malware.news Open in urlscan Pro
2606:4700:20::681a:769 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://malware.news/t/cloudy-with-a-chance-of-rats-unveiling-apt36-and-the-evolution-of-elizarat/88085
Submission: On November 05 via api (November 5th 2024, 7:17:14 am UTC) from IN — Scanned from DE

Summary HTTP 43 Redirects Links 6 Behaviour Indicators

Summary

This website contacted 7 IPs in 3 countries across 6 domains to perform 43 HTTP transactions. The main IP is 2606:4700:20::681a:769, located in United States and belongs to CLOUDFLARENET, US. The main domain is malware.news. The Cisco Umbrella rank of the primary domain is 923402.
TLS certificate: Issued by WE1 on September 8th 2024. Valid for: 3 months.

This is the only time malware.news was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
38	2606:4700:20:... 2606:4700:20::681a:769	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:830::2008	15169 (GOOGLE) (GOOGLE)
1	141.193.213.20 141.193.213.20	209242 (CLOUDFLAR...) (CLOUDFLARESPECTRUM Cloudflare)
1	2001:4860:480... 2001:4860:4802:32::36	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:400c:c09::9b	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:80e::2003	15169 (GOOGLE) (GOOGLE)
43	7

38 2606:4700:20::681a:769 (United States)

ASN13335 (CLOUDFLARENET, US)

malware.news	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:830::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 141.193.213.20 (United States)

ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US)

research.checkpoint.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4860:4802:32::36 (United States)

ASN15169 (GOOGLE, US)

region1.analytics.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c09::9b (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80e::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
38	malware.news malware.news — Cisco Umbrella Rank: 923402	2 MB
1	google.de www.google.de — Cisco Umbrella Rank: 11271	63 B
1	doubleclick.net stats.g.doubleclick.net — Cisco Umbrella Rank: 136	552 B
1	google.com region1.analytics.google.com — Cisco Umbrella Rank: 4401
1	checkpoint.com research.checkpoint.com	23 KB
1	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 39	94 KB
43	6

	Domain	Requested by
38	malware.news	malware.news
1	www.google.de	malware.news
1	stats.g.doubleclick.net	www.googletagmanager.com
1	region1.analytics.google.com	www.googletagmanager.com
1	research.checkpoint.com	malware.news
1	www.googletagmanager.com	malware.news
43	6

This site contains links to these domains. Also see Links.

Domain
www.zscaler.com
github.com
www.seqrite.com
research.checkpoint.com
discourse.org

Subject Issuer	Validity	Valid
malware.news WE1	`2024-09-08` - `2024-12-07`	3 months	crt.sh
*.google-analytics.com WR2	`2024-10-07` - `2024-12-30`	3 months	crt.sh
research.checkpoint.com WE1	`2024-11-02` - `2025-01-31`	3 months	crt.sh
*.g.doubleclick.net WR2	`2024-10-07` - `2024-12-30`	3 months	crt.sh
*.google.de WR2	`2024-10-07` - `2024-12-30`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://malware.news/t/cloudy-with-a-chance-of-rats-unveiling-apt36-and-the-evolution-of-elizarat/88085
Frame ID: 3E09AFFEFD45C94023DBC877BD98C054
Requests: 46 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Cloudy With a Chance of RATs: Unveiling APT36 and the Evolution of ElizaRAT - Malware Analysis - Malware Analysis, News and Indicators

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

/wp-(?:content|includes)/

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtag/js

Page Statistics

43
Requests

100 %
HTTPS

83 %
IPv6

6
Domains

6
Subdomains

7
IPs

3
Countries

2408 kB
Transfer

14913 kB
Size

2
Cookies

6 Outgoing links

These are links going to different origins than the main page.

URL: https://www.zscaler.com/blogs/security-research/peek-apt36-s-updated-arsenal
Title: disclosed

Search URL Search Domain Scan URL

URL: https://github.com/Fody/Costura
Title: Costura

Search URL Search Domain Scan URL

URL: https://www.seqrite.com/blog/umbrella-of-pakistani-threats-converging-tactics-of-cyber-operations-targeting-india/
Title: Linux

Search URL Search Domain Scan URL

URL: https://research.checkpoint.com/2024/the-evolution-of-transparent-tribes-new-malware/
Title: Cloudy With a Chance of RATs: Unveiling APT36 and the Evolution of ElizaRAT 8

Search URL Search Domain Scan URL

URL: https://research.checkpoint.com/
Title: Check Point Research

Search URL Search Domain Scan URL

URL: https://discourse.org/powered-by
Title: Powered by Discourse

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

43 HTTP transactions
3 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request 88085 Show response
malware.news/t/cloudy-with-a-chance-of-rats-unveiling-apt36-and-the-evolution-of-elizarat/ 172 KB
34 KB 408ms
333ms Document
text/html 2606:4700:20::681a:769
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://malware.news/t/cloudy-with-a-chance-of-rats-unveiling-apt36-and-the-evolution-of-elizarat/88085

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:769 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b570d9bc41345f0e8c87714b72c214d41d95014be8308081e609d074844d28f1

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests; base-uri 'self'; object-src 'none'; script-src 'nonce-QTDIRKwuqrWbS7lOuakOzwLkK' 'strict-dynamic'; frame-ancestors 'self'; manifest-src 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

cache-control: no-cache, no-store
cf-cache-status: DYNAMIC
cf-ray: 8ddb0fe8bc11d294-FRA
content-encoding: br
content-security-policy: upgrade-insecure-requests; base-uri 'self'; object-src 'none'; script-src 'nonce-QTDIRKwuqrWbS7lOuakOzwLkK' 'strict-dynamic'; frame-ancestors 'self'; manifest-src 'self'
content-security-policy-report-only: upgrade-insecure-requests; base-uri 'self'; object-src 'none'; script-src 'nonce-QTDIRKwuqrWbS7lOuakOzwLkK' 'strict-dynamic'; frame-ancestors 'self'; manifest-src 'self'
content-type: text/html; charset=utf-8
cross-origin-opener-policy: same-origin-allow-popups
date: Tue, 05 Nov 2024 07:17:06 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy: strict-origin-when-cross-origin
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ekFDS37EkbZ%2B0%2B8AsCUkbBuAm0IFP6ySuP0jZsXZydY%2FMgpRVVwKPPi1HevdwYM16DGpbCHpKQcXR2VMrQmxVEA9Th0LG89dco5vIG5poy2PasMf2tP8AkH8Ksp4Qd9kbIiDvEuHYDNFcA%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
server-timing: cfL4;desc="?proto=TCP&rtt=6083&sent=8&recv=12&lost=0&retrans=0&sent_bytes=4009&recv_bytes=2436&delivery_rate=673655&cwnd=253&unsent_bytes=0&cid=f2b55b8230be2271&ts=378&x=0"
vary: Accept-Encoding Accept
x-content-type-options: nosniff
x-discourse-cached: true
x-discourse-route: topics/show
x-discourse-trackview: 1
x-download-options: noopen
x-frame-options: SAMEORIGIN
x-permitted-cross-domain-policies: none
x-request-id: 521da5a2-632f-4d90-9d27-14b43c4ff325
x-runtime: 0.002210
x-xss-protection: 0

GET
H2 200 start-discourse-c524a8995f2f0cbcea43353efe8e8f269da821ea97c21ef0f04df5fcd916170a.js Show response
malware.news/assets/ 567 B
701 B 62ms
53ms Script
application/javascript 2606:4700:20::681a:769
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://malware.news/assets/start-discourse-c524a8995f2f0cbcea43353efe8e8f269da821ea97c21ef0f04df5fcd916170a.js
Requested by: Host: malware.news
URL: https://malware.news/t/cloudy-with-a-chance-of-rats-unveiling-apt36-and-the-evolution-of-elizarat/88085
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:769 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c524a8995f2f0cbcea43353efe8e8f269da821ea97c21ef0f04df5fcd916170a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://malware.news/t/cloudy-with-a-chance-of-rats-unveiling-apt36-and-the-evolution-of-elizarat/88085

Response headers

cache-control: public, max-age=31536000, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: HIT
age: 1776315
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=l6dzbP4eBc4Z%2BSsMdySQTOdz5%2BJ%2Bgt3d07qQttvmKT%2FV%2FN5MvJ4XBTAVwIrORMEulTA%2FQ1CAQnBpOlfFY%2BLqrlaRnaG384gQDO%2FscKzyaV7HLN%2FCOwZ1gP%2Bpc6GUmPsljiDEE%2FWpNYyYCA%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 8ddb0feb0893d294-FRA
expires: Sat, 13 Sep 2025 23:56:52 GMT
server-timing: cfL4;desc="?proto=TCP&rtt=6723&sent=69&recv=24&lost=0&retrans=0&sent_bytes=74521&recv_bytes=4404&delivery_rate=829555&cwnd=253&unsent_bytes=31872&cid=f2b55b8230be2271&ts=454&x=0"
date: Tue, 05 Nov 2024 07:17:06 GMT
content-type: application/javascript
last-modified: Sun, 19 May 2024 17:35:46 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 browser-update-9070f07226d022f68c06506e046ae33f8fe725302ff53955cd3d483f2fc47ff6.js Show response
malware.news/assets/ 2 KB
1 KB 61ms
52ms Script
application/javascript 2606:4700:20::681a:769
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://malware.news/assets/browser-update-9070f07226d022f68c06506e046ae33f8fe725302ff53955cd3d483f2fc47ff6.js
Requested by: Host: malware.news
URL: https://malware.news/t/cloudy-with-a-chance-of-rats-unveiling-apt36-and-the-evolution-of-elizarat/88085
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:769 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9070f07226d022f68c06506e046ae33f8fe725302ff53955cd3d483f2fc47ff6

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://malware.news/t/cloudy-with-a-chance-of-rats-unveiling-apt36-and-the-evolution-of-elizarat/88085

Response headers

cache-control: public, max-age=31536000, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: HIT
age: 1776315
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=koRtompErjrvk5NE8%2BMrI403e7AjwHk%2FufqnWUpTGZEBtPkAwhLfNS5zMPwVeNmHaux44Umbsw7FTmCTN7KllaNVFIEEtiNcXFoAQPMEYk94G4PusPq8tTArwGK8ol9gSTWVnwML37VtSw%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 8ddb0feb0894d294-FRA
expires: Sun, 09 Mar 2025 04:07:38 GMT
server-timing: cfL4;desc="?proto=TCP&rtt=6723&sent=69&recv=24&lost=0&retrans=0&sent_bytes=74521&recv_bytes=4404&delivery_rate=829555&cwnd=253&unsent_bytes=31872&cid=f2b55b8230be2271&ts=454&x=0"
date: Tue, 05 Nov 2024 07:17:06 GMT
content-type: application/javascript
last-modified: Sat, 09 Mar 2024 04:04:58 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 browser-detect-99f42f91bffa8ca1606d62b70bb92f981d83921e78ccdbd3d9538f07007f27ac.js Show response
malware.news/assets/ 497 B
789 B 65ms
13ms Script
application/javascript 2606:4700:20::681a:769
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://malware.news/assets/browser-detect-99f42f91bffa8ca1606d62b70bb92f981d83921e78ccdbd3d9538f07007f27ac.js
Requested by: Host: malware.news
URL: https://malware.news/t/cloudy-with-a-chance-of-rats-unveiling-apt36-and-the-evolution-of-elizarat/88085
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:769 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 99f42f91bffa8ca1606d62b70bb92f981d83921e78ccdbd3d9538f07007f27ac

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://malware.news/t/cloudy-with-a-chance-of-rats-unveiling-apt36-and-the-evolution-of-elizarat/88085

Response headers

cache-control: public, max-age=31536000, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: HIT
age: 1867358
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=I5Vm1cDsPIq8IpOlJPiOQ%2BMAcAFVrZEEVM8Y%2FrhgwbR9c32ZdLqETaAqRuyaNUBjqQGJXlxOH3pO8ybnacizhhrizgQJr%2FyXLZ7YMKhp3uMuya4v5EpOi4pIcC4f%2FTiU3ZvPM7sW42c%2F6g%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 8ddb0feb593fd294-FRA
expires: Fri, 10 Oct 2025 17:19:16 GMT
server-timing: cfL4;desc="?proto=TCP&rtt=10938&sent=150&recv=46&lost=0&retrans=0&sent_bytes=170898&recv_bytes=6229&delivery_rate=1587033&cwnd=253&unsent_bytes=0&cid=f2b55b8230be2271&ts=504&x=0"
date: Tue, 05 Nov 2024 07:17:06 GMT
content-type: application/javascript
last-modified: Sun, 19 May 2024 17:35:46 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 vendor.ff29780b9fed784cce2d843dcb93a803-608f4f77d8437d715d8d39c739c0c8bbe0fe51c9305e55f1ec7d0bee19f5571f.js Show response
malware.news/assets/ 438 KB
123 KB 76ms
23ms Script
application/javascript 2606:4700:20::681a:769
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://malware.news/assets/vendor.ff29780b9fed784cce2d843dcb93a803-608f4f77d8437d715d8d39c739c0c8bbe0fe51c9305e55f1ec7d0bee19f5571f.js
Requested by: Host: malware.news
URL: https://malware.news/t/cloudy-with-a-chance-of-rats-unveiling-apt36-and-the-evolution-of-elizarat/88085
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:769 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 608f4f77d8437d715d8d39c739c0c8bbe0fe51c9305e55f1ec7d0bee19f5571f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://malware.news/t/cloudy-with-a-chance-of-rats-unveiling-apt36-and-the-evolution-of-elizarat/88085

Response headers

cache-control: public, max-age=31536000, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: HIT
age: 1867358
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xjOU9mvgkwkHE9OCo5kwRnUcZ5zS%2FCoengXe27Y9HAufXBllvLJH11NrHSQ6duo%2FTo0K1Uxn7NM3ubNiuMUdMb8KB4M6KR8aIL02kGOWD%2FjlJ02i2WgqLKLS%2BYA63pOxZvxq8CNGx20Hkg%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 8ddb0feb5940d294-FRA
expires: Mon, 19 May 2025 17:21:44 GMT
server-timing: cfL4;desc="?proto=TCP&rtt=9797&sent=232&recv=48&lost=0&retrans=0&sent_bytes=249449&recv_bytes=6229&delivery_rate=1587033&cwnd=253&unsent_bytes=38512&cid=f2b55b8230be2271&ts=511&x=0"
date: Tue, 05 Nov 2024 07:17:06 GMT
content-type: application/javascript
last-modified: Sun, 19 May 2024 17:17:10 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 chunk.6d6a6a17194d67289ef4.d41d8cd9.js Show response
malware.news/assets/ 12 MB
2 MB 68ms
15ms Script
application/javascript 2606:4700:20::681a:769
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://malware.news/assets/chunk.6d6a6a17194d67289ef4.d41d8cd9.js
Requested by: Host: malware.news
URL: https://malware.news/t/cloudy-with-a-chance-of-rats-unveiling-apt36-and-the-evolution-of-elizarat/88085
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:769 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5566fc85873915364c34914ef9efda42cca8e77faad713da08a9d3d8e8677943

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://malware.news/t/cloudy-with-a-chance-of-rats-unveiling-apt36-and-the-evolution-of-elizarat/88085

Response headers

cache-control: public, max-age=31536000, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: HIT
age: 1860983
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=h8qNOr90fX8DXM67c%2FPeTlFqiKocA%2FT%2FCUIXY9t%2FIBrCFsQZ%2BpjiQ8U5DvoUNOoJB7hgqiaWdBBMRjnfUVR4DUygqjgcC8N67drrE2Oic4mfdOsnJU5k1Z1A8rYmAn1rAmZzjFsaTdliOw%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 8ddb0feb5941d294-FRA
expires: Mon, 19 May 2025 17:21:38 GMT
server-timing: cfL4;desc="?proto=TCP&rtt=9797&sent=214&recv=48&lost=0&retrans=0&sent_bytes=226433&recv_bytes=6229&delivery_rate=1587033&cwnd=253&unsent_bytes=0&cid=f2b55b8230be2271&ts=511&x=0"
date: Tue, 05 Nov 2024 07:17:06 GMT
content-type: application/javascript
last-modified: Sun, 19 May 2024 17:17:01 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 chunk.d43472f435e6bfab8439.d41d8cd9.js Show response
malware.news/assets/ 305 KB
21 KB 114ms
62ms Script
application/javascript 2606:4700:20::681a:769
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://malware.news/assets/chunk.d43472f435e6bfab8439.d41d8cd9.js
Requested by: Host: malware.news
URL: https://malware.news/t/cloudy-with-a-chance-of-rats-unveiling-apt36-and-the-evolution-of-elizarat/88085
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:769 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0b5ddfb3a605aeed9ff478a225e8062861424d523836d7256e2b75489bf20cdf

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://malware.news/t/cloudy-with-a-chance-of-rats-unveiling-apt36-and-the-evolution-of-elizarat/88085

Response headers

cache-control: public, max-age=31536000, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: HIT
age: 1776315
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2b35sIM1SdmfHARHbmhHdMlU4r%2Fksw%2FhN8gDtJJ0x%2BkkjpGPdFkZXb5LyBtSyakwWGAY9DXhZsYsEJJ%2F1OtZpBV9tHqI6hTjmhh%2F9FSMM4SAsCi17GARRpRusGrH34dZNnKfCBDHnOwKGQ%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 8ddb0feb5942d294-FRA
expires: Mon, 19 May 2025 17:21:38 GMT
server-timing: cfL4;desc="?proto=TCP&rtt=10938&sent=175&recv=46&lost=0&retrans=0&sent_bytes=187264&recv_bytes=6229&delivery_rate=1587033&cwnd=253&unsent_bytes=0&cid=f2b55b8230be2271&ts=507&x=0"
date: Tue, 05 Nov 2024 07:17:06 GMT
content-type: application/javascript
last-modified: Sun, 19 May 2024 17:17:01 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 checklist-55813a5bacc3c99fda0b099a80401f124870fa9b510ced078af32f8a82364461.js Show response
malware.news/assets/plugins/ 4 KB
2 KB 69ms
17ms Script
application/javascript 2606:4700:20::681a:769
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://malware.news/assets/plugins/checklist-55813a5bacc3c99fda0b099a80401f124870fa9b510ced078af32f8a82364461.js
Requested by: Host: malware.news
URL: https://malware.news/t/cloudy-with-a-chance-of-rats-unveiling-apt36-and-the-evolution-of-elizarat/88085
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:769 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 55813a5bacc3c99fda0b099a80401f124870fa9b510ced078af32f8a82364461

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://malware.news/t/cloudy-with-a-chance-of-rats-unveiling-apt36-and-the-evolution-of-elizarat/88085

Response headers

cache-control: public, max-age=31536000, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: HIT
age: 1861941
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3lqoe59dUeTUarlTOij1RHH9RcTO9Y9Sxs5WUqBT%2FvXLzj%2F73VuLmWY62BOVvxFb5fOqJQf8OQulrBSFpMvw5NmHnScwBguleW37et1pMDt1SPWi9CQzV%2FxaJinXzLLjCMgubvMXokk1qQ%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 8ddb0feb5945d294-FRA
expires: Mon, 19 May 2025 17:21:38 GMT
server-timing: cfL4;desc="?proto=TCP&rtt=10938&sent=146&recv=46&lost=0&retrans=0&sent_bytes=168527&recv_bytes=6229&delivery_rate=1587033&cwnd=253&unsent_bytes=0&cid=f2b55b8230be2271&ts=503&x=0"
date: Tue, 05 Nov 2024 07:17:06 GMT
content-type: application/javascript
last-modified: Sun, 19 May 2024 17:18:01 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 discourse-details-48148ec534a4c5e9614302186b345123ba1358787c41bc31cbd17231f794fe42.js Show response
malware.news/assets/plugins/ 1 KB
1 KB 65ms
13ms Script
application/javascript 2606:4700:20::681a:769
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://malware.news/assets/plugins/discourse-details-48148ec534a4c5e9614302186b345123ba1358787c41bc31cbd17231f794fe42.js
Requested by: Host: malware.news
URL: https://malware.news/t/cloudy-with-a-chance-of-rats-unveiling-apt36-and-the-evolution-of-elizarat/88085
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:769 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 48148ec534a4c5e9614302186b345123ba1358787c41bc31cbd17231f794fe42

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://malware.news/t/cloudy-with-a-chance-of-rats-unveiling-apt36-and-the-evolution-of-elizarat/88085

Response headers

cache-control: public, max-age=31536000, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: HIT
age: 1776315
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lij%2FYWmN1abLol7nt1Nk4qBYLy0NPKGWwh2y7CPqmaSxA8sOgtA526uU5kCt1xCyfXSCK48sDMDqYVqS8c8JqujRqW1xJRh92Q63emn%2FKyEv8DaSystPkZj5Y8c%2FToSnA906kDUACj8wWA%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 8ddb0feb5946d294-FRA
expires: Mon, 12 May 2025 06:44:11 GMT
server-timing: cfL4;desc="?proto=TCP&rtt=10938&sent=152&recv=46&lost=0&retrans=0&sent_bytes=171753&recv_bytes=6229&delivery_rate=1587033&cwnd=253&unsent_bytes=0&cid=f2b55b8230be2271&ts=504&x=0"
date: Tue, 05 Nov 2024 07:17:06 GMT
content-type: application/javascript
last-modified: Sat, 09 Mar 2024 04:05:22 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 discourse-lazy-videos-bdf1486acc96b228a2163490640a2bdc90f5e0a1bb1949335fd1fde2ad48795c.js Show response
malware.news/assets/plugins/ 7 KB
3 KB 66ms
14ms Script
application/javascript 2606:4700:20::681a:769
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://malware.news/assets/plugins/discourse-lazy-videos-bdf1486acc96b228a2163490640a2bdc90f5e0a1bb1949335fd1fde2ad48795c.js
Requested by: Host: malware.news
URL: https://malware.news/t/cloudy-with-a-chance-of-rats-unveiling-apt36-and-the-evolution-of-elizarat/88085
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:769 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: bdf1486acc96b228a2163490640a2bdc90f5e0a1bb1949335fd1fde2ad48795c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://malware.news/t/cloudy-with-a-chance-of-rats-unveiling-apt36-and-the-evolution-of-elizarat/88085

Response headers

cache-control: public, max-age=31536000, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: HIT
age: 1861941
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=AINkyg6Ds7odqvzFS8dA8qPnuwX98PtxhPno3bLihD8fGV%2FDcTTcSXV0r4V5eGoZ0AB1AfhYrsA46Ex%2FT41%2F%2B3uwTPCSIdJr8pZMbzn0sJWa5xNuiTjUfrKvPdYmuhiRfDVDU9sjHsCKrw%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 8ddb0feb5948d294-FRA
expires: Thu, 09 Oct 2025 21:12:05 GMT
server-timing: cfL4;desc="?proto=TCP&rtt=10938&sent=193&recv=46&lost=0&retrans=0&sent_bytes=209125&recv_bytes=6229&delivery_rate=1587033&cwnd=253&unsent_bytes=0&cid=f2b55b8230be2271&ts=507&x=0"
date: Tue, 05 Nov 2024 07:17:06 GMT
content-type: application/javascript
last-modified: Sun, 19 May 2024 17:36:18 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 discourse-local-dates-823b91992054aeb8ca1e4921c7a3ae7f9fae09ef838946f3b261ab5a6ad776ee.js Show response
malware.news/assets/plugins/ 33 KB
10 KB 67ms
15ms Script
application/javascript 2606:4700:20::681a:769
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://malware.news/assets/plugins/discourse-local-dates-823b91992054aeb8ca1e4921c7a3ae7f9fae09ef838946f3b261ab5a6ad776ee.js
Requested by: Host: malware.news
URL: https://malware.news/t/cloudy-with-a-chance-of-rats-unveiling-apt36-and-the-evolution-of-elizarat/88085
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:769 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 823b91992054aeb8ca1e4921c7a3ae7f9fae09ef838946f3b261ab5a6ad776ee

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://malware.news/t/cloudy-with-a-chance-of-rats-unveiling-apt36-and-the-evolution-of-elizarat/88085

Response headers

cache-control: public, max-age=31536000, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: HIT
age: 1776315
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=A%2BMVRfctt%2BG6%2BTxLzaTrESjBCg9LvfKU6T6OShEtCZogjes98bDq%2B%2FtpTQWuAiQhJe1bQfvCN%2Ffg5asNWeC0vuRIXQjEzGRM7fbWyqJ5%2Bn89O7ENkxXZiCsnNj8%2BbQgd28FUT8Abf2GlPA%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 8ddb0feb5949d294-FRA
expires: Mon, 19 May 2025 17:21:38 GMT
server-timing: cfL4;desc="?proto=TCP&rtt=9797&sent=204&recv=48&lost=0&retrans=0&sent_bytes=216595&recv_bytes=6229&delivery_rate=1587033&cwnd=253&unsent_bytes=0&cid=f2b55b8230be2271&ts=510&x=0"
date: Tue, 05 Nov 2024 07:17:06 GMT
content-type: application/javascript
last-modified: Sun, 19 May 2024 17:18:02 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 discourse-presence-a43bd7b3aa8d60242368b06762baf883047520450269be0bbd5491f6c14661c0.js Show response
malware.news/assets/plugins/ 11 KB
3 KB 66ms
14ms Script
application/javascript 2606:4700:20::681a:769
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://malware.news/assets/plugins/discourse-presence-a43bd7b3aa8d60242368b06762baf883047520450269be0bbd5491f6c14661c0.js
Requested by: Host: malware.news
URL: https://malware.news/t/cloudy-with-a-chance-of-rats-unveiling-apt36-and-the-evolution-of-elizarat/88085
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:769 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a43bd7b3aa8d60242368b06762baf883047520450269be0bbd5491f6c14661c0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://malware.news/t/cloudy-with-a-chance-of-rats-unveiling-apt36-and-the-evolution-of-elizarat/88085

Response headers

cache-control: public, max-age=31536000, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: HIT
age: 1776315
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cw2FW1eUlZmo%2F67CZ%2Fag70nJTwhTzNZj%2BDNjbecS1Zzo0Ezgnck3AjUALlMjjgDj1pUQLc4Op2Ei62JKGq049essJEvWCiNZFJwIAsvsMoobpvTKSrnnSRGI7uXlAGEEqCW%2BYZO9YnEnSA%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 8ddb0feb594bd294-FRA
expires: Mon, 19 May 2025 17:21:38 GMT
server-timing: cfL4;desc="?proto=TCP&rtt=10938&sent=167&recv=46&lost=0&retrans=0&sent_bytes=183122&recv_bytes=6229&delivery_rate=1587033&cwnd=253&unsent_bytes=0&cid=f2b55b8230be2271&ts=506&x=0"
date: Tue, 05 Nov 2024 07:17:06 GMT
content-type: application/javascript
last-modified: Sun, 19 May 2024 17:18:02 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 docker_manager_admin-b355b48ea8dc5f9252a78cf0a6b7210b0493676ee421a69a425d092b98c2cc51.js Show response
malware.news/assets/plugins/ 37 KB
8 KB 80ms
28ms Script
application/javascript 2606:4700:20::681a:769
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://malware.news/assets/plugins/docker_manager_admin-b355b48ea8dc5f9252a78cf0a6b7210b0493676ee421a69a425d092b98c2cc51.js
Requested by: Host: malware.news
URL: https://malware.news/t/cloudy-with-a-chance-of-rats-unveiling-apt36-and-the-evolution-of-elizarat/88085
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:769 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b355b48ea8dc5f9252a78cf0a6b7210b0493676ee421a69a425d092b98c2cc51

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://malware.news/t/cloudy-with-a-chance-of-rats-unveiling-apt36-and-the-evolution-of-elizarat/88085

Response headers

cache-control: public, max-age=31536000, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: HIT
age: 1776315
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TfOGzEB0bBig%2FupFmG9YRn3YDxfvltB6eHDCPUbP7W9V0sc3xOo6oN26nPeYR1VdqBtf9gBI52P%2F%2F1hZTKOsSJvovTA%2FINOhWPOEtjv2V9nTtmD5faYQTzIY4QBdh6Wwyt7pEWvxn%2FLmvg%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 8ddb0feb594dd294-FRA
expires: Mon, 19 May 2025 17:21:38 GMT
server-timing: cfL4;desc="?proto=TCP&rtt=10938&sent=159&recv=46&lost=0&retrans=0&sent_bytes=174909&recv_bytes=6229&delivery_rate=1587033&cwnd=253&unsent_bytes=0&cid=f2b55b8230be2271&ts=505&x=0"
date: Tue, 05 Nov 2024 07:17:06 GMT
content-type: application/javascript
last-modified: Sun, 19 May 2024 17:18:02 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 footnote-79e2a367b53b791240c3504826b87b2787c9d197d77cd422969d592aae9cf23b.js Show response
malware.news/assets/plugins/ 3 KB
2 KB 66ms
14ms Script
application/javascript 2606:4700:20::681a:769
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://malware.news/assets/plugins/footnote-79e2a367b53b791240c3504826b87b2787c9d197d77cd422969d592aae9cf23b.js
Requested by: Host: malware.news
URL: https://malware.news/t/cloudy-with-a-chance-of-rats-unveiling-apt36-and-the-evolution-of-elizarat/88085
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:769 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 79e2a367b53b791240c3504826b87b2787c9d197d77cd422969d592aae9cf23b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://malware.news/t/cloudy-with-a-chance-of-rats-unveiling-apt36-and-the-evolution-of-elizarat/88085

Response headers

cache-control: public, max-age=31536000, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: HIT
age: 1867355
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LHmhrY4myaUHhuyaeqsZeOyqM1RwhMCvfNezY7ht9UI8NSLSnlpLgJMl0cz5Cr2qCy3jF1Pu5esLiiJLe974ayraxgdAy0HitFTsgB%2FzyrUmDTII6mC8Aff38zM8sSYBwEf5YIztRp0dsw%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 8ddb0feb594fd294-FRA
expires: Mon, 19 May 2025 17:21:38 GMT
server-timing: cfL4;desc="?proto=TCP&rtt=10938&sent=197&recv=46&lost=0&retrans=0&sent_bytes=212069&recv_bytes=6229&delivery_rate=1587033&cwnd=253&unsent_bytes=0&cid=f2b55b8230be2271&ts=508&x=0"
date: Tue, 05 Nov 2024 07:17:06 GMT
content-type: application/javascript
last-modified: Sun, 19 May 2024 17:18:02 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 footnote_extra-295b457b90cb18fedfdb544868c494c71842a27c0781d3042fa4fd26589204fa.js Show response
malware.news/assets/plugins/ 6 KB
3 KB 66ms
14ms Script
application/javascript 2606:4700:20::681a:769
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://malware.news/assets/plugins/footnote_extra-295b457b90cb18fedfdb544868c494c71842a27c0781d3042fa4fd26589204fa.js
Requested by: Host: malware.news
URL: https://malware.news/t/cloudy-with-a-chance-of-rats-unveiling-apt36-and-the-evolution-of-elizarat/88085
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:769 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5d42ebdcddd972fdff22dca8398998a80ce50b0ec08915e8e8b9682a941b8651

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://malware.news/t/cloudy-with-a-chance-of-rats-unveiling-apt36-and-the-evolution-of-elizarat/88085

Response headers

cache-control: public, max-age=31536000, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: HIT
age: 1867355
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=53mTFgOkSZIJH0rl3xab%2FVA9orXsmqe6%2B0XTpWQoodVQETBK9d%2Fugv%2F%2FA3lco669PfjX360p%2BO%2BKYvbFONdrU9UxUg84ZR9nDvgIqTHkKNsYcFE28p3W5GNjAGQ7UjNMSm5pHjUC0c8lcA%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 8ddb0feb5950d294-FRA
expires: Mon, 12 May 2025 01:37:00 GMT
server-timing: cfL4;desc="?proto=TCP&rtt=9797&sent=200&recv=48&lost=0&retrans=0&sent_bytes=213772&recv_bytes=6229&delivery_rate=1587033&cwnd=253&unsent_bytes=0&cid=f2b55b8230be2271&ts=510&x=0"
date: Tue, 05 Nov 2024 07:17:06 GMT
content-type: application/javascript
last-modified: Sat, 09 Mar 2024 04:05:57 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 poll-ee978b42838e26d757251675c40fb0f62dff2f4081dc00fc4bb5492265f63b16.js Show response
malware.news/assets/plugins/ 62 KB
17 KB 124ms
72ms Script
application/javascript 2606:4700:20::681a:769
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://malware.news/assets/plugins/poll-ee978b42838e26d757251675c40fb0f62dff2f4081dc00fc4bb5492265f63b16.js
Requested by: Host: malware.news
URL: https://malware.news/t/cloudy-with-a-chance-of-rats-unveiling-apt36-and-the-evolution-of-elizarat/88085
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:769 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ee978b42838e26d757251675c40fb0f62dff2f4081dc00fc4bb5492265f63b16

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://malware.news/t/cloudy-with-a-chance-of-rats-unveiling-apt36-and-the-evolution-of-elizarat/88085

Response headers

cache-control: public, max-age=31536000, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: HIT
age: 1738537
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Iz%2FYy9OtDPCBMFAbP7aY7mbkOr44bazSIt%2Fr5PK0WaEgOyPErqqc2pS8oZyAxC5%2Byp0cFdnnZeobn13sltobnIMx8oSSHi6qNud9WrUGEd3tGCl10ggz7QcOENqOvNh1MnsNAzQdmjjcGA%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 8ddb0feb5951d294-FRA
expires: Mon, 19 May 2025 17:21:39 GMT
server-timing: cfL4;desc="?proto=TCP&rtt=8203&sent=261&recv=53&lost=0&retrans=0&sent_bytes=287528&recv_bytes=6229&delivery_rate=3151242&cwnd=253&unsent_bytes=51792&cid=f2b55b8230be2271&ts=512&x=0"
date: Tue, 05 Nov 2024 07:17:06 GMT
content-type: application/javascript
last-modified: Sun, 19 May 2024 17:18:03 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 spoiler-alert-77512c36f465902e7dbf3b8252c7cd6387edc9bf4ca804b79466212c1d1c843d.js Show response
malware.news/assets/plugins/ 3 KB
2 KB 65ms
13ms Script
application/javascript 2606:4700:20::681a:769
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://malware.news/assets/plugins/spoiler-alert-77512c36f465902e7dbf3b8252c7cd6387edc9bf4ca804b79466212c1d1c843d.js
Requested by: Host: malware.news
URL: https://malware.news/t/cloudy-with-a-chance-of-rats-unveiling-apt36-and-the-evolution-of-elizarat/88085
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:769 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 77512c36f465902e7dbf3b8252c7cd6387edc9bf4ca804b79466212c1d1c843d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://malware.news/t/cloudy-with-a-chance-of-rats-unveiling-apt36-and-the-evolution-of-elizarat/88085

Response headers

cache-control: public, max-age=31536000, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: HIT
age: 1776315
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zOJr6lzHpAgYGciTSDSviAJ6jpiWbQ1nzeV0eOqhBAuh1AptXpAeBOmHd%2Bxy1fU1i4ZEZksJXQx86PBWHB1rYDYIsTLYmfsRSm1KmNAsaHa5wSgNgVlToFEDAabbGpDlq%2BMosZgIBSqiyw%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 8ddb0feb5953d294-FRA
expires: Tue, 29 Apr 2025 17:27:28 GMT
server-timing: cfL4;desc="?proto=TCP&rtt=10938&sent=155&recv=46&lost=0&retrans=0&sent_bytes=172942&recv_bytes=6229&delivery_rate=1587033&cwnd=253&unsent_bytes=0&cid=f2b55b8230be2271&ts=505&x=0"
date: Tue, 05 Nov 2024 07:17:06 GMT
content-type: application/javascript
last-modified: Sat, 09 Mar 2024 04:05:23 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 en-666fe268c5c09740e19778d3756be4ffa4bfa22642e83a31cc7ee39923049ac7.js Show response
malware.news/assets/locales/ 348 KB
95 KB 124ms
73ms Script
application/javascript 2606:4700:20::681a:769
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://malware.news/assets/locales/en-666fe268c5c09740e19778d3756be4ffa4bfa22642e83a31cc7ee39923049ac7.js
Requested by: Host: malware.news
URL: https://malware.news/t/cloudy-with-a-chance-of-rats-unveiling-apt36-and-the-evolution-of-elizarat/88085
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:769 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c5ee33f26479a267cb93b664a5c2ff07e4f835e022e2fdbc5c8c23564b0dc292

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://malware.news/t/cloudy-with-a-chance-of-rats-unveiling-apt36-and-the-evolution-of-elizarat/88085

Response headers

cache-control: public, max-age=31536000, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: HIT
age: 1867355
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FyG%2B9jF%2BsGwa6akdPOuxmYEir0o7CkKNwssxroaF6N1R%2BSaVFZzIDG4kiROxm68LKwXlKfH5Kj%2FO96l7%2BgZ7l5MgmU5kDH6amZ4KAM2hCbAPZlKnKELI5orc9yvmreY3x0c7zQYO6cTV2A%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 8ddb0feb5954d294-FRA
expires: Mon, 19 May 2025 17:40:56 GMT
server-timing: cfL4;desc="?proto=TCP&rtt=7770&sent=261&recv=55&lost=0&retrans=0&sent_bytes=287528&recv_bytes=6229&delivery_rate=3833994&cwnd=253&unsent_bytes=51792&cid=f2b55b8230be2271&ts=513&x=0"
date: Tue, 05 Nov 2024 07:17:06 GMT
content-type: application/javascript
last-modified: Sun, 19 May 2024 17:36:59 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 267 KB
94 KB 142ms
16ms Script
application/javascript 2a00:1450:4001:830::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-SVDG4GL741

Requested by

Host: malware.news
URL: https://malware.news/t/cloudy-with-a-chance-of-rats-unveiling-apt36-and-the-evolution-of-elizarat/88085

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

22e279590f9dfe408b04174f52ccd94482b9e600292c833971ec5540833fd413

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://malware.news/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Tue, 05 Nov 2024 07:17:06 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 05 Nov 2024 07:17:06 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 95884
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 google-universal-analytics-v4-e154af4adb3c483a3aba7f9a7229b8881cdc5cf369290923d965a2ad30163ae8.js Show response
malware.news/assets/ 533 B
832 B 64ms
14ms Script
application/javascript 2606:4700:20::681a:769
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://malware.news/assets/google-universal-analytics-v4-e154af4adb3c483a3aba7f9a7229b8881cdc5cf369290923d965a2ad30163ae8.js
Requested by: Host: malware.news
URL: https://malware.news/t/cloudy-with-a-chance-of-rats-unveiling-apt36-and-the-evolution-of-elizarat/88085
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:769 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e154af4adb3c483a3aba7f9a7229b8881cdc5cf369290923d965a2ad30163ae8

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://malware.news/t/cloudy-with-a-chance-of-rats-unveiling-apt36-and-the-evolution-of-elizarat/88085

Response headers

cache-control: public, max-age=31536000, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: HIT
age: 1738537
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OWcC8ttUsKvIEpIg06RexkBYdmrQ98Kmv7wrws1N3r3O8P2efqdVgwrdY%2FcQqat4qU9IGll3z5CRRNhnDL5uprfHZHaX7k1nfvSi3XFJJEvnnYMn31x4ZdNo7vF7L7Dw%2FTgm%2FuiJkAy4IA%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 8ddb0feb5955d294-FRA
expires: Tue, 29 Apr 2025 14:41:33 GMT
server-timing: cfL4;desc="?proto=TCP&rtt=10938&sent=172&recv=46&lost=0&retrans=0&sent_bytes=186366&recv_bytes=6229&delivery_rate=1587033&cwnd=253&unsent_bytes=0&cid=f2b55b8230be2271&ts=507&x=0"
date: Tue, 05 Nov 2024 07:17:06 GMT
content-type: application/javascript
last-modified: Sat, 09 Mar 2024 04:04:58 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 color_definitions_base__2_4a8c937dd96730817e3ecfdfc23b856bce1e757d.css
malware.news/stylesheets/ 4 KB
2 KB 55ms
46ms Stylesheet
text/css 2606:4700:20::681a:769
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://malware.news/stylesheets/color_definitions_base__2_4a8c937dd96730817e3ecfdfc23b856bce1e757d.css?__ws=malware.news

Requested by

Host: malware.news
URL: https://malware.news/t/cloudy-with-a-chance-of-rats-unveiling-apt36-and-the-evolution-of-elizarat/88085

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:769 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c4e134f40c8c4baad557dbe3eb6869d8cf4a66462084170b4881a2aff6eca274

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://malware.news/t/cloudy-with-a-chance-of-rats-unveiling-apt36-and-the-evolution-of-elizarat/88085

Response headers

x-request-id: ec55d492-ec82-4a17-9160-650e9eb115b8
content-encoding: gzip
cf-cache-status: HIT
age: 1861941
x-permitted-cross-domain-policies: none
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Ktw%2BUBSgxelZpw0TkDWqvV2Zgk%2BS3uAwkzW9uv4a7KgdCJ1BkcyKdFr83jerLD54YSk0O0GgXq9auI84NP5beGA07iJwOMleuuqeianbb%2BUbcXyE0Ewad2CdwlUppMGIdY2uMKSfjtDtJQ%3D%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
server-timing: cfL4;desc="?proto=TCP&rtt=6723&sent=69&recv=24&lost=0&retrans=0&sent_bytes=74521&recv_bytes=4404&delivery_rate=829555&cwnd=253&unsent_bytes=31872&cid=f2b55b8230be2271&ts=448&x=0"
date: Tue, 05 Nov 2024 07:17:06 GMT
content-disposition: inline; filename="color_definitions_base__2_4a8c937dd96730817e3ecfdfc23b856bce1e757d.css"; filename*=UTF-8''color_definitions_base__2_4a8c937dd96730817e3ecfdfc23b856bce1e757d.css
content-type: text/css
vary: Accept-Encoding
last-modified: Sun, 19 May 2024 17:37:16 GMT
x-frame-options: SAMEORIGIN
cache-control: public, max-age=31556952, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cross-origin-opener-policy: same-origin-allow-popups
content-transfer-encoding: binary
referrer-policy: strict-origin-when-cross-origin
x-download-options: noopen
cf-ray: 8ddb0feb0877d294-FRA
x-discourse-route: stylesheets/show
x-xss-protection: 0
server: cloudflare

GET
H2 200 desktop_2867f57e66c2a9b74ab08f80de95e5a0436372fb.css
malware.news/stylesheets/ 661 KB
103 KB 38ms
30ms Stylesheet
text/css 2606:4700:20::681a:769
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://malware.news/stylesheets/desktop_2867f57e66c2a9b74ab08f80de95e5a0436372fb.css?__ws=malware.news

Requested by

Host: malware.news
URL: https://malware.news/t/cloudy-with-a-chance-of-rats-unveiling-apt36-and-the-evolution-of-elizarat/88085

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:769 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2fe258a6b3a482ce904aaa4d71aa8b276ac2d66289e56515adaa373ce73e6173

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://malware.news/t/cloudy-with-a-chance-of-rats-unveiling-apt36-and-the-evolution-of-elizarat/88085

Response headers

x-request-id: d5e0fb08-e9f8-4b92-9a16-00ade4ca5c82
content-encoding: gzip
cf-cache-status: HIT
age: 998666
x-permitted-cross-domain-policies: none
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=D6N0yIPQAV4m6toxvxgKnvFSAwW%2FvYIYYd4aaMgBiWHZ3%2FxmqiJq1YNucutBjrrEJJdCnMj7IddELL%2BUysNoIqF7ppOZb%2B8QkYAHrZSk26JSrtq5pvhFr14sVd1e3cNJVaXaiRfJ8Q1nCQ%3D%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
server-timing: cfL4;desc="?proto=TCP&rtt=6723&sent=16&recv=24&lost=0&retrans=0&sent_bytes=10393&recv_bytes=4404&delivery_rate=829555&cwnd=253&unsent_bytes=0&cid=f2b55b8230be2271&ts=448&x=0"
date: Tue, 05 Nov 2024 07:17:06 GMT
content-disposition: inline; filename="desktop_2867f57e66c2a9b74ab08f80de95e5a0436372fb.css"; filename*=UTF-8''desktop_2867f57e66c2a9b74ab08f80de95e5a0436372fb.css
content-type: text/css
vary: Accept-Encoding
last-modified: Sun, 19 May 2024 17:37:10 GMT
x-frame-options: SAMEORIGIN
cache-control: public, max-age=31556952, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cross-origin-opener-policy: same-origin-allow-popups
content-transfer-encoding: binary
referrer-policy: strict-origin-when-cross-origin
x-download-options: noopen
cf-ray: 8ddb0feb0878d294-FRA
x-discourse-route: stylesheets/show
x-xss-protection: 0
server: cloudflare

GET
H2 200 checklist_2867f57e66c2a9b74ab08f80de95e5a0436372fb.css
malware.news/stylesheets/ 5 KB
2 KB 51ms
43ms Stylesheet
text/css 2606:4700:20::681a:769
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://malware.news/stylesheets/checklist_2867f57e66c2a9b74ab08f80de95e5a0436372fb.css?__ws=malware.news

Requested by

Host: malware.news
URL: https://malware.news/t/cloudy-with-a-chance-of-rats-unveiling-apt36-and-the-evolution-of-elizarat/88085

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:769 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f0fbc7f61c0620a4ec824cc106951eff46d60cfd8eb8d8d490218463d2fd98cb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://malware.news/t/cloudy-with-a-chance-of-rats-unveiling-apt36-and-the-evolution-of-elizarat/88085

Response headers

x-request-id: 1a993d85-260b-47f0-9546-228b39271db1
content-encoding: gzip
cf-cache-status: HIT
age: 1776315
x-permitted-cross-domain-policies: none
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=n%2FKEkam11z%2FoZWCLwJu5ndcWGRboXV%2BoqS5xwhzkHg0mZOtJhCCJAJIuGg5YjTi87NFtxRSGf6P4802J9nstztpNYVEG2OkMwkCCMbLR2N%2BO1nUcNynfKXmAxyXosQQefqfnF4lamX4gCw%3D%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
server-timing: cfL4;desc="?proto=TCP&rtt=6723&sent=69&recv=24&lost=0&retrans=0&sent_bytes=74521&recv_bytes=4404&delivery_rate=829555&cwnd=253&unsent_bytes=31872&cid=f2b55b8230be2271&ts=448&x=0"
date: Tue, 05 Nov 2024 07:17:06 GMT
content-disposition: inline; filename="checklist_2867f57e66c2a9b74ab08f80de95e5a0436372fb.css"; filename*=UTF-8''checklist_2867f57e66c2a9b74ab08f80de95e5a0436372fb.css
content-type: text/css
vary: Accept-Encoding
last-modified: Sun, 19 May 2024 17:37:14 GMT
x-frame-options: SAMEORIGIN
cache-control: public, max-age=31556952, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cross-origin-opener-policy: same-origin-allow-popups
content-transfer-encoding: binary
referrer-policy: strict-origin-when-cross-origin
x-download-options: noopen
cf-ray: 8ddb0feb0879d294-FRA
x-discourse-route: stylesheets/show
x-xss-protection: 0
server: cloudflare

GET
H2 200 discourse-details_2867f57e66c2a9b74ab08f80de95e5a0436372fb.css
malware.news/stylesheets/ 3 KB
1 KB 53ms
45ms Stylesheet
text/css 2606:4700:20::681a:769
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://malware.news/stylesheets/discourse-details_2867f57e66c2a9b74ab08f80de95e5a0436372fb.css?__ws=malware.news

Requested by

Host: malware.news
URL: https://malware.news/t/cloudy-with-a-chance-of-rats-unveiling-apt36-and-the-evolution-of-elizarat/88085

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:769 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0998f98bd48342f12e7081dc237e6982e151d5f03cda0cf111da67e615b8ce9a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://malware.news/t/cloudy-with-a-chance-of-rats-unveiling-apt36-and-the-evolution-of-elizarat/88085

Response headers

x-request-id: 1534ccd9-ef9e-455b-8259-e75df474fb94
content-encoding: gzip
cf-cache-status: HIT
age: 1861941
x-permitted-cross-domain-policies: none
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Ay3F41TvHWtdNjJW44adRzhMK3jPECn1ZAqEJjP63%2BjLLX4QNqsULptOZRDTD2e39FA%2F00XMMx2mxDP9LyDq7stwqZsr695xTAI0QTyNBZ49dwm1Z%2BqlEx4zot6SDq5emOosZDjyrTnnSQ%3D%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
server-timing: cfL4;desc="?proto=TCP&rtt=6723&sent=69&recv=24&lost=0&retrans=0&sent_bytes=74521&recv_bytes=4404&delivery_rate=829555&cwnd=253&unsent_bytes=31872&cid=f2b55b8230be2271&ts=448&x=0"
date: Tue, 05 Nov 2024 07:17:06 GMT
content-disposition: inline; filename="discourse-details_2867f57e66c2a9b74ab08f80de95e5a0436372fb.css"; filename*=UTF-8''discourse-details_2867f57e66c2a9b74ab08f80de95e5a0436372fb.css
content-type: text/css
vary: Accept-Encoding
last-modified: Sun, 19 May 2024 17:37:14 GMT
x-frame-options: SAMEORIGIN
cache-control: public, max-age=31556952, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cross-origin-opener-policy: same-origin-allow-popups
content-transfer-encoding: binary
referrer-policy: strict-origin-when-cross-origin
x-download-options: noopen
cf-ray: 8ddb0feb087bd294-FRA
x-discourse-route: stylesheets/show
x-xss-protection: 0
server: cloudflare

GET
H2 200 discourse-lazy-videos_2867f57e66c2a9b74ab08f80de95e5a0436372fb.css
malware.news/stylesheets/ 7 KB
4 KB 51ms
44ms Stylesheet
text/css 2606:4700:20::681a:769
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://malware.news/stylesheets/discourse-lazy-videos_2867f57e66c2a9b74ab08f80de95e5a0436372fb.css?__ws=malware.news

Requested by

Host: malware.news
URL: https://malware.news/t/cloudy-with-a-chance-of-rats-unveiling-apt36-and-the-evolution-of-elizarat/88085

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:769 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

152760f614cc53fb6dd1c362d06c281a719e37ce1dec3636ffb90f33e2bb6131

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://malware.news/t/cloudy-with-a-chance-of-rats-unveiling-apt36-and-the-evolution-of-elizarat/88085

Response headers

x-request-id: f1c5df15-0a88-4aab-bd13-b20596d0831c
content-encoding: gzip
cf-cache-status: HIT
age: 138351
x-permitted-cross-domain-policies: none
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vG1EzRdfjFX8ycbW6slN1az%2FlZ2mD2t7CYVSr2UyPmyGPKrfQgx2aWpVKlstqBUal6tULWlx9Xopbp0CAS4VJx2U45Vq82%2FrBm4yEM0qOAVG2CnNZ%2B77JZqPAu5%2BkS2f47JuEI2nKvdGUQ%3D%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
server-timing: cfL4;desc="?proto=TCP&rtt=6723&sent=69&recv=24&lost=0&retrans=0&sent_bytes=74521&recv_bytes=4404&delivery_rate=829555&cwnd=253&unsent_bytes=31872&cid=f2b55b8230be2271&ts=449&x=0"
date: Tue, 05 Nov 2024 07:17:06 GMT
content-disposition: inline; filename="discourse-lazy-videos_2867f57e66c2a9b74ab08f80de95e5a0436372fb.css"; filename*=UTF-8''discourse-lazy-videos_2867f57e66c2a9b74ab08f80de95e5a0436372fb.css
content-type: text/css
vary: Accept-Encoding
last-modified: Sun, 19 May 2024 17:37:14 GMT
x-frame-options: SAMEORIGIN
cache-control: public, max-age=31556952, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cross-origin-opener-policy: same-origin-allow-popups
content-transfer-encoding: binary
referrer-policy: strict-origin-when-cross-origin
x-download-options: noopen
cf-ray: 8ddb0feb087cd294-FRA
x-discourse-route: stylesheets/show
x-xss-protection: 0
server: cloudflare

GET
H2 200 discourse-local-dates_2867f57e66c2a9b74ab08f80de95e5a0436372fb.css
malware.news/stylesheets/ 875 B
1 KB 52ms
44ms Stylesheet
text/css 2606:4700:20::681a:769
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://malware.news/stylesheets/discourse-local-dates_2867f57e66c2a9b74ab08f80de95e5a0436372fb.css?__ws=malware.news

Requested by

Host: malware.news
URL: https://malware.news/t/cloudy-with-a-chance-of-rats-unveiling-apt36-and-the-evolution-of-elizarat/88085

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:769 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a2b15f24ee32ae108d07a11757c4e120fb2c0384f3a842952432da1736158ce7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://malware.news/t/cloudy-with-a-chance-of-rats-unveiling-apt36-and-the-evolution-of-elizarat/88085

Response headers

x-request-id: fdb288da-5f3e-4e2b-ac1b-dee5aee94f6d
content-encoding: gzip
cf-cache-status: HIT
age: 1776315
x-permitted-cross-domain-policies: none
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yJTV0D%2Brz4xe%2BNhqmstq9a5OnuM4ZLn77DfsGOswFrhqRH%2BT6ZgYF946tKticxf40Fx5kTQwauxMQCj%2BW8UGQafYQad43rVj3HGaxlroW1pAhfJhmV2NNjW4zQRpFeaPq9fv%2FRfnOhGLvw%3D%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
server-timing: cfL4;desc="?proto=TCP&rtt=6723&sent=69&recv=24&lost=0&retrans=0&sent_bytes=74521&recv_bytes=4404&delivery_rate=829555&cwnd=253&unsent_bytes=31872&cid=f2b55b8230be2271&ts=449&x=0"
date: Tue, 05 Nov 2024 07:17:06 GMT
content-disposition: inline; filename="discourse-local-dates_2867f57e66c2a9b74ab08f80de95e5a0436372fb.css"; filename*=UTF-8''discourse-local-dates_2867f57e66c2a9b74ab08f80de95e5a0436372fb.css
content-type: text/css
vary: Accept-Encoding
last-modified: Sun, 19 May 2024 17:37:15 GMT
x-frame-options: SAMEORIGIN
cache-control: public, max-age=31556952, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cross-origin-opener-policy: same-origin-allow-popups
content-transfer-encoding: binary
referrer-policy: strict-origin-when-cross-origin
x-download-options: noopen
cf-ray: 8ddb0feb087fd294-FRA
x-discourse-route: stylesheets/show
x-xss-protection: 0
server: cloudflare

GET
H2 200 discourse-narrative-bot_2867f57e66c2a9b74ab08f80de95e5a0436372fb.css
malware.news/stylesheets/ 171 B
653 B 52ms
44ms Stylesheet
text/css 2606:4700:20::681a:769
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://malware.news/stylesheets/discourse-narrative-bot_2867f57e66c2a9b74ab08f80de95e5a0436372fb.css?__ws=malware.news

Requested by

Host: malware.news
URL: https://malware.news/t/cloudy-with-a-chance-of-rats-unveiling-apt36-and-the-evolution-of-elizarat/88085

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:769 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1c3dcd0afcea9a61171dd74c218ce2ba9bb686ae0e68c967ae4e75c8fdeb8687

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://malware.news/t/cloudy-with-a-chance-of-rats-unveiling-apt36-and-the-evolution-of-elizarat/88085

Response headers

x-request-id: 1569a4d0-d527-4f26-88b2-4831c34dbba7
content-encoding: gzip
cf-cache-status: HIT
age: 1861941
x-permitted-cross-domain-policies: none
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CbCaL2riRWz027Sp%2BQ537GzdFKtslmKpuNJ57CERXMQFPpvbzNnhD%2F6a9%2FW6CO4rkK8zBlT1qvXJewiH9%2Fi674veEY40G9Rgg%2BSfH44x%2BnfwcLFheec7JIBWQr2W%2Fa7UjvzjjggOkpaPlQ%3D%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
server-timing: cfL4;desc="?proto=TCP&rtt=6723&sent=69&recv=24&lost=0&retrans=0&sent_bytes=74521&recv_bytes=4404&delivery_rate=829555&cwnd=253&unsent_bytes=31872&cid=f2b55b8230be2271&ts=449&x=0"
date: Tue, 05 Nov 2024 07:17:06 GMT
content-disposition: inline; filename="discourse-narrative-bot_2867f57e66c2a9b74ab08f80de95e5a0436372fb.css"; filename*=UTF-8''discourse-narrative-bot_2867f57e66c2a9b74ab08f80de95e5a0436372fb.css
content-type: text/css
vary: Accept-Encoding
last-modified: Sun, 19 May 2024 17:37:15 GMT
x-frame-options: SAMEORIGIN
cache-control: public, max-age=31556952, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cross-origin-opener-policy: same-origin-allow-popups
content-transfer-encoding: binary
referrer-policy: strict-origin-when-cross-origin
x-download-options: noopen
cf-ray: 8ddb0feb0882d294-FRA
x-discourse-route: stylesheets/show
x-xss-protection: 0
server: cloudflare

GET
H2 200 discourse-presence_2867f57e66c2a9b74ab08f80de95e5a0436372fb.css
malware.news/stylesheets/ 1 KB
1 KB 51ms
45ms Stylesheet
text/css 2606:4700:20::681a:769
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://malware.news/stylesheets/discourse-presence_2867f57e66c2a9b74ab08f80de95e5a0436372fb.css?__ws=malware.news

Requested by

Host: malware.news
URL: https://malware.news/t/cloudy-with-a-chance-of-rats-unveiling-apt36-and-the-evolution-of-elizarat/88085

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:769 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a39db0af2b877ea2c5cccbc1420ef9533196f61a33e740d8ec2bb31126470856

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://malware.news/t/cloudy-with-a-chance-of-rats-unveiling-apt36-and-the-evolution-of-elizarat/88085

Response headers

x-request-id: 180573a8-0fd7-428c-88aa-a4821fca2709
content-encoding: gzip
cf-cache-status: HIT
age: 1776315
x-permitted-cross-domain-policies: none
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rG14rXsP4IFYQyZ2VwsWUiZpY%2BJQOxuqKyebPsG2%2BQvmVuUHSt%2Bj9hZ8e9b6s2jipu3vso%2F%2FjMj07lJVTZefXpM4wr7e9728%2BhGGTRKOHRkYpkge08k%2FmEqaddZTLyA2Z28VVefTnCv%2BUQ%3D%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
server-timing: cfL4;desc="?proto=TCP&rtt=6723&sent=69&recv=24&lost=0&retrans=0&sent_bytes=74521&recv_bytes=4404&delivery_rate=829555&cwnd=253&unsent_bytes=31872&cid=f2b55b8230be2271&ts=450&x=0"
date: Tue, 05 Nov 2024 07:17:06 GMT
content-disposition: inline; filename="discourse-presence_2867f57e66c2a9b74ab08f80de95e5a0436372fb.css"; filename*=UTF-8''discourse-presence_2867f57e66c2a9b74ab08f80de95e5a0436372fb.css
content-type: text/css
vary: Accept-Encoding
last-modified: Sun, 19 May 2024 17:37:15 GMT
x-frame-options: SAMEORIGIN
cache-control: public, max-age=31556952, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cross-origin-opener-policy: same-origin-allow-popups
content-transfer-encoding: binary
referrer-policy: strict-origin-when-cross-origin
x-download-options: noopen
cf-ray: 8ddb0feb0883d294-FRA
x-discourse-route: stylesheets/show
x-xss-protection: 0
server: cloudflare

GET
H2 200 docker_manager_2867f57e66c2a9b74ab08f80de95e5a0436372fb.css
malware.news/stylesheets/ 2 KB
1 KB 52ms
45ms Stylesheet
text/css 2606:4700:20::681a:769
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://malware.news/stylesheets/docker_manager_2867f57e66c2a9b74ab08f80de95e5a0436372fb.css?__ws=malware.news

Requested by

Host: malware.news
URL: https://malware.news/t/cloudy-with-a-chance-of-rats-unveiling-apt36-and-the-evolution-of-elizarat/88085

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:769 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

cb79726d8b50ade37e5ca0c5c82fc92eea9757c2e14e5f7feca1b80f7732048e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://malware.news/t/cloudy-with-a-chance-of-rats-unveiling-apt36-and-the-evolution-of-elizarat/88085

Response headers

x-request-id: 8e046a15-4c38-45b5-b003-5981d94f7bef
content-encoding: gzip
cf-cache-status: HIT
age: 1861941
x-permitted-cross-domain-policies: none
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0MghGWk%2FSkAhD1aEbjdJjDTKucf9oOVSTeetyybkkv1VRw8mUtR9vb%2B1ANbjWuLu0aQHyA7oZ%2F6C%2BjpvHcHVj%2F9hljY1ApHFrUTtTLOVknsEqehckA%2FOL7BR68gz%2FnkeE%2F1yKA75Hm9%2FuA%3D%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
server-timing: cfL4;desc="?proto=TCP&rtt=6723&sent=69&recv=24&lost=0&retrans=0&sent_bytes=74521&recv_bytes=4404&delivery_rate=829555&cwnd=253&unsent_bytes=31872&cid=f2b55b8230be2271&ts=451&x=0"
date: Tue, 05 Nov 2024 07:17:06 GMT
content-disposition: inline; filename="docker_manager_2867f57e66c2a9b74ab08f80de95e5a0436372fb.css"; filename*=UTF-8''docker_manager_2867f57e66c2a9b74ab08f80de95e5a0436372fb.css
content-type: text/css
vary: Accept-Encoding
last-modified: Sun, 19 May 2024 17:37:15 GMT
x-frame-options: SAMEORIGIN
cache-control: public, max-age=31556952, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cross-origin-opener-policy: same-origin-allow-popups
content-transfer-encoding: binary
referrer-policy: strict-origin-when-cross-origin
x-download-options: noopen
cf-ray: 8ddb0feb0884d294-FRA
x-discourse-route: stylesheets/show
x-xss-protection: 0
server: cloudflare

GET
H2 200 footnote_2867f57e66c2a9b74ab08f80de95e5a0436372fb.css
malware.news/stylesheets/ 2 KB
1 KB 52ms
45ms Stylesheet
text/css 2606:4700:20::681a:769
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://malware.news/stylesheets/footnote_2867f57e66c2a9b74ab08f80de95e5a0436372fb.css?__ws=malware.news

Requested by

Host: malware.news
URL: https://malware.news/t/cloudy-with-a-chance-of-rats-unveiling-apt36-and-the-evolution-of-elizarat/88085

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:769 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b795edfb1b2de13aba43932708e4148b0aa37971047c94fcded06dbe5a4f61ac

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://malware.news/t/cloudy-with-a-chance-of-rats-unveiling-apt36-and-the-evolution-of-elizarat/88085

Response headers

x-request-id: 0a14e6ff-3c2f-40eb-ac99-ff981b6824ea
content-encoding: gzip
cf-cache-status: HIT
age: 1738537
x-permitted-cross-domain-policies: none
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SfWJZOZfX03X3fiInhWVynLBFQxn7mrzog6Z8M9qvZFPIZ3IvSIMYvVaTqLY7tajaUOistufzZX70%2BWAsWthhJpzji1ONv3QwwnVQjQlFwU4O%2BZHJ50pZ31ceBdpdvCiVcz5bxMDQqOLvw%3D%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
server-timing: cfL4;desc="?proto=TCP&rtt=6723&sent=69&recv=24&lost=0&retrans=0&sent_bytes=74521&recv_bytes=4404&delivery_rate=829555&cwnd=253&unsent_bytes=31872&cid=f2b55b8230be2271&ts=451&x=0"
date: Tue, 05 Nov 2024 07:17:06 GMT
content-disposition: inline; filename="footnote_2867f57e66c2a9b74ab08f80de95e5a0436372fb.css"; filename*=UTF-8''footnote_2867f57e66c2a9b74ab08f80de95e5a0436372fb.css
content-type: text/css
vary: Accept-Encoding
last-modified: Sun, 19 May 2024 17:37:15 GMT
x-frame-options: SAMEORIGIN
cache-control: public, max-age=31556952, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cross-origin-opener-policy: same-origin-allow-popups
content-transfer-encoding: binary
referrer-policy: strict-origin-when-cross-origin
x-download-options: noopen
cf-ray: 8ddb0feb0886d294-FRA
x-discourse-route: stylesheets/show
x-xss-protection: 0
server: cloudflare

GET
H2 200 poll_2867f57e66c2a9b74ab08f80de95e5a0436372fb.css
malware.news/stylesheets/ 10 KB
3 KB 58ms
51ms Stylesheet
text/css 2606:4700:20::681a:769
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://malware.news/stylesheets/poll_2867f57e66c2a9b74ab08f80de95e5a0436372fb.css?__ws=malware.news

Requested by

Host: malware.news
URL: https://malware.news/t/cloudy-with-a-chance-of-rats-unveiling-apt36-and-the-evolution-of-elizarat/88085

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:769 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4ae4f4ee6f5299f646a880259e857f469f41fc0ae30cc568c94e81901dad49cd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://malware.news/t/cloudy-with-a-chance-of-rats-unveiling-apt36-and-the-evolution-of-elizarat/88085

Response headers

x-request-id: 1d474f2c-3dc1-441e-8712-b226c908560a
content-encoding: gzip
cf-cache-status: HIT
age: 1776315
x-permitted-cross-domain-policies: none
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CKIWKTWFGKyYegxumSlJ2FZkwkHhIsX4vBqHBvJqd%2FbmgAZhbct4pFHyrlvl7dwrzioSx0nRva1Xp%2FKCKUQgnfEZJq5MPYgDvrOpchSMhVgMcDvXoMolvt0aRjlw5Nqacm4eiKLQrEt8LA%3D%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
server-timing: cfL4;desc="?proto=TCP&rtt=6723&sent=69&recv=24&lost=0&retrans=0&sent_bytes=74521&recv_bytes=4404&delivery_rate=829555&cwnd=253&unsent_bytes=31872&cid=f2b55b8230be2271&ts=453&x=0"
date: Tue, 05 Nov 2024 07:17:06 GMT
content-disposition: inline; filename="poll_2867f57e66c2a9b74ab08f80de95e5a0436372fb.css"; filename*=UTF-8''poll_2867f57e66c2a9b74ab08f80de95e5a0436372fb.css
content-type: text/css
vary: Accept-Encoding
last-modified: Sun, 19 May 2024 17:37:15 GMT
x-frame-options: SAMEORIGIN
cache-control: public, max-age=31556952, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cross-origin-opener-policy: same-origin-allow-popups
content-transfer-encoding: binary
referrer-policy: strict-origin-when-cross-origin
x-download-options: noopen
cf-ray: 8ddb0feb088cd294-FRA
x-discourse-route: stylesheets/show
x-xss-protection: 0
server: cloudflare

GET
H2 200 spoiler-alert_2867f57e66c2a9b74ab08f80de95e5a0436372fb.css
malware.news/stylesheets/ 1 KB
1 KB 48ms
42ms Stylesheet
text/css 2606:4700:20::681a:769
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://malware.news/stylesheets/spoiler-alert_2867f57e66c2a9b74ab08f80de95e5a0436372fb.css?__ws=malware.news

Requested by

Host: malware.news
URL: https://malware.news/t/cloudy-with-a-chance-of-rats-unveiling-apt36-and-the-evolution-of-elizarat/88085

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:769 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1f1ad194fec669a7a9d1643b2e5aa0fc0d4c3566c0652e741f9b7667e687185d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://malware.news/t/cloudy-with-a-chance-of-rats-unveiling-apt36-and-the-evolution-of-elizarat/88085

Response headers

x-request-id: 1025a72b-c694-435b-ae6b-a3817b13fb2e
content-encoding: gzip
cf-cache-status: HIT
age: 1867358
x-permitted-cross-domain-policies: none
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GHwls9haftIAw8F%2FUCoHuHDh6LWdqlSkNC6Ek7NGVDwSwIkDDnfVGCfRJLIhhpQxhlLwh%2FUh1kk37lYm2Pb2js8M9PyBfQyCkZ9hEFErjTMXbnuhomzsAhOlAQD9sVs2FuWu%2B0zcpkzWhg%3D%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
server-timing: cfL4;desc="?proto=TCP&rtt=6723&sent=69&recv=24&lost=0&retrans=0&sent_bytes=74521&recv_bytes=4404&delivery_rate=829555&cwnd=253&unsent_bytes=31872&cid=f2b55b8230be2271&ts=456&x=0"
date: Tue, 05 Nov 2024 07:17:06 GMT
content-disposition: inline; filename="spoiler-alert_2867f57e66c2a9b74ab08f80de95e5a0436372fb.css"; filename*=UTF-8''spoiler-alert_2867f57e66c2a9b74ab08f80de95e5a0436372fb.css
content-type: text/css
vary: Accept-Encoding
last-modified: Sun, 19 May 2024 17:37:15 GMT
x-frame-options: SAMEORIGIN
cache-control: public, max-age=31556952, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cross-origin-opener-policy: same-origin-allow-popups
content-transfer-encoding: binary
referrer-policy: strict-origin-when-cross-origin
x-download-options: noopen
cf-ray: 8ddb0feb088fd294-FRA
x-discourse-route: stylesheets/show
x-xss-protection: 0
server: cloudflare

GET
H2 200 poll_desktop_2867f57e66c2a9b74ab08f80de95e5a0436372fb.css
malware.news/stylesheets/ 611 B
1 KB 52ms
46ms Stylesheet
text/css 2606:4700:20::681a:769
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://malware.news/stylesheets/poll_desktop_2867f57e66c2a9b74ab08f80de95e5a0436372fb.css?__ws=malware.news

Requested by

Host: malware.news
URL: https://malware.news/t/cloudy-with-a-chance-of-rats-unveiling-apt36-and-the-evolution-of-elizarat/88085

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:769 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

25f16c6ec5664d0694edfe491fb383a433ece0ea25917cf656e87d3867d5dd5d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://malware.news/t/cloudy-with-a-chance-of-rats-unveiling-apt36-and-the-evolution-of-elizarat/88085

Response headers

x-request-id: 6fe1b42b-501f-4ea8-a40f-423db8c4ee7f
content-encoding: gzip
cf-cache-status: HIT
age: 1860983
x-permitted-cross-domain-policies: none
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=94EmRd1CcMKXKFn59gAKwCr9LM9DdQBomkRxjYGBpY8ThT9ZMA37wu8p2%2B%2BTTNzXICT6ZGlYzkKX8SinrZ7e6c1QJ%2FgsMWIp%2FBAF1qpZ0hwGZRwLl1OqEHf3Kml%2F7dwUnC0I2cLohHfMHQ%3D%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
server-timing: cfL4;desc="?proto=TCP&rtt=6723&sent=69&recv=24&lost=0&retrans=0&sent_bytes=74521&recv_bytes=4404&delivery_rate=829555&cwnd=253&unsent_bytes=31872&cid=f2b55b8230be2271&ts=452&x=0"
date: Tue, 05 Nov 2024 07:17:06 GMT
content-disposition: inline; filename="poll_desktop_2867f57e66c2a9b74ab08f80de95e5a0436372fb.css"; filename*=UTF-8''poll_desktop_2867f57e66c2a9b74ab08f80de95e5a0436372fb.css
content-type: text/css
vary: Accept-Encoding
last-modified: Sun, 19 May 2024 17:37:15 GMT
x-frame-options: SAMEORIGIN
cache-control: public, max-age=31556952, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cross-origin-opener-policy: same-origin-allow-popups
content-transfer-encoding: binary
referrer-policy: strict-origin-when-cross-origin
x-download-options: noopen
cf-ray: 8ddb0feb0890d294-FRA
x-discourse-route: stylesheets/show
x-xss-protection: 0
server: cloudflare

GET
H2 200 desktop_theme_2_a38326017212e35af640b7285f440cd9f26f6eaa.css
malware.news/stylesheets/ 108 B
807 B 46ms
40ms Stylesheet
text/css 2606:4700:20::681a:769
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://malware.news/stylesheets/desktop_theme_2_a38326017212e35af640b7285f440cd9f26f6eaa.css?__ws=malware.news

Requested by

Host: malware.news
URL: https://malware.news/t/cloudy-with-a-chance-of-rats-unveiling-apt36-and-the-evolution-of-elizarat/88085

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:769 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b01475a1ed788124386bf51068464a0ea886a403c1b1e51e8a2cde722894a2c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://malware.news/t/cloudy-with-a-chance-of-rats-unveiling-apt36-and-the-evolution-of-elizarat/88085

Response headers

x-request-id: 2623e9a5-df6b-4bf4-ba65-70c12a647b5f
content-encoding: gzip
cf-cache-status: HIT
age: 1860983
x-permitted-cross-domain-policies: none
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=chvW4pvdGOsfAiVzV0Okv%2BqKvqghgM7hmOEMaaf125XGWOKJrF6jhVGdkqbk1fk%2BGIloae7AI0cZU8B1m%2BHTdT8KrVIGRVcVYDngKRl7F9T1wUNE4nPpQxAxzVwe%2BcH5jYdMUdc8f8iyQw%3D%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
server-timing: cfL4;desc="?proto=TCP&rtt=6723&sent=69&recv=24&lost=0&retrans=0&sent_bytes=74521&recv_bytes=4404&delivery_rate=829555&cwnd=253&unsent_bytes=31872&cid=f2b55b8230be2271&ts=455&x=0"
date: Tue, 05 Nov 2024 07:17:06 GMT
content-disposition: inline; filename="desktop_theme_2_a38326017212e35af640b7285f440cd9f26f6eaa.css"; filename*=UTF-8''desktop_theme_2_a38326017212e35af640b7285f440cd9f26f6eaa.css
content-type: text/css
vary: Accept-Encoding
last-modified: Sun, 19 May 2024 17:37:16 GMT
x-frame-options: SAMEORIGIN
cache-control: public, max-age=31556952, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cross-origin-opener-policy: same-origin-allow-popups
content-transfer-encoding: binary
referrer-policy: strict-origin-when-cross-origin
x-download-options: noopen
cf-ray: 8ddb0feb0891d294-FRA
x-discourse-route: stylesheets/show
x-xss-protection: 0
server: cloudflare

GET
DATA 200
OK truncated
/ 42 B
42 B Image
image/svg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/svg

GET
DATA 200
OK truncated
/ 3 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a0389bf2491388d6184b975a3a130c29fc1a9af8f29a4c9a3d0536a3da88e0f3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/svg+xml

GET
H2 200 svg-2-c1066beb12cc75cc4c3bc42f218f381c862e7905.js Show response
malware.news/svg-sprite/malware.news/ 143 KB
49 KB 17ms
16ms Script
application/javascript 2606:4700:20::681a:769
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://malware.news/svg-sprite/malware.news/svg-2-c1066beb12cc75cc4c3bc42f218f381c862e7905.js

Requested by

Host: malware.news
URL: https://malware.news/assets/chunk.6d6a6a17194d67289ef4.d41d8cd9.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:769 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8ce1934be1fa8520dcc9442317e483c1fc52cc241cc48c096c0d188cd327ae04

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://malware.news/t/cloudy-with-a-chance-of-rats-unveiling-apt36-and-the-evolution-of-elizarat/88085

Response headers

x-request-id: a1b55771-44c0-4a8f-aedb-1d6a2d2d6638
content-encoding: gzip
cf-cache-status: HIT
age: 1867355
x-permitted-cross-domain-policies: none
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QOaG%2BcAZDKHqkHGl%2BOGm%2Bw0gf203VeSZeY1pQAJOcEMCNcVTO5jECQnRFrDlWfxhc%2BQWDKlybKXHPLIltrXZ1hH0ZJ8gFKO0sl4W7c3WNiCqwEbX9RRz3qg9FdN3%2FktKY1lXEo2GrBpLyg%3D%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
server-timing: cfL4;desc="?proto=TCP&rtt=7861&sent=1902&recv=425&lost=0&retrans=74&sent_bytes=2386041&recv_bytes=6330&delivery_rate=41116886&cwnd=666&unsent_bytes=0&cid=f2b55b8230be2271&ts=1554&x=0"
date: Tue, 05 Nov 2024 07:17:07 GMT
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding, Accept
last-modified: Mon, 19 May 2014 17:24:04 GMT
x-frame-options: SAMEORIGIN
cache-control: public, max-age=31556952, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cross-origin-opener-policy: same-origin-allow-popups
referrer-policy: strict-origin-when-cross-origin
x-download-options: noopen
cf-ray: 8ddb0ff1ed4cd294-FRA
x-discourse-route: svg_sprite/show
x-xss-protection: 0
server: cloudflare

GET
H2 200 ba8ee0a927a69022c651441ac23d01bcdbc09785.png
malware.news/uploads/default/original/3X/b/a/ 9 KB
9 KB 15ms
15ms Image
image/png 2606:4700:20::681a:769
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://malware.news/uploads/default/original/3X/b/a/ba8ee0a927a69022c651441ac23d01bcdbc09785.png
Requested by: Host: malware.news
URL: https://malware.news/t/cloudy-with-a-chance-of-rats-unveiling-apt36-and-the-evolution-of-elizarat/88085
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:769 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 041dc75fa9294876d29e6d78e76c9f7f3202f1763480da93d6ce2414d0a095c3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://malware.news/t/cloudy-with-a-chance-of-rats-unveiling-apt36-and-the-evolution-of-elizarat/88085

Response headers

cf-cache-status: HIT
age: 1738537
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gcosmhw%2FP%2FLaUCF%2BlGita1Oe1l7K3%2F0MXmO5JGolb9r9T65hdchx3ue10f2sV1N1OSVghmcltk7RM0MIkgK4gmWr0i2wfj0kTcvc2fyPlqJk%2FOXIqR8t6NQn9TwWFq2DSEYfDbapyMse%2FA%3D%3D"}],"group":"cf-nel","max_age":604800}
expires: Wed, 03 Sep 2025 05:48:43 GMT
server-timing: cfL4;desc="?proto=TCP&rtt=12274&sent=1945&recv=449&lost=0&retrans=74&sent_bytes=2437500&recv_bytes=6695&delivery_rate=41116886&cwnd=666&unsent_bytes=0&cid=f2b55b8230be2271&ts=1835&x=0"
date: Tue, 05 Nov 2024 07:17:07 GMT
content-type: image/png
last-modified: Sat, 22 Dec 2018 04:38:37 GMT
vary: Accept-Encoding
cache-control: max-age=31536000
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 8ddb0ff3a86cd294-FRA
accept-ranges: bytes
access-control-allow-origin: *
content-length: 8758
server: cloudflare

GET
H2 200 24_2.png
malware.news/user_avatar/malware.news/malbot/48/ 3 KB
3 KB 16ms
15ms Image
image/jpeg 2606:4700:20::681a:769
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://malware.news/user_avatar/malware.news/malbot/48/24_2.png

Requested by

Host: malware.news
URL: https://malware.news/t/cloudy-with-a-chance-of-rats-unveiling-apt36-and-the-evolution-of-elizarat/88085

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:769 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

acb53c4533765bc5dc1225c4850964ddb2ed637a7a1cf420c446a08104085da8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://malware.news/t/cloudy-with-a-chance-of-rats-unveiling-apt36-and-the-evolution-of-elizarat/88085

Response headers

cf-bgj: h2pri
cf-cache-status: HIT
age: 1858099
x-permitted-cross-domain-policies: none
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=95pyW02swFqK%2F%2FANRP8GHIuOEs4fqZjS9jXVaoWNTLS9zTfYRh%2Bvj3UtiqTTrRqTzOsSvyp%2Bso9D6MOtMn6svPCbcUysUf5rqJNZ%2BouXJFHDnweBTIY%2Fg2JRldiq0bd%2FOBa4lTplw9ZM6w%3D%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
server-timing: cfL4;desc="?proto=TCP&rtt=7882&sent=1954&recv=459&lost=0&retrans=74&sent_bytes=2446852&recv_bytes=6777&delivery_rate=41116886&cwnd=666&unsent_bytes=0&cid=f2b55b8230be2271&ts=1949&x=0"
date: Tue, 05 Nov 2024 07:17:07 GMT
content-type: image/jpeg
last-modified: Sat, 09 Mar 2024 04:15:49 GMT
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
cache-control: public, max-age=31556952, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-transfer-encoding: binary
referrer-policy: strict-origin-when-cross-origin
x-download-options: noopen
cf-ray: 8ddb0ff469f4d294-FRA
accept-ranges: bytes
content-length: 2626
x-discourse-route: user_avatars/show
x-xss-protection: 0
server: cloudflare

GET
H2 200 UNR56TU4OV-image1.png
research.checkpoint.com/wp-content/uploads/2024/10/ 22 KB
23 KB 279ms
30ms Image
image/webp 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://research.checkpoint.com/wp-content/uploads/2024/10/UNR56TU4OV-image1.png
Requested by: Host: malware.news
URL: https://malware.news/t/cloudy-with-a-chance-of-rats-unveiling-apt36-and-the-evolution-of-elizarat/88085
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: c785b08bf3402eccdd15b3ab2b76cac69a0357c8b31e52bb74fbfe52d06d94ca

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://malware.news/

Response headers

cf-bgj: imgq:100,h2pri
etag: "670b88f1-b4b5"
age: 63120
cf-cache-status: HIT
cf-polished: origFmt=png, origSize=46261
alt-svc: h3=":443"; ma=86400
date: Tue, 05 Nov 2024 07:17:08 GMT
content-type: image/webp
content-disposition: inline; filename="UNR56TU4OV-image1.webp"
vary: Accept
last-modified: Sun, 13 Oct 2024 08:46:41 GMT
cache-control: public, max-age=31536000
cf-ray: 8ddb0ff5ffe49747-FRA
accept-ranges: bytes
access-control-allow-origin: *
content-length: 22922
server: cloudflare

POST
H2 204 collect
region1.analytics.google.com/g/ 0
0 93ms
15ms Fetch
text/plain 2001:4860:4802:32::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.analytics.google.com/g/collect?v=2&tid=G-SVDG4GL741&gtm=45je4au0v9121104881za200&_p=1730791027400&_gaz=1&gcd=13l3l3l2l1l1&npa=1&dma_cps=syphamo&dma=1&tag_exp=101823848~101878899~101878944~101925629&cid=492575934.1730791028&ecid=747549078&ul=de-de&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&dl=%2Ft%2Fcloudy-with-a-chance-of-rats-unveiling-apt36-and-the-evolution-of-elizarat%2F88085&dt=Cloudy%20With%20a%20Chance%20of%20RATs%3A%20Unveiling%20APT36%20and%20the%20Evolution%20of%20ElizaRAT%20-%20Malware%20Analysis%20-%20Malware%20Analysis%2C%20News%20and%20Indicators&sid=1730791028&sct=1&seg=0&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&ep.autoLinkConfig=%5Bobject%20Object%5D&tfd=2309
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-SVDG4GL741
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://malware.news/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:136:0
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:136:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://malware.news
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 05 Nov 2024 07:17:08 GMT
content-type: text/plain
server: Golfe2

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
552 B 97ms
17ms Ping
text/plain 2a00:1450:400c:c09::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-SVDG4GL741&cid=492575934.1730791028&gtm=45je4au0v9121104881za200&aip=1&dma=1&dma_cps=syphamo&gcd=13l3l3l2l1l1&npa=1&frm=0&tag_exp=101823848~101878899~101878944~101925629
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-SVDG4GL741
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:400c:c09::9b Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://malware.news/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:111:0
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:111:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://malware.news
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 05 Nov 2024 07:17:08 GMT
content-type: text/plain
server: Golfe2

GET
H3 200 ga-audiences
www.google.de/ads/ 42 B
63 B 101ms
31ms Image
image/gif 2a00:1450:4001:80e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-SVDG4GL741&cid=492575934.1730791028&gtm=45je4au0v9121104881za200&aip=1&dma=1&dma_cps=syphamo&gcd=13l3l3l2l1l1&npa=1&frm=0&tag_exp=101823848~101878899~101878944~101925629&tag_exp=101823848~101878899~101878944~101925629&z=37196903

Requested by

Host: malware.news
URL: https://malware.news/t/cloudy-with-a-chance-of-rats-unveiling-apt36-and-the-evolution-of-elizarat/88085

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://malware.news/

Response headers

cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Tue, 05 Nov 2024 07:17:08 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
DATA 200
OK truncated
/ 3 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1ad09817976c24d9eab6f4fc788740fc5db93bda522227a4f18f324bb38adf11

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/svg+xml

GET
H2 200 a0086c91da850eb004fb4af82117ab347b9e272a_2_32x32.png
malware.news/uploads/default/optimized/3X/a/0/ 2 KB
2 KB 14ms
13ms Other
image/png 2606:4700:20::681a:769
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://malware.news/uploads/default/optimized/3X/a/0/a0086c91da850eb004fb4af82117ab347b9e272a_2_32x32.png
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:769 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c7afa12ce5701916349284e884f7fddcf56832f30d041982b6f9a484b64084f5

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://malware.news/t/cloudy-with-a-chance-of-rats-unveiling-apt36-and-the-evolution-of-elizarat/88085

Response headers

cf-cache-status: HIT
age: 1861941
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Wx%2F6IaXz6K8MAylW3pKFefDAA0R3vO5Lh5PhKaG0pVbp%2Fcck9kmsnPSFnFdS5FxDeNeG3DT5dix2NtU%2BU9d8awY%2BkEYkcHm46M5DudmRG%2FjY%2B2ymT6NgpornU43JJxYQk%2FzCSGqTPemvjw%3D%3D"}],"group":"cf-nel","max_age":604800}
expires: Sun, 09 Mar 2025 04:07:40 GMT
server-timing: cfL4;desc="?proto=TCP&rtt=7894&sent=1959&recv=465&lost=0&retrans=74&sent_bytes=2450164&recv_bytes=6966&delivery_rate=41116886&cwnd=666&unsent_bytes=0&cid=f2b55b8230be2271&ts=2422&x=0"
date: Tue, 05 Nov 2024 07:17:08 GMT
content-type: image/png
last-modified: Sat, 01 Jun 2019 22:43:41 GMT
vary: Accept-Encoding
cache-control: max-age=31536000
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 8ddb0ff75f44d294-FRA
accept-ranges: bytes
access-control-allow-origin: *
content-length: 1851
server: cloudflare

POST
H2 200 poll
malware.news/message-bus/c733d8b3167543fbad410a4ed4d1945e/ 267 B
0 316ms
302ms XHR
text/plain 2606:4700:20::681a:769
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://malware.news/message-bus/c733d8b3167543fbad410a4ed4d1945e/poll

Requested by

Host: malware.news
URL: https://malware.news/assets/chunk.6d6a6a17194d67289ef4.d41d8cd9.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:769 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Discourse-Deferred-Track-View: true
X-CSRF-Token: undefined
Referer: https://malware.news/t/cloudy-with-a-chance-of-rats-unveiling-apt36-and-the-evolution-of-elizarat/88085
X-SILENCE-LOGGER: true
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Accept: text/plain, */*; q=0.01
Discourse-Present: true
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

access-control-max-age: 7200
content-encoding: br
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1701JImwpfEN94%2FuT7uNahaHdMYTPbztwj05DnaX%2F9ngobpDuOg7jFaTdnlLgOi7o03BczdM02vpJJYueGpoP6MMCIQic%2Bv21EuRfG%2F0qgOzOmp2vn6zvbjfDInTvhhLhqar48jC6x7i0Q%3D%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-methods: GET, POST
x-content-type-options: nosniff
expires: 0
server-timing: cfL4;desc="?proto=TCP&rtt=7163&sent=1964&recv=471&lost=0&retrans=74&sent_bytes=2452587&recv_bytes=7531&delivery_rate=41116886&cwnd=666&unsent_bytes=0&cid=f2b55b8230be2271&ts=2850&x=0"
date: Tue, 05 Nov 2024 07:17:08 GMT
content-type: text/plain; charset=utf-8
access-control-allow-headers: X-SILENCE-LOGGER, X-Shared-Session-Key, Dont-Chunk, Discourse-Present, Discourse-Deferred-Track-View
cache-control: must-revalidate, private, max-age=0
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
cf-ray: 8ddb0ff828a5d294-FRA
access-control-allow-origin: https://malware.news
server: cloudflare

Verdicts & Comments Add Verdict or Comment

30 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.malware.news/	1970-01-21 10:22:31	Name: _ga_SVDG4GL741 Value: GS1.1.1730791028.1.0.1730791028.60.0.747549078
			.malware.news/	1970-01-21 10:22:31	Name: _ga Value: GA1.1.492575934.1730791028

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	error	URL: https://malware.news/t/cloudy-with-a-chance-of-rats-unveiling-apt36-and-the-evolution-of-elizarat/88085 Message: The Content Security Policy directive 'upgrade-insecure-requests' is ignored when delivered in a report-only policy.
recommendation	verbose	URL: https://malware.news/t/cloudy-with-a-chance-of-rats-unveiling-apt36-and-the-evolution-of-elizarat/88085 Message: [DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	upgrade-insecure-requests; base-uri 'self'; object-src 'none'; script-src 'nonce-QTDIRKwuqrWbS7lOuakOzwLkK' 'strict-dynamic'; frame-ancestors 'self'; manifest-src 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

malware.news
region1.analytics.google.com
research.checkpoint.com
stats.g.doubleclick.net
www.google.de
www.googletagmanager.com
141.193.213.20
2001:4860:4802:32::36
2606:4700:20::681a:769
2a00:1450:4001:80e::2003
2a00:1450:4001:830::2008
2a00:1450:400c:c09::9b
041dc75fa9294876d29e6d78e76c9f7f3202f1763480da93d6ce2414d0a095c3
0998f98bd48342f12e7081dc237e6982e151d5f03cda0cf111da67e615b8ce9a
0b5ddfb3a605aeed9ff478a225e8062861424d523836d7256e2b75489bf20cdf
152760f614cc53fb6dd1c362d06c281a719e37ce1dec3636ffb90f33e2bb6131
1ad09817976c24d9eab6f4fc788740fc5db93bda522227a4f18f324bb38adf11
1c3dcd0afcea9a61171dd74c218ce2ba9bb686ae0e68c967ae4e75c8fdeb8687
1f1ad194fec669a7a9d1643b2e5aa0fc0d4c3566c0652e741f9b7667e687185d
22e279590f9dfe408b04174f52ccd94482b9e600292c833971ec5540833fd413
25f16c6ec5664d0694edfe491fb383a433ece0ea25917cf656e87d3867d5dd5d
2fe258a6b3a482ce904aaa4d71aa8b276ac2d66289e56515adaa373ce73e6173
48148ec534a4c5e9614302186b345123ba1358787c41bc31cbd17231f794fe42
4ae4f4ee6f5299f646a880259e857f469f41fc0ae30cc568c94e81901dad49cd
5566fc85873915364c34914ef9efda42cca8e77faad713da08a9d3d8e8677943
55813a5bacc3c99fda0b099a80401f124870fa9b510ced078af32f8a82364461
5d42ebdcddd972fdff22dca8398998a80ce50b0ec08915e8e8b9682a941b8651
608f4f77d8437d715d8d39c739c0c8bbe0fe51c9305e55f1ec7d0bee19f5571f
77512c36f465902e7dbf3b8252c7cd6387edc9bf4ca804b79466212c1d1c843d
79e2a367b53b791240c3504826b87b2787c9d197d77cd422969d592aae9cf23b
823b91992054aeb8ca1e4921c7a3ae7f9fae09ef838946f3b261ab5a6ad776ee
8ce1934be1fa8520dcc9442317e483c1fc52cc241cc48c096c0d188cd327ae04
9070f07226d022f68c06506e046ae33f8fe725302ff53955cd3d483f2fc47ff6
99f42f91bffa8ca1606d62b70bb92f981d83921e78ccdbd3d9538f07007f27ac
a0389bf2491388d6184b975a3a130c29fc1a9af8f29a4c9a3d0536a3da88e0f3
a2b15f24ee32ae108d07a11757c4e120fb2c0384f3a842952432da1736158ce7
a39db0af2b877ea2c5cccbc1420ef9533196f61a33e740d8ec2bb31126470856
a43bd7b3aa8d60242368b06762baf883047520450269be0bbd5491f6c14661c0
acb53c4533765bc5dc1225c4850964ddb2ed637a7a1cf420c446a08104085da8
b01475a1ed788124386bf51068464a0ea886a403c1b1e51e8a2cde722894a2c1
b355b48ea8dc5f9252a78cf0a6b7210b0493676ee421a69a425d092b98c2cc51
b570d9bc41345f0e8c87714b72c214d41d95014be8308081e609d074844d28f1
b795edfb1b2de13aba43932708e4148b0aa37971047c94fcded06dbe5a4f61ac
bdf1486acc96b228a2163490640a2bdc90f5e0a1bb1949335fd1fde2ad48795c
c4e134f40c8c4baad557dbe3eb6869d8cf4a66462084170b4881a2aff6eca274
c524a8995f2f0cbcea43353efe8e8f269da821ea97c21ef0f04df5fcd916170a
c5ee33f26479a267cb93b664a5c2ff07e4f835e022e2fdbc5c8c23564b0dc292
c785b08bf3402eccdd15b3ab2b76cac69a0357c8b31e52bb74fbfe52d06d94ca
c7afa12ce5701916349284e884f7fddcf56832f30d041982b6f9a484b64084f5
cb79726d8b50ade37e5ca0c5c82fc92eea9757c2e14e5f7feca1b80f7732048e
e154af4adb3c483a3aba7f9a7229b8881cdc5cf369290923d965a2ad30163ae8
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ee978b42838e26d757251675c40fb0f62dff2f4081dc00fc4bb5492265f63b16
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f0fbc7f61c0620a4ec824cc106951eff46d60cfd8eb8d8d490218463d2fd98cb

malware.news Open in urlscan Pro 2606:4700:20::681a:769 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

43 Requests

100 %HTTPS

83 %IPv6

6 Domains

6 Subdomains

7 IPs

3 Countries

2408 kBTransfer

14913 kBSize

2 Cookies

6 Outgoing links

Redirected requests

43 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 3 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

malware.news Open in urlscan Pro
2606:4700:20::681a:769 Public Scan

Screenshot
Live screenshot

Full Image

43
Requests

100 %
HTTPS

83 %
IPv6

6
Domains

6
Subdomains

7
IPs

3
Countries

2408 kB
Transfer

14913 kB
Size

2
Cookies

43 HTTP transactions
3 data transactions