 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 29 Nov 2022 07:39:21 GMT server nginx etag "bf1-5ee9716179e8a-gzip" x-frame-options sameorigin vary Accept-Encoding content-type image/svg+xml access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id xGHvJ0aN7wIEWe06eLLbZ0WkIeex9fvl-FCRX-l0Tda9cCrxxGWTgg== expires Thu, 24 Aug 2023 21:19:58 GMT
GET H/1.1	200 OK	counters.gif forms-eu1.hsforms.com/embed/v3/	35 B 1016 B	226ms 114ms	Image image/gif	172.65.232.43 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://forms-eu1.hsforms.com/embed/v3/counters.gif?key=forms-embed-v2-RENDER_SUCCESS&count=1 Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 172.65.232.43 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language en-GB,en;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 Response headers Date Thu, 24 Aug 2023 20:49:59 GMT Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff CF-Cache-Status DYNAMIC x-evy-trace-route-service-name envoyset-translator X-HubSpot-Correlation-Id 8111e671-bac1-4edf-b609-1d818dbbc452 x-envoy-upstream-service-time 1 Connection keep-alive alt-svc h3=":443"; ma=86400 Content-Length 35 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id 8111e671-bac1-4edf-b609-1d818dbbc452 Server cloudflare X-Trace 2BF8BD8B2723D584D5C37792CBAEC80D720FC748C7000000000000000000 Vary origin Content-Type image/gif x-evy-trace-virtual-host all x-evy-trace-served-by-pod fra04/star-hubspot-td/envoy-proxy-79bb87d888-ldcjz Access-Control-Expose-Headers X-Origin-Hublet Cache-Control max-age=0, no-cache, no-store Access-Control-Allow-Credentials false X-Robots-Tag none CF-RAY 7fbe77085d4660b5-DUB
GET H2	200	collect px.ads.linkedin.com/	0 270 B	394ms 281ms	Image application/javascript	2620:1ec:21::14 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=&time=1692910199039&url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language en-GB,en;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 Response headers date Thu, 24 Aug 2023 20:49:58 GMT x-li-pop afd-prod-lor1-x x-msedge-ref Ref A: 352AAA55C7C848538BC2F664AEA44BAF Ref B: DUS30EDGE0316 Ref C: 2023-08-24T20:49:59Z linkedin-action 1 x-cache CONFIG_NOCACHE content-type application/javascript x-li-fabric prod-lor1 x-li-proto http/2 content-length 0 x-li-uuid AAYDsV8QUmRIt0v4wXU6ag==
POST H2	200	fl Show response www.group-ib.com/api/	665 B 971 B	129ms 128ms	XHR application/json	3.72.181.255 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://www.group-ib.com/api/fl?u=44765f40-4296-11ee-952f-221c0dcfc0b5&cfidsgib-w-61354c22-16cc-40a8-a871-6901f1a76e24=EAQ1g61No9EeZpLuhWuHCaYZn9K0WNZBC86MjB5KE99OTkTnHN0EV0%2FI2eXz8jwIzdWq4yt8AVrVsNgmipgtfz88Pj5avQ0OD4LSgJcPCUdY12DYPhwkVxctX6S5Y0BG3GAAubkeanH9kg5%2FsQhnuD3j3f85F2oT%2BAJ%2F Requested by Host: fhp-de-js.group-ib.com URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-72-181-255.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash c314e84c0a964cb0db2acc0ea37080683bafc39e6a998a34c72ded1ad202ddd0 Request headers X-GIB-GSSCgib-w-61354c22-16cc-40a8-a871-6901f1a76e24 aiAdlGTfiR/VFj8UZaEqUhl6CDaWnyxd2YPKdvYV06a0Y61I312CjRamfhGrb91orGVuwsfTVyNKY1UyMOkUR7mD3pFRk3GOkZ+wrGmjKU/JzGinxkA7f34wWMp6oRmxuAXPtZwJ1QVBrI5aGLmBo/y8hlhCKqxBjdbx1KkPbOvAm8Xz6ak0kV+RXyNmXlKrs2AcII+eMhsEN1ZnYBIP5K5EtLa+rFBTzgs2zipkirRme4SRYsleA5cnn7O0zA== Referer https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ accept-language en-GB,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 X-GIB-FGSSCgib-w-61354c22-16cc-40a8-a871-6901f1a76e24 juCedef9f3b6a2fdd1091d70034b1c4490fa6ca7 Content-Type text/plain;charset=UTF-8 Response headers date Thu, 24 Aug 2023 20:49:59 GMT content-encoding gzip server nginx vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/json; charset=utf-8 access-control-allow-origin https://www.group-ib.com cache-control no-store access-control-allow-credentials true x-envoy-upstream-service-time 5 access-control-allow-headers Accept,DNT,Keep-Alive,User-Agent,If-Modified-Since,Cache-Control,Content-Type,Origin,ETag,If-None-Match,X-Cfids,Authorization
GET H2	200	json Show response api-eu1.hubapi.com/hs-script-loader-public/v1/config/pixels-and-events/	250 B 1 KB	243ms 108ms	XHR application/json	2a06:98c1:3200::90:3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://api-eu1.hubapi.com/hs-script-loader-public/v1/config/pixels-and-events/json?portalId=25755956 Requested by Host: fhp-de-js.group-ib.com URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a06:98c1:3200::90:3 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash fc50d7c745b4b7ad268ab0c4a71b545dab230889a7f171a29e4a6534041f65bc Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language en-GB,en;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 Response headers date Thu, 24 Aug 2023 20:49:59 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status DYNAMIC nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} x-evy-trace-route-service-name envoyset-translator x-hubspot-correlation-id e8e87de7-44dd-4c6d-bcc9-323b8c02681d content-encoding br x-envoy-upstream-service-time 2 alt-svc h3=":443"; ma=86400 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id e8e87de7-44dd-4c6d-bcc9-323b8c02681d server cloudflare x-trace 2BF15FE0AE1F21F047106EC677CEB0AE117A6BE502000000000000000000 vary origin access-control-allow-methods GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD content-type application/json;charset=utf-8 access-control-allow-origin https://www.group-ib.com x-evy-trace-virtual-host all access-control-max-age 180 access-control-allow-credentials false x-evy-trace-served-by-pod fra04/hubapi-td/envoy-proxy-74f74b4b68-9zkqb report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=o3GM%2BjxCayGjxr6B6fIv8HNcIgyKmv46UHeJBIv3gq%2Bw2divZ5BBx4Cgi8ZSXziqpawU2M%2BCuPLazK63sV4XWQIxFMN96lvVKfEcQMWunyRmtsuzKfGJAmfkGD4hJJjZGKw5glwLoQUwxR%2FuL3Q5Og%3D%3D"}],"group":"cf-nel","max_age":604800} cf-ray 7fbe770978ba1b80-DUB access-control-allow-headers *
GET H2	200	6si.min.js Show response j.6sc.co/	48 KB 14 KB	238ms 52ms	Script application/javascript	23.38.98.119 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://j.6sc.co/6si.min.js Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 23.38.98.119 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a23-38-98-119.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash ae3536ecd79c98f87387cee9060be3053e0eb8fe0871e7336554812ef8138772 Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language en-GB,en;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 Response headers pragma no-cache date Thu, 24 Aug 2023 20:49:59 GMT content-encoding gzip x-content-type-options nosniff last-modified Thu, 20 Jul 2023 16:27:10 GMT server nginx/1.14.0 (Ubuntu) etag "64b9605e-bf6f" vary Accept-Encoding content-type application/javascript cache-control private, no-cache, proxy-revalidate accept-ranges bytes content-length 14190 expires Thu, 24 Aug 2023 20:49:59 GMT
GET H2	200	/ Show response googleads.g.doubleclick.net/pagead/viewthroughconversion/10897073384/	3 KB 2 KB	208ms 82ms	Script text/javascript	2a00:1450:4001:810::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://googleads.g.doubleclick.net/pagead/viewthroughconversion/10897073384/?random=1692910199138&cv=11&fst=1692910199138&bg=ffffff&guid=ON&async=1&gtm=45He38n0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&ref=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&hn=www.googleadservices.com&frm=0&tiba=Traders%27%20dollars%20in%20danger%3A%20CVE-2023-38831%20zero-day%20vulnerability%20in%20WinRAR%20exploited%20by%20cybercriminals%20to%20target%20traders%20%7C%20Group-IB%20Blog&auid=1966813297.1692910199&uamb=0&uaw=0&rfmt=3&fmt=4 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-PW7265 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 4d059a2feab94c908a8b6023bcd0145128e61807322474331ca817b9068d3c9f Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language en-GB,en;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 Response headers pragma no-cache date Thu, 24 Aug 2023 20:49:59 GMT content-encoding br x-content-type-options nosniff server cafe content-type text/javascript; charset=UTF-8 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 1422 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	NeverBounce.js Show response cdn.neverbounce.com/widget/dist/	96 KB 29 KB	224ms 65ms	Script application/javascript	13.225.78.65 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://cdn.neverbounce.com/widget/dist/NeverBounce.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-PW7265 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.225.78.65 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-225-78-65.fra2.r.cloudfront.net Software AmazonS3 / Resource Hash c99d11cb4960d6e1918ed55d5bcbb316d38b51098e2efc1201904d7274d3273e Request headers accept-language en-GB,en;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 Response headers date Wed, 23 Aug 2023 21:15:47 GMT content-encoding gzip via 1.1 83caebe1f817a31bd75ba17dff7ae1a6.cloudfront.net (CloudFront) last-modified Mon, 02 Mar 2020 18:37:33 GMT server AmazonS3 x-amz-cf-pop FRA2-C2 age 84853 etag W/"c1e06621030dfcba15b88abbcaa546eb" vary Accept-Encoding x-cache Hit from cloudfront content-type application/javascript x-amz-cf-id ZU4S977m4PoCr7vcPeWDzzI5g3KqCtMdFKtBqI2yr9e21oei7RFcnw==
GET H2	200	63e267f61a03d71ea3df5fe7 Show response ws.zoominfo.com/pixel/	3 KB 2 KB	458ms 337ms	Script text/javascript	2606:4700::6810:890f CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://ws.zoominfo.com/pixel/63e267f61a03d71ea3df5fe7 Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:890f , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Express Resource Hash b8467b13e3cfdada0cea0c0d15c5e6c4d7fdc199ad83b3586802908ec024e84b Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language en-GB,en;q=0.9 Referer https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 Response headers date Thu, 24 Aug 2023 20:49:59 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status DYNAMIC via 1.1 google server cloudflare x-powered-by Express vary Accept-Encoding content-type text/javascript access-control-allow-origin * access-control-allow-credentials true cf-ray 7fbe77098f89dd80-LHR access-control-allow-headers Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for, x-ws-collect-type,requestFromZITag,unifiedScriptVerified,_zitok,_vtok alt-svc h3=":443"; ma=86400
GET H2	200	js Show response www.googletagmanager.com/gtag/	274 KB 90 KB	72ms 71ms	Script application/javascript	2a00:1450:4001:813::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=G-QMES53K3Y2&l=dataLayer&cx=c Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-PW7265 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:813::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash b0287bb5bc98313d96ee03d9bf46c04bb041352a9defc92d352d36c05b81a722 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers accept-language en-GB,en;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 Response headers date Thu, 24 Aug 2023 20:49:59 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true cross-origin-resource-policy cross-origin access-control-allow-headers Cache-Control content-length 92160 x-xss-protection 0 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 expires Thu, 24 Aug 2023 20:49:59 GMT
GET H2	200	collect px4.ads.linkedin.com/ Redirect Chain https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=4496601&time=1692910199143&url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&tm=gtmv2 https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=4496601&time=1692910199143&url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&tm=gtmv2&cookiesTest=true https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D4496601%26time%3D1692910199143%26url%3Dhttps%253A%252F%252Fwww.group-ib.com%252Fb... https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=4496601&time=1692910199143&url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&tm=gtmv2&cookiesTest=true&liSync=true https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=4496601&time=1692910199143&url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&tm=gtmv2&cookiesTest=true&liSync=true&e_...	0 480 B	363ms 229ms	Image application/javascript	13.107.42.14
General Check archive.org Show headers Download Go to Show image Full URL https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=4496601&time=1692910199143&url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&tm=gtmv2&cookiesTest=true&liSync=true&e_ipv6=AQLPxyQw7PgEeQAAAYopT6TPEVRn7-1TtTtuqJ0TwDjuC9zJ03aECk9-kYIEnkzJ Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Server 13.107.42.14 -, , ASN (), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language en-GB,en;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 Response headers date Thu, 24 Aug 2023 20:49:59 GMT nel {"report_to":"network-errors","max_age":1296000,"success_fraction":0.00066,"failure_fraction":1,"include_subdomains":true} x-li-pop afd-prod-lor1-x x-msedge-ref Ref A: E10F1E65994246E69265714BCF7B6DBD Ref B: FRAEDGE1705 Ref C: 2023-08-24T20:50:00Z linkedin-action 1 report-to {"group":"network-errors","max_age":2592000,"endpoints":[{"url":"https://www.linkedin.com/li/rep"}],"include_subdomains":true} content-type application/javascript x-li-fabric prod-lor1 x-cache CONFIG_NOCACHE x-li-proto http/2 content-length 0 x-li-uuid AAYDsV8hRZHkW/0S61XtbA== Redirect headers date Thu, 24 Aug 2023 20:49:59 GMT nel {"report_to":"network-errors","max_age":1296000,"success_fraction":0.00066,"failure_fraction":1,"include_subdomains":true} x-li-pop afd-prod-lor1-x x-msedge-ref Ref A: 832B0F252BAB45759A409FE2F6227D77 Ref B: DUS30EDGE0316 Ref C: 2023-08-24T20:49:59Z linkedin-action 1 report-to {"group":"network-errors","max_age":2592000,"endpoints":[{"url":"https://www.linkedin.com/li/rep"}],"include_subdomains":true} x-li-fabric prod-lor1 location https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=4496601&time=1692910199143&url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&tm=gtmv2&cookiesTest=true&liSync=true&e_ipv6=AQLPxyQw7PgEeQAAAYopT6TPEVRn7-1TtTtuqJ0TwDjuC9zJ03aECk9-kYIEnkzJ x-cache CONFIG_NOCACHE x-li-proto http/2 content-length 0 x-li-uuid AAYDsV8bqg2l1MYneD64XA==
GET H2	200	json Show response forms-eu1.hscollectedforms.net/collected-forms/v1/config/	116 B 457 B	131ms 100ms	XHR application/json	172.65.192.122 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://forms-eu1.hscollectedforms.net/collected-forms/v1/config/json?portalId=25755956&utk= Requested by Host: fhp-de-js.group-ib.com URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.65.192.122 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 43f22362329b9705cf8629061fb5b1d1a38f1cc2bc9fd46728f73e5cd9eb77cf Security Headers Name Value X-Content-Type-Options nosniff Request headers Accept application/json, text/plain, */* Referer https://www.group-ib.com/ accept-language en-GB,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 Response headers date Thu, 24 Aug 2023 20:49:59 GMT content-encoding br x-content-type-options nosniff cf-cache-status DYNAMIC x-evy-trace-route-service-name envoyset-translator x-hubspot-correlation-id e67c3c39-626d-4d91-a480-9b885323cdc9 x-envoy-upstream-service-time 7 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id e67c3c39-626d-4d91-a480-9b885323cdc9 server cloudflare vary Accept-Encoding access-control-allow-methods GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD content-type application/json;charset=utf-8 access-control-allow-origin https://www.group-ib.com x-evy-trace-virtual-host all cache-control max-age=0 x-evy-trace-served-by-pod fra04/app-td/envoy-proxy-5b45bc9bc5-8ct2c access-control-max-age 180 x-robots-tag none access-control-allow-headers * cf-ray 7fbe7709185334e3-DUB
GET H2	200	sync_cookie_image_decide mc.yandex.com/ Redirect Chain https://mc.yandex.com/sync_cookie_image_check https://mc.yandex.ru/sync_cookie_image_start?redirect_domain=mc.yandex.com&token=10105.omWYI1wFpuhTpTwMgEKrUy-Isn6ck-cl4r8HK8mAKxSktVbEUB--NeEmmZpJnDOB.ar4SsJenPEI-04leWbswb03LBQU%2C https://mc.yandex.com/sync_cookie_image_decide?token=10105.Qe7TXPPjX6nFWuSNydIQ6QQaIBfK86n1mCCYTgNSPPX7hfwQ7tcGvo931Zy0i-IwTHzK0NUhCJrIz2nwdWqhlqFyJTugYNrlqRQPnbWToFM%2C.tppYfzJFFgmhyKJr42ffKHqLxSA%2C	43 B 67 B	97ms 96ms	Image image/gif	2a02:6b8::1:119 GLOBAL_DC
General Check archive.org Show headers Download Go to Show image Full URL https://mc.yandex.com/sync_cookie_image_decide?token=10105.Qe7TXPPjX6nFWuSNydIQ6QQaIBfK86n1mCCYTgNSPPX7hfwQ7tcGvo931Zy0i-IwTHzK0NUhCJrIz2nwdWqhlqFyJTugYNrlqRQPnbWToFM%2C.tppYfzJFFgmhyKJr42ffKHqLxSA%2C Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Server 2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI), Reverse DNS Software / Resource Hash 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Xss-Protection 1; mode=block Request headers accept-language en-GB,en;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 Response headers date Thu, 24 Aug 2023 20:49:59 GMT strict-transport-security max-age=31536000 content-length 43 x-xss-protection 1; mode=block content-type image/gif Redirect headers location https://mc.yandex.com/sync_cookie_image_decide?token=10105.Qe7TXPPjX6nFWuSNydIQ6QQaIBfK86n1mCCYTgNSPPX7hfwQ7tcGvo931Zy0i-IwTHzK0NUhCJrIz2nwdWqhlqFyJTugYNrlqRQPnbWToFM%2C.tppYfzJFFgmhyKJr42ffKHqLxSA%2C date Thu, 24 Aug 2023 20:49:59 GMT strict-transport-security max-age=31536000 x-xss-protection 1; mode=block
GET H2	200	advert.gif mc.yandex.com/metrika/	43 B 138 B	90ms 90ms	Image image/gif	2a02:6b8::1:119 GLOBAL_DC
General Check archive.org Show headers Download Go to Show image Full URL https://mc.yandex.com/metrika/advert.gif Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI), Reverse DNS Software / Resource Hash 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers accept-language en-GB,en;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 Response headers date Thu, 24 Aug 2023 20:49:59 GMT strict-transport-security max-age=31536000 last-modified Tue, 22 Aug 2023 14:02:29 GMT accept-ch Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA etag "64e495c5-2b" content-type image/gif access-control-allow-origin * cache-control max-age=3600 accept-ranges bytes timing-allow-origin * content-length 43 expires Thu, 24 Aug 2023 21:49:59 GMT
POST H2	204	collect region1.analytics.google.com/g/	0 255 B	180ms 59ms	Ping text/plain	2001:4860:4802:34::36 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://region1.analytics.google.com/g/collect?v=2&tid=G-QMES53K3Y2&gtm=45je38n0&_p=2064548745&_gaz=1&cid=19331679.1692910199&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=1&sid=1692910199&sct=1&seg=0&dl=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&dr=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&dt=Traders%27%20dollars%20in%20danger%3A%20CVE-2023-38831%20zero-day%20vulnerability%20in%20WinRAR%20exploited%20by%20cybercriminals%20to%20target%20traders%20%7C%20Group-IB%20Blog&en=page_view&_fv=1&_nsi=1&_ss=1 Requested by Host: fhp-de-js.group-ib.com URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language en-GB,en;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 Response headers pragma no-cache date Thu, 24 Aug 2023 20:49:59 GMT server Golfe2 content-type text/plain access-control-allow-origin https://www.group-ib.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 0 expires Fri, 01 Jan 1990 00:00:00 GMT
POST H2	204	collect stats.g.doubleclick.net/g/	0 246 B	163ms 53ms	Ping text/plain	2a00:1450:400c:c0a::9b GOOGLE
General Check archive.org Show headers Download Go to Full URL https://stats.g.doubleclick.net/g/collect?v=2&tid=G-QMES53K3Y2&cid=19331679.1692910199&gtm=45je38n0&aip=1 Requested by Host: fhp-de-js.group-ib.com URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:400c:c0a::9b Brussels, Belgium, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language en-GB,en;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 Response headers pragma no-cache date Thu, 24 Aug 2023 20:49:59 GMT server Golfe2 content-type text/plain access-control-allow-origin https://www.group-ib.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	ga-audiences www.google.de/ads/	42 B 107 B	206ms 90ms	Image image/gif	2a00:1450:4001:810::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-QMES53K3Y2&cid=19331679.1692910199&gtm=45je38n0&aip=1&z=1966008350 Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language en-GB,en;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 Response headers pragma no-cache date Thu, 24 Aug 2023 20:49:59 GMT x-content-type-options nosniff server cafe content-type image/gif p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H/1.1	200 OK	counters.gif forms-eu1.hsforms.com/embed/v3/	35 B 1016 B	404ms 103ms	Image image/gif	172.65.232.43 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://forms-eu1.hsforms.com/embed/v3/counters.gif?key=collected-forms-embed-js-form-bind&count=4 Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 172.65.232.43 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language en-GB,en;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 Response headers Date Thu, 24 Aug 2023 20:49:59 GMT Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff CF-Cache-Status DYNAMIC x-evy-trace-route-service-name envoyset-translator X-HubSpot-Correlation-Id 4a3633c2-ee41-4f65-9241-005ae1cb6772 x-envoy-upstream-service-time 1 Connection keep-alive alt-svc h3=":443"; ma=86400 Content-Length 35 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id 4a3633c2-ee41-4f65-9241-005ae1cb6772 Server cloudflare X-Trace 2B9FF1DF8E68070252D9E2FA2E1ED6CA5143B41D17000000000000000000 Vary origin Content-Type image/gif x-evy-trace-virtual-host all x-evy-trace-served-by-pod fra04/star-hubspot-td/envoy-proxy-79bb87d888-ldcjz Access-Control-Expose-Headers X-Origin-Hublet Cache-Control max-age=0, no-cache, no-store Access-Control-Allow-Credentials false X-Robots-Tag none CF-RAY 7fbe770bb9aa60b5-DUB
GET H2	200	/ www.google.com/pagead/1p-user-list/10897073384/	42 B 455 B	182ms 67ms	Image image/gif	2a00:1450:4001:829::2004 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/pagead/1p-user-list/10897073384/?random=1692910199138&cv=11&fst=1692907200000&bg=ffffff&guid=ON&async=1&gtm=45He38n0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&ref=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&frm=0&tiba=Traders%27%20dollars%20in%20danger%3A%20CVE-2023-38831%20zero-day%20vulnerability%20in%20WinRAR%20exploited%20by%20cybercriminals%20to%20target%20traders%20%7C%20Group-IB%20Blog&fmt=3&is_vtc=1&random=2464009434&rmt_tld=0&ipr=y Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:829::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language en-GB,en;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 Response headers pragma no-cache date Thu, 24 Aug 2023 20:49:59 GMT content-security-policy script-src 'none'; object-src 'none' x-content-type-options nosniff server cafe content-type image/gif p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	/ www.google.de/pagead/1p-user-list/10897073384/	42 B 455 B	101ms 65ms	Image image/gif	2a00:1450:4001:810::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/pagead/1p-user-list/10897073384/?random=1692910199138&cv=11&fst=1692907200000&bg=ffffff&guid=ON&async=1&gtm=45He38n0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&ref=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&frm=0&tiba=Traders%27%20dollars%20in%20danger%3A%20CVE-2023-38831%20zero-day%20vulnerability%20in%20WinRAR%20exploited%20by%20cybercriminals%20to%20target%20traders%20%7C%20Group-IB%20Blog&fmt=3&is_vtc=1&random=2464009434&rmt_tld=1&ipr=y Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language en-GB,en;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 Response headers pragma no-cache date Thu, 24 Aug 2023 20:49:59 GMT content-security-policy script-src 'none'; object-src 'none' x-content-type-options nosniff server cafe content-type image/gif p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3	200	js Show response www.googletagmanager.com/gtag/	219 KB 76 KB	67ms 67ms	Script application/javascript	2a00:1450:4001:813::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=AW-10882981508 Requested by Host: js-eu1.hsadspixel.net URL: https://js-eu1.hsadspixel.net/fb.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:813::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash fb9c796ba978712830d71a37568387f88a19d6d84837e41e69f6c9ba0fd724d8 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers accept-language en-GB,en;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 Response headers date Thu, 24 Aug 2023 20:49:59 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 78119 x-xss-protection 0 last-modified Thu, 24 Aug 2023 18:02:13 GMT server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Thu, 24 Aug 2023 20:49:59 GMT
GET H3	200	js Show response www.googletagmanager.com/gtag/	219 KB 76 KB	70ms 69ms	Script application/javascript	2a00:1450:4001:813::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=AW-10882981508&l=dataLayer&cx=c Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-PW7265 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:813::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 1e25e084d7fd8ecfd6dbde7261b30a4fc5b088974953ca5833b1523330b81409 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers accept-language en-GB,en;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 Response headers date Thu, 24 Aug 2023 20:49:59 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 78072 x-xss-protection 0 last-modified Thu, 24 Aug 2023 18:02:13 GMT server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Thu, 24 Aug 2023 20:49:59 GMT
GET H2	200	notify Show response api.neverbounce.com/v4/poe/	63 B 283 B	423ms 131ms	Script application/javascript	52.0.43.29 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://api.neverbounce.com/v4/poe/notify?key=public_feedec8c69cd171b06421bb96273f04d&event=form.load&callback=__neverbounce_703519 Requested by Host: cdn.neverbounce.com URL: https://cdn.neverbounce.com/widget/dist/NeverBounce.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.0.43.29 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-52-0-43-29.compute-1.amazonaws.com Software nginx / Resource Hash 5e18dddadca5633407c2436ad40e19925691b00a8d7177a08e736ae48c63575e Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language en-GB,en;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 Response headers date Thu, 24 Aug 2023 20:49:59 GMT content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains server nginx vary Accept-Encoding content-type application/javascript cache-control no-cache, private x-ua-compatible IE=Edge
GET H2	200	notify Show response api.neverbounce.com/v4/poe/	63 B 282 B	382ms 139ms	Script application/javascript	52.0.43.29 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://api.neverbounce.com/v4/poe/notify?key=public_feedec8c69cd171b06421bb96273f04d&event=form.load&callback=__neverbounce_303418 Requested by Host: cdn.neverbounce.com URL: https://cdn.neverbounce.com/widget/dist/NeverBounce.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.0.43.29 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-52-0-43-29.compute-1.amazonaws.com Software nginx / Resource Hash b12d804e38dd5e8a31c213177f261422ba3bc03328a6a64bc81e2bb02960320e Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language en-GB,en;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 Response headers date Thu, 24 Aug 2023 20:49:59 GMT content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains server nginx vary Accept-Encoding content-type application/javascript cache-control no-cache, private x-ua-compatible IE=Edge
GET H2	200	notify Show response api.neverbounce.com/v4/poe/	63 B 282 B	351ms 133ms	Script application/javascript	52.0.43.29 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://api.neverbounce.com/v4/poe/notify?key=public_feedec8c69cd171b06421bb96273f04d&event=form.load&callback=__neverbounce_633211 Requested by Host: cdn.neverbounce.com URL: https://cdn.neverbounce.com/widget/dist/NeverBounce.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.0.43.29 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-52-0-43-29.compute-1.amazonaws.com Software nginx / Resource Hash fdf1283620c46f37c42a86432cf3355835c9ae7b4aee4d52787a943ba13293e2 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language en-GB,en;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 Response headers date Thu, 24 Aug 2023 20:49:59 GMT content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains server nginx vary Accept-Encoding content-type application/javascript cache-control no-cache, private x-ua-compatible IE=Edge
GET H2	200	notify Show response api.neverbounce.com/v4/poe/	63 B 282 B	333ms 132ms	Script application/javascript	52.0.43.29 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://api.neverbounce.com/v4/poe/notify?key=public_feedec8c69cd171b06421bb96273f04d&event=form.load&callback=__neverbounce_606476 Requested by Host: cdn.neverbounce.com URL: https://cdn.neverbounce.com/widget/dist/NeverBounce.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.0.43.29 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-52-0-43-29.compute-1.amazonaws.com Software nginx / Resource Hash 086fa53f13f89023d8f305f1815ab6b4c28b1eecd7f703c90a635cec4a51f119 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language en-GB,en;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 Response headers date Thu, 24 Aug 2023 20:49:59 GMT content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains server nginx vary Accept-Encoding content-type application/javascript cache-control no-cache, private x-ua-compatible IE=Edge
GET H2	200	/ Show response c.6sc.co/	7 B 194 B	71ms 53ms	XHR text/html	23.38.98.119 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://c.6sc.co/ Requested by Host: fhp-de-js.group-ib.com URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 23.38.98.119 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a23-38-98-119.deploy.static.akamaitechnologies.com Software / Resource Hash fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a Request headers accept-language en-GB,en;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 Response headers date Thu, 24 Aug 2023 20:49:59 GMT access-control-max-age 86400 access-control-allow-methods GET,POST content-type text/html access-control-allow-origin https://www.group-ib.com access-control-allow-credentials true access-control-allow-headers * content-length 7
GET H2	200	/ Show response ipv6.6sc.co/	14 B 300 B	283ms 55ms	XHR text/html	2a02:26f0:480:23::1726:629c AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://ipv6.6sc.co/ Requested by Host: fhp-de-js.group-ib.com URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:480:23::1726:629c Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software / Resource Hash 82e5f07b7e4cbad52002bfd8a3591cf3edcabaea4a8ec73c56a6df732b43353c Request headers accept-language en-GB,en;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 Response headers pragma no-cache date Thu, 24 Aug 2023 20:49:59 GMT vary Origin content-type text/html access-control-allow-origin https://www.group-ib.com cache-control max-age=0, no-cache, no-store 6si-ipv6 2a01:4a0:2c::5 server-timing cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1692910199593_388391900_623150171_17_903_51_106_219";dur=1 content-length 14 expires Thu, 24 Aug 2023 20:49:59 GMT
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 484 B	279ms 258ms	Image image/gif	23.38.98.119 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=e84d9c08a990af8592952e7ac9a983ad&svisitor=null&visitor=287bf85b-2334-419b-8009-b335b649d8cb&session=d55a5164-2517-4157-88e2-fa0533c629d5&event=a_pageload&q=%7B%22pageLoadTime%22%3A%22Thu%2C%2024%20Aug%202023%2020%3A49%3A59%20GMT%22%2C%22settings%22%3A%22%5B%7B%5C%22name%5C%22%3A%5C%22enableEventTracking%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2024%20Aug%202023%2020%3A49%3A59%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setToken%5C%22%2C%5C%22value%5C%22%3A%5C%22e84d9c08a990af8592952e7ac9a983ad%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2024%20Aug%202023%2020%3A49%3A59%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setEndpoint%5C%22%2C%5C%22value%5C%22%3A%5C%22b.6sc.co%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2024%20Aug%202023%2020%3A49%3A59%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%5D%22%7D&isIframe=false&m=%7B%22description%22%3A%22Spoof%20extensions%20help%20cybercriminals%20target%20users%20on%20trading%20forums%20as%20130%20devices%20still%20infected%20at%20time%20of%20writing%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Traders%27%20dollars%20in%20danger%3A%20CVE-2023-38831%20zero-day%20vulnerability%20in%20WinRAR%20exploited%20by%20cybercriminals%20to%20target%20traders%20%7C%20Group-IB%20Blog%22%7D&cb=&r=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&pageViewId=4e5541af-791f-4dbb-83e2-ed66f5a0514c&v=1.1.5 Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 23.38.98.119 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a23-38-98-119.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language en-GB,en;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 Response headers date Thu, 24 Aug 2023 20:49:59 GMT x-content-type-options nosniff content-length 43 pragma no-cache last-modified Sat, 18 Feb 2023 00:49:36 GMT server nginx/1.14.0 (Ubuntu) etag "63f020a0-2b" access-control-max-age 86400 access-control-allow-methods GET,POST content-type image/gif access-control-allow-origin cache-control private, no-cache, no-cache=Set-Cookie, proxy-revalidate access-control-allow-credentials true accept-ranges bytes access-control-allow-headers * expires Wed, 19 Apr 2000 11:43:00 GMT
GET H2	200	1 Show response mc.yandex.com/watch/26812653/ Redirect Chain https://mc.yandex.com/watch/26812653?wmode=7&page-url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&charset=utf-8&site-info=%7B%22shareVersion%22%3A2%2C%22strategy%22%3A... https://mc.yandex.com/watch/26812653/1?wmode=7&page-url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&charset=utf-8&site-info=%7B%22shareVersion%22%3A2%2C%22strategy%22%...	435 B 549 B	97ms 96ms	Fetch application/json	2a02:6b8::1:119 GLOBAL_DC
General Check archive.org Show headers Download Go to Full URL https://mc.yandex.com/watch/26812653/1?wmode=7&page-url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&charset=utf-8&site-info=%7B%22shareVersion%22%3A2%2C%22strategy%22%3A%22d%2Fn%2Fq%2Fr%2Fs%2Ft%22%7D&uah=chm%0A%3F0&browser-info=pv%3A1%3Avf%3Aeygqx1x5sixaiiugyrqh3hb%3Afp%3A830%3Afu%3A1%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A1093%3Acn%3A1%3Adp%3A0%3Als%3A1091298705691%3Ahid%3A971870371%3Az%3A60%3Ai%3A20230824214959%3Aet%3A1692910199%3Ac%3A1%3Arn%3A72626395%3Arqn%3A1%3Au%3A1692910199469179042%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Awv%3A2%3Ads%3A0%2C0%2C81%2C56%2C0%2C0%2C%2C1114%2C52%2C%2C%2C%2C1305%3Aco%3A0%3Acpf%3A1%3Ans%3A1692910197276%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1692910200%3At%3ATraders%27%20dollars%20in%20danger%3A%20CVE-2023-38831%20zero-day%20vulnerability%20in%20WinRAR%20exploited%20by%20cybercriminals%20to%20target%20traders%20%7C%20Group-IB%20Blog&t=gdpr%2814%29clc%280-0-0%29rqnt%281%29aw%281%29ti%281%29&redirnss=1 Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Server 2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI), Reverse DNS Software / Resource Hash 428d979a278688374e44d8a8860743bf4f23321e2973aecbedd4ff4f8cb34eb1 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers accept-language en-GB,en;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 Response headers pragma no-cache date Thu, 24 Aug 2023 20:49:59 GMT strict-transport-security max-age=31536000 x-content-type-options nosniff last-modified Thu, 24-Aug-2023 20:49:59 GMT accept-ch Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA content-type application/json; charset=utf-8 access-control-allow-origin https://www.group-ib.com cache-control private, no-cache, no-store, must-revalidate, max-age=0 access-control-allow-credentials true content-length 435 x-xss-protection 1; mode=block expires Thu, 24-Aug-2023 20:49:59 GMT Redirect headers pragma no-cache date Thu, 24 Aug 2023 20:49:59 GMT strict-transport-security max-age=31536000 last-modified Thu, 24-Aug-2023 20:49:59 GMT accept-ch Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA location /watch/26812653/1?wmode=7&page-url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&charset=utf-8&site-info=%7B%22shareVersion%22%3A2%2C%22strategy%22%3A%22d%2Fn%2Fq%2Fr%2Fs%2Ft%22%7D&uah=chm%0A%3F0&browser-info=pv%3A1%3Avf%3Aeygqx1x5sixaiiugyrqh3hb%3Afp%3A830%3Afu%3A1%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A1093%3Acn%3A1%3Adp%3A0%3Als%3A1091298705691%3Ahid%3A971870371%3Az%3A60%3Ai%3A20230824214959%3Aet%3A1692910199%3Ac%3A1%3Arn%3A72626395%3Arqn%3A1%3Au%3A1692910199469179042%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Awv%3A2%3Ads%3A0%2C0%2C81%2C56%2C0%2C0%2C%2C1114%2C52%2C%2C%2C%2C1305%3Aco%3A0%3Acpf%3A1%3Ans%3A1692910197276%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1692910200%3At%3ATraders%27%20dollars%20in%20danger%3A%20CVE-2023-38831%20zero-day%20vulnerability%20in%20WinRAR%20exploited%20by%20cybercriminals%20to%20target%20traders%20%7C%20Group-IB%20Blog&t=gdpr%2814%29clc%280-0-0%29rqnt%281%29aw%281%29ti%281%29&redirnss=1 access-control-allow-origin https://www.group-ib.com cache-control private, no-cache, no-store, must-revalidate, max-age=0 access-control-allow-credentials true x-xss-protection 1; mode=block expires Thu, 24-Aug-2023 20:49:59 GMT
GET H2	200	/ Show response googleads.g.doubleclick.net/pagead/viewthroughconversion/10882981508/	3 KB 2 KB	166ms 166ms	Script text/javascript	2a00:1450:4001:810::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://googleads.g.doubleclick.net/pagead/viewthroughconversion/10882981508/?random=1692910199551&cv=11&fst=1692910199551&bg=ffffff&guid=ON&async=1&gtm=45be38n0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&ref=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&hn=www.googleadservices.com&frm=0&tiba=Traders%27%20dollars%20in%20danger%3A%20CVE-2023-38831%20zero-day%20vulnerability%20in%20WinRAR%20exploited%20by%20cybercriminals%20to%20target%20traders%20%7C%20Group-IB%20Blog&did=dZTQ1Zm&gdid=dZTQ1Zm&auid=1966813297.1692910199&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=AW-10882981508 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 61e5f9e408cd71b5c13962ef01edfeb076386b5aee4e41ed0cbd91794bd86f36 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language en-GB,en;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 Response headers pragma no-cache date Thu, 24 Aug 2023 20:49:59 GMT content-encoding br x-content-type-options nosniff server cafe content-type text/javascript; charset=UTF-8 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 1438 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 485 B	251ms 250ms	Image image/gif	23.38.98.119 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=e84d9c08a990af8592952e7ac9a983ad&svisitor=null&visitor=287bf85b-2334-419b-8009-b335b649d8cb&session=d55a5164-2517-4157-88e2-fa0533c629d5&event=ipv6&q=%7B%22address%22%3A%222a01%3A4a0%3A2c%3A%3A5%22%7D&isIframe=false&m=%7B%22description%22%3A%22Spoof%20extensions%20help%20cybercriminals%20target%20users%20on%20trading%20forums%20as%20130%20devices%20still%20infected%20at%20time%20of%20writing%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Traders%27%20dollars%20in%20danger%3A%20CVE-2023-38831%20zero-day%20vulnerability%20in%20WinRAR%20exploited%20by%20cybercriminals%20to%20target%20traders%20%7C%20Group-IB%20Blog%22%7D&cb=&r=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&pageViewId=4e5541af-791f-4dbb-83e2-ed66f5a0514c&v=1.1.5 Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 23.38.98.119 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a23-38-98-119.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language en-GB,en;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 Response headers date Thu, 24 Aug 2023 20:49:59 GMT x-content-type-options nosniff content-length 43 pragma no-cache last-modified Sat, 18 Feb 2023 02:04:22 GMT server nginx/1.14.0 (Ubuntu) etag "63f03226-2b" access-control-max-age 86400 access-control-allow-methods GET,POST content-type image/gif access-control-allow-origin cache-control private, no-cache, no-cache=Set-Cookie, proxy-revalidate access-control-allow-credentials true accept-ranges bytes access-control-allow-headers * expires Wed, 19 Apr 2000 11:43:00 GMT
GET H2	200	sync_cookie_image_decide_secondary mc.yandex.com/ Redirect Chain https://mc.yandex.com/sync_cookie_image_check_secondary https://mc.yandex.ru/sync_cookie_image_start_secondary?redirect_domain=mc.yandex.com&token=10105.VNMckq2a6fEr4r6AgDp5vlhBshDOimzkIWSIlJRXgD44dWCK74LdhzRj6VXA34rl.668S9gjWkoe6bk3izHTtJ_2sQ9k%2C https://mc.yandex.com/sync_cookie_image_decide_secondary?token=10105.mt0V0zkT1CNVJLX5Q91YkjqVSXMVkXsjpy8-ZKVQs6pnvOnBFCtaoJOfXjd6k1RjrVDBEccyQ3y61fYNUDRKR46fWRKYTJT75xz2OjsX_wU%2C.LPLea0pPMmvddxvz4...	43 B 79 B	91ms 91ms	Image image/gif	2a02:6b8::1:119 GLOBAL_DC
General Check archive.org Show headers Download Go to Show image Full URL https://mc.yandex.com/sync_cookie_image_decide_secondary?token=10105.mt0V0zkT1CNVJLX5Q91YkjqVSXMVkXsjpy8-ZKVQs6pnvOnBFCtaoJOfXjd6k1RjrVDBEccyQ3y61fYNUDRKR46fWRKYTJT75xz2OjsX_wU%2C.LPLea0pPMmvddxvz4kiVZEGMw38%2C Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Server 2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI), Reverse DNS Software / Resource Hash 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Xss-Protection 1; mode=block Request headers accept-language en-GB,en;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 Response headers date Thu, 24 Aug 2023 20:49:59 GMT strict-transport-security max-age=31536000 content-length 43 x-xss-protection 1; mode=block content-type image/gif Redirect headers location https://mc.yandex.com/sync_cookie_image_decide_secondary?token=10105.mt0V0zkT1CNVJLX5Q91YkjqVSXMVkXsjpy8-ZKVQs6pnvOnBFCtaoJOfXjd6k1RjrVDBEccyQ3y61fYNUDRKR46fWRKYTJT75xz2OjsX_wU%2C.LPLea0pPMmvddxvz4kiVZEGMw38%2C date Thu, 24 Aug 2023 20:49:59 GMT strict-transport-security max-age=31536000 x-xss-protection 1; mode=block
GET H2	200	/ www.google.com/pagead/1p-user-list/10882981508/	42 B 108 B	67ms 64ms	Image image/gif	2a00:1450:4001:829::2004 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/pagead/1p-user-list/10882981508/?random=1692910199551&cv=11&fst=1692907200000&bg=ffffff&guid=ON&async=1&gtm=45be38n0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&ref=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&frm=0&tiba=Traders%27%20dollars%20in%20danger%3A%20CVE-2023-38831%20zero-day%20vulnerability%20in%20WinRAR%20exploited%20by%20cybercriminals%20to%20target%20traders%20%7C%20Group-IB%20Blog&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=886021053&rmt_tld=0&ipr=y Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:829::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language en-GB,en;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 Response headers pragma no-cache date Thu, 24 Aug 2023 20:49:59 GMT content-security-policy script-src 'none'; object-src 'none' x-content-type-options nosniff server cafe content-type image/gif p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	/ www.google.de/pagead/1p-user-list/10882981508/	42 B 108 B	67ms 66ms	Image image/gif	2a00:1450:4001:810::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/pagead/1p-user-list/10882981508/?random=1692910199551&cv=11&fst=1692907200000&bg=ffffff&guid=ON&async=1&gtm=45be38n0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&ref=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&frm=0&tiba=Traders%27%20dollars%20in%20danger%3A%20CVE-2023-38831%20zero-day%20vulnerability%20in%20WinRAR%20exploited%20by%20cybercriminals%20to%20target%20traders%20%7C%20Group-IB%20Blog&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=886021053&rmt_tld=1&ipr=y Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language en-GB,en;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 Response headers pragma no-cache date Thu, 24 Aug 2023 20:49:59 GMT content-security-policy script-src 'none'; object-src 'none' x-content-type-options nosniff server cafe content-type image/gif p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
POST H2	200	1 mc.yandex.com/watch/26812653/	43 B 0	93ms 93ms	Fetch image/gif	2a02:6b8::1:119 GLOBAL_DC
General Check archive.org Show headers Download Go to Full URL https://mc.yandex.com/watch/26812653/1?page-url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&charset=utf-8&hittoken=1692910199_c1756e999ef2622b31628c970fa33b2073cd86dae67d8daa3cbc303b867bdf01&browser-info=pa%3A1%3Aar%3A1%3Avf%3Aeygqx1x5sixaiiugyrqh3hb%3Afu%3A1%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A1093%3Acn%3A1%3Adp%3A1%3Als%3A1091298705691%3Ahid%3A971870371%3Az%3A60%3Ai%3A20230824214959%3Aet%3A1692910200%3Ac%3A1%3Arn%3A716981052%3Arqn%3A2%3Au%3A1692910199469179042%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Awv%3A2%3Aco%3A0%3Acpf%3A1%3Ans%3A1692910197276%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1692910200&t=gdpr(14)mc(p-3)clc(0-0-0)rqnt(2)lt(41800)aw(1)ti(1) Requested by Host: fhp-de-js.group-ib.com URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI), Reverse DNS Software / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Xss-Protection 1; mode=block Request headers Referer https://www.group-ib.com/ accept-language en-GB,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 Content-Type application/x-www-form-urlencoded Response headers pragma no-cache date Thu, 24 Aug 2023 20:50:00 GMT strict-transport-security max-age=31536000 last-modified Thu, 24-Aug-2023 20:50:00 GMT accept-ch Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA content-type image/gif access-control-allow-origin https://www.group-ib.com cache-control private, no-cache, no-store, must-revalidate, max-age=0 access-control-allow-credentials true content-length 43 x-xss-protection 1; mode=block expires Thu, 24-Aug-2023 20:50:00 GMT
POST H2	200	1 mc.yandex.com/watch/26812653/	43 B 0	91ms 88ms	Fetch image/gif	2a02:6b8::1:119 GLOBAL_DC
General Check archive.org Show headers Download Go to Full URL https://mc.yandex.com/watch/26812653/1?page-url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&charset=utf-8&hittoken=1692910199_c1756e999ef2622b31628c970fa33b2073cd86dae67d8daa3cbc303b867bdf01&browser-info=pa%3A1%3Aar%3A1%3Avf%3Aeygqx1x5sixaiiugyrqh3hb%3Afu%3A1%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A1093%3Acn%3A1%3Adp%3A1%3Als%3A1091298705691%3Ahid%3A971870371%3Az%3A60%3Ai%3A20230824214959%3Aet%3A1692910200%3Ac%3A1%3Arn%3A943851198%3Arqn%3A3%3Au%3A1692910199469179042%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Awv%3A2%3Aco%3A0%3Acpf%3A1%3Ans%3A1692910197276%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1692910200&t=gdpr(14)mc(p-3)clc(0-0-0)rqnt(3)lt(41800)aw(1)ti(1) Requested by Host: fhp-de-js.group-ib.com URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI), Reverse DNS Software / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Xss-Protection 1; mode=block Request headers Referer https://www.group-ib.com/ accept-language en-GB,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 Content-Type application/x-www-form-urlencoded Response headers pragma no-cache date Thu, 24 Aug 2023 20:50:00 GMT strict-transport-security max-age=31536000 last-modified Thu, 24-Aug-2023 20:50:00 GMT accept-ch Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA content-type image/gif access-control-allow-origin https://www.group-ib.com cache-control private, no-cache, no-store, must-revalidate, max-age=0 access-control-allow-credentials true content-length 43 x-xss-protection 1; mode=block expires Thu, 24-Aug-2023 20:50:00 GMT
POST H2	200	1 mc.yandex.com/watch/26812653/	43 B 0	99ms 97ms	Fetch image/gif	2a02:6b8::1:119 GLOBAL_DC
General Check archive.org Show headers Download Go to Full URL https://mc.yandex.com/watch/26812653/1?page-url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&charset=utf-8&hittoken=1692910199_c1756e999ef2622b31628c970fa33b2073cd86dae67d8daa3cbc303b867bdf01&browser-info=pa%3A1%3Aar%3A1%3Avf%3Aeygqx1x5sixaiiugyrqh3hb%3Afu%3A1%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A1093%3Acn%3A1%3Adp%3A1%3Als%3A1091298705691%3Ahid%3A971870371%3Az%3A60%3Ai%3A20230824214959%3Aet%3A1692910200%3Ac%3A1%3Arn%3A762548305%3Arqn%3A4%3Au%3A1692910199469179042%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Awv%3A2%3Aco%3A0%3Acpf%3A1%3Ans%3A1692910197276%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1692910200&t=gdpr(14)mc(p-3)clc(0-0-0)rqnt(4)lt(41800)aw(1)ti(1) Requested by Host: fhp-de-js.group-ib.com URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI), Reverse DNS Software / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Xss-Protection 1; mode=block Request headers Referer https://www.group-ib.com/ accept-language en-GB,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 Content-Type application/x-www-form-urlencoded Response headers pragma no-cache date Thu, 24 Aug 2023 20:50:00 GMT strict-transport-security max-age=31536000 last-modified Thu, 24-Aug-2023 20:50:00 GMT accept-ch Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA content-type image/gif access-control-allow-origin https://www.group-ib.com cache-control private, no-cache, no-store, must-revalidate, max-age=0 access-control-allow-credentials true content-length 43 x-xss-protection 1; mode=block expires Thu, 24-Aug-2023 20:50:00 GMT
POST H2	200	fl Show response www.group-ib.com/api/	665 B 814 B	133ms 133ms	XHR application/json	3.72.181.255 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://www.group-ib.com/api/fl?u=44765f40-4296-11ee-952f-221c0dcfc0b5&cfidsgib-w-61354c22-16cc-40a8-a871-6901f1a76e24=FONWN4b30WG8qKfj3vX6E6mb0peFpjPQg0YnzSXw6z5m3ZaMQwMM3hvzk%2FHohHKF8T5xKUgv4BtEgyPiBZoI%2BHKDR9PXrev8QC9RNw%2FB%2Bl6JnOK8PN6i4LIATvY%2BllqSZkLPDqqdXCmJ8vqO6M5yfDWiT0%2FXhx8SWPpX Requested by Host: fhp-de-js.group-ib.com URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-72-181-255.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash 8179b61433edc75af2c674a3863dbd75cff82ce8d8b5a716b3a11e4a7bc0b82b Request headers X-GIB-GSSCgib-w-61354c22-16cc-40a8-a871-6901f1a76e24 65bJqQUtEgcmHVFhsiHP1pOpSAPiEUSTupyVIphiFbETsCY9cGxNktHEcbiib/0SQI5o/oXU1ZhvNYGY3cwofDeCRNyXlQ1OnL1LgdDWfiha2LO6SOPZOs1JBnXtKmr63KzGehI1AOsQZdsKEZQ6Xk8IVJuXzGe6xnSiMIKaNcHSEPo0T5QhRYhs/yp+nC4osp7ZLtdl95rJJEtt1+Aqexg1OTl0xgdixPWuzrA9lFBUibclwwSZCDIpMKs5vg== Referer https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ accept-language en-GB,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 X-GIB-FGSSCgib-w-61354c22-16cc-40a8-a871-6901f1a76e24 htii699bfb397cb5d8983da5882ef87492dd56a4 Content-Type text/plain;charset=UTF-8 Response headers date Thu, 24 Aug 2023 20:50:00 GMT content-encoding gzip server nginx vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/json; charset=utf-8 access-control-allow-origin https://www.group-ib.com cache-control no-store access-control-allow-credentials true x-envoy-upstream-service-time 4 access-control-allow-headers Accept,DNT,Keep-Alive,User-Agent,If-Modified-Since,Cache-Control,Content-Type,Origin,ETag,If-None-Match,X-Cfids,Authorization
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 484 B	300ms 300ms	Image image/gif	23.38.98.119 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=e84d9c08a990af8592952e7ac9a983ad&svisitor=null&visitor=287bf85b-2334-419b-8009-b335b649d8cb&session=d55a5164-2517-4157-88e2-fa0533c629d5&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2024%20Aug%202023%2020%3A50%3A00%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2024%20Aug%202023%2020%3A49%3A59%20GMT%22%2C%22timeSpent%22%3A%221003%22%2C%22totalTimeSpent%22%3A%221003%22%7D&isIframe=false&m=%7B%22description%22%3A%22Spoof%20extensions%20help%20cybercriminals%20target%20users%20on%20trading%20forums%20as%20130%20devices%20still%20infected%20at%20time%20of%20writing%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Traders%27%20dollars%20in%20danger%3A%20CVE-2023-38831%20zero-day%20vulnerability%20in%20WinRAR%20exploited%20by%20cybercriminals%20to%20target%20traders%20%7C%20Group-IB%20Blog%22%7D&cb=&r=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&pageViewId=4e5541af-791f-4dbb-83e2-ed66f5a0514c&v=1.1.5 Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 23.38.98.119 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a23-38-98-119.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language en-GB,en;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36 Response headers date Thu, 24 Aug 2023 20:50:00 GMT x-content-type-options nosniff content-length 43 pragma no-cache last-modified Sat, 18 Feb 2023 00:49:36 GMT server nginx/1.14.0 (Ubuntu) etag "63f020a0-2b" access-control-max-age 86400 access-control-allow-methods GET,POST content-type image/gif access-control-allow-origin cache-control private, no-cache, no-cache=Set-Cookie, proxy-revalidate access-control-allow-credentials true accept-ranges bytes access-control-allow-headers * expires Wed, 19 Apr 2000 11:43:00 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain

www.group-ib.com

URL

https://www.group-ib.com/wp-admin/admin-ajax.php