URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
Submission: On August 07 via api from DE — Scanned from DE

Summary

This website contacted 47 IPs in 3 countries across 37 domains to perform 153 HTTP transactions. The main IP is 2606:2c40::c73c:671f, located in United States and belongs to CLOUDFLARESPECTRUM Cloudflare, Inc., US. The main domain is www.reversinglabs.com.
TLS certificate: Issued by GTS CA 1P5 on July 24th 2023. Valid for: 3 months.
This is the only time www.reversinglabs.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
63 2606:2c40::c7... 209242 (CLOUDFLAR...)
1 151.101.193.181 54113 (FASTLY)
1 2620:1ec:46::60 8075 (MICROSOFT...)
1 2606:4700::68... 13335 (CLOUDFLAR...)
11 2606:4700::68... 13335 (CLOUDFLAR...)
1 2606:4700::68... 13335 (CLOUDFLAR...)
1 2606:4700::68... 13335 (CLOUDFLAR...)
1 2a06:98c1:312... 13335 (CLOUDFLAR...)
1 65.9.99.119 16509 (AMAZON-02)
2 2a00:1450:400... 15169 (GOOGLE)
1 52.222.139.19 16509 (AMAZON-02)
4 2a00:1450:400... 15169 (GOOGLE)
4 2a03:2880:f08... 32934 (FACEBOOK)
1 65.9.95.27 16509 (AMAZON-02)
2 2a00:1450:400... 15169 (GOOGLE)
1 2a02:26f0:350... 20940 (AKAMAI-ASN1)
1 2a04:4e42:400... 54113 (FASTLY)
1 2600:9000:223... 16509 (AMAZON-02)
1 52.21.20.174 14618 (AMAZON-AES)
3 2a03:2880:f17... 32934 (FACEBOOK)
5 2a00:1450:400... 15169 (GOOGLE)
1 2606:4700::68... 13335 (CLOUDFLAR...)
2 2606:2800:234... 15133 (EDGECAST)
1 151.101.65.140 54113 (FASTLY)
2 2600:9000:212... 16509 (AMAZON-02)
4 4 2620:1ec:21::14 8068 (MICROSOFT...)
1 13.107.42.14 8068 (MICROSOFT...)
1 2a00:1450:400... 15169 (GOOGLE)
6 2001:4860:480... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
1 2606:4700::68... 13335 (CLOUDFLAR...)
1 2606:4700::68... 13335 (CLOUDFLAR...)
2 2606:4700::68... 13335 (CLOUDFLAR...)
1 2606:4700::68... 13335 (CLOUDFLAR...)
1 2606:4700::68... 13335 (CLOUDFLAR...)
1 2606:4700::68... 13335 (CLOUDFLAR...)
4 2606:4700::68... 13335 (CLOUDFLAR...)
9 2.20.143.57 20940 (AKAMAI-ASN1)
2 2606:4700::68... 13335 (CLOUDFLAR...)
1 2a00:1450:400... 15169 (GOOGLE)
1 2606:4700::68... 13335 (CLOUDFLAR...)
1 2606:4700::68... 13335 (CLOUDFLAR...)
1 2a02:26f0:480... 20940 (AKAMAI-ASN1)
1 104.244.42.72 13414 (TWITTER)
1 52.223.40.198 16509 (AMAZON-02)
1 2606:4700::68... 13335 (CLOUDFLAR...)
153 47
Apex Domain
Subdomains
Transfer
63 reversinglabs.com
www.reversinglabs.com
2 MB
11 hubspotusercontent-na1.net
3375217.fs1.hubspotusercontent-na1.net
256 KB
10 6sc.co
j.6sc.co — Cisco Umbrella Rank: 5439
c.6sc.co — Cisco Umbrella Rank: 8622
ipv6.6sc.co — Cisco Umbrella Rank: 5612
b.6sc.co — Cisco Umbrella Rank: 3549
18 KB
6 google.com
region1.analytics.google.com — Cisco Umbrella Rank: 2577
www.google.com — Cisco Umbrella Rank: 3
929 B
6 linkedin.com
platform.linkedin.com — Cisco Umbrella Rank: 3010
px.ads.linkedin.com — Cisco Umbrella Rank: 391
www.linkedin.com — Cisco Umbrella Rank: 539
px4.ads.linkedin.com — Cisco Umbrella Rank: 6039
166 KB
5 hubspot.com
app.hubspot.com — Cisco Umbrella Rank: 5177
track.hubspot.com — Cisco Umbrella Rank: 2254
forms.hubspot.com — Cisco Umbrella Rank: 4396
4 KB
5 gstatic.com
fonts.gstatic.com
80 KB
4 facebook.net
connect.facebook.net — Cisco Umbrella Rank: 170
221 KB
4 googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 73
361 KB
3 hsforms.com
forms.hsforms.com — Cisco Umbrella Rank: 4156
forms-na1.hsforms.com — Cisco Umbrella Rank: 6801
3 KB
3 twitter.com
platform.twitter.com — Cisco Umbrella Rank: 1003
syndication.twitter.com — Cisco Umbrella Rank: 1212
132 KB
3 facebook.com
www.facebook.com — Cisco Umbrella Rank: 107
292 B
3 google-analytics.com
www.google-analytics.com — Cisco Umbrella Rank: 55
region1.google-analytics.com — Cisco Umbrella Rank: 1869
21 KB
2 hscollectedforms.net
js.hscollectedforms.net — Cisco Umbrella Rank: 4645
forms.hscollectedforms.net — Cisco Umbrella Rank: 4755
26 KB
2 google.de
www.google.de — Cisco Umbrella Rank: 5576
562 B
2 doubleclick.net
googleads.g.doubleclick.net — Cisco Umbrella Rank: 54
stats.g.doubleclick.net — Cisco Umbrella Rank: 115
2 KB
2 oribi.io
cdn.linkedin.oribi.io — Cisco Umbrella Rank: 870
753 B
2 hotjar.com
static.hotjar.com — Cisco Umbrella Rank: 745
script.hotjar.com — Cisco Umbrella Rank: 967
59 KB
2 googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 77
2 KB
2 adsrvr.org
js.adsrvr.org — Cisco Umbrella Rank: 1375
insight.adsrvr.org — Cisco Umbrella Rank: 604
3 KB
1 hubapi.com
api.hubapi.com — Cisco Umbrella Rank: 3473
1 KB
1 hsadspixel.net
js.hsadspixel.net — Cisco Umbrella Rank: 3228
3 KB
1 hs-banner.com
js.hs-banner.com — Cisco Umbrella Rank: 2192
16 KB
1 usemessages.com
js.usemessages.com — Cisco Umbrella Rank: 4789
22 KB
1 hs-analytics.net
js.hs-analytics.net — Cisco Umbrella Rank: 2187
21 KB
1 hsleadflows.net
js.hsleadflows.net — Cisco Umbrella Rank: 4274
86 KB
1 reddit.com
alb.reddit.com — Cisco Umbrella Rank: 1468
637 B
1 zoominfo.com
ws.zoominfo.com — Cisco Umbrella Rank: 4388
2 KB
1 quora.com
q.quora.com — Cisco Umbrella Rank: 3965
416 B
1 metadata.io
cdn.metadata.io — Cisco Umbrella Rank: 33170
2 KB
1 redditstatic.com
www.redditstatic.com — Cisco Umbrella Rank: 1326
8 KB
1 licdn.com
snap.licdn.com — Cisco Umbrella Rank: 783
5 KB
1 cookieinfoscript.com
cookieinfoscript.com — Cisco Umbrella Rank: 90872
4 KB
1 hsappstatic.net
static.hsappstatic.net — Cisco Umbrella Rank: 5423
5 KB
1 cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 257
27 KB
1 hubspot.net
cdn2.hubspot.net — Cisco Umbrella Rank: 7970
2 KB
1 vidyard.com
play.vidyard.com — Cisco Umbrella Rank: 12467
23 KB
153 37
Domain Requested by
63 www.reversinglabs.com www.reversinglabs.com
js.usemessages.com
11 3375217.fs1.hubspotusercontent-na1.net www.reversinglabs.com
7 b.6sc.co www.reversinglabs.com
5 region1.analytics.google.com www.googletagmanager.com
5 fonts.gstatic.com fonts.googleapis.com
4 connect.facebook.net www.reversinglabs.com
connect.facebook.net
4 www.googletagmanager.com www.reversinglabs.com
www.googletagmanager.com
www.google-analytics.com
js.hsadspixel.net
3 track.hubspot.com
3 px.ads.linkedin.com 3 redirects
3 www.facebook.com www.reversinglabs.com
2 forms.hsforms.com www.reversinglabs.com
2 www.google.de www.reversinglabs.com
2 cdn.linkedin.oribi.io snap.licdn.com
2 platform.twitter.com www.reversinglabs.com
platform.twitter.com
2 www.google-analytics.com www.googletagmanager.com
www.google-analytics.com
2 fonts.googleapis.com www.reversinglabs.com
1 forms.hubspot.com js.hsleadflows.net
1 insight.adsrvr.org js.adsrvr.org
1 syndication.twitter.com platform.twitter.com
1 region1.google-analytics.com www.googletagmanager.com
1 ipv6.6sc.co j.6sc.co
1 c.6sc.co j.6sc.co
1 forms.hscollectedforms.net js.hscollectedforms.net
1 api.hubapi.com js.hsadspixel.net
1 forms-na1.hsforms.com www.reversinglabs.com
1 www.google.com www.reversinglabs.com
1 j.6sc.co www.reversinglabs.com
1 app.hubspot.com www.reversinglabs.com
1 js.hsadspixel.net www.reversinglabs.com
1 js.hs-banner.com www.reversinglabs.com
1 js.usemessages.com www.reversinglabs.com
1 js.hscollectedforms.net www.reversinglabs.com
1 js.hs-analytics.net www.reversinglabs.com
1 js.hsleadflows.net www.reversinglabs.com
1 stats.g.doubleclick.net www.googletagmanager.com
1 googleads.g.doubleclick.net www.googletagmanager.com
1 px4.ads.linkedin.com www.reversinglabs.com
1 www.linkedin.com 1 redirects
1 alb.reddit.com www.reversinglabs.com
1 ws.zoominfo.com www.reversinglabs.com
1 q.quora.com www.reversinglabs.com
1 cdn.metadata.io www.reversinglabs.com
1 www.redditstatic.com www.googletagmanager.com
1 snap.licdn.com www.googletagmanager.com
1 script.hotjar.com static.hotjar.com
1 static.hotjar.com www.reversinglabs.com
1 js.adsrvr.org www.reversinglabs.com
1 cookieinfoscript.com www.reversinglabs.com
1 static.hsappstatic.net www.reversinglabs.com
1 cdnjs.cloudflare.com www.reversinglabs.com
1 cdn2.hubspot.net www.reversinglabs.com
1 platform.linkedin.com www.reversinglabs.com
1 play.vidyard.com www.reversinglabs.com
153 53
Subject Issuer Validity Valid
www.reversinglabs.com
GTS CA 1P5
2023-07-24 -
2023-10-22
3 months crt.sh
*.vidyard.com
GlobalSign Atlas R3 DV TLS CA 2023 Q2
2023-07-01 -
2024-08-01
a year crt.sh
platform.linkedin.com
DigiCert SHA2 Secure Server CA
2023-07-24 -
2024-01-24
6 months crt.sh
hubspot.net
Cloudflare Inc ECC CA-3
2023-04-06 -
2024-04-05
a year crt.sh
hubspotusercontent-na1.net
Cloudflare Inc ECC CA-3
2023-01-26 -
2024-01-25
a year crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3
2023-07-03 -
2024-07-02
a year crt.sh
hsappstatic.net
Cloudflare Inc ECC CA-3
2023-04-10 -
2024-04-09
a year crt.sh
cookieinfoscript.com
E1
2023-06-14 -
2023-09-12
3 months crt.sh
*.adsrvr.org
GlobalSign GCC R3 DV TLS CA 2020
2023-04-12 -
2024-05-13
a year crt.sh
upload.video.google.com
GTS CA 1C3
2023-07-10 -
2023-10-02
3 months crt.sh
*.hotjar.com
Amazon ECDSA 256 M01
2023-03-09 -
2024-04-06
a year crt.sh
*.google-analytics.com
GTS CA 1C3
2023-07-10 -
2023-10-02
3 months crt.sh
*.facebook.com
DigiCert SHA2 High Assurance Server CA
2023-05-16 -
2023-08-14
3 months crt.sh
snap.licdn.com
DigiCert SHA2 Secure Server CA
2023-02-01 -
2024-01-31
a year crt.sh
www.redditstatic.com
DigiCert Global G2 TLS RSA SHA256 2020 CA1
2023-04-12 -
2023-10-08
6 months crt.sh
*.metadata.io
DigiCert TLS Hybrid ECC SHA384 2020 CA1
2023-01-18 -
2024-01-07
a year crt.sh
*.quora.com
R3
2023-07-12 -
2023-10-10
3 months crt.sh
*.gstatic.com
GTS CA 1C3
2023-07-10 -
2023-10-02
3 months crt.sh
zoominfo.com
Cloudflare Inc ECC CA-3
2023-04-04 -
2024-04-03
a year crt.sh
*.twimg.com
DigiCert Global G2 TLS RSA SHA256 2020 CA1
2023-07-28 -
2024-07-26
a year crt.sh
*.reddit.com
DigiCert TLS RSA SHA256 2020 CA1
2023-04-19 -
2023-10-15
6 months crt.sh
linkedin.oribi.io
Amazon RSA 2048 M01
2023-06-08 -
2024-07-07
a year crt.sh
*.g.doubleclick.net
GTS CA 1C3
2023-07-10 -
2023-10-02
3 months crt.sh
www.google.de
GTS CA 1C3
2023-07-10 -
2023-10-02
3 months crt.sh
hubspot.com
Cloudflare Inc ECC CA-3
2023-02-05 -
2024-02-05
a year crt.sh
6sc.co
R3
2023-05-25 -
2023-08-23
3 months crt.sh
www.google.com
GTS CA 1C3
2023-07-10 -
2023-10-02
3 months crt.sh
hubapi.com
Cloudflare Inc ECC CA-3
2023-04-07 -
2024-04-06
a year crt.sh
syndication.twitter.com
DigiCert TLS Hybrid ECC SHA384 2020 CA1
2023-02-05 -
2024-02-05
a year crt.sh

This page contains 4 frames:

Primary Page: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
Frame ID: C596BAB34D7237150A222FF3C9A67CAD
Requests: 150 HTTP requests in this frame

Frame: https://platform.twitter.com/widgets/widget_iframe.2b2d73daf636805223fb11d48f3e94f7.html?origin=https%3A%2F%2Fwww.reversinglabs.com
Frame ID: 69C47AE982DEC37C01219F8F5609F95E
Requests: 2 HTTP requests in this frame

Frame: https://www.facebook.com/tr/
Frame ID: 1F5B7BE431AE6EEBEAF59D5C62C53818
Requests: 1 HTTP requests in this frame

Frame: https://insight.adsrvr.org/track/up?adv=7qhctws&ref=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fvmconnect-malicious-pypi-packages-imitate-popular-open-source-modules&upid=8t4axvj&upv=1.1.0
Frame ID: B503A63258F7C5A47507409401478078
Requests: 1 HTTP requests in this frame

Screenshot

Page Title

VMConnect: Malicious PyPI packages imitate popular open source modules

Detected technologies

Overall confidence: 100%
Detected patterns
  • //connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Overall confidence: 100%
Detected patterns
  • google-analytics\.com/(?:ga|urchin|analytics)\.js

Overall confidence: 100%
Detected patterns
  • googletagmanager\.com/gtm\.js
  • googletagmanager\.com/gtag/js

Overall confidence: 100%
Detected patterns
  • //static\.hotjar\.com/

Overall confidence: 100%
Detected patterns
  • js\.hs-analytics\.net/analytics

Overall confidence: 100%
Detected patterns
  • lightbox(?:-plus-jquery)?.{0,32}\.js

Overall confidence: 100%
Detected patterns
  • //platform\.linkedin\.com/in\.js

Overall confidence: 100%
Detected patterns
  • snap\.licdn\.com/li\.lms-analytics/insight\.min\.js

Overall confidence: 100%
Detected patterns
  • //platform\.twitter\.com/widgets\.js

Overall confidence: 100%
Detected patterns
  • /([\d.]+)/jquery(?:\.min)?\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

153
Requests

99 %
HTTPS

79 %
IPv6

37
Domains

53
Subdomains

47
IPs

3
Countries

3554 kB
Transfer

7225 kB
Size

35
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 103
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=976924&time=1691412132965&url=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fvmconnect-malicious-pypi-packages-imitate-popular-open-source-modules&tm=gtmv2 HTTP 302
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=976924&time=1691412132965&url=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fvmconnect-malicious-pypi-packages-imitate-popular-open-source-modules&tm=gtmv2&cookiesTest=true HTTP 302
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D976924%26time%3D1691412132965%26url%3Dhttps%253A%252F%252Fwww.reversinglabs.com%252Fblog%252Fvmconnect-malicious-pypi-packages-imitate-popular-open-source-modules%26tm%3Dgtmv2%26cookiesTest%3Dtrue%26liSync%3Dtrue HTTP 302
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=976924&time=1691412132965&url=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fvmconnect-malicious-pypi-packages-imitate-popular-open-source-modules&tm=gtmv2&cookiesTest=true&liSync=true HTTP 302
  • https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=976924&time=1691412132965&url=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fvmconnect-malicious-pypi-packages-imitate-popular-open-source-modules&tm=gtmv2&cookiesTest=true&liSync=true&e_ipv6=AQK05CInJCtmcAAAAYnQBPcKxn7ADY69RZnY-B9KABehK8wqFgmBIWUDtPibD2v1

153 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
www.reversinglabs.com/blog/
133 KB
28 KB
Document
General
Full URL
https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
d58fcc9b037c7817d2d7565a677f19616b2ca13d2575df0a2c82f4ad60b0ec87
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=31536000

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400
cache-control
no-store, no-cache, must-revalidate
cf-ray
7f2f991dd95d1c28-FRA
content-encoding
br
content-security-policy
upgrade-insecure-requests
content-type
text/html; charset=UTF-8
date
Mon, 07 Aug 2023 12:42:11 GMT
edge-cache-tag
CT-128190968732,CG-3375217,CG-5901382633,P-3375217,L-11118979719,L-11735000539,CW-103636562700,CW-10782554896,CW-11119297579,CW-11395370497,CW-114796045952,CW-115016303498,CW-115021731904,CW-11538883136,CW-23776629869,CW-23799638916,CW-28186900061,CW-36845096476,CW-6520974104,CW-79001037452,CW-80857835930,CW-80864562095,CW-80864563080,CW-80868056874,CW-87757605656,E-10528761402,E-10777459487,E-11119463588,E-11190015046,E-11395370929,E-11395383304,E-11708570900,E-21052151416,E-23712622487,E-28203361861,E-38216899954,E-5951651806,E-6021532803,E-6021916068,E-6519964395,E-70521421874,PGS-ALL,SW-1,B-112999115134,B-5901382633,B-70179327783,B-94488163452,GC-103819429689,GC-115009898400,GC-115015365221,GC-115020232564,GC-25875947801,GC-25876057703,GC-26129507391,GC-28186555742,GC-80858624881,GC-80970810765,GC-80971492144,GC-81200326231,GC-87768577627
etag
W/"fc65ff0bb81ce00ae84caf0244109953"
last-modified
Sun, 06 Aug 2023 04:05:31 GMT
link
</hs/hsstatic/HubspotToolsMenu/static-1.191/js/index.js>; rel=preload; as=script,</hs/hsstatic/cos-i18n/static-1.53/bundles/project.js>; rel=preload; as=script,</_hcms/forms/v2.js>; rel=preload; as=script
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
referrer-policy
no-referrer-when-downgrade
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gc%2Fm%2F4%2BGRkbz5XvAjkiOaGG2BTtYlj5DjiA0o9OmgOm4QMqQ%2B%2Fq4Jf%2F6qGBBYdn3ZRM6YfVjHy%2B6KFFTcvixsTiiDBSpyQB1u8W9sGgOv%2F6WqsvhvvPecItR0ETwyJB%2F%2BqbRP1L9zj%2F2pzMS8pt2DFKKZA%3D%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
strict-transport-security
max-age=31536000
vary
Accept-Encoding
x-hs-cache-config
BrowserCache-5s-EdgeCache-0s
x-hs-cache-control
s-maxage=10800, max-age=0
x-hs-cf-cache-status
HIT
x-hs-content-id
128190968732
x-hs-https-only
worker
x-hs-hub-id
3375217
x-hs-prerendered
Sun, 06 Aug 2023 04:05:31 GMT
index.js
www.reversinglabs.com/hs/hsstatic/HubspotToolsMenu/static-1.191/js/
11 KB
5 KB
Script
General
Full URL
https://www.reversinglabs.com/hs/hsstatic/HubspotToolsMenu/static-1.191/js/index.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
fd5e0c3a0682f03217f201588e51e77bf778d5506224074918f505423f0e25a2
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Mon, 07 Aug 2023 12:42:11 GMT
strict-transport-security
max-age=31536000
via
1.1 a355d8f903a0cf5525893c863fcdf216.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
content-security-policy
upgrade-insecure-requests
age
9321420
x-amz-cf-pop
CDG52-P4
x-amz-server-side-encryption
AES256
x-amz-version-id
inhS2tX2f2C4tITR3p2haS.uhsvA9eGz
content-encoding
br
x-cache
Hit from cloudfront
x-amz-replication-status
COMPLETED
x-hs-https-only
worker
alt-svc
h3=":443"; ma=86400
last-modified
Fri, 21 Apr 2023 15:17:56 GMT
server
cloudflare
etag
W/"0bbd63c0750f141fd5cec04a9393647e"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JcOcK8NtNKfsAe6fa68Bja5l75TgiJWji4DxT82pRB6VHntGfCegEX9fQ5oIVQ24vYObmXyjbn2mTWPlyyDv6WSO8fTWKHf9ZUFivLfb7YETxWIiufn4Sbx%2B64pl7mBCNwsBwrEheSOrs8zVLczojWnM1Q%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
public, max-age=31536000
cf-ray
7f2f991e29cb1c28-FRA
x-amz-cf-id
TYHgsp09grVKpYA9dxiozj2UAW4tlG6PoALJeeeJ-H2x7PoACqsm6Q==
expires
Tue, 06 Aug 2024 12:42:11 GMT
project.js
www.reversinglabs.com/hs/hsstatic/cos-i18n/static-1.53/bundles/
1 KB
1 KB
Script
General
Full URL
https://www.reversinglabs.com/hs/hsstatic/cos-i18n/static-1.53/bundles/project.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
8da927b6b1240ffca4323fbb2a12c8e5abb541040965c2bc5b7d09a2eb963b02
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Mon, 07 Aug 2023 12:42:11 GMT
strict-transport-security
max-age=31536000
via
1.1 84294257ed643a88ee54d2e3f7d7ccea.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
content-security-policy
upgrade-insecure-requests
age
8754847
x-amz-cf-pop
FRA56-P2
x-amz-server-side-encryption
AES256
x-amz-version-id
P9ES7sOpFzrLl1QoRwjEAy5outPo5_GO
content-encoding
br
x-cache
Hit from cloudfront
x-amz-replication-status
COMPLETED
x-hs-https-only
worker
alt-svc
h3=":443"; ma=86400
last-modified
Tue, 09 Nov 2021 16:12:42 GMT
server
cloudflare
etag
W/"61ca66de658cab9587e4636894680d5d"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VCFcBxDrgGm5aERHD1MtF3%2F8oq%2BiiTsnwZfPd8xiRbWhp%2BnDbaqxqTL4r3UFvB3aWMV0jUVGVCGf7tOWut61HepvI16XSyoR5%2B1%2FozS%2FHTDtbl%2FJgzzIz%2FdEgwy%2B6aCoqS3n2ED27kiLZNxzOp%2BUQ0c3NQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
public, max-age=31536000
cf-ray
7f2f991e29cd1c28-FRA
x-amz-cf-id
npDRtHLjVqh8zeihJtuF2gyuTq3Qaqk2QrNbNCcHimg8EpZG5wWqkA==
expires
Tue, 06 Aug 2024 12:42:11 GMT
v2.js
www.reversinglabs.com/_hcms/forms/
526 KB
172 KB
Script
General
Full URL
https://www.reversinglabs.com/_hcms/forms/v2.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
3dcf5ab0268e05f2e26960055d40e37a5ec0cb225dcc9da43f52967710cea56b
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

content-security-policy
upgrade-insecure-requests
content-encoding
br
age
580
x-evy-trace-route-service-name
envoyset-translator
x-amz-server-side-encryption
AES256
content-security-policy-report-only
frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=forms-embed/static-1.3512/bundles/project-v2.js&cfRay=7f2f8af561cdbb3d-FRA
x-amz-replication-status
COMPLETED
x-hs-https-only
worker
x-evy-trace-listener
listener_https
etag
W/"c93e66dd60926c55c794dc765ffe6c1a"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
x-evy-trace-virtual-host
all
cache-control
s-maxage=600, max-age=300
x-hs-target-asset
forms-embed/static-1.3512/bundles/project-v2.js
date
Mon, 07 Aug 2023 12:42:11 GMT
strict-transport-security
max-age=31536000
via
1.1 16d910967d343c8da7828222a653755e.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-content-type-options
nosniff
x-amz-version-id
ti0_iiw7PITtrft.AIEOPeRnP3ag2uRE
x-amz-cf-pop
IAD12-P3
x-hubspot-correlation-id
dec5384c-b5ca-4068-b1cc-15b54e882cfe
x-cache
Hit from cloudfront
cache-tag
staticjsapp-forms-embed-v2-web-prod,staticjsapp-prod
x-envoy-upstream-service-time
2
alt-svc
h3=":443"; ma=86400
x-evy-trace-route-configuration
listener_https/all
x-request-id
dec5384c-b5ca-4068-b1cc-15b54e882cfe
last-modified
Tue, 01 Aug 2023 10:17:49 UTC
server
cloudflare
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=64nb0daKV87NZm3bPq3Zk7jLDTJVFHUSzjcJF%2BN53P4F4nchlbE70pZDb6T%2F3Z5DBbSYVFh1X0UCIADuY8IfVUSmBBUcnZ30VGHUzBqIl1qK7J1%2FTWN7Sa5g3vAVvfRTtXpRgENJixt%2FK5KYWPVGtv5FkQ%3D%3D"}],"group":"cf-nel","max_age":604800}
x-hs-cache-status
HIT
x-evy-trace-served-by-pod
iad02/app-td/envoy-proxy-57ff77fcd-xjmf2
cf-ray
7f2f991e29ce1c28-FRA
x-amz-cf-id
aofsfeMJOUDLSPY9pCEun2b78Vb7LrDzMCSqsZU48hrDfWY7B2qv5g==
stickybar.min.css
www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/38216899954/1683495050466/Modules/StickyBar/
4 KB
2 KB
Stylesheet
General
Full URL
https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/38216899954/1683495050466/Modules/StickyBar/stickybar.min.css
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
a9ff889aa2badd5dcf9989574fa2006fb183febc1685353d19bf1dd28ed7c1b2
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

content-security-policy
upgrade-insecure-requests
content-encoding
br
age
446
x-amz-request-id
A1EP1F3CR54NCV7Q
x-amz-server-side-encryption
AES256
x-evy-trace-route-service-name
envoyset-translator
x-amz-replication-status
COMPLETED
x-hs-https-only
worker
x-hs-cf-lambda
us-east-1.enforceAclForReadsProd 20
x-evy-trace-listener
listener_https
etag
W/"424627ea38e47986af8095e0d67d40e2"
vary
origin, Accept-Encoding
x-amz-meta-created-unix-time-millis
1683495051068
content-type
text/css
x-evy-trace-virtual-host
all
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-hs-cf-lambda-enforce
us-east-1.enforceAclForReadsProd 20
date
Mon, 07 Aug 2023 12:42:11 GMT
strict-transport-security
max-age=31536000
via
1.1 814e6200dbb5865e94b7b0c1ba6129fe.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id
jgLYEQ4EOqvxpqZTyxVIjrm84TepXoQY
x-amz-cf-pop
IAD89-C1
x-hs-alternate-content-type
text/plain
x-cache
RefreshHit from cloudfront
x-amz-storage-class
INTELLIGENT_TIERING
x-envoy-upstream-service-time
114
alt-svc
h3=":443"; ma=86400
x-amz-id-2
Lc6djJd1ckKCs+aBHkYMonVKhz1sxjFxH09hsCTMR2phNMdXw4mGMkPvk2JbdJkNU/5N8So/Jf8=
x-evy-trace-route-configuration
listener_https/all
x-request-id
2adbc651-67b9-4ddb-8b5e-19f4d1a74cbf
last-modified
Sun, 07 May 2023 21:30:52 GMT
server
cloudflare
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8fdk4MXQwf4y9JgYVMl6HJgLlbYJfHZi73Z0vyq0dVGKkrf0CLlyXfeeBTsWAI5j2OI%2BhtEO4xBINUQwhw9GIY0x9W3R8XXmsd4y762D%2FSCRSMPeDlF4SXJPD1z3eCbgEau0ypEjXGv4ax%2B4fzThX4ax3w%3D%3D"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod
iad02/cms-hubfs-td/envoy-proxy-55b7d448b-hlzsf
access-control-allow-credentials
false
cf-ray
7f2f991e29d81c28-FRA
x-amz-cf-id
Xe60HxEZc2yldg7dFlLAwerCj3PHyAGkt5L1BTEeWIilFZDlnvsUIw==
site-menu.min.css
www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/11119463588/1690214555806/Redesign_june_2019/Coded_Files/CSS/Components/
6 KB
2 KB
Stylesheet
General
Full URL
https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/11119463588/1690214555806/Redesign_june_2019/Coded_Files/CSS/Components/site-menu.min.css
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
eb8d8c2427fab53f2c4d0c70d9661c7d33d995e486cdb923b0c6d65b6b4fef19
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

content-security-policy
upgrade-insecure-requests
content-encoding
br
age
446
x-amz-request-id
ZNCGH859ZJ43QA1Y
x-amz-server-side-encryption
AES256
x-evy-trace-route-service-name
envoyset-translator
x-amz-replication-status
COMPLETED
x-hs-https-only
worker
x-hs-cf-lambda
us-east-1.EnforceAclForReads 2
x-evy-trace-listener
listener_https
etag
W/"eb32609c5026ffac513b3e81d68d3ded"
vary
origin, Accept-Encoding
x-amz-meta-created-unix-time-millis
1690214556506
content-type
text/css
x-evy-trace-virtual-host
all
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-hs-cf-lambda-enforce
us-east-1.EnforceAclForReads 2
date
Mon, 07 Aug 2023 12:42:11 GMT
strict-transport-security
max-age=31536000
via
1.1 b4346add631a498bf6cdbf88cbc5ff12.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id
GKLmHl3sCXmnSkwVBkhk10OG72nsj2BC
x-amz-cf-pop
IAD89-C1
x-hs-alternate-content-type
text/plain
x-hubspot-correlation-id
850b9dc4-e94f-44ab-8f9e-453a59548e6b
x-cache
RefreshHit from cloudfront
x-amz-storage-class
INTELLIGENT_TIERING
x-envoy-upstream-service-time
212
alt-svc
h3=":443"; ma=86400
x-amz-id-2
/RHDl8GKbOMBQsxfj8mZiFKJA25WzIa+5TvSVN7jHCsJ2bFGQJEVov6/9S/i2vvam53kcXHxbVo=
x-evy-trace-route-configuration
listener_https/all
x-request-id
850b9dc4-e94f-44ab-8f9e-453a59548e6b
last-modified
Mon, 24 Jul 2023 16:02:37 GMT
server
cloudflare
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qkiW%2B0Th03ezPMv4oP4V3MVbye0YGDzyUY%2BVQ0tztg16De1HaJkCI2mvb4FY6Se7NGUknbGyPnQbJHl9rehxj32H3jvuZ%2BzYP9ECoFnYki3418o%2F4qDuHFs9ht%2FuuT1Z72Y0HlrJ%2BEiDvy8wbNkU6NJeMg%3D%3D"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod
iad02/cms-hubfs-td/envoy-proxy-fd8f7bc74-mxtb7
access-control-allow-credentials
false
cf-ray
7f2f991e39dd1c28-FRA
x-amz-cf-id
PDTq2iw3fKj-4YIkxpy39-MMuABvHOd6G1A8JrEeVYXLht5g0YONTA==
micromodal.min.css
www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/11395383304/1628866683496/Redesign_june_2019/Coded_Files/CSS/Components/
4 KB
2 KB
Stylesheet
General
Full URL
https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/11395383304/1628866683496/Redesign_june_2019/Coded_Files/CSS/Components/micromodal.min.css
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
9e634b615e771259a6dc723ef2cda097c480ad26dc92faa6450c5e4e16e3288a
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Mon, 07 Aug 2023 12:42:11 GMT
strict-transport-security
max-age=31536000
via
1.1 aa6e16f47d6a0519f52b8dcfca2d841a.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
content-security-policy
upgrade-insecure-requests
age
446
x-amz-cf-pop
IAD89-P1
x-amz-server-side-encryption
AES256
x-amz-request-id
2YS7J1XDFTRMGGVY
x-hs-alternate-content-type
text/plain
x-cache
Miss from cloudfront
x-amz-version-id
e3VxwMWpNWQvL0ZQahFb1P28o.8Kjgu5
content-encoding
br
x-amz-replication-status
COMPLETED
x-hs-https-only
worker
x-hs-cf-lambda
us-east-1.enforceAclForReadsProd 15
alt-svc
h3=":443"; ma=86400
x-amz-id-2
nz1mOdCCQju0kYhIrRsgASldTGuIaEddI1UPSlHxkgDFTj0XP9C41a2DrMFo0TT5JHQ/55iE6hA=
last-modified
Fri, 13 Aug 2021 14:58:04 GMT
server
cloudflare
etag
W/"20c2f66e9f10bed15056fd6b975b8a75"
vary
origin, Accept-Encoding
x-amz-meta-created-unix-time-millis
1628866683533
content-type
text/css
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=wz7cgLPLx05qk4NMuWuDi6J82xIw8toYtWrD78uPQLYYIGoNLRyDGhtwGLNpO7N%2BTAQvrVNIcsH1vxcJyjEOh%2BVVyuPD8rUuy5cG0BnNB%2BmLOX%2BkFKR3JSrHz%2FUjnnrDav2fzNspM9XcLtkzOOyhzRjE0Q%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900, s-maxage=31536000, max-age=31536000
access-control-allow-credentials
false
cf-ray
7f2f991e39e01c28-FRA
x-amz-cf-id
2-IU40prcFtbX0JqzoEuY1N3dTR8BB10tPvrumPAv3CT_d3C7hDKag==
x-hs-cf-lambda-enforce
us-east-1.enforceAclForReadsProd 15
module_11395370497_Redesign_june_2019_Custom_Modules_Site_Search_Input_-_Header_Modal.min.css
www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/module_assets/1563505647497/
610 B
1007 B
Stylesheet
General
Full URL
https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/module_assets/1563505647497/module_11395370497_Redesign_june_2019_Custom_Modules_Site_Search_Input_-_Header_Modal.min.css
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
249d08c8fde3e1912f9d6d25ff14eed26f4adea29df815b794933eb133f8ec37
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Mon, 07 Aug 2023 12:42:11 GMT
strict-transport-security
max-age=31536000
via
1.1 aa6e16f47d6a0519f52b8dcfca2d841a.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
content-security-policy
upgrade-insecure-requests
age
446
x-amz-cf-pop
IAD89-P1
x-amz-request-id
VSEXTJJ8TXTDG8M8
content-encoding
br
x-cache
RefreshHit from cloudfront
x-amz-version-id
n_rdB5Zjo6jQpLlilRmMi5fLWw35sgNj
x-hs-https-only
worker
x-hs-cf-lambda
us-east-1.enforceAclForReadsProd 15
alt-svc
h3=":443"; ma=86400
x-amz-id-2
zS7gpyK4ngg++6o2GlW32zj366QwJqv+/gzWYXmB24zV0gk2AuOWvTrlQDcBw6J6yiTezglW09I=
last-modified
Fri, 19 Jul 2019 03:07:28 GMT
server
cloudflare
etag
W/"6b50e831aa1329ecfc246611e5b73e07"
vary
origin, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7b6sr8nqUbfc6O%2BYLuH8igV8Qvn8ZpbihocZTdPNdd%2ByKtUQ9wpDYoIRMT1vWVbAQ5xtdtUU17GPQ6twxtXtTy2nl4gz1NBbmqhfkMEVYuztzjbwFZIK5clfkh94zt4B%2BYy1xboCx7nig2eCxdRLYCsdtg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900, s-maxage=31536000, max-age=31536000
access-control-allow-credentials
false
cf-ray
7f2f991e39e21c28-FRA
x-amz-cf-id
j4lWry9rsENA-M56NhWXljQae9YwySDV6RjDp2O8FxZICdiu9_tX2A==
x-hs-cf-lambda-enforce
us-east-1.enforceAclForReadsProd 15
module_103636562700_Footer_Categories_Text_-_global.min.css
www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/module_assets/103636562700/1677161481432/
89 B
1 KB
Stylesheet
General
Full URL
https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/module_assets/103636562700/1677161481432/module_103636562700_Footer_Categories_Text_-_global.min.css
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
350dfd290fcaf704accd61883b7d6dd6e2fcb8d6f10c747ba96707c20bddc000
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

content-security-policy
upgrade-insecure-requests
content-encoding
br
age
1784
x-amz-request-id
7VDYX6YBDPYEPK88
x-amz-server-side-encryption
AES256
x-evy-trace-route-service-name
envoyset-translator
x-amz-replication-status
COMPLETED
x-hs-https-only
worker
x-hs-cf-lambda
us-east-1.enforceAclForReadsProd 20
x-evy-trace-listener
listener_https
etag
W/"0e24424bd7a91e1adc940105ffcd26d9"
vary
origin, Accept-Encoding
x-amz-meta-created-unix-time-millis
1677161481432
content-type
text/css
x-evy-trace-virtual-host
all
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-hs-cf-lambda-enforce
us-east-1.enforceAclForReadsProd 20
date
Mon, 07 Aug 2023 12:42:11 GMT
strict-transport-security
max-age=31536000
via
1.1 c6bba20dc3ec8526b729f039a2fdf7ae.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id
S9Og3Ezj9hRyblXN9qKf01bBpHlkGn4t
x-amz-cf-pop
IAD12-P2
x-hs-alternate-content-type
text/plain
x-cache
RefreshHit from cloudfront
x-amz-storage-class
INTELLIGENT_TIERING
x-envoy-upstream-service-time
110
alt-svc
h3=":443"; ma=86400
x-amz-id-2
GCHdKb6pnWl1WMzThxaVjLEgaktKu4Dzwu/H97avc0A6/xZYrjMa3kbjx4cC4hY98fTdWtsEqO4=
x-evy-trace-route-configuration
listener_https/all
x-request-id
4c6bd3be-d196-4185-8d66-c34713fd8d55
last-modified
Thu, 23 Feb 2023 14:11:22 GMT
server
cloudflare
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4xAjng5NIWg8yZrypUv0r%2BmAGDM4hh1ior2jYQkvuFJt%2F5266ee%2BdZdOK7WRevjjXjoRYiC3gBkWq2AaCj2nLKKKM9IRevaniAPLufDSjDJ9%2FZz7l1iByWoRVBugZfC4ME735%2B%2BOQaJTrn3JFihK0ARokA%3D%3D"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod
iad02/cms-hubfs-td/envoy-proxy-55b7d448b-fwhk5
access-control-allow-credentials
false
cf-ray
7f2f991e39e41c28-FRA
x-amz-cf-id
Yg4pipa3VRdo0zttA-R5LUyZYOkDAPmRp-4Uqx9xqr6mwD7US85mQQ==
module_87757605656_Footer_Categories_Blog_Listing_-_global.min.css
www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/module_assets/87757605656/1666371595958/
135 B
1 KB
Stylesheet
General
Full URL
https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/module_assets/87757605656/1666371595958/module_87757605656_Footer_Categories_Blog_Listing_-_global.min.css
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
abe603cadd5d178715e8d259697dd4470bf63c6ad1115eb0af8715c778640133
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

content-security-policy
upgrade-insecure-requests
content-encoding
br
age
446
x-amz-request-id
BSHEJJ0J7M0Z406A
x-amz-server-side-encryption
AES256
x-evy-trace-route-service-name
envoyset-translator
x-amz-replication-status
COMPLETED
x-hs-https-only
worker
x-hs-cf-lambda
us-east-1.enforceAclForReadsProd 20
x-evy-trace-listener
listener_https
etag
W/"13b7e92cbbf8ac04eec1f7b100347115"
vary
origin, Accept-Encoding
x-amz-meta-created-unix-time-millis
1666371595958
content-type
text/css
x-evy-trace-virtual-host
all
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-hs-cf-lambda-enforce
us-east-1.enforceAclForReadsProd 20
date
Mon, 07 Aug 2023 12:42:11 GMT
strict-transport-security
max-age=31536000
via
1.1 14d757a67b913f1bc93427e69819362c.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id
kLOdiFo6YnWIpiP8BLnJdzSgnAZ9CfEh
x-amz-cf-pop
IAD89-C1
x-hs-alternate-content-type
text/plain
x-cache
RefreshHit from cloudfront
x-amz-storage-class
INTELLIGENT_TIERING
x-envoy-upstream-service-time
144
alt-svc
h3=":443"; ma=86400
x-amz-id-2
evQ/5MYvkDYpn1vpTO6vk99GU3OCODvH8c3gILDmY4BxuA8xOL4mV8uqTZwUC3GMeEBC8it7H5I=
x-evy-trace-route-configuration
listener_https/all
x-request-id
19555df2-b004-43ab-b28e-f57dd55085df
last-modified
Fri, 21 Oct 2022 16:59:56 GMT
server
cloudflare
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vFsznAfXxg7%2FSR9%2BAIkdBS3CVqtKr%2B9LWqoPhqET2m3xuM3jUfcXaT%2B1KCGz%2BPIHj8Cbr0k8Q0%2BqK7E%2FRvUesAH%2BL9%2FSAB9lPiFwRqK1vKF3bQJ9cJezfG%2F3eTaa0GRJLEH16mJh718D64hFQI0h%2BUEC%2Fg%3D%3D"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod
iad02/cms-hubfs-td/envoy-proxy-55b7d448b-r4k2f
access-control-allow-credentials
false
cf-ray
7f2f991e39e81c28-FRA
x-amz-cf-id
mP_hBHU0YmCXSC5F2Kax4PpVNlFgecwbWXeLqNDMvOQH0qvcDBxMbw==
module_36845096476_Blog_listing_card_grid.min.css
www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/module_assets/36845096476/1683635695217/
304 B
1 KB
Stylesheet
General
Full URL
https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/module_assets/36845096476/1683635695217/module_36845096476_Blog_listing_card_grid.min.css
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
2e0e46665e34d5b09152a1ab9be9e89802f26f40b6e1a29780bf07ae94bc2376
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

content-security-policy
upgrade-insecure-requests
content-encoding
br
age
446
x-amz-request-id
493BPZ3TQ3W0EMJR
x-amz-server-side-encryption
AES256
x-evy-trace-route-service-name
envoyset-translator
x-amz-replication-status
COMPLETED
x-hs-https-only
worker
x-hs-cf-lambda
us-east-1.enforceAclForReadsProd 20
x-evy-trace-listener
listener_https
etag
W/"bfd6c45ad0a0ed80b73460eea867fdb6"
vary
origin, Accept-Encoding
x-amz-meta-created-unix-time-millis
1683635695217
content-type
text/css
x-evy-trace-virtual-host
all
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-hs-cf-lambda-enforce
us-east-1.enforceAclForReadsProd 20
date
Mon, 07 Aug 2023 12:42:11 GMT
strict-transport-security
max-age=31536000
via
1.1 0cba74644cedf83bb6fb7dc90d8b0980.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id
QEtrj8a5Jw.zNpvkZ3KAKAvL2xgpFoi3
x-amz-cf-pop
IAD12-P2
x-hs-alternate-content-type
text/plain
x-cache
RefreshHit from cloudfront
x-amz-storage-class
INTELLIGENT_TIERING
x-envoy-upstream-service-time
112
alt-svc
h3=":443"; ma=86400
x-amz-id-2
MMxDYlGAKstu6xcv7FF1yOTH82QSEPxgsUHCfDREspFI3X/rVg/KSkoCdSqFHVVi7kUtUPPCOns=
x-evy-trace-route-configuration
listener_https/all
x-request-id
70a882f2-5814-44ee-a5ae-368b05624550
last-modified
Tue, 09 May 2023 12:34:56 GMT
server
cloudflare
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FTktG4nuCj4G%2FQf4Yq0VrGSpoJE46ZzncfX7BQHr4qKj4wxNaPHf%2FKt3R53CgLRsYnp0zm%2Ba4RqJ61wBgFvtd%2FDwgQppu2Q2GSLn%2BWH05Jan%2BwqeeCTD3980%2B7iWfLXzlZaiSNZ90LwM0jJFaQ7ChB7i%2FA%3D%3D"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod
iad02/cms-hubfs-td/envoy-proxy-55b7d448b-fwhk5
access-control-allow-credentials
false
cf-ray
7f2f991e39ea1c28-FRA
x-amz-cf-id
nFSROtreYfVNhvwYYd0UDd-5eq1Mmw_0_LvzBmqdiBlPGjVMp0yAdw==
module_80864562095_Sidebar_Categories_Blog_-_global.min.css
www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/module_assets/80864562095/1659712321004/
419 B
1 KB
Stylesheet
General
Full URL
https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/module_assets/80864562095/1659712321004/module_80864562095_Sidebar_Categories_Blog_-_global.min.css
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
c7d36be0a73651297b0f6b15b1aa2e63a204489bb9c552c11e0cf7db771081d4
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

content-security-policy
upgrade-insecure-requests
content-encoding
br
age
446
x-amz-request-id
NAYX3P3QBFXSJ0XW
x-amz-server-side-encryption
AES256
x-amz-replication-status
COMPLETED
x-hs-https-only
worker
x-hs-cf-lambda
us-east-1.enforceAclForReadsProd 15
etag
W/"d7c0ecedc0f1ad068aa363dbf6f552be"
vary
origin, Accept-Encoding
x-amz-meta-created-unix-time-millis
1659712321004
content-type
text/css
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900, s-maxage=31536000, max-age=31536000
x-hs-cf-lambda-enforce
us-east-1.enforceAclForReadsProd 15
date
Mon, 07 Aug 2023 12:42:11 GMT
strict-transport-security
max-age=31536000
via
1.1 6f3546b6b501aaa8c1b4750231158188.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id
kytFTmhcx66YfyEHUvgGyzju7VPEYvXs
x-amz-cf-pop
IAD89-P1
x-hs-alternate-content-type
text/plain
x-cache
RefreshHit from cloudfront
x-amz-storage-class
INTELLIGENT_TIERING
alt-svc
h3=":443"; ma=86400
x-amz-id-2
Z9kOjStGIvTfaj8fcvCKu5QQ+/9/yXsNCNlkDg7YeIRxGZxM2Zuxkim0/blpoD8/cnIl5JAsKsE=
last-modified
Fri, 05 Aug 2022 15:12:02 GMT
server
cloudflare
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rNzvEPEyA92bFjMNXBQ1Smfq03rtP1bp5p9k0tL8n0DbHt%2BJ6nFC55TWIbgXGNZdTGK8HokGNx4yBZ6Co7FEydDh3V9ybdW%2FFTC0qg%2FGKI%2FTg%2BENWjIPMBD%2Fb9gpbaD1%2BR1y91ADKEBBHTDJWBX%2BtiIvGQ%3D%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-credentials
false
cf-ray
7f2f991e39ec1c28-FRA
x-amz-cf-id
O86xJHE49-iPfxDzp58DEiqXVNoF2204Ahc8nNeaZbdHAGFJcCVWrQ==
module_80868056874_Sidebar_Social_-_global.min.css
www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/module_assets/80868056874/1659702739351/
298 B
965 B
Stylesheet
General
Full URL
https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/module_assets/80868056874/1659702739351/module_80868056874_Sidebar_Social_-_global.min.css
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
f419ad33d162aefac608940b47d2a524fca46eee0c82f877710a6369e68be33c
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

content-security-policy
upgrade-insecure-requests
content-encoding
br
age
446
x-amz-request-id
98NB269N0E5B3BGZ
x-amz-server-side-encryption
AES256
x-evy-trace-route-service-name
envoyset-translator
x-amz-replication-status
COMPLETED
x-hs-https-only
worker
x-hs-cf-lambda
us-east-1.enforceAclForReadsProd 20
x-evy-trace-listener
listener_https
etag
W/"ea0c94f5b1324d7913f6a18ec1f3fe14"
vary
origin, Accept-Encoding
x-amz-meta-created-unix-time-millis
1659702739351
content-type
text/css
x-evy-trace-virtual-host
all
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-hs-cf-lambda-enforce
us-east-1.enforceAclForReadsProd 20
date
Mon, 07 Aug 2023 12:42:11 GMT
strict-transport-security
max-age=31536000
via
1.1 9b097dfab92228268a37145aac5629c0.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id
shmO1QlyhGMyDoImESYiUCU5phlmEXau
x-amz-cf-pop
IAD89-C1
x-hs-alternate-content-type
text/plain
x-cache
RefreshHit from cloudfront
x-amz-storage-class
INTELLIGENT_TIERING
x-envoy-upstream-service-time
172
alt-svc
h3=":443"; ma=86400
x-amz-id-2
lSaiJ+khQb0Samuok6dlEzLOoqMgHk31Tz8Q4h5JJv1Syr0xvdW/m2ogOiQeZHajxkcO74hExM3rZxDVwerTYQ==
x-evy-trace-route-configuration
listener_https/all
x-request-id
df15e28b-cd7d-4883-84b9-a224f2b23284
last-modified
Fri, 05 Aug 2022 12:32:20 GMT
server
cloudflare
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=q%2BQK0dK6nP5KaH7Ke3N%2BO29jXXldbZvbWBHWTNerlv6V%2Fd3%2Frj86YWKTa3oSrGGgml%2FjTrGwMllTCRh86T8jUAys6S9IgInGH%2FucHLvjefBPX94ZhErLDR%2FC1AQyn6Ord7v1Bs9LLwzNFRJBcOMcATUt4w%3D%3D"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod
iad02/cms-hubfs-td/envoy-proxy-55b7d448b-7hqzq
access-control-allow-credentials
false
cf-ray
7f2f991e39ed1c28-FRA
x-amz-cf-id
uKuhaBOnVQBZIJ7QPGBv_7uN4OVvIUJO7CRAT28hiq66nN5XB3Cx6g==
module_80857835930_Sidebar_Blog_Subscribe_-_global.min.css
www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/module_assets/80857835930/1659449374148/
620 B
1 KB
Stylesheet
General
Full URL
https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/module_assets/80857835930/1659449374148/module_80857835930_Sidebar_Blog_Subscribe_-_global.min.css
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
e2d14bf82ef15e64d7503eed437a43ad5f26d4f5bcac6745870c32f1ed77a8a6
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

content-security-policy
upgrade-insecure-requests
content-encoding
br
age
446
x-amz-request-id
0CPD67HGP2T4VTGR
x-amz-server-side-encryption
AES256
x-evy-trace-route-service-name
envoyset-translator
x-amz-replication-status
COMPLETED
x-hs-https-only
worker
x-hs-cf-lambda
us-east-1.enforceAclForReadsProd 20
x-evy-trace-listener
listener_https
etag
W/"058524ab080d84460f7e7c6d2ecb4d89"
vary
origin, Accept-Encoding
x-amz-meta-created-unix-time-millis
1659449374148
content-type
text/css
x-evy-trace-virtual-host
all
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-hs-cf-lambda-enforce
us-east-1.enforceAclForReadsProd 20
date
Mon, 07 Aug 2023 12:42:11 GMT
strict-transport-security
max-age=31536000
via
1.1 a251e31740a6e166e8fdccf296c41644.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id
e1cZxYRKfUgD2rKmkLGGtFZUzq.7EtsO
x-amz-cf-pop
IAD89-C1
x-hs-alternate-content-type
text/plain
x-cache
RefreshHit from cloudfront
x-amz-storage-class
INTELLIGENT_TIERING
x-envoy-upstream-service-time
113
alt-svc
h3=":443"; ma=86400
x-amz-id-2
bCDnldKnN76qEWzQaXcoZtvxtXp5x4LpXnT0mIjgzv39px+tYwFovBBTeI4wNMaTu1STGAKufvc=
x-evy-trace-route-configuration
listener_https/all
x-request-id
578d693d-5549-42d7-8647-3673bba6f8c6
last-modified
Tue, 02 Aug 2022 14:09:35 GMT
server
cloudflare
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HBV4Ez9a2WzBTecdiGnIG7DilfJu%2FuJrt51fOLTv7hHp%2B3cFN7QSshTfC6UbmORrZDev5%2Fnc30W5eXtaLLNFXrYEv2vaXpL7WN5GXQPkb3G7I7vFWGmlFeUUN7WrBu2SPV27AdlE%2BSeAGjL3ymptzIBZmQ%3D%3D"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod
iad02/cms-hubfs-td/envoy-proxy-55b7d448b-rwfnd
access-control-allow-credentials
false
cf-ray
7f2f991e39ef1c28-FRA
x-amz-cf-id
tAy8LPGZD01OtX2us_cOxCSc8m88XLHg8AWtggdKSL5WxDifIdK6lQ==
module_80864563080_Sidebar_Blog_Favorite_Post_-_global.min.css
www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/module_assets/80864563080/1670427753922/
581 B
973 B
Stylesheet
General
Full URL
https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/module_assets/80864563080/1670427753922/module_80864563080_Sidebar_Blog_Favorite_Post_-_global.min.css
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
cafcf576874435cca6e41394ae820ab1573b83f8b405d10d3ff8add93614c8fe
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

content-security-policy
upgrade-insecure-requests
content-encoding
br
age
446
x-amz-request-id
TN8JRPSHNZXRKZ1T
x-amz-server-side-encryption
AES256
x-amz-replication-status
COMPLETED
x-hs-https-only
worker
x-hs-cf-lambda
us-east-1.enforceAclForReadsProd 15
etag
W/"c2bccdea5694cead22c9370560abd5e0"
vary
origin, Accept-Encoding
x-amz-meta-created-unix-time-millis
1670427753922
content-type
text/css
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900, s-maxage=31536000, max-age=31536000
x-hs-cf-lambda-enforce
us-east-1.enforceAclForReadsProd 15
date
Mon, 07 Aug 2023 12:42:11 GMT
strict-transport-security
max-age=31536000
via
1.1 979084a90b32fe3f5fdc377fb6e67b76.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id
wr_YakpyxY_udxaEA70Z09_FgvspAnTj
x-amz-cf-pop
IAD89-P1
x-hs-alternate-content-type
text/plain
x-cache
RefreshHit from cloudfront
x-amz-storage-class
INTELLIGENT_TIERING
alt-svc
h3=":443"; ma=86400
x-amz-id-2
9sfkui2lNOR9HKXf6QfZearJZoYc0emHrBP83j3aY7vY+2brJY7jYGZoDJWFmJrFJb6N0xmaw1+Ls7OvihVQ6w==
last-modified
Wed, 07 Dec 2022 15:42:34 GMT
server
cloudflare
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=z0plMt6roJ3YNFIwcGxNxaa4boLCqljzh6AGBKZ36IBXnnzWMMQ8a%2FTGmrBXcwfT%2B%2B7RunwdAGE7U%2BsFZJG6GKnOsZZyOqr%2FI40mZZvwPpQNiXPwfiQgHprkErc7W25JD%2F5paDLHw9E9QPpPjxqkSCnmdA%3D%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-credentials
false
cf-ray
7f2f991e39f41c28-FRA
x-amz-cf-id
o2TRwN4aGb9oEUiEbVp07433bxR0UkfScK3-5CyU0yLXB4cisUJZrw==
module_114796045952_Sidebar_ConversingLabs_Latest_Post_Block_-_global.min.css
www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/module_assets/114796045952/1683726402031/
449 B
1 KB
Stylesheet
General
Full URL
https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/module_assets/114796045952/1683726402031/module_114796045952_Sidebar_ConversingLabs_Latest_Post_Block_-_global.min.css
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
7d6d019be5fdd6ed212ab83345278024e52cb55e59e5a577644a58f1c29ae316
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

content-security-policy
upgrade-insecure-requests
content-encoding
br
age
446
x-amz-request-id
1ZWPRY4T8RG5FBX9
x-amz-server-side-encryption
AES256
x-evy-trace-route-service-name
envoyset-translator
x-amz-replication-status
COMPLETED
x-hs-https-only
worker
x-hs-cf-lambda
us-east-1.enforceAclForReadsProd 20
x-evy-trace-listener
listener_https
etag
W/"8518a5951d9ad4d2295f309cf6fca5e1"
vary
origin, Accept-Encoding
x-amz-meta-created-unix-time-millis
1683726402031
content-type
text/css
x-evy-trace-virtual-host
all
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-hs-cf-lambda-enforce
us-east-1.enforceAclForReadsProd 20
date
Mon, 07 Aug 2023 12:42:11 GMT
strict-transport-security
max-age=31536000
via
1.1 90ac509e6263ee9fa7bb3f1ed1f46118.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id
AQN4k9CjDjzeOb4WGe179iRQS2cuvN7I
x-amz-cf-pop
IAD55-P3
x-hs-alternate-content-type
text/plain
x-cache
RefreshHit from cloudfront
x-amz-storage-class
INTELLIGENT_TIERING
x-envoy-upstream-service-time
123
alt-svc
h3=":443"; ma=86400
x-amz-id-2
6K0VBtV/5SlAb1taN90asHPq5fzkTfPUeUwGYp3puajuy/55zsup7qAFUEik9P06pIXqOUgK3CU=
x-evy-trace-route-configuration
listener_https/all
x-request-id
776cbc17-31d8-444d-a4fa-8237b1225682
last-modified
Wed, 10 May 2023 13:46:43 GMT
server
cloudflare
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=upSZSsGPdzqA6U89T5SX08tZjLskf3XSFUEoerx8D%2Fi8qjtpUL7FaPEG7ubTeso%2FaBI8PnvgJZ%2FNTJSPJOz9qQqey%2BrwuVHg2aVbRm1ZhgQ6GYE%2FUesm2NEoEIZEFlAGo%2BRJ2CkJTtN6aCPUvDv379mCJw%3D%3D"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod
iad02/cms-hubfs-td/envoy-proxy-55b7d448b-hlzsf
access-control-allow-credentials
false
cf-ray
7f2f991e39f51c28-FRA
x-amz-cf-id
aCcoQlUlrPmuTAJpQvqlVfR-qxCZTPQFToO94h0EwgY4qOIQY1r2zg==
module_115016303498_Sidebar_ReversingGlass_Latest_Post_Block_-_global.min.css
www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/module_assets/115016303498/1683726382481/
449 B
1 KB
Stylesheet
General
Full URL
https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/module_assets/115016303498/1683726382481/module_115016303498_Sidebar_ReversingGlass_Latest_Post_Block_-_global.min.css
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
7d6d019be5fdd6ed212ab83345278024e52cb55e59e5a577644a58f1c29ae316
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

content-security-policy
upgrade-insecure-requests
content-encoding
br
age
446
x-amz-request-id
0WSX39427J1AS112
x-amz-server-side-encryption
AES256
x-evy-trace-route-service-name
envoyset-translator
x-amz-replication-status
COMPLETED
x-hs-https-only
worker
x-hs-cf-lambda
us-east-1.enforceAclForReadsProd 20
x-evy-trace-listener
listener_https
etag
W/"8518a5951d9ad4d2295f309cf6fca5e1"
vary
origin, Accept-Encoding
x-amz-meta-created-unix-time-millis
1683726382481
content-type
text/css
x-evy-trace-virtual-host
all
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-hs-cf-lambda-enforce
us-east-1.enforceAclForReadsProd 20
date
Mon, 07 Aug 2023 12:42:11 GMT
strict-transport-security
max-age=31536000
via
1.1 b64454e3c1123ac098282f1036154740.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id
kE2bMXeYWn_ktJqXj7KUhR8Fu5cHi1x4
x-amz-cf-pop
IAD55-P3
x-hs-alternate-content-type
text/plain
x-cache
RefreshHit from cloudfront
x-amz-storage-class
INTELLIGENT_TIERING
x-envoy-upstream-service-time
135
alt-svc
h3=":443"; ma=86400
x-amz-id-2
PW5+eWD9+xuuphm0jZbqbs12I5xghMcILTCbUgQxi2xPmBxVBs2q5a6cC6+jJLZGKMXQe6Tng7s=
x-evy-trace-route-configuration
listener_https/all
x-request-id
bf630b5b-dfad-40fb-be66-6907bb0b9973
last-modified
Wed, 10 May 2023 13:46:23 GMT
server
cloudflare
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ttxZBQh15rjoWrPX%2FMZ5B8bTuR5i0M7sOlpRijk0%2BU%2BgzEgKaKL9sBmjADY9UmwkMMdtkTfOh764V1UDMG4iVAFPsZuA3fNoX1j4wqOgsrPJUN4eu46%2FkAekTvVxloXvl421kxRWrLXiCBK9foP58xgJbg%3D%3D"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod
iad02/cms-hubfs-td/envoy-proxy-55b7d448b-fwhk5
access-control-allow-credentials
false
cf-ray
7f2f991e39f71c28-FRA
x-amz-cf-id
uuvQbsRPHfQRoKUdPc9CdrHq4khVP5eIig2tHSi4wmDEv8XOJo5d4w==
module_115021731904_Sidebar_SPD_Latest_Post_Block_-_global.min.css
www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/module_assets/115021731904/1683728917797/
449 B
1 KB
Stylesheet
General
Full URL
https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/module_assets/115021731904/1683728917797/module_115021731904_Sidebar_SPD_Latest_Post_Block_-_global.min.css
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
7d6d019be5fdd6ed212ab83345278024e52cb55e59e5a577644a58f1c29ae316
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

content-security-policy
upgrade-insecure-requests
content-encoding
br
age
446
x-amz-request-id
FZ7AC83PSS98SKD7
x-amz-server-side-encryption
AES256
x-evy-trace-route-service-name
envoyset-translator
x-amz-replication-status
COMPLETED
x-hs-https-only
worker
x-hs-cf-lambda
us-east-1.enforceAclForReadsProd 20
x-evy-trace-listener
listener_https
etag
W/"8518a5951d9ad4d2295f309cf6fca5e1"
vary
origin, Accept-Encoding
x-amz-meta-created-unix-time-millis
1683728917797
content-type
text/css
x-evy-trace-virtual-host
all
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-hs-cf-lambda-enforce
us-east-1.enforceAclForReadsProd 20
date
Mon, 07 Aug 2023 12:42:11 GMT
strict-transport-security
max-age=31536000
via
1.1 d4564d6809e10e731bfdfae814a717f8.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id
_NB7Ho2f9mjVTOSpgbcz46QGtgjcNPEf
x-amz-cf-pop
IAD55-P3
x-hs-alternate-content-type
text/plain
x-cache
RefreshHit from cloudfront
x-amz-storage-class
INTELLIGENT_TIERING
x-envoy-upstream-service-time
134
alt-svc
h3=":443"; ma=86400
x-amz-id-2
VFqhNEo69Eom5zdF27L0BoBqLcEsNE+6NT4gvpsJwKDcqBUCspDQOL27i0/xPUFMy1z6BIDvln4JjkfAEwvByH5rewwErVDf7pCBZOvWyt4=
x-evy-trace-route-configuration
listener_https/all
x-request-id
48b01650-ff18-4237-a242-538decc54d8d
last-modified
Wed, 10 May 2023 14:28:38 GMT
server
cloudflare
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xgYvpkxN%2Bl5fXeQWsryGGnXKA%2B6nDQAn1uqEmlctyqAFYQz2p1FewNteAv%2FIhrvEKDn%2F9SkQl7b6pQwiMvFbCow8QibEnkbFT6VDSrDeGbkEsCBK2%2F8oiGB1aa91rX%2BM53oD3DGGjhj6o7nv2W1GZo4M5w%3D%3D"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod
iad02/cms-hubfs-td/envoy-proxy-55b7d448b-7hqzq
access-control-allow-credentials
false
cf-ray
7f2f991e39fb1c28-FRA
x-amz-cf-id
ML-o27nR3DM5iAcRNOXPn07RaCZMoZxnkpdGul3CDRqf1SxiLLfAxg==
footer-redesign-2019.min.css
www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/10777459487/1628866681200/Redesign_june_2019/Coded_Files/CSS/Components/
1 KB
2 KB
Stylesheet
General
Full URL
https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/10777459487/1628866681200/Redesign_june_2019/Coded_Files/CSS/Components/footer-redesign-2019.min.css
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
27215dede1579d37bcf4ab9ef8fc7d968bd02081c4e61d77837a9bb8f6ca9511
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

content-security-policy
upgrade-insecure-requests
content-encoding
br
age
446
x-amz-request-id
WSFB17NDP7WVXHDC
x-amz-server-side-encryption
AES256
x-evy-trace-route-service-name
envoyset-translator
x-amz-replication-status
COMPLETED
x-hs-https-only
worker
x-hs-cf-lambda
us-east-1.enforceAclForReadsProd 20
x-evy-trace-listener
listener_https
etag
W/"74345f5a0d3875bb7f758b06d4778849"
vary
origin, Accept-Encoding
x-amz-meta-created-unix-time-millis
1628866681235
content-type
text/css
x-evy-trace-virtual-host
all
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-hs-cf-lambda-enforce
us-east-1.enforceAclForReadsProd 20
date
Mon, 07 Aug 2023 12:42:11 GMT
strict-transport-security
max-age=31536000
via
1.1 d1cde188ada6755fe03b8541b71fce4a.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id
KkIg9v6XZx4VO697E4AlyOGL9YPPr5d0
x-amz-cf-pop
IAD89-C1
x-hs-alternate-content-type
text/plain
x-cache
Miss from cloudfront
x-envoy-upstream-service-time
168
alt-svc
h3=":443"; ma=86400
x-amz-id-2
NTSW39LESqcpEzbdKO4Sp9EssZbi2rZke+7eplwYSYjEAGP5fu0TBEJHLi0+m1yM0YbvViu3aAMKM2hhTwxdrQ==
x-evy-trace-route-configuration
listener_https/all
x-request-id
d47d7ef7-1f8a-4a92-bbb5-81d1ff5e909c
last-modified
Fri, 13 Aug 2021 14:58:02 GMT
server
cloudflare
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xREnzcPoyjUG%2FE4xkUKT7HGXvmHD33nGwKHn%2BCZFW5Y68Mmx0sQ9IFs%2BJQBRqDvVEIz19vu0R99v3B1mwgOmO%2BNWQ8Dl%2F4rYSw8SIFvplIUqccC9sQxhMngjIpztVGYc%2F1aXgp1nZYz4267GI0dgeHGg9Q%3D%3D"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod
iad02/cms-hubfs-td/envoy-proxy-55b7d448b-r4k2f
access-control-allow-credentials
false
cf-ray
7f2f991e39fd1c28-FRA
x-amz-cf-id
Py1daG-4qDMY_6piUCte2gArFkk6RFnYsjFmo-O7skAEor7gpWQa2A==
module_10782554896_Footer_-_Redesign_-_2019_-_Global.min.css
www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/module_assets/10782554896/1684325396009/
126 B
1 KB
Stylesheet
General
Full URL
https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/module_assets/10782554896/1684325396009/module_10782554896_Footer_-_Redesign_-_2019_-_Global.min.css
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
04245f85425b7978fbfd092971444a755772b93d9fb41f4c58f388e520403afd
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

content-security-policy
upgrade-insecure-requests
content-encoding
br
age
2837
x-amz-request-id
7X42C64NHK6DKKZ6
x-amz-server-side-encryption
AES256
x-evy-trace-route-service-name
envoyset-translator
x-amz-replication-status
PENDING
x-hs-https-only
worker
x-hs-cf-lambda
us-east-1.enforceAclForReadsProd 20
x-evy-trace-listener
listener_https
etag
W/"d5024537c90d258c2752af5a17a95367"
vary
origin, Accept-Encoding
x-amz-meta-created-unix-time-millis
1684325396009
content-type
text/css
x-evy-trace-virtual-host
all
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-hs-cf-lambda-enforce
us-east-1.enforceAclForReadsProd 20
date
Mon, 07 Aug 2023 12:42:11 GMT
strict-transport-security
max-age=31536000
via
1.1 16df6ade68382d048f8aad1f7e39da28.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id
ojCcsa3Hbm8KsKBjYnw5U.TUyefQWjmM
x-amz-cf-pop
IAD12-P3
x-hs-alternate-content-type
text/plain
x-cache
RefreshHit from cloudfront
x-amz-storage-class
INTELLIGENT_TIERING
x-envoy-upstream-service-time
121
alt-svc
h3=":443"; ma=86400
x-amz-id-2
jViwf9FZMI3kLz81OlMSSEAWGIfG1h+N5HMjut2XqQyD4f6sd57vNh+/LOTvlzEnwFAGwQi7P7Q=
x-evy-trace-route-configuration
listener_https/all
x-request-id
99334791-2074-4d1b-b287-4a3c755b37a1
last-modified
Wed, 17 May 2023 12:09:57 GMT
server
cloudflare
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4slv3Xdq45FylIIv8KhRciJIwt5TRJ8lMD77ig%2FMqgXiHxKz5zW9nQC%2B6Jc0OejWnUNJrMDkpk5I6x2XZMAN5vrSNK4z1IswHIa3OUVYDVq%2BL3KOh1npu2acBTysOqrgJS8I67TGrk2kxCfB8hzKRAIkpw%3D%3D"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod
iad02/cms-hubfs-td/envoy-proxy-fd8f7bc74-mxtb7
access-control-allow-credentials
false
cf-ray
7f2f991e39fe1c28-FRA
x-amz-cf-id
McaJ-7R67LJK9XZmYCQNRIwGIRwHpUu9pqoObAk1pDUcS76W5xy71w==
Reversing_Labs_November2018-style.min.css
www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/6519964395/1685359416657/Reversing_Labs_November2018_Theme/Coded_Files/
143 KB
24 KB
Stylesheet
General
Full URL
https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/6519964395/1685359416657/Reversing_Labs_November2018_Theme/Coded_Files/Reversing_Labs_November2018-style.min.css
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
61ce08dbad99d88826d7e7d374b628662137c7893a943d6a541cf4b0455c5067
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

content-security-policy
upgrade-insecure-requests
content-encoding
br
age
446
x-amz-request-id
9BY06TDA00GEHJTS
x-amz-server-side-encryption
AES256
x-evy-trace-route-service-name
envoyset-translator
x-amz-replication-status
COMPLETED
x-hs-https-only
worker
x-hs-cf-lambda
us-east-1.enforceAclForReadsProd 20
x-evy-trace-listener
listener_https
etag
W/"3d0f457bdc611022c3f48f57eb877977"
vary
origin, Accept-Encoding
x-amz-meta-created-unix-time-millis
1685359417818
content-type
text/css
x-evy-trace-virtual-host
all
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-hs-cf-lambda-enforce
us-east-1.enforceAclForReadsProd 20
date
Mon, 07 Aug 2023 12:42:11 GMT
strict-transport-security
max-age=31536000
via
1.1 6400936fc4525d1c60e3e8fee9d4806e.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id
AcrfIRW95QY88SeuDIXAFoVt.4x1ZQWb
x-amz-cf-pop
IAD12-P2
x-hs-alternate-content-type
text/plain
x-cache
RefreshHit from cloudfront
x-amz-storage-class
INTELLIGENT_TIERING
x-envoy-upstream-service-time
139
alt-svc
h3=":443"; ma=86400
x-amz-id-2
GkxM6CyUTGG0PBFgMJaDRztxsWFbJcPlZ0/7OioWm4zjLouo3IjGbhgJ83dkKDN715dWTz+6LH0HE9fsUUy+aoo105Uo0mmZotlTj0R0A+k=
x-evy-trace-route-configuration
listener_https/all
x-request-id
87030c20-b4df-4c9a-a844-9982d6c02ddf
last-modified
Mon, 29 May 2023 11:23:38 GMT
server
cloudflare
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ULeaA572zM2nEs%2BpR1yldjHMbU7OzoqXs%2BjF8mv88do4FQvUSOe8%2BxDNtKyCrpsADjfDzvgl44wCkpFkN6N5n%2B8Sm7AQTPVvsp1p9c3%2FqyL3HHcS9UHfSXVFF%2Fb0e6jOjQESQ4%2FyvGEeX4HS%2FwyEuhEJxw%3D%3D"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod
iad02/cms-hubfs-td/envoy-proxy-fd8f7bc74-9xkdz
access-control-allow-credentials
false
cf-ray
7f2f991e39ff1c28-FRA
x-amz-cf-id
EfnvyHcxkM0r5MgmZNSmpahxHbS44buGtkHilNHaDyIqxvzzMKUqGQ==
v4.js
play.vidyard.com/embed/
70 KB
23 KB
Script
General
Full URL
https://play.vidyard.com/embed/v4.js
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.193.181 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
86bc7c25a3bf03fad86ce1733e1a562b1395d60635b29960b7b3f68aefa8bc7a
Security Headers
Name Value
Strict-Transport-Security max-age=31557600

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

x-cache-hits
24
date
Mon, 07 Aug 2023 12:42:12 GMT
content-encoding
gzip
via
1.1 varnish
strict-transport-security
max-age=31557600
age
12826
x-amz-server-side-encryption
AES256
x-cache
HIT
content-length
23020
x-served-by
cache-fra-eddf8230043-FRA
x-china
0
last-modified
Mon, 19 Jun 2023 19:37:16 GMT
etag
"4e2f211a0d5f0f0e82bcf94c1f18d11d"
vary
X-China, accept-language, Accept-Encoding
content-type
application/javascript
cache-control
no-cache, no-store, must-revalidate
accept-ranges
bytes
expires
Thu, 01 Jan 1970 00:00:00 GMT
in.js
platform.linkedin.com/
510 KB
161 KB
Script
General
Full URL
https://platform.linkedin.com/in.js
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:1ec:46::60 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
548e19007f81a4cc069dc87c3e54afa0aad5519c1640d5f31506b16793729bd2
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Mon, 07 Aug 2023 12:42:12 GMT
content-encoding
gzip
x-content-type-options
nosniff
nel
{"report_to":"network-errors","max_age":1296000,"success_fraction":0.00066,"failure_fraction":1,"include_subdomains":true}
x-cdn
AZUR
x-cdn-client-ip-version
IPV6
x-cache
TCP_MISS
x-cdn-proto
HTTP2
content-length
163638
x-li-uuid
AAYCVJNMUk5DGjy4oKlwig==
x-li-pop
prod-ltx1-x
vary
Accept-Encoding
report-to
{"group":"network-errors","max_age":2592000,"endpoints":[{"url":"https://www.linkedin.com/li/rep"}],"include_subdomains":true}
x-li-fabric
prod-ltx1
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=3600
x-li-proto
http/1.1
x-azure-ref
20230807T124211Z-fd4k59kr3d5hdaagebae3vht5g00000005v000000002v3st
accept-ranges
bytes
expires
Mon, 7 Aug 2023 13:42:12 GMT
layout.min.css
cdn2.hubspot.net/hub/7052064/hub_generated/template_assets/1691156845456/hubspot/hubspot_default/shared/responsive/
4 KB
2 KB
Stylesheet
General
Full URL
https://cdn2.hubspot.net/hub/7052064/hub_generated/template_assets/1691156845456/hubspot/hubspot_default/shared/responsive/layout.min.css
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:cec9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
257855f4e23a1e3d382077b15bfc30971c9c261fc23512c88abfdcda05f28bc4

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

content-encoding
br
age
255229
x-evy-trace-route-service-name
envoyset-translator
x-amz-server-side-encryption
AES256
x-amz-replication-status
COMPLETED
x-hs-cf-lambda
us-east-1.EnforceAclForReads 2
x-evy-trace-listener
listener_https
etag
W/"94daf62e7e6df83595c6251fb0c7c055"
vary
Accept-Encoding
access-control-allow-methods
GET
content-type
text/css
access-control-allow-origin
*
x-amz-meta-created-unix-time-millis
1691156846066
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
x-evy-trace-virtual-host
all
x-hs-cf-lambda-enforce
us-east-1.EnforceAclForReads 2
date
Mon, 07 Aug 2023 12:42:11 GMT
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop
IAD89-C1
x-hs-alternate-content-type
text/plain
x-hubspot-correlation-id
360d3742-4e44-4d59-b9be-9c67e2e8f82b
x-amz-storage-class
INTELLIGENT_TIERING
x-envoy-upstream-service-time
172
alt-svc
h3=":443"; ma=86400
x-evy-trace-route-configuration
listener_https/all
x-request-id
360d3742-4e44-4d59-b9be-9c67e2e8f82b
last-modified
Fri, 04 Aug 2023 13:47:27 GMT
server
cloudflare
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ZgYlk5NHM690JFyhlz8EDrUKHBt%2BtoEBDUCqlbit7bsUJBvpFvXVeeZMPL1PJEiEu8zo3qjrEk%2F0UicQqdBAKNNZxXp2AHY628awS9s2TNBQitqnR2yDTRAR%2BwlcQavpFUD3JxA2MhqUcPm%2BBDo%3D"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod
iad02/cms-cdn2-td/envoy-proxy-8dfbb9f7c-hml5r
cf-ray
7f2f991e6f87040c-FRA
RL-custom.min.css
www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/5951651806/1659964887293/Reversinglabs_July2018_Theme/Coded_Files/
12 KB
4 KB
Stylesheet
General
Full URL
https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/5951651806/1659964887293/Reversinglabs_July2018_Theme/Coded_Files/RL-custom.min.css
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
1a5f6ffeb8930092b29aef8860e2c8ebbe25dd2dcdf70ab4b6b137c4b4592f70
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

content-security-policy
upgrade-insecure-requests
content-encoding
br
age
446
x-amz-request-id
WSFDFSSBK9N81HVZ
x-amz-server-side-encryption
AES256
x-evy-trace-route-service-name
envoyset-translator
x-amz-replication-status
COMPLETED
x-hs-https-only
worker
x-hs-cf-lambda
us-east-1.enforceAclForReadsProd 20
x-evy-trace-listener
listener_https
etag
W/"87c5bc53e5805378faf6e71727ae7d28"
vary
origin, Accept-Encoding
x-amz-meta-created-unix-time-millis
1659964888595
content-type
text/css
x-evy-trace-virtual-host
all
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-hs-cf-lambda-enforce
us-east-1.enforceAclForReadsProd 20
date
Mon, 07 Aug 2023 12:42:11 GMT
strict-transport-security
max-age=31536000
via
1.1 6b7e1e42d74fd61097787cc6c1a37c34.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id
rddr3nP1mNXXwP_ajL22vN12Zg.dfVCT
x-amz-cf-pop
IAD89-C1
x-hs-alternate-content-type
text/plain
x-cache
Miss from cloudfront
x-amz-storage-class
INTELLIGENT_TIERING
x-envoy-upstream-service-time
159
alt-svc
h3=":443"; ma=86400
x-amz-id-2
UqeA8J80HdHOEez+UEItUcXFZiXPApxUbaH+hxOMVMVtReJig3r0S5AU15jOP+ae1v/qn/PqpOc=
x-evy-trace-route-configuration
listener_https/all
x-request-id
eae55deb-8363-4e52-acd7-5bf486a87765
last-modified
Mon, 08 Aug 2022 13:21:29 GMT
server
cloudflare
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=A7A1jy4cN9BoWYZeuoi50Dp4e1iuMh85Xk2%2BqX%2FVIksYNI8Dy3fduZmvDh9RfndIIvR0noODSA%2FIOaw1fMFY42OCvjvMDcHuU7YKyl0CIOPc1OPntKvLzn90RJOyJ6w2ljKwBCwJGGWWtzPuXxMuhhB%2BLw%3D%3D"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod
iad02/cms-hubfs-td/envoy-proxy-55b7d448b-rwfnd
access-control-allow-credentials
false
cf-ray
7f2f991e3a011c28-FRA
x-amz-cf-id
B9Yhy7rO2pUM57KSsEaozlTaUkMoatfztys-Nm__3BWZ8LERlt3rOg==
site-redesign-june-2019.min.css
www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/10528761402/1689162268961/Redesign_june_2019/Coded_Files/CSS/Modules/
11 KB
4 KB
Stylesheet
General
Full URL
https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/10528761402/1689162268961/Redesign_june_2019/Coded_Files/CSS/Modules/site-redesign-june-2019.min.css
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
c889e86e6c42fc475d139233bc09a8fe599673cfeebe015bd3083cd1ea994e93
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

content-security-policy
upgrade-insecure-requests
content-encoding
br
age
446
x-amz-request-id
C67VNPFCGTB66AF7
x-amz-server-side-encryption
AES256
x-evy-trace-route-service-name
envoyset-translator
x-amz-replication-status
COMPLETED
x-hs-https-only
worker
x-hs-cf-lambda
us-east-1.enforceAclForReadsProd 20
x-evy-trace-listener
listener_https
etag
W/"a6b54e2468e63ef91aa2333794289d8a"
vary
origin, Accept-Encoding
x-amz-meta-created-unix-time-millis
1689162269645
content-type
text/css
x-evy-trace-virtual-host
all
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-hs-cf-lambda-enforce
us-east-1.enforceAclForReadsProd 20
date
Mon, 07 Aug 2023 12:42:11 GMT
strict-transport-security
max-age=31536000
via
1.1 99baebf4b5bb631267dcfa82456151cc.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id
cM9nJ1gR34B3YQ2cLQTyj7pejlMLYf.6
x-amz-cf-pop
IAD89-C1
x-hs-alternate-content-type
text/plain
x-hubspot-correlation-id
1474e339-698f-4678-ac49-46d176a69129
x-cache
Miss from cloudfront
x-amz-storage-class
INTELLIGENT_TIERING
x-envoy-upstream-service-time
117
alt-svc
h3=":443"; ma=86400
x-amz-id-2
X7RU/r2YFdcytCOlgM3h5/PV30HyOohS2Xaa5t4y75gPm8QMm1r2rhFCkhlXSZA0DcGrag1V4Rt9F5pg0FstSq+Yz90fCNIJHulrHuua1/Q=
x-evy-trace-route-configuration
listener_https/all
x-request-id
1474e339-698f-4678-ac49-46d176a69129
last-modified
Wed, 12 Jul 2023 11:44:30 GMT
server
cloudflare
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6KF80%2BVJKVckOKUC1yxoepcxoKBItKpSb5Qz7c9jwrD1ACK%2BVXF4LA8J%2Bm1roWT8fekDWdYliU%2BsZzVO46I4evp%2FDYevauKkYw8wjJbt2lya91E%2F5%2BrRbjY6UYBksDoyBoGB7lz1iZSjpj%2FMWlJRhqzGJQ%3D%3D"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod
iad02/cms-hubfs-td/envoy-proxy-fd8f7bc74-fhfns
access-control-allow-credentials
false
cf-ray
7f2f991e3a021c28-FRA
x-amz-cf-id
V1blr6uorwDl5n385W2TrhgZrQ1kZSwtT96BG6jm5T3ARQRqDRqRzw==
blog.min.css
www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/23712622487/1628866682579/Coded_files/Modules/
3 KB
2 KB
Stylesheet
General
Full URL
https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/23712622487/1628866682579/Coded_files/Modules/blog.min.css
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
9a612c9ad7bdfdfeb71ed257ea676a5bca9db5694ee8a0f0c1f8a96330429ea3
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Mon, 07 Aug 2023 12:42:11 GMT
strict-transport-security
max-age=31536000
via
1.1 0920aeb1eced22df07c9ece1cab0a554.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
content-security-policy
upgrade-insecure-requests
age
446
x-amz-cf-pop
IAD89-P1
x-amz-server-side-encryption
AES256
x-amz-request-id
DNP27C5RWRB8DGE8
x-hs-alternate-content-type
text/plain
x-cache
Miss from cloudfront
x-amz-version-id
Mz.2Pn4CEDs4ZaIeZ_NrZ0_ijfcT5uxW
content-encoding
br
x-amz-replication-status
COMPLETED
x-hs-https-only
worker
x-hs-cf-lambda
us-east-1.enforceAclForReadsProd 15
alt-svc
h3=":443"; ma=86400
x-amz-id-2
aF9DnAibKuggE3nwF/8DGE4otx8SyJ/0gV504ougeH9vk3FdM5ORhQGCBd+jn2+jF5PJDYw2ODs=
last-modified
Fri, 13 Aug 2021 14:58:03 GMT
server
cloudflare
etag
W/"86cceae70fe2cace0184968b3abea7a2"
vary
origin, Accept-Encoding
x-amz-meta-created-unix-time-millis
1628866682656
content-type
text/css
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2PQHTyTzOtz8hkBSqV5XEChW8hloy4ROOKGuC67xdWJs%2FQfbHdkDjGp5xpG%2Bib4rJfA7MTSqovshA6o0do1ff4uDN9L%2F0YPcVCygTbSeWPvprtAwSNMuxWXC%2BagEKssUy0oDbLsevuD2Zg0W%2FKM6wFd5Hw%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900, s-maxage=31536000, max-age=31536000
access-control-allow-credentials
false
cf-ray
7f2f991e3a031c28-FRA
x-amz-cf-id
aG2xrv5xdEfuxj8b5AmMr5yoi7tmkED9dJ5TRo2fhQ4RNcrpAQyMMg==
x-hs-cf-lambda-enforce
us-east-1.enforceAclForReadsProd 15
conversing.min.css
www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/70521421874/1671120024586/Redesign_june_2019/Coded_Files/CSS/Modules/
2 KB
2 KB
Stylesheet
General
Full URL
https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/70521421874/1671120024586/Redesign_june_2019/Coded_Files/CSS/Modules/conversing.min.css
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
fc2fab7ad17829305a9146a6a0db45bf46dba8b104548a2777c5583c0aff059d
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

content-security-policy
upgrade-insecure-requests
content-encoding
br
age
446
x-amz-request-id
J9KZTYZHNSHCZTGH
x-amz-server-side-encryption
AES256
x-amz-replication-status
COMPLETED
x-hs-https-only
worker
x-hs-cf-lambda
us-east-1.enforceAclForReadsProd 15
etag
W/"03194bf820a8d747a9c4e33f60a3d8a6"
vary
origin, Accept-Encoding
x-amz-meta-created-unix-time-millis
1671120025512
content-type
text/css
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900, s-maxage=31536000, max-age=31536000
x-hs-cf-lambda-enforce
us-east-1.enforceAclForReadsProd 15
date
Mon, 07 Aug 2023 12:42:11 GMT
strict-transport-security
max-age=31536000
via
1.1 e418fd5667de46c635f0321ea814c2e0.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id
ezK3yCXod3kovn6QNb0kvlsgyxcpZGDT
x-amz-cf-pop
IAD89-P1
x-hs-alternate-content-type
text/plain
x-cache
Miss from cloudfront
x-amz-storage-class
INTELLIGENT_TIERING
alt-svc
h3=":443"; ma=86400
x-amz-id-2
TfcqbW0xVQnwmf18TMo1AkAfYCJmkgstNGmg5X2qr95N+mK8F8254KafmMO/Jc4dNP0IzXF4zDk=
last-modified
Thu, 15 Dec 2022 16:00:26 GMT
server
cloudflare
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=MLfWvGBTWvlwgQ9mKG6Kq0bDYq1yBo6%2BI5BBYjyO9V2Q3WcPn%2F%2FFBKey7yBP1siYN05%2Fr%2BRlIzMC%2BZOLE%2FGMlupFy%2BXoDjGRViq2Q7Kh%2BiaVoleYwwYQEr9ZKvm8o%2B1Ied8SAckjHMZ5rF4TJmOp017EHg%3D%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-credentials
false
cf-ray
7f2f991e3a041c28-FRA
x-amz-cf-id
-yQe4VUatzkgzq19dzD6qBzt_6cJtKSfZ25qMzUppn8xeegJmw_-1A==
simplelightbox.min.css
www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/6021532803/1569840493756/Reversinglabs_July2018_Theme/Coded_Files/
5 KB
2 KB
Stylesheet
General
Full URL
https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/6021532803/1569840493756/Reversinglabs_July2018_Theme/Coded_Files/simplelightbox.min.css
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
c44bc92eb78d7b1596789095812e8c24f5c3f9b4835318cf329204d1efc37abb
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Mon, 07 Aug 2023 12:42:11 GMT
strict-transport-security
max-age=31536000
via
1.1 0501dadffc52b06a0cf6aadc57586acc.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
content-security-policy
upgrade-insecure-requests
age
446
x-amz-cf-pop
IAD89-P1
x-amz-request-id
J9KSC9CABFFESGP5
content-encoding
br
x-cache
Miss from cloudfront
x-amz-version-id
Y9o3twj1TmNPLtARM7I8GKUA.atzxWnP
x-hs-https-only
worker
x-hs-cf-lambda
us-east-1.enforceAclForReadsProd 15
alt-svc
h3=":443"; ma=86400
x-amz-id-2
oxraOPjJn53Br6tpYNTq5Te988jVxT29GqKa5BQPszxaSJH0rnsRC6Fcit7hN/U0NvIytO8gLRo=
last-modified
Mon, 30 Sep 2019 10:48:14 GMT
server
cloudflare
etag
W/"9c259f55b65931c5838c0f7cd5f58f93"
vary
origin, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2iNt6xe64dF4DLVSndb3IhYooszoCEbViOyDiq3iUgtgMnRVzPfx3eQr8kMLAsNZtL0wLibsmL7HtpRV1CMBMFasU3VKfqNzefvgaGiTtuoPfwxU61I6%2FVXwxW54y1moJxg2XEiwHjZBEJCyE6smGWcBRw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900, s-maxage=31536000, max-age=31536000
access-control-allow-credentials
false
cf-ray
7f2f991e3a051c28-FRA
x-amz-cf-id
Sg3oF4j5w_b49xgy_GBQc2gzJh4yQ9ybxhTeniZzX9xDLZyfQvcKCg==
x-hs-cf-lambda-enforce
us-east-1.enforceAclForReadsProd 15
tag-list.min.css
www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/11708570900/1657723424898/Modules/Tag_list_-_inline/
834 B
1 KB
Stylesheet
General
Full URL
https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/11708570900/1657723424898/Modules/Tag_list_-_inline/tag-list.min.css
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
0f631dc190b0572010591fe489a4d434db77ce0ff6156e9e7e9aa745156c095c
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

content-security-policy
upgrade-insecure-requests
content-encoding
br
age
446
x-amz-request-id
0BT4PNDSW2FRTFT2
x-amz-server-side-encryption
AES256
x-amz-replication-status
COMPLETED
x-hs-https-only
worker
x-hs-cf-lambda
us-east-1.enforceAclForReadsProd 15
etag
W/"d0f8005c0d02f9ea2078b355ed1700b3"
vary
origin, Accept-Encoding
x-amz-meta-created-unix-time-millis
1657723425746
content-type
text/css
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900, s-maxage=31536000, max-age=31536000
x-hs-cf-lambda-enforce
us-east-1.enforceAclForReadsProd 15
date
Mon, 07 Aug 2023 12:42:11 GMT
strict-transport-security
max-age=31536000
via
1.1 979084a90b32fe3f5fdc377fb6e67b76.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id
R3vEp_hu.nAXB21yRaHK818uFUl.x7KV
x-amz-cf-pop
IAD89-P1
x-hs-alternate-content-type
text/plain
x-cache
RefreshHit from cloudfront
x-amz-storage-class
INTELLIGENT_TIERING
alt-svc
h3=":443"; ma=86400
x-amz-id-2
6BrV+bMAW2zZcmI9DfbxJEdZiguADzTgIgd29gBp1JrcwylJMwHT6ixtc4O11/9zsH1HN5auy5o=
last-modified
Wed, 13 Jul 2022 14:43:46 GMT
server
cloudflare
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=R4hOvEQb7ROjIy1uMwVh%2FCzkuDQLR1rC0gh5KqmAotc5USMAF%2FaGIck%2FIWr2iJ%2Bsxwdj4nvVtEZ49b4jiN4H63klAzeBoxHf%2BvRrO3QnvpYqgztituLtjznct4fGNYCcmY6EToGCZUqMnYEKZiFOXeF7fw%3D%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-credentials
false
cf-ray
7f2f991e3a061c28-FRA
x-amz-cf-id
B2Ndioz5GayXkl4R1Beu6DulRkGVs9v4aFtUg-nl7BlU3EqgSN_87w==
rl-com-logo.svg
www.reversinglabs.com/hubfs/Reversing_Labs_November%202018/Images/
3 KB
2 KB
Image
General
Full URL
https://www.reversinglabs.com/hubfs/Reversing_Labs_November%202018/Images/rl-com-logo.svg
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
4ed697a94ae987ec690170223f411112068b61caf8678788cb4c37347249fd00
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Mon, 07 Aug 2023 12:42:12 GMT
strict-transport-security
max-age=31536000
via
1.1 f1a22cc8d842b0950e4bd5bda60806f2.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-meta-cache-tag
F-6517800726,FD-6517800709,P-3375217,FLS-ALL
content-security-policy
upgrade-insecure-requests
age
252744
x-amz-cf-pop
FRA56-P7
x-amz-request-id
Y6Z201APYHMBA3GA
content-encoding
br
edge-cache-tag
F-6517800726,FD-6517800709,P-3375217,FLS-ALL
cache-tag
F-6517800726,FD-6517800709,P-3375217,FLS-ALL
x-amz-version-id
BUsncvg3SahbgModZfK7dQUIXXLSPFen
x-cache
RefreshHit from cloudfront
x-hs-https-only
worker
x-hs-cf-lambda
us-east-1.EnforceAclForReads 2
alt-svc
h3=":443"; ma=86400
x-amz-id-2
p0oZJA2psZII0vVkNybjTB90mgmD1w98My7yJzLiT8xjn8nwBy8SRTbJrguIn8qJiLZCD/gnqw8=
last-modified
Wed, 14 Nov 2018 07:33:54 GMT
server
cloudflare
etag
W/"86ace497147ac2cd02198f3cde44219e"
vary
Accept-Encoding
access-control-allow-methods
GET
content-type
image/svg+xml
access-control-allow-origin
*
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=15wWHKzsNEbA0O9qALNnZU1RMM6wQ6szQc4b9jx7QiF9pc4wPSrUM0kjMovUfMQve6H7VO%2Bs43QrXbcZ3Gbw%2Bq6sCd9NHCT8Yr%2B1w37IHvSjROxMbDxwYMIkWzOcI6zA5ENfOKRqgRZNe91miXnJuJjg%2Fg%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
cf-ray
7f2f99223f2291f6-FRA
x-amz-cf-id
IEj5TzmNnFs1ep8Ep-PbNFawVXNGC5yDNbWkh5BxfkGFx75FwuNE6Q==
x-hs-cf-lambda-enforce
us-east-1.EnforceAclForReads 2
karlo_zanki.jpg
www.reversinglabs.com/hubfs/Imported_Blog_Media/authors/
18 KB
19 KB
Image
General
Full URL
https://www.reversinglabs.com/hubfs/Imported_Blog_Media/authors/karlo_zanki.jpg
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
262c51d03e4bdb5c91511e2df131b608a522b7a96c6a89048ceb90084b3402dc
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

content-security-policy
upgrade-insecure-requests
x-amz-meta-cache-tag
F-24367560330,FD-8444884887,P-3375217,FLS-ALL
age
488
x-amz-request-id
WSG7FZZ2JEVRK8N0
edge-cache-tag
F-24367560330,FD-8444884887,P-3375217,FLS-ALL
x-hs-https-only
worker
x-hs-cf-lambda
us-east-1.EnforceAclForReads 2
cf-bgj
imgq:85,h2pri
etag
"c40419dee622f0738b5c1f8a5152db50"
vary
Accept-Encoding
access-control-allow-methods
GET
content-type
image/jpeg
access-control-allow-origin
*
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
x-hs-cf-lambda-enforce
us-east-1.EnforceAclForReads 2
date
Mon, 07 Aug 2023 12:42:12 GMT
strict-transport-security
max-age=31536000
via
1.1 4b69099d64ffa1fbe8adbe1235065a14.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id
lfcykLsw0R1YXz10xZ03n4UPI8BPc.OS
x-amz-cf-pop
FRA56-P7
cf-polished
degrade=85, origSize=90381, status=webp_bigger
x-cache
Miss from cloudfront
cache-tag
F-24367560330,FD-8444884887,P-3375217,FLS-ALL
alt-svc
h3=":443"; ma=86400
content-length
18276
x-amz-id-2
QPNfnTDW/siWySsEvDK8LpdLCArdASfuKI5mdU9WUPCgtlNIwaAFTcm55NHLg+YKu+YG5IVXi7g=
last-modified
Tue, 14 Jan 2020 16:45:17 GMT
server
cloudflare
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=PFKZ3utZZYGR%2F19b518jYvOcB5bsW%2BYb3nfTb5V5iC9lfMmKHgQ5kDbUyGCZN7dqPxpkTX4eFBjkZs9joK02qk7hYnWgIn3zZmPLJMUeKxP3BwvGymOt578BUMOHJ4OTCygFgbeI4ZlUjtn4DIlNWyXs2A%3D%3D"}],"group":"cf-nel","max_age":604800}
accept-ranges
bytes
cf-ray
7f2f99226f7091f6-FRA
x-amz-cf-id
5s5r65dIwevslvm19nxpcd7p8vVy5I_BMAX07bX2GHQxk4oB1ZqGyg==
vmconnect-blog-figure1-behaviors.png
www.reversinglabs.com/hs-fs/hubfs/Blog/
52 KB
53 KB
Image
General
Full URL
https://www.reversinglabs.com/hs-fs/hubfs/Blog/vmconnect-blog-figure1-behaviors.png?width=1455&name=vmconnect-blog-figure1-behaviors.png
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
cebbc0e23f1d58a574eab9a677d14629b3aa59a6fbfb0133feb3e03f0e43f754
Security Headers
Name Value
Content-Security-Policy default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Mon, 07 Aug 2023 12:42:12 GMT
strict-transport-security
max-age=31536000
via
1.1 85ca8c4198fb707d10ecc2a784a315be.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-content-type-options
nosniff
content-security-policy
default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
cache-tag
F-128372092758,FD-11822274822,P-3375217,FLS-ALL
x-hs-https-only
worker
alt-svc
h3=":443"; ma=86400
content-length
53054
cf-resized
internal=ok/m q=0 n=928+0 c=1+33 v=2023.7.3 l=53054
last-modified
Fri, 04 Aug 2023 12:08:01 GMT
cf-bgj
imgq:100,h2pri
server
cloudflare
etag
"cfufej3QaZimVEgmG-b-ZxJre5GKd00Nl93VqLII45DQ:a0a8e391d1e908289a78165d747c52a3"
vary
Accept, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=YQAE%2Bs1cvLmSQrbOTSfzOWm5zax0kOOlo%2FNIp7jSVWozaaps9wSOJ2r6Vzh6VFpYQK5gTcz9E2r9UedVGpQz6XOep0%2B8c98k62jqyxp6NxCpyYiwsy8rokvguhWQywEJXya5lhf2BJbO7%2B2k1cOBCCl8TQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/webp
access-control-allow-origin
*
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
accept-ranges
bytes
cf-ray
7f2f9922afc391f6-FRA
vmconnect-blog-figure2-init.png
www.reversinglabs.com/hs-fs/hubfs/Blog/
22 KB
23 KB
Image
General
Full URL
https://www.reversinglabs.com/hs-fs/hubfs/Blog/vmconnect-blog-figure2-init.png?width=1455&name=vmconnect-blog-figure2-init.png
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
b452e67d0f273f9147920b2ec0783838b1ee33727eb9c6fae0a7cff22bf0ac85
Security Headers
Name Value
Content-Security-Policy default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Mon, 07 Aug 2023 12:42:12 GMT
strict-transport-security
max-age=31536000
via
1.1 76d5d69c7419d6e5ee08d1a87f9d8316.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-content-type-options
nosniff
content-security-policy
default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
cache-tag
F-128372335896,FD-11822274822,P-3375217,FLS-ALL
x-hs-https-only
worker
alt-svc
h3=":443"; ma=86400
content-length
22832
cf-resized
internal=ok/h q=0 n=53+89 c=0+0 v=2023.7.3 l=22832
last-modified
Fri, 04 Aug 2023 12:08:01 GMT
cf-bgj
imgq:100,h2pri
server
cloudflare
etag
"cfFt2DVxVAwJfmRRxOIQy60dx2GKd00Nl93VqLII45DQ:7da2d727a22e07f170b074d37a6a926e"
vary
Accept, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6bYaF3ZT9olUHzHbotCi3MX75qb3cdUQ0CVAcooIh2xW45IyqijjyQ7lE%2BMp4Qs48yTdXpCHY7jktGBpW55oGPfEjw4kwQETJImUQvtdVKFbSoxdRy8SrT5jhnwg3dq3C85o9jln%2F4bkNukoA20GmW8r0g%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/webp
access-control-allow-origin
*
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
accept-ranges
bytes
cf-ray
7f2f9922f82991f6-FRA
vmconnect-blog-figure4-loop.png
www.reversinglabs.com/hs-fs/hubfs/Blog/
17 KB
18 KB
Image
General
Full URL
https://www.reversinglabs.com/hs-fs/hubfs/Blog/vmconnect-blog-figure4-loop.png?width=1455&name=vmconnect-blog-figure4-loop.png
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
ddb82c84e1cb4f9ed0e23ada938029f0ac7a79f8a8215eee7bd5177726c02c32
Security Headers
Name Value
Content-Security-Policy default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Mon, 07 Aug 2023 12:42:12 GMT
strict-transport-security
max-age=31536000
via
1.1 544c0277595a14fa38c11c01dc0e79e4.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-content-type-options
nosniff
content-security-policy
default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
cache-tag
F-128374422914,FD-11822274822,P-3375217,FLS-ALL
x-hs-https-only
worker
alt-svc
h3=":443"; ma=86400
content-length
17238
cf-resized
internal=ok/h q=0 n=59+94 c=0+0 v=2023.7.3 l=17238
last-modified
Fri, 04 Aug 2023 12:08:01 GMT
cf-bgj
imgq:100,h2pri
server
cloudflare
etag
"cf_SALb2FHaXCWedM222ZRwjYzGKd00Nl93VqLII45DQ:9d3990287e545845bf5381744ab07eff"
vary
Accept, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=EqrxC%2FSm5pRjok8zt%2BAgmLrLvX5D4H8GRzsL5UNOYo4oUVQVaiZiygha4bYm9XUo6YChpZoEqvWCd4stPPcuz8oUGtdKPR1sxuIVH8YgCAxrX55P8H44%2Fj9uACv4jmLoH1OQ1IHy5Qky%2Buo2Oj6j0udEvg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/webp
access-control-allow-origin
*
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
accept-ranges
bytes
cf-ray
7f2f992348a591f6-FRA
vmconnect-blog-figure5-PyPI_author.png
www.reversinglabs.com/hs-fs/hubfs/Blog/
41 KB
42 KB
Image
General
Full URL
https://www.reversinglabs.com/hs-fs/hubfs/Blog/vmconnect-blog-figure5-PyPI_author.png?width=1455&name=vmconnect-blog-figure5-PyPI_author.png
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
68858bf90cb3efb40b74dc096a0c14d3d7d8df522e30067cbee82f0640af2bab
Security Headers
Name Value
Content-Security-Policy default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Mon, 07 Aug 2023 12:42:12 GMT
strict-transport-security
max-age=31536000
via
1.1 7c75723adf667c2274cb64e1ba92db6c.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-content-type-options
nosniff
content-security-policy
default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
cache-tag
F-128341467472,FD-11822274822,P-3375217,FLS-ALL
x-hs-https-only
worker
alt-svc
h3=":443"; ma=86400
content-length
42454
cf-resized
internal=ok/m q=0 n=896+0 c=2+153 v=2023.7.3 l=42454
last-modified
Fri, 04 Aug 2023 12:08:01 GMT
cf-bgj
imgq:100,h2pri
server
cloudflare
etag
"cf4eAidWT4Kfyr0376G4LYBTEkGKd00Nl93VqLII45DQ:dfca138c459dd0bde26f427b54882fb0"
vary
Accept, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=oryNW7iHAkF8OKQO6dMHlPb23foDewOEDdOFSF0luDQ28kcpBQLWkkxGak1YFmLfO5lNqDDdrAMslE8uBEZIWg2kw7Zas4SjjI%2B3FtMLE%2FZNt4kayvesEHU4Inoj93PrhLrc06Bp2kGxABJdSHN2y5b7bw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/webp
access-control-allow-origin
*
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
accept-ranges
bytes
cf-ray
7f2f992388f591f6-FRA
vmconnect-blog-figure6-PyPI_project.png
www.reversinglabs.com/hs-fs/hubfs/Blog/
186 KB
186 KB
Image
General
Full URL
https://www.reversinglabs.com/hs-fs/hubfs/Blog/vmconnect-blog-figure6-PyPI_project.png?width=1455&name=vmconnect-blog-figure6-PyPI_project.png
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
cc3652de6720e88bb9378b09d34a2e807d1706b7a59a2d29903a68fa481759d5
Security Headers
Name Value
Content-Security-Policy default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Mon, 07 Aug 2023 12:42:12 GMT
strict-transport-security
max-age=31536000
via
1.1 d4a6e22bfb276f18612ccc6f7763ed5e.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-content-type-options
nosniff
content-security-policy
default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
cache-tag
F-128374414403,FD-11822274822,P-3375217,FLS-ALL
x-hs-https-only
worker
alt-svc
h3=":443"; ma=86400
content-length
189956
cf-resized
internal=ok/h q=0 n=28+88 c=0+0 v=2023.7.3 l=189956
last-modified
Fri, 04 Aug 2023 12:08:01 GMT
cf-bgj
imgq:100,h2pri
server
cloudflare
etag
"cfFfRcqUYlcTr9pFJWgfYd3pdbGKd00Nl93VqLII45DQ:1cfbe751e2673baa5ce60b4c41060984"
vary
Accept, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=SVT%2BKl9h7dn0DKpnLWfAnCGpDd%2BqxA37l17%2FhgMytDwb6SpdblQGyXRDDbaNxgpT7Icj%2BBSGpSRkc6IYpnxyxp%2BTzJ3b1YZKsYw%2Fq4b8pUp2s1OWThBlJ8USDR6hfjdi18FZ%2Bvgvi6QrxzQdNwb1MF9dFA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/webp
access-control-allow-origin
*
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
accept-ranges
bytes
cf-ray
7f2f9923f9c291f6-FRA
vmconnect-blog-figure7-husky_github.png
www.reversinglabs.com/hs-fs/hubfs/Blog/
40 KB
41 KB
Image
General
Full URL
https://www.reversinglabs.com/hs-fs/hubfs/Blog/vmconnect-blog-figure7-husky_github.png?width=1455&name=vmconnect-blog-figure7-husky_github.png
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
d0f80d27eb235c529b6f87057ab7763ab82f8eb2396e8d40df573eb80e5364ec
Security Headers
Name Value
Content-Security-Policy default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Mon, 07 Aug 2023 12:42:12 GMT
strict-transport-security
max-age=31536000
via
1.1 ef76486b8b2194781e7708296c3d455c.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-content-type-options
nosniff
content-security-policy
default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
cache-tag
F-128372092759,FD-11822274822,P-3375217,FLS-ALL
x-hs-https-only
worker
alt-svc
h3=":443"; ma=86400
content-length
40814
cf-resized
internal=ok/h q=0 n=117+0 c=4+125 v=2023.7.3 l=40814
last-modified
Fri, 04 Aug 2023 12:08:01 GMT
cf-bgj
imgq:86,h2pri
server
cloudflare
etag
"cf6mRjUQKEMCNe1MHl4G6669OlGKd00Nl93VqLII45DQ:65453383a0255d7d93786baa4e8ea55e"
vary
Accept, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hfg4Wu9F1E4Rjt46bjnablLGxs%2Fzwyhrb5It112PyJAyqnpg8KUPOi3bwRdvbTRlR0fFisb%2FdFZvmwme1OutA0WJQCSzuczREHDGfWXxOz6trfgphmgJa5oBnm8yG%2BgHLvkb60YejkyTc4nO62H8N53wMg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/webp
access-control-allow-origin
*
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
accept-ranges
bytes
cf-ray
7f2f99245a3491f6-FRA
vmconnect-blog-figure8-init_gihub.png
www.reversinglabs.com/hs-fs/hubfs/Blog/
21 KB
21 KB
Image
General
Full URL
https://www.reversinglabs.com/hs-fs/hubfs/Blog/vmconnect-blog-figure8-init_gihub.png?width=1455&name=vmconnect-blog-figure8-init_gihub.png
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
4fe6def01e693b4ff7f8a5baa5663c2b2eb7a228d7eb28ca379d255b640df211
Security Headers
Name Value
Content-Security-Policy default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Mon, 07 Aug 2023 12:42:12 GMT
strict-transport-security
max-age=31536000
via
1.1 a64d90720955c3d3de37aa0526d1a7a4.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-content-type-options
nosniff
content-security-policy
default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
cache-tag
F-128373652739,FD-11822274822,P-3375217,FLS-ALL
x-hs-https-only
worker
alt-svc
h3=":443"; ma=86400
content-length
21010
cf-resized
internal=ok/h q=0 n=67+150 c=0+0 v=2023.7.3 l=21010
last-modified
Fri, 04 Aug 2023 12:08:01 GMT
cf-bgj
imgq:100,h2pri
server
cloudflare
etag
"cfs-ifkdVbVAVeuQWW3EQdNzUMGKd00Nl93VqLII45DQ:cbfb25e399f643ee0577249514d1bb1a"
vary
Accept, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3spvop9xUlsEYk%2F6CbOJ4ipRGpI7nyJ99nv1HG7pOFvGZSI2BKHCgoFTyQx5Yo7NzVevTTAOQwJH6eeuOKThN2CmhjVyLRcPKK5fCXBMFGTcJQOYz3CJssn01Tv7jFLV6%2FJWIpac%2Bx9XnZiMOWqgvsyE1w%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/webp
access-control-allow-origin
*
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
accept-ranges
bytes
cf-ray
7f2f99245a4791f6-FRA
vmconnect-blog-figure9-VMConnect.png
www.reversinglabs.com/hs-fs/hubfs/Blog/
161 KB
162 KB
Image
General
Full URL
https://www.reversinglabs.com/hs-fs/hubfs/Blog/vmconnect-blog-figure9-VMConnect.png?width=1455&name=vmconnect-blog-figure9-VMConnect.png
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
d09af97ee06f58b7c0e071433e4f08dcfc244e3786639a601e31d3227418473a
Security Headers
Name Value
Content-Security-Policy default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Mon, 07 Aug 2023 12:42:12 GMT
strict-transport-security
max-age=31536000
via
1.1 d3c8e64039dcd16cd7cc4074aaecf75c.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-content-type-options
nosniff
content-security-policy
default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
cache-tag
F-128372335897,FD-11822274822,P-3375217,FLS-ALL
x-hs-https-only
worker
alt-svc
h3=":443"; ma=86400
content-length
165108
cf-resized
internal=ok/h q=0 n=49+98 c=0+0 v=2023.7.3 l=165108
last-modified
Fri, 04 Aug 2023 12:08:01 GMT
cf-bgj
imgq:100,h2pri
server
cloudflare
etag
"cfDtEuFLyHnqiI5u-mEeIjwAyrGKd00Nl93VqLII45DQ:b7c5d069ae16571551aedfc140d1cd44"
vary
Accept, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FfVuGsz4oZW2BYY7fiCTmT0Mnb7I3sWK2C69ggg%2FIZOAXyISCOQgINZw1iw5NNPENNrJbnW9Y9J7ntsiSjVnpx0sJZoFa%2BYk2XvhknMjTrDph274WzYXcl4d61wSFnLbllj4lfG59Wtqyy6lGYdJBiyDcw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/webp
access-control-allow-origin
*
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
accept-ranges
bytes
cf-ray
7f2f99247a7f91f6-FRA
vmconnect-blog-figure10-vconnector.png
www.reversinglabs.com/hs-fs/hubfs/Blog/
169 KB
170 KB
Image
General
Full URL
https://www.reversinglabs.com/hs-fs/hubfs/Blog/vmconnect-blog-figure10-vconnector.png?width=1455&name=vmconnect-blog-figure10-vconnector.png
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
e600901c3822e2410c8113d763d1f8babb08aab7d06aa1c861be265408cdf649
Security Headers
Name Value
Content-Security-Policy default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Mon, 07 Aug 2023 12:42:12 GMT
strict-transport-security
max-age=31536000
via
1.1 3e0d912790c2cd730e222487cbb10f98.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-content-type-options
nosniff
content-security-policy
default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
cache-tag
F-128371840411,FD-11822274822,P-3375217,FLS-ALL
x-hs-https-only
worker
alt-svc
h3=":443"; ma=86400
content-length
173076
cf-resized
internal=ok/h q=0 n=37+130 c=0+0 v=2023.7.3 l=173076
last-modified
Fri, 04 Aug 2023 12:08:01 GMT
cf-bgj
imgq:100,h2pri
server
cloudflare
etag
"cftFp7EBIUJYCcv0x9uuWvalXcGKd00Nl93VqLII45DQ:a3fd118096a03f915ee02d3e659ce71b"
vary
Accept, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=QV52clJPN1E3%2B56jUt1mFOElicMzpcdfpW%2BuKnYfgeixVkLQ7Ojd6RuUUznKGZCsc%2BWD8VuKUAFrZINlO7QH%2BX5uguRe75F1v32Ci9zdG4ZqxAt3qX%2FfFB7TN2yU%2FkaPPX9IxSTK5zuSYykmyZ326GYkww%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/webp
access-control-allow-origin
*
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
accept-ranges
bytes
cf-ray
7f2f99248a8591f6-FRA
must-see-sessions-black-hat-2023.jpg
3375217.fs1.hubspotusercontent-na1.net/hub/3375217/hubfs/
38 KB
38 KB
Image
General
Full URL
https://3375217.fs1.hubspotusercontent-na1.net/hub/3375217/hubfs/must-see-sessions-black-hat-2023.jpg?width=480&name=must-see-sessions-black-hat-2023.jpg
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:f0f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
7426c1c0d2289ccde69718bb10ae44a1a6602702194410999afb700e1e580d94
Security Headers
Name Value
Content-Security-Policy default-src 'none'; navigate-to 'none'; form-action 'none'
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Mon, 07 Aug 2023 12:42:12 GMT
via
1.1 5c91d033409cd7607633594f94b09064.cloudfront.net (CloudFront)
x-content-type-options
nosniff
cf-cache-status
HIT
content-security-policy
default-src 'none'; navigate-to 'none'; form-action 'none'
cache-tag
F-128445232020,P-3375217,FLS-ALL
content-length
38412
cf-resized
internal=ok/m q=0 n=188+0 c=11+33 v=2023.7.3 l=38412
last-modified
Fri, 04 Aug 2023 17:26:35 GMT
cf-bgj
imgq:86,h2pri
server
cloudflare
etag
"cfYumcyN5h7tB9G9kNrISFMtgNzQG3Dz_JuxJXtzypDQ:c2dafc0f4f9381d2204a0799a5f235ec"
vary
Accept, Accept-Encoding
content-type
image/webp
access-control-allow-origin
*
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
accept-ranges
bytes
cf-ray
7f2f9924ab25365a-FRA
Join-us-at-Bsides%2c-Black-Hat%2c-Def-on.png
3375217.fs1.hubspotusercontent-na1.net/hub/3375217/hubfs/
21 KB
21 KB
Image
General
Full URL
https://3375217.fs1.hubspotusercontent-na1.net/hub/3375217/hubfs/Join-us-at-Bsides%2c-Black-Hat%2c-Def-on.png?width=480&name=Join-us-at-Bsides%2c-Black-Hat%2c-Def-on.png
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:f0f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
867e2af897e43a15b5cb0cbf905ba563964426f8707d602891643fe039aa2566
Security Headers
Name Value
Content-Security-Policy default-src 'none'; navigate-to 'none'; form-action 'none'
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Mon, 07 Aug 2023 12:42:12 GMT
via
1.1 776fbf9a4fc4b393f157f9f75dd29a06.cloudfront.net (CloudFront)
x-content-type-options
nosniff
cf-cache-status
HIT
content-security-policy
default-src 'none'; navigate-to 'none'; form-action 'none'
cache-tag
F-125626784020,P-3375217,FLS-ALL
content-length
21380
cf-resized
internal=ok/m q=0 n=350+0 c=6+33 v=2023.7.3 l=21380
last-modified
Thu, 20 Jul 2023 15:32:15 GMT
cf-bgj
imgq:86,h2pri
server
cloudflare
etag
"cfKQAtJ6vhYxPAvRVg0GlPAx7QzQG3Dz_JuxJXtzypDQ:b0ec1614a8085e5cb245b7a0f678054a"
vary
Accept, Accept-Encoding
content-type
image/webp
access-control-allow-origin
*
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
accept-ranges
bytes
cf-ray
7f2f9924ab26365a-FRA
air-gap-remote-access-kaspersky.jpg
3375217.fs1.hubspotusercontent-na1.net/hub/3375217/hubfs/
44 KB
45 KB
Image
General
Full URL
https://3375217.fs1.hubspotusercontent-na1.net/hub/3375217/hubfs/air-gap-remote-access-kaspersky.jpg?width=480&name=air-gap-remote-access-kaspersky.jpg
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:f0f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
29d170b4f372603eff8bafec8eedd2dc57712f5e38b276f31c4a5295eeeb9de3
Security Headers
Name Value
Content-Security-Policy default-src 'none'; navigate-to 'none'; form-action 'none'
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Mon, 07 Aug 2023 12:42:12 GMT
via
1.1 afd822e99baebd9321fa9aa8f9350e78.cloudfront.net (CloudFront)
x-content-type-options
nosniff
cf-cache-status
HIT
content-security-policy
default-src 'none'; navigate-to 'none'; form-action 'none'
cache-tag
F-128135521287,P-3375217,FLS-ALL
content-length
45536
cf-resized
internal=ok/m q=0 n=210+0 c=11+34 v=2023.7.3 l=45536
last-modified
Thu, 03 Aug 2023 12:49:14 GMT
cf-bgj
imgq:86,h2pri
server
cloudflare
etag
"cfKtefQyCYdAtrcIkKJuwm6qaCzQG3Dz_JuxJXtzypDQ:24f11135095e0a03c427cb44e068bda0"
vary
Accept, Accept-Encoding
content-type
image/webp
access-control-allow-origin
*
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
accept-ranges
bytes
cf-ray
7f2f9924ab27365a-FRA
tag.svg
www.reversinglabs.com/hubfs/
946 B
2 KB
Image
General
Full URL
https://www.reversinglabs.com/hubfs/tag.svg
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
8dc97419c862f91c4279fb9e2d9a0b7b9b63982ae1d3700a351ea1950c46f564
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

content-security-policy
upgrade-insecure-requests
content-encoding
br
x-amz-meta-cache-tag
F-79211394341,P-3375217,FLS-ALL
age
252744
x-amz-request-id
E01Y81VPVHD41TD5
x-amz-server-side-encryption
AES256
edge-cache-tag
F-79211394341,P-3375217,FLS-ALL
x-amz-replication-status
COMPLETED
x-hs-https-only
worker
x-hs-cf-lambda
us-east-1.EnforceAclForReads 2
etag
W/"27594f47645e4d58406fd3cf3d07e0a2"
vary
Accept-Encoding
access-control-allow-methods
GET
content-type
image/svg+xml
access-control-allow-origin
*
x-amz-meta-created-unix-time-millis
1657811796583
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
x-robots-tag
all
x-hs-cf-lambda-enforce
us-east-1.EnforceAclForReads 2
date
Mon, 07 Aug 2023 12:42:12 GMT
strict-transport-security
max-age=31536000
via
1.1 d76db2cbee553c8bb2de7fd88a960646.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id
aRYhGFr8YswkXmWbJnGhRE6TAiUwxgKw
x-amz-cf-pop
FRA56-P7
x-hs-alternate-content-type
text/plain
x-cache
RefreshHit from cloudfront
cache-tag
F-79211394341,P-3375217,FLS-ALL
x-amz-meta-index-tag
all
x-amz-storage-class
INTELLIGENT_TIERING
alt-svc
h3=":443"; ma=86400
x-amz-id-2
W9fWfkyXzVhcsgKPhrOLob4TsO7RFDVainp6spzW/jPNDFITJ0LGEA+GYiP6PyrifYZHYa2mfx8=
last-modified
Thu, 14 Jul 2022 15:16:37 GMT
server
cloudflare
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=NvcVdiRSPL9OgHjXNryNAsoiXh28%2FO8q729%2FV6CVKxVyLxofmh06FmyE0QOsOTTrGZEjaduR1ThNFwRN4MVqnjjd1NujqsxBzBap66HHcv2fyyELeU7MoMHh65xmiX%2FD20dlDI2Vkyx2EtSL6iFO7ZzdmA%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray
7f2f99248a8791f6-FRA
x-amz-cf-id
ARoyVi_iZh_qPK_iyRH4nsUAmGue5Vhk9LnsNw5jgBRVRcmWsLHh7A==
puzzle.png
www.reversinglabs.com/hs-fs/hubfs/images/
190 B
999 B
Image
General
Full URL
https://www.reversinglabs.com/hs-fs/hubfs/images/puzzle.png?width=24&name=puzzle.png
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
6ba44383bc980179d0772e2785fdb088c71034b7c54607e739bc56c0e1002250
Security Headers
Name Value
Content-Security-Policy default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Mon, 07 Aug 2023 12:42:12 GMT
strict-transport-security
max-age=31536000
via
1.1 1977dea801f0741d1661725223f1ca34.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-content-type-options
nosniff
content-security-policy
default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
cache-tag
F-80971515058,FD-41794900664,P-3375217,FLS-ALL
x-hs-https-only
worker
alt-svc
h3=":443"; ma=86400
content-length
190
cf-resized
internal=ok/m q=0 n=490+0 c=0+0 v=2023.7.3 l=190
last-modified
Wed, 03 Aug 2022 11:16:38 GMT
cf-bgj
imgq:100,h2pri
server
cloudflare
etag
"cfTEUp8Ew9ax83YU-aC7YLXg9u1csUNuQbJ8Ycnj_pDQ:e388a2e47cf27a736b1d0bbd369fa3d1"
vary
Accept, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HgasHm9WlJ6d2I6tSPiAtj4J1WZH5BsdCTkWZfZjni5247lBuuk8X8SZrUfUiXdpn5l2fz0hhcbLZOmQnJ16mlPHzjcfLTwISYzoXIg01hzJHIvL5sMnB6hQb3mXMNsXor2C9l2m2pFmmxoqzLKcmWxnfA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/webp
access-control-allow-origin
*
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
accept-ranges
bytes
cf-ray
7f2f99248a8991f6-FRA
tag-dev-devsec-ops.png
www.reversinglabs.com/hs-fs/hubfs/images/
170 B
989 B
Image
General
Full URL
https://www.reversinglabs.com/hs-fs/hubfs/images/tag-dev-devsec-ops.png?width=24&name=tag-dev-devsec-ops.png
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
94e9a5e460eda83b3532d27cbb92a176ac95f1429ae89f9164d47a29d3370ee2
Security Headers
Name Value
Content-Security-Policy default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Mon, 07 Aug 2023 12:42:12 GMT
strict-transport-security
max-age=31536000
via
1.1 5cf1e5a040860c85477a2471f3114b6a.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-content-type-options
nosniff
content-security-policy
default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
cache-tag
F-85478930439,FD-41794900664,P-3375217,FLS-ALL
x-hs-https-only
worker
alt-svc
h3=":443"; ma=86400
content-length
170
cf-resized
internal=ok/m q=0 n=730+0 c=0+0 v=2023.7.3 l=170
last-modified
Tue, 20 Sep 2022 12:31:04 GMT
cf-bgj
imgq:100,h2pri
server
cloudflare
etag
"cfv7c03z3Ffq_nGeIA5yKSc4mh1csUNuQbJ8Ycnj_pDQ:9183b185622ef93c463aaa428f1f5ec1"
vary
Accept, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3wvIMh3xT7LQeefrpAYHrrw9av%2FgruoVNMSejJLjTXuoRruNelJdFG%2F0Yg24muL4qe%2Be6QEXOhRx%2FvJA19HQjtaIBYKubaVvcSQPgJApxkcdIeYnwAnXsxuMWRznkUw3Es%2Frd7bwXCyXZDcIYhBNwAl%2Bqg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/webp
access-control-allow-origin
*
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
accept-ranges
bytes
cf-ray
7f2f99248a8a91f6-FRA
ico-threat-research.png
www.reversinglabs.com/hs-fs/hubfs/images/
292 B
1 KB
Image
General
Full URL
https://www.reversinglabs.com/hs-fs/hubfs/images/ico-threat-research.png?width=24&name=ico-threat-research.png
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
7b1ecc91aa14b48acb2f7655cc2f4285d7839ab8d239982d4473b02917cd55db
Security Headers
Name Value
Content-Security-Policy default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Mon, 07 Aug 2023 12:42:12 GMT
strict-transport-security
max-age=31536000
via
1.1 729d37e21e9ea52922700604dfdaf082.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-content-type-options
nosniff
content-security-policy
default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
cache-tag
F-80135253149,FD-41794900664,P-3375217,FLS-ALL
x-hs-https-only
worker
alt-svc
h3=":443"; ma=86400
content-length
292
cf-resized
internal=ok/h q=0 n=26+0 c=0+0 v=2023.7.3 l=292
last-modified
Mon, 25 Jul 2022 15:07:22 GMT
cf-bgj
imgq:100,h2pri
server
cloudflare
etag
"cfUSLvJ4c4Cy57IRZiA1hwxqgf1csUNuQbJ8Ycnj_pDQ:e7151140ece53d72171148a7324d4b11"
vary
Accept, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=XJ%2FhMg2kXhWFzq7%2BzuZtBvceD02bR%2F9uoc8SOEER7rgSyEQGiuvMkcBdq2MitrbI5GNCvThM6uanu6m39I7vbbEpBmTvXj8iWv9FlnNEUockbh8SbxJBcBqLdcqSAgGPzDAlI%2F5ICUFR0eCsLIaaqgrUOw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/webp
access-control-allow-origin
*
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
accept-ranges
bytes
cf-ray
7f2f99248a8b91f6-FRA
alarm.png
www.reversinglabs.com/hs-fs/hubfs/images/
224 B
1 KB
Image
General
Full URL
https://www.reversinglabs.com/hs-fs/hubfs/images/alarm.png?width=24&name=alarm.png
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
be806513bf84af0e310b27e6d4c7eaa56119e06690c7b0bc50d728b7e82b3c9f
Security Headers
Name Value
Content-Security-Policy default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Mon, 07 Aug 2023 12:42:12 GMT
strict-transport-security
max-age=31536000
via
1.1 099a327961f82798658bf21aa210d4a0.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-content-type-options
nosniff
content-security-policy
default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
cache-tag
F-80978517010,FD-41794900664,P-3375217,FLS-ALL
x-hs-https-only
worker
alt-svc
h3=":443"; ma=86400
content-length
224
cf-resized
internal=ok/m q=0 n=615+0 c=0+0 v=2023.7.3 l=224
last-modified
Wed, 03 Aug 2022 11:17:23 GMT
cf-bgj
imgq:100,h2pri
server
cloudflare
etag
"cf8LPChb5JPnuX8S6grriML_Pq1csUNuQbJ8Ycnj_pDQ:e129885aca10039ee2de1413175bc2d5"
vary
Accept, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=idcyA6c01RUJ%2B1caHtlGnXso74tbnQxmiewha72oCHHFb8yrPlXMlrxa10JE8XDU19OlHCIKZLr%2FPo%2B8WgpjsgE4i583%2BsKUx3tAFqMv9OkIci9GFVWIutbrrqVeQQEOh5rwjJHt%2BBBaMo9V4OYlrKg3pA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/webp
access-control-allow-origin
*
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
accept-ranges
bytes
cf-ray
7f2f99248a8c91f6-FRA
terminal.png
www.reversinglabs.com/hs-fs/hubfs/images/
198 B
1017 B
Image
General
Full URL
https://www.reversinglabs.com/hs-fs/hubfs/images/terminal.png?width=24&name=terminal.png
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
4bc7148ba69c82eccc86c4a9b90d4cf456d9129c9503ad143c8005735f3fb8ba
Security Headers
Name Value
Content-Security-Policy default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Mon, 07 Aug 2023 12:42:12 GMT
strict-transport-security
max-age=31536000
via
1.1 4dd80d99fd5d0f6baaaf5179cd921f72.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-content-type-options
nosniff
content-security-policy
default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
cache-tag
F-80972444337,FD-41794900664,P-3375217,FLS-ALL
x-hs-https-only
worker
alt-svc
h3=":443"; ma=86400
content-length
198
cf-resized
internal=ok/m q=0 n=564+0 c=0+0 v=2023.7.3 l=198
last-modified
Wed, 03 Aug 2022 11:18:30 GMT
cf-bgj
imgq:100,h2pri
server
cloudflare
etag
"cf6bMIImIWOdGtWqvTkruXE1Mt1csUNuQbJ8Ycnj_pDQ:df29f53ad31749ce8ebed7c59dfda5a3"
vary
Accept, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=UVm%2BEICmw2CoA66tTYs00CYxwcLp93yXrvp8a%2FSqTeGehX9489v0Z3WjJXI2L7FM8oe2YcA4OTObrnuI%2Fbmzdvif8g4zqU3YoKiNYOAeN5li%2Bvz1dvJIcC1CVKxt1u4vnCymFTA1Qk9If4OX2%2FrjYFhnHQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/webp
access-control-allow-origin
*
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
accept-ranges
bytes
cf-ray
7f2f99248a8d91f6-FRA
calendar-three.png
www.reversinglabs.com/hs-fs/hubfs/images/
222 B
1 KB
Image
General
Full URL
https://www.reversinglabs.com/hs-fs/hubfs/images/calendar-three.png?width=24&name=calendar-three.png
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
09d01a00c23781420e6623249a514a995ea7dd8417159f308ca5391078243928
Security Headers
Name Value
Content-Security-Policy default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Mon, 07 Aug 2023 12:42:12 GMT
strict-transport-security
max-age=31536000
via
1.1 ebc2f999559db1a05f6ebf1e799bb574.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-content-type-options
nosniff
content-security-policy
default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
cache-tag
F-80978517087,FD-41794900664,P-3375217,FLS-ALL
x-hs-https-only
worker
alt-svc
h3=":443"; ma=86400
content-length
222
cf-resized
internal=ok/h q=0 n=57+0 c=0+0 v=2023.7.3 l=222
last-modified
Wed, 03 Aug 2022 11:19:08 GMT
cf-bgj
imgq:100,h2pri
server
cloudflare
etag
"cfSCUVVewrbUrCezSPDCvLRaq61csUNuQbJ8Ycnj_pDQ:18503effdeb9c9bf3130e4d9c19e5f39"
vary
Accept, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ugKQHoyZjgk12l2dIsZC9Ld4fISY%2BbXGS7mzNkVYIuNCqTttrzB6cE39qF45Ll1iKOIXR%2BWM1KBG2h%2FrfpypjZE6Q7%2BLTfNqwDX2sKfkneay%2FbvwjyOczyiS5XHL09Qcp2v4L17xRhdpWbGMDtcWUkPylw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/webp
access-control-allow-origin
*
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
accept-ranges
bytes
cf-ray
7f2f99248a8e91f6-FRA
ConversingLabs-S4E10-Creating-the-Standard-for-Supply-Chain-Risk.jpg
www.reversinglabs.com/hubfs/ConversingLabs/
126 KB
128 KB
Image
General
Full URL
https://www.reversinglabs.com/hubfs/ConversingLabs/ConversingLabs-S4E10-Creating-the-Standard-for-Supply-Chain-Risk.jpg
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
d57a29c035e1164e865f08b030edaa603ee2a60d806138df4c2975eac83cb08f
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

content-security-policy
upgrade-insecure-requests
x-amz-meta-cache-tag
F-119368537456,FD-69168798251,P-3375217,FLS-ALL
age
252744
x-amz-request-id
0PAPW9M00MDEWSJN
x-amz-server-side-encryption
AES256
edge-cache-tag
F-119368537456,FD-69168798251,P-3375217,FLS-ALL
x-amz-replication-status
COMPLETED
x-hs-https-only
worker
content-disposition
inline; filename="ConversingLabs-S4E10-Creating-the-Standard-for-Supply-Chain-Risk.webp"
x-hs-cf-lambda
us-east-1.EnforceAclForReads 2
cf-bgj
imgq:85,h2pri
etag
"8edb1e262542561f086a7d70308044f2"
vary
Accept, Accept-Encoding
access-control-allow-methods
GET
content-type
image/webp
access-control-allow-origin
*
x-amz-meta-created-unix-time-millis
1686228293352
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
x-robots-tag
all
x-hs-cf-lambda-enforce
us-east-1.EnforceAclForReads 2
date
Mon, 07 Aug 2023 12:42:12 GMT
strict-transport-security
max-age=31536000
via
1.1 6be461c5a9399007c1540eee90371674.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id
dPT6TZvb.kLAJ9gmDvqn5Ei_fgYVy3Sm
x-amz-cf-pop
FRA56-P7
x-hs-alternate-content-type
text/plain
cf-polished
qual=85, origFmt=jpeg, origSize=252204
x-cache
RefreshHit from cloudfront
cache-tag
F-119368537456,FD-69168798251,P-3375217,FLS-ALL
x-amz-meta-index-tag
all
x-amz-storage-class
INTELLIGENT_TIERING
alt-svc
h3=":443"; ma=86400
content-length
129440
x-amz-id-2
AwupxXKdSxS8jFo/wDXy7IwlIgJhJcgqlynQ33d/ZUAta8GWkxPadqNtWZH+Lm906HQaQvpCDOdgSQ48hbdFsjtrxafpG4MJ82E8akVO2II=
last-modified
Thu, 08 Jun 2023 12:44:54 GMT
server
cloudflare
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2FWm8ArZvn1zgY06pMQ7yxr39hFATjcs%2BdUDAZj6%2BZSBnQSIAt2di8Eu3Lp3E95Ap2Tpk3NHOGl0WKMLGsY%2B%2BXMrU%2F%2FvOWB32ln8UvH6L3eT7E4P%2BMrT8UoULjEFQaaDvQssFlm24P1YYCVi0iqtrSffpgQ%3D%3D"}],"group":"cf-nel","max_age":604800}
accept-ranges
bytes
cf-ray
7f2f99248a8f91f6-FRA
x-amz-cf-id
imAp0nZ6xxYh9GkGUWPqSe3DgJ5lxwBHSpTqYVXEadPqqfLzBDLDXg==
SSCS%20Vulns%20vs%20Malware%20v2%20%281%29.png
www.reversinglabs.com/hubfs/
458 KB
459 KB
Image
General
Full URL
https://www.reversinglabs.com/hubfs/SSCS%20Vulns%20vs%20Malware%20v2%20%281%29.png
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
ec283af1b220ae388d616832c82a2612f2630ac572784dd39b6d2c5b8e81e7aa
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

content-security-policy
upgrade-insecure-requests
x-amz-meta-cache-tag
F-128054183304,P-3375217,FLS-ALL
age
21714
x-amz-request-id
CYC9KF0CVAQ1P9T5
x-amz-server-side-encryption
AES256
edge-cache-tag
F-128054183304,P-3375217,FLS-ALL
x-amz-replication-status
COMPLETED
x-hs-https-only
worker
content-disposition
inline; filename="SSCS%20Vulns%20vs%20Malware%20v2%20%281%29.webp"
x-hs-cf-lambda
us-east-1.EnforceAclForReads 2
cf-bgj
imgq:85,h2pri
etag
"6fd3531028492e6451288b395ff0aba1"
vary
Accept, Accept-Encoding
access-control-allow-methods
GET
content-type
image/webp
access-control-allow-origin
*
x-amz-meta-created-unix-time-millis
1691007621369
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
x-robots-tag
all
x-hs-cf-lambda-enforce
us-east-1.EnforceAclForReads 2
date
Mon, 07 Aug 2023 12:42:12 GMT
strict-transport-security
max-age=31536000
via
1.1 837a869ba82f4a85a2e5810b11746698.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id
1gITI7UH1lp9vpl7Goz4qSuO9Ek5JrFZ
x-amz-cf-pop
FRA56-P7
x-hs-alternate-content-type
text/plain
cf-polished
origFmt=png, origSize=531429
x-cache
RefreshHit from cloudfront
cache-tag
F-128054183304,P-3375217,FLS-ALL
x-amz-meta-index-tag
all
x-amz-storage-class
INTELLIGENT_TIERING
alt-svc
h3=":443"; ma=86400
content-length
468664
x-amz-id-2
TXhwwDBzjJP4JIJC7xkFR9K8rMrxYHa7prMpEWq+Q6V0+IL4d7zjD6uKmHzioiJWlqRtU3QwUWgT2Fy2N2r9rKOZYS4jpl7rZmcjbqqXH7Y=
last-modified
Wed, 02 Aug 2023 20:20:22 GMT
server
cloudflare
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dFiNhVJzsbR%2F59zyIYkLrduDMH5bUdMwfl%2F0t47eyEazlr2JrG6eqvh4gUrt0FRAxenmho4pMwfGHvJGkEhdFvapE3aK4SNxljsfWP3w792XGp7b8RdSIQWkR7BknJQgFk7GerTkQI76oOTF31KFpVvZmQ%3D%3D"}],"group":"cf-nel","max_age":604800}
accept-ranges
bytes
cf-ray
7f2f99248a9091f6-FRA
x-amz-cf-id
S8P50aGiWMOKpsXvOXAEbf37DRWdVy74YKxRL9UDpQ8jOsGWoyfZ7w==
Webpage-Banner-Software-Package-Deconstruction-EP07-1400x732.jpg
www.reversinglabs.com/hubfs/
98 KB
99 KB
Image
General
Full URL
https://www.reversinglabs.com/hubfs/Webpage-Banner-Software-Package-Deconstruction-EP07-1400x732.jpg
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
199a07091795dc18d5f648c8ae6ea323b953a6232f814e35c0217925de105a94
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

content-security-policy
upgrade-insecure-requests
x-amz-meta-cache-tag
F-127116244143,P-3375217,FLS-ALL
age
252744
x-amz-request-id
DWBEMC3RPDQCKZRR
x-amz-server-side-encryption
AES256
edge-cache-tag
F-127116244143,P-3375217,FLS-ALL
x-amz-replication-status
COMPLETED
x-hs-https-only
worker
content-disposition
inline; filename="Webpage-Banner-Software-Package-Deconstruction-EP07-1400x732.webp"
x-hs-cf-lambda
us-east-1.EnforceAclForReads 2
cf-bgj
imgq:85,h2pri
etag
"d863474a07d18297d34a6ab8da71a3c8"
vary
Accept, Accept-Encoding
access-control-allow-methods
GET
content-type
image/webp
access-control-allow-origin
*
x-amz-meta-created-unix-time-millis
1690395688500
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
x-robots-tag
all
x-hs-cf-lambda-enforce
us-east-1.EnforceAclForReads 2
date
Mon, 07 Aug 2023 12:42:12 GMT
strict-transport-security
max-age=31536000
via
1.1 4a95385e61c9df8f5f8de6338a3fe59a.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id
p9dFM0KI5I.1lHtGTE3Sw.K9.1pZvEwT
x-amz-cf-pop
FRA56-P7
x-hs-alternate-content-type
text/plain
cf-polished
qual=85, origFmt=jpeg, origSize=254194
x-cache
RefreshHit from cloudfront
cache-tag
F-127116244143,P-3375217,FLS-ALL
x-amz-meta-index-tag
all
x-amz-storage-class
INTELLIGENT_TIERING
alt-svc
h3=":443"; ma=86400
content-length
100108
x-amz-id-2
P5zw/fxtP8pRYoKAfmmT0n12Dob6PEB/oHRFCsIkeoDUFcZFB5ICQH/yZOeDlrdhzE1ayEOhbhw=
last-modified
Wed, 26 Jul 2023 18:21:29 GMT
server
cloudflare
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=a%2F%2BGwBOSw371jd0VebsnZXZj8Oy82Fw5sVw51ErU3lpo5MLeMJUhndvfxfnTVDxFhcpdDxHjV8V%2FZ58yL9BLIw%2Fk3WiFxYEoOUniIm1qsDhgh73DKIHl0Tch3CcbkbFLPv5rbNbC3js4hfXs6dkoX0Au6g%3D%3D"}],"group":"cf-nel","max_age":604800}
accept-ranges
bytes
cf-ray
7f2f99248a9191f6-FRA
x-amz-cf-id
6YoDg0ILGQRaslgNioyIZsnH6KQhxSh6N7l4prBgx1-p5Ftoq_iUSQ==
jquery.min.js
cdnjs.cloudflare.com/ajax/libs/jquery/3.7.0/
85 KB
27 KB
Script
General
Full URL
https://cdnjs.cloudflare.com/ajax/libs/jquery/3.7.0/jquery.min.js
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d8f9afbf492e4c139e9d2bcb9ba6ef7c14921eb509fb703bc7a3f911b774eff8
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

Referer
Origin
https://www.reversinglabs.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Mon, 07 Aug 2023 12:42:11 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=15780000
age
331056
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
27437
last-modified
Tue, 01 Aug 2023 17:19:52 GMT
server
cloudflare
cf-cdnjs-via
cfworker/r2
etag
"64c93eb8-6b2d"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vjcl87xFd6GoPnxk6Mgl4An%2FGEAB99L4VCN9aHJFDAoQDz3XM0sFC0Dz8sHE62WOTQuwCF7P%2BJKpG4mYEX92UnmlfnM9yg%2FNZsf5kuxdeehX%2Fy4H0DZfC%2BcJ6tIEIVmt%2BQGcRT2l5UQMqTiDb28Fs8l5"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=30672000
accept-ranges
bytes
timing-allow-origin
*
cf-ray
7f2f991f3a491d8c-FRA
expires
Sat, 27 Jul 2024 12:42:11 GMT
embed.js
static.hsappstatic.net/content-cwv-embed/static-1.372/
12 KB
5 KB
Script
General
Full URL
https://static.hsappstatic.net/content-cwv-embed/static-1.372/embed.js
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:8f65 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
48caefba7197eca695349c196a4fb51a5998c8f3bd365988462d71e3c65a4b1d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Mon, 07 Aug 2023 12:42:12 GMT
x-amz-version-id
y7ND9ey1AdjRUW5XrlhHQ1urKE3DE81O
via
1.1 891011d51eb2353ebe8601f5b6467070.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-amz-cf-pop
FRA56-P2
age
429805
x-amz-server-side-encryption
AES256
content-encoding
br
x-cache
Hit from cloudfront
x-amz-replication-status
COMPLETED
alt-svc
h3=":443"; ma=86400
last-modified
Tue, 01 Aug 2023 20:39:52 GMT
server
cloudflare
etag
W/"fa27a9379786a382617de08f3ae57836"
vary
Origin,Accept-Encoding,Access-Control-Request-Headers,Access-Control-Request-Method
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KdcG7WYRZK67wLkmPXh9T0osRNZi3f4WSWv8meHYXRRCDTuLIg5TNbKBqpzbsBcjShDnecyklCoTyGAk%2FR5uljPui7sqo1QVrwjG8KO3Tn4XhkO01ip9X5hFUzNYtbUNnoB7UDV9lJi8gEDez2JJglx7abw%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
public, max-age=31536000
cf-ray
7f2f9924ac3c5b50-FRA
x-amz-cf-id
m-oF25phlCphIf6dCAd0qmIMx9c6wpxZQFa_Zx58B-_o8ibOsWdnxg==
expires
Tue, 06 Aug 2024 12:42:12 GMT
simple-lightbox-min.js
www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/6021916068/1569840500063/Reversinglabs_July2018_Theme/Coded_Files/
7 KB
4 KB
Script
General
Full URL
https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/6021916068/1569840500063/Reversinglabs_July2018_Theme/Coded_Files/simple-lightbox-min.js
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
d6dc97993d7e4803aeb35d0e9a24f0393eceb43de5f7ff0f0e437f1b05aea4e2
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

content-security-policy
upgrade-insecure-requests
content-encoding
br
age
487
x-amz-request-id
H42K3MH7TZVXFF5H
x-evy-trace-route-service-name
envoyset-translator
x-hs-https-only
worker
x-hs-cf-lambda
us-east-1.enforceAclForReadsProd 20
x-evy-trace-listener
listener_https
etag
W/"d02c339064b8d2b370bc4e18fa6ae421"
vary
origin, Accept-Encoding
content-type
application/javascript; charset=utf-8
x-evy-trace-virtual-host
all
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-hs-cf-lambda-enforce
us-east-1.enforceAclForReadsProd 20
date
Mon, 07 Aug 2023 12:42:11 GMT
strict-transport-security
max-age=31536000
via
1.1 c3d335addde48969fafe25d4064cee80.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id
FsEJuIr7CYCWLWb_isdf3JLdbLwDP7p.
x-amz-cf-pop
IAD12-P3
x-cache
RefreshHit from cloudfront
x-envoy-upstream-service-time
253
alt-svc
h3=":443"; ma=86400
x-amz-id-2
h84pfZiqlEUqzWk3B4QyWId8zMJDoF3j4jPsPmK2zkGBSl3nw0TayFcgwDhKxeVxxVo5TJCE+4E=
x-request-id
13bed4ec-9bf0-4b6e-bca4-8a5fd2a4a053
x-evy-trace-route-configuration
listener_https/all
last-modified
Mon, 30 Sep 2019 10:48:21 GMT
server
cloudflare
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=oW6Thy9l3O%2Fm00QGT%2BeEsLicR3I6NG%2Fo2%2BDZWtXZqYjOQS%2B2a%2B6gbXxxbG3wM0WWCEe53oyP4NMYYCEmy0utGCSliXW2gBWUjtWWPYIu%2BGIl4HxsIStiy6yqfrNyzKHt7167y%2F97No24l7DP4rEx800fsA%3D%3D"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod
iad02/cms-hubfs-td/envoy-proxy-55b7d448b-fwhk5
access-control-allow-credentials
false
cf-ray
7f2f991f5b7791f6-FRA
x-amz-cf-id
HVhQ5PMUnqs7Zcwj-8vhwczl-jEJI2QPAl3Zy9hfDABHiQte0CrN_Q==
rd-2019-main.min.js
www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/11190015046/1639664698263/Redesign_june_2019/Coded_Files/JS/
2 KB
2 KB
Script
General
Full URL
https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/11190015046/1639664698263/Redesign_june_2019/Coded_Files/JS/rd-2019-main.min.js
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
589ec6096d83ed322d2e1cf7b85f978ecfe80dc19aab6ac106ef5e2352e32269
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Mon, 07 Aug 2023 12:42:11 GMT
strict-transport-security
max-age=31536000
via
1.1 470d4277236d0557f3e42c6bfe9dac78.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
content-security-policy
upgrade-insecure-requests
age
877
x-amz-cf-pop
IAD89-P1
x-amz-server-side-encryption
AES256
x-amz-request-id
C7DZSR8Q6EK9RM60
x-hs-alternate-content-type
text/plain
x-cache
RefreshHit from cloudfront
x-amz-version-id
I5.cidQ.vGRls6iGZkmuPTBztEr2IVdj
content-encoding
br
x-amz-replication-status
COMPLETED
x-hs-https-only
worker
x-hs-cf-lambda
us-east-1.enforceAclForReadsProd 15
alt-svc
h3=":443"; ma=86400
x-amz-id-2
pfF1DSUo3s0cNvj3V0nRDAXu3dHPSnupagysYaQR0CaLbv3YiGGQJflhVIVlSDdBZFTUbJDkM1o=
last-modified
Thu, 16 Dec 2021 14:24:59 GMT
server
cloudflare
etag
W/"b2a254916a67659b4df42aa3c333359a"
vary
origin, Accept-Encoding
x-amz-meta-created-unix-time-millis
1639664698586
content-type
application/javascript; charset=utf-8
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=MGL3pm4Guaj%2BvFq%2FWOBj6KzUzzcsuGAB1BRsA5LW4py8gFXNs3XuhDHdJrV9vOPsmj9%2F%2BpXUXFwcCBBjuXqt1twojnVNWaeDVATPQ7immzkGeDbjQj4ofhbKLfNr21RFznAY0OEU3WbAnUV%2BZuDLDos6RA%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900, s-maxage=31536000, max-age=31536000
access-control-allow-credentials
false
cf-ray
7f2f991fbbf891f6-FRA
x-amz-cf-id
VioiiEcMpFuOZgHJns3L29Y-j7rcH2rXTd1-uHY7WG3ge9ZctS1-hA==
x-hs-cf-lambda-enforce
us-east-1.enforceAclForReadsProd 15
jscookie.min.js
www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/28203361861/1586494134457/Redesign_june_2019/Coded_Files/JS/
1 KB
2 KB
Script
General
Full URL
https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/28203361861/1586494134457/Redesign_june_2019/Coded_Files/JS/jscookie.min.js
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
bc595999f7c46e3f7a293c86fcc256c35467e9947bf0051464628416f1db14f0
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Mon, 07 Aug 2023 12:42:11 GMT
strict-transport-security
max-age=31536000
via
1.1 c0b0d7167cc2eb52d8d154aa7fc03a0a.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
content-security-policy
upgrade-insecure-requests
age
877
x-amz-cf-pop
IAD12-P3
x-amz-server-side-encryption
AES256
x-amz-request-id
V9NKNPV3RF377GPW
content-encoding
br
x-cache
RefreshHit from cloudfront
x-amz-version-id
_PdfjdMgm8.M2DiCSVpcYFrpWe519SIO
x-hs-https-only
worker
x-hs-cf-lambda
us-east-1.enforceAclForReadsProd 15
alt-svc
h3=":443"; ma=86400
x-amz-id-2
fILsc0qCRgAtGgiTHtx9HhgXrElg6McyzHWdsAfrz93wUPjyXdnJsYPrQXSPhZgAdLrW/0Uc8+E=
last-modified
Fri, 10 Apr 2020 04:48:55 GMT
server
cloudflare
etag
W/"93c12b195cd05418a85b4eafc15c92fb"
vary
origin, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=bjP0TJMeP1zKcRNpHED3QlfsnyLICIKgO%2FtM%2FnVhUnrWH2WSJb3rY0WPmwOu1EY9%2F4ZG0czWJiKPR7IrusfGGrpqfXK3H1IkVRnBHWXrp0lOAmHxVWs8z7iWxHGEPNlvUDSBUFeJ3FY%2BUgdu%2B4SuHuPvpg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900, s-maxage=31536000, max-age=31536000
access-control-allow-credentials
false
cf-ray
7f2f991ffc3d91f6-FRA
x-amz-cf-id
aQqrDJgfajBTImIBVFxo2nylKzNYo5vhaM3gd5Omp_6NSgVflv1n1A==
x-hs-cf-lambda-enforce
us-east-1.enforceAclForReadsProd 15
tiny-slider.min.js
www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/21052151416/1577281626952/Redesign_june_2019/Custom_Modules/Sliders/JS/
31 KB
14 KB
Script
General
Full URL
https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/21052151416/1577281626952/Redesign_june_2019/Custom_Modules/Sliders/JS/tiny-slider.min.js
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
37eae8190baecf55f16575bf754238976116ad37b55f81e27db05743461cd507
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Mon, 07 Aug 2023 12:42:11 GMT
strict-transport-security
max-age=31536000
via
1.1 470d4277236d0557f3e42c6bfe9dac78.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
content-security-policy
upgrade-insecure-requests
age
877
x-amz-cf-pop
IAD89-P1
x-amz-request-id
558YDE7RKW824B7Z
content-encoding
br
x-cache
RefreshHit from cloudfront
x-amz-version-id
a_gzCem69enGGi103.H.X02BRl8OY0mV
x-hs-https-only
worker
x-hs-cf-lambda
us-east-1.enforceAclForReadsProd 15
alt-svc
h3=":443"; ma=86400
x-amz-id-2
VDlncO/fnULjHbCYMh4KX5vUwZEynS5Ab+l2vajG+svBBfzUxvfhaaJH0ZbTFFpsma6WHB3NSBM=
last-modified
Wed, 25 Dec 2019 13:47:07 GMT
server
cloudflare
etag
W/"6603e5d1b1eded8b550dc3ef7fbe687d"
vary
origin, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=s6JaefnH%2BmBV1bg7jih1ZKEtEvDZrsC02Byq37vKtEabC6J45gE8kUpPj3Iy7xYWM6%2BOFrn0So6wW0HLTrvJksxg0tQx4Ww%2FmpncgzxO%2FusLezLvH9GwOx23bLPv%2F5vDEIkVQXCdiKcFDkx3q6vKMciSXg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900, s-maxage=31536000, max-age=31536000
access-control-allow-credentials
false
cf-ray
7f2f99202c7d91f6-FRA
x-amz-cf-id
BkWG8JtGhPQ_pHatQvnBBeJXJ305LmAyl9bNsyKwNHOAwEHkjzYYaw==
x-hs-cf-lambda-enforce
us-east-1.enforceAclForReadsProd 15
module_28186900061_StickyBar.min.js
www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/module_assets/28186900061/1683494323317/
1 KB
2 KB
Script
General
Full URL
https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/module_assets/28186900061/1683494323317/module_28186900061_StickyBar.min.js
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
f35c317df74c5ceaca83bc620ab17f68e882a21e5378933002f20aae3af0517f
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

content-security-policy
upgrade-insecure-requests
content-encoding
br
age
1790
x-amz-request-id
80GNJQM6FRHN4BA8
x-amz-server-side-encryption
AES256
x-evy-trace-route-service-name
envoyset-translator
x-amz-replication-status
COMPLETED
x-hs-https-only
worker
x-hs-cf-lambda
us-east-1.enforceAclForReadsProd 20
x-evy-trace-listener
listener_https
etag
W/"05f529f2d7b3ca476f37bdcf0b96ef7e"
vary
origin, Accept-Encoding
x-amz-meta-created-unix-time-millis
1683494323317
content-type
application/javascript; charset=utf-8
x-evy-trace-virtual-host
all
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-hs-cf-lambda-enforce
us-east-1.enforceAclForReadsProd 20
date
Mon, 07 Aug 2023 12:42:11 GMT
strict-transport-security
max-age=31536000
via
1.1 7a99ed3f39c18af8fe138a695e5f657c.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id
Dj1AN92dBhP0GYrdJYdEZgTGEMSZDLdS
x-amz-cf-pop
IAD89-C1
x-hs-alternate-content-type
text/plain
x-cache
RefreshHit from cloudfront
x-amz-storage-class
INTELLIGENT_TIERING
x-envoy-upstream-service-time
98
alt-svc
h3=":443"; ma=86400
x-amz-id-2
1hy2ztk0sACwGhSaHXYGJTePyK2ElHBN6n6KqLJWX/hSVZLtLds/IPQ+WQYqlA9cxxggdjz4BtA=
x-evy-trace-route-configuration
listener_https/all
x-request-id
f572166f-83a7-408e-93ef-ff2c31e30e6d
last-modified
Sun, 07 May 2023 21:18:44 GMT
server
cloudflare
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VayJ0t7Mz3Hj24NbAWl2ECHk%2F2I3%2FYcXCQW5UF%2F7ugnc60upFvO3b%2FPkQ%2FaHPgoCuYD2RBwxZIiBtjTm4jUGLZ%2FQDPi45g%2FnCw3eUU4FU07DJVjMAV9nLn9AtzuuzNx6v%2BeDtDzsK0kimJ1OW%2B44zw7E3g%3D%3D"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod
iad02/cms-hubfs-td/envoy-proxy-55b7d448b-rwfnd
access-control-allow-credentials
false
cf-ray
7f2f99207ce791f6-FRA
x-amz-cf-id
nXR_gmwXMnT_HcUaEkIukORt9QClCbVkQ6HKo-u93_Kum0m6YhmVKQ==
micromodal.js
www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/11395370929/1569840498778/Redesign_june_2019/Coded_Files/JS/
5 KB
3 KB
Script
General
Full URL
https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/11395370929/1569840498778/Redesign_june_2019/Coded_Files/JS/micromodal.js
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
c9b277f813652ab4fc3476fe4b9771d2d29e10204caef39416ad8d30e45fc5a2
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

content-security-policy
upgrade-insecure-requests
content-encoding
br
age
877
x-amz-request-id
7E1VQ66FKNKKQ08V
x-evy-trace-route-service-name
envoyset-translator
x-hs-https-only
worker
x-hs-cf-lambda
us-east-1.enforceAclForReadsProd 20
x-evy-trace-listener
listener_https
etag
W/"84194eded494d011e2828f00329b15c6"
vary
origin, Accept-Encoding
content-type
application/javascript; charset=utf-8
x-evy-trace-virtual-host
all
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-hs-cf-lambda-enforce
us-east-1.enforceAclForReadsProd 20
date
Mon, 07 Aug 2023 12:42:11 GMT
strict-transport-security
max-age=31536000
via
1.1 6bc1c280aeef9bbdeb102c7f4e4f773e.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id
3FilIB6THj7cvPLh93UnKYXf5w_lQZsq
x-amz-cf-pop
IAD89-C1
x-cache
RefreshHit from cloudfront
x-envoy-upstream-service-time
113
alt-svc
h3=":443"; ma=86400
x-amz-id-2
+7Dd1wnp4I4QGZJVEC4gEfZnnpANuHNP4+5tiEf+RBSwgJqsxbDMe6hfDdGNDXFlDiKnZF7J4SA=
x-request-id
9d752046-f070-46ef-9342-22189ad277a4
x-evy-trace-route-configuration
listener_https/all
last-modified
Mon, 30 Sep 2019 10:48:19 GMT
server
cloudflare
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=SP8N4805hKAfDKArz%2FR%2FNgqY3I4VMQBqHHlfo7Aq4y8OLgMs2itu0RJrJEp175BbghysSlChLNvT0A%2FEikBpTIai13e%2B8weRxoehSM5ZqgBEcgD%2FQeMjMLRrAdh23w1O3ZgUV6ZE0rMq9vN%2BU7Csi51hvA%3D%3D"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod
iad02/cms-hubfs-td/envoy-proxy-55b7d448b-hlzsf
access-control-allow-credentials
false
cf-ray
7f2f9920ad2391f6-FRA
x-amz-cf-id
oVEFF-0IlCXdy8qma87Tg-WOGFp7Ho-JFdZZirW7K8Go5wYkrMnEaw==
module_11395370497_Redesign_june_2019_Custom_Modules_Site_Search_Input_-_Header_Modal.min.js
www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/module_assets/1563505647431/
3 KB
2 KB
Script
General
Full URL
https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/module_assets/1563505647431/module_11395370497_Redesign_june_2019_Custom_Modules_Site_Search_Input_-_Header_Modal.min.js
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
130eb7bbe1dca232b6636767637e6bdc2a35fc2d412db3a601593d79c1d743a5
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Mon, 07 Aug 2023 12:42:12 GMT
strict-transport-security
max-age=31536000
via
1.1 c0b0d7167cc2eb52d8d154aa7fc03a0a.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
content-security-policy
upgrade-insecure-requests
age
1791
x-amz-cf-pop
IAD12-P3
x-amz-request-id
K07YSYYM5GRJW4FE
content-encoding
br
x-cache
RefreshHit from cloudfront
x-amz-version-id
uYaggxrRRLpm1_Oqgp40jmGQ7KENtM4f
x-hs-https-only
worker
x-hs-cf-lambda
us-east-1.enforceAclForReadsProd 15
alt-svc
h3=":443"; ma=86400
x-amz-id-2
nQbHCH7W2RdfTKYGRArrUk2TfYfoq3d2P8s7v2fT4D5AwZ8p/fm5LCVSH9EGLcCf9b7lOV3f8RQ=
last-modified
Fri, 19 Jul 2019 03:07:28 GMT
server
cloudflare
etag
W/"c27b7b6ea1f66fa47d64742279aee97a"
vary
origin, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=uWH0QUJybWRkVn%2FunlUyr1haMYX709q21kOhWPIqeilM3qPo4XybXDj5MMI9ohG%2FpwqWOYWHWbC9yUB2YD209M6nxpHO3HOrCCvRxlFYubv9WQz0I4E3%2B6MO4ZLWBKtxRuqsAESj%2BXm%2FcDX5nbS4JLQUaw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900, s-maxage=31536000, max-age=31536000
access-control-allow-credentials
false
cf-ray
7f2f9920ed6b91f6-FRA
x-amz-cf-id
sFVqWBw_sl6kWZIJXvhzAlshdZqnv612O93SZ8LwBnruiKM1okxy8g==
x-hs-cf-lambda-enforce
us-east-1.enforceAclForReadsProd 15
module_36845096476_Blog_listing_card_grid.min.js
www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/module_assets/36845096476/1683635694467/
723 B
2 KB
Script
General
Full URL
https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/module_assets/36845096476/1683635694467/module_36845096476_Blog_listing_card_grid.min.js
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
96012ea1e665f4555d84592c02ed5ee2ae06ae12e7869c7878a9fb15cf2bd729
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

content-security-policy
upgrade-insecure-requests
content-encoding
br
age
1784
x-amz-request-id
49376P20C5N2Z5NJ
x-amz-server-side-encryption
AES256
x-evy-trace-route-service-name
envoyset-translator
x-amz-replication-status
COMPLETED
x-hs-https-only
worker
x-hs-cf-lambda
us-east-1.enforceAclForReadsProd 20
x-evy-trace-listener
listener_https
etag
W/"a26b824a33500d5b24e748588dd1c35a"
vary
origin, Accept-Encoding
x-amz-meta-created-unix-time-millis
1683635694467
content-type
application/javascript; charset=utf-8
x-evy-trace-virtual-host
all
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-hs-cf-lambda-enforce
us-east-1.enforceAclForReadsProd 20
date
Mon, 07 Aug 2023 12:42:12 GMT
strict-transport-security
max-age=31536000
via
1.1 624a1750702d82319b25f17c35c73d04.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id
vX4VGHX7oLkggy1lxnxWYDLA5rVHVqKM
x-amz-cf-pop
IAD89-P2
x-hs-alternate-content-type
text/plain
x-cache
RefreshHit from cloudfront
x-amz-storage-class
INTELLIGENT_TIERING
x-envoy-upstream-service-time
114
alt-svc
h3=":443"; ma=86400
x-amz-id-2
lIjufGA3ZDty/JYLu572sxuNz17BFUtLeN1DL+Fk3VccVQXeBz49aN972HyHJBYd+XhB3bkzLZg=
x-evy-trace-route-configuration
listener_https/all
x-request-id
988abf89-8a76-45b9-b1b2-c1393cc5ac83
last-modified
Tue, 09 May 2023 12:34:55 GMT
server
cloudflare
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=EtnqEsJ1PGceHYIeL06KK3ICC%2FTl06qLdHXHMjbfUdB48xRIWjRwj81bt1kuY6yLnHSOlPiEj%2BfuQKvEYHUGtVKq430zPlfDPH93GJ%2B8WlAWLYzieBebBHFRa%2BAZ7vvHL4m1rEi0EqlgqJt8kq%2B3vyEr0A%3D%3D"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod
iad02/cms-hubfs-td/envoy-proxy-55b7d448b-fwhk5
access-control-allow-credentials
false
cf-ray
7f2f99211d9e91f6-FRA
x-amz-cf-id
p-enmljeQRSm9qto_xg_OQ_4375sVjbuPKBVHvIjeyUn05v21cU0pg==
3375217.js
www.reversinglabs.com/hs/scriptloader/
3 KB
2 KB
Script
General
Full URL
https://www.reversinglabs.com/hs/scriptloader/3375217.js
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
4d923e30c9ba92131920bece76f573c5bc2f6575097264025daf038254d5540c
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

content-security-policy
upgrade-insecure-requests
content-encoding
br
age
34
x-evy-trace-route-service-name
envoyset-translator
x-hs-https-only
worker
x-evy-trace-listener
listener_https
cf-bgj
minify
vary
origin, Accept-Encoding
content-type
application/javascript;charset=utf-8
access-control-allow-origin
https://www.reversinglabs.com
x-evy-trace-virtual-host
all
cache-control
public, max-age=60
expires
Mon, 07 Aug 2023 12:43:12 GMT
date
Mon, 07 Aug 2023 12:42:12 GMT
strict-transport-security
max-age=31536000
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-hubspot-correlation-id
7ea24249-c907-45bf-8e21-af83e8deccfe
cf-polished
origSize=2975
x-envoy-upstream-service-time
6
alt-svc
h3=":443"; ma=86400
x-evy-trace-route-configuration
listener_https/all
x-request-id
7ea24249-c907-45bf-8e21-af83e8deccfe
last-modified
Mon, 07 Aug 2023 12:41:38 GMT
server
cloudflare
x-trace
2B1FF87E27283E03BCDF643DECF69BAC3C17F89A55000000000000000000
access-control-max-age
3600
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6F96VoaS64wDlubhzpZJFQhxaeyZc0qvzsZYeIZcpyDqMpLKCQV1WjirKiiMUGekjwNgqt2x5KdXJCJYr7SycL0NW3Wjw37ADUBiUvib1%2Bkb%2BRlW%2BG2EjWy2ORrSYQoTxeV1HBIMciI%2B%2FiTbLYH5%2Fe%2FKPA%3D%3D"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod
iad02/hubapi-td/envoy-proxy-598c95b5b7-nkmk5
access-control-allow-credentials
true
cf-ray
7f2f99248a9391f6-FRA
cookieinfo.min.js
cookieinfoscript.com/js/
7 KB
4 KB
Script
General
Full URL
https://cookieinfoscript.com/js/cookieinfo.min.js
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0ab31a97c236988bb6e415187b2197cdbf689664173015dffd6da8eb96b1626f

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Mon, 07 Aug 2023 12:42:12 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-request-id
A5GRR99Z9G3E30KV
age
2207
x-amz-meta-cb-modifiedtime
Mon, 03 Jul 2023 14:52:01 GMT
alt-svc
h3=":443"; ma=86400
x-amz-id-2
UUJv+3LiXBmoD6rbOyxcBpjDawBL+oyjbgXrX9okgfcRZGDF0cseqhlk5pqgSmJIXP248v68HB4=
last-modified
Wed, 05 Jul 2023 10:39:27 GMT
server
cloudflare
etag
W/"d15d93068c1121f63008407d339bd819"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=cXRyREDncHbJVo%2B3ocgae4We5E07aO2WYcfmM4Cwfo7pocIqo4xlhfhFPTuAvIah33qaXr51dM7N%2FRrFEISPNY8enInA2aIlLCajzDkkoDc5Q6sn15svBJdWKNCM%2FvrBYM07uQO4bjxRry7uC54a7T0qbQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/x-javascript
cache-control
max-age=2678400
cf-ray
7f2f99219cbf2c2a-FRA
up_loader.1.1.0.js
js.adsrvr.org/
5 KB
3 KB
Script
General
Full URL
https://js.adsrvr.org/up_loader.1.1.0.js
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
65.9.99.119 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-65-9-99-119.prg50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
899663bfeab6b11842c974c2417dc0ad88bd79bb7510b1e032384ccf2618dcc1

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

Date
Sun, 06 Aug 2023 20:10:51 GMT
Content-Encoding
gzip
Via
1.1 97101640da3dcba7a2d4a3d67a31b114.cloudfront.net (CloudFront)
Last-Modified
Tue, 01 Aug 2023 20:10:44 GMT
Server
AmazonS3
X-Amz-Cf-Pop
PRG50-C1
Age
59482
x-amz-server-side-encryption
AES256
ETag
W/"b7474eac210849250426a8f6a39d00f3"
Transfer-Encoding
chunked
Vary
Accept-Encoding
Content-Type
application/x-javascript
X-Cache
Hit from cloudfront
Connection
keep-alive
X-Amz-Cf-Id
sfHIatAxPg5Eyz2X9jr0hZumh3ROsip07B7FIBAnimDHQI75Ja9DCw==
css
fonts.googleapis.com/
16 KB
1 KB
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Roboto:100,300,300i,400,500,700,900&display=swap&subset=latin-ext
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/6519964395/1685359416657/Reversing_Labs_November2018_Theme/Coded_Files/Reversing_Labs_November2018-style.min.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:813::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
e40c8f9d7a3c7c71ee109b2ae4df7dd9b6e3b0cd287d77f9a98312c53392ae25
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/6519964395/1685359416657/Reversing_Labs_November2018_Theme/Coded_Files/Reversing_Labs_November2018-style.min.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Mon, 07 Aug 2023 12:42:11 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Mon, 07 Aug 2023 12:34:49 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Mon, 07 Aug 2023 12:42:11 GMT
hotjar-3176008.js
static.hotjar.com/c/
10 KB
4 KB
Script
General
Full URL
https://static.hotjar.com/c/hotjar-3176008.js?sv=6
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
52.222.139.19 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-52-222-139-19.ams50.r.cloudfront.net
Software
/
Resource Hash
2e5436b217fb1a7d9d2365cccfcc95e7483fcba03205c3a216d512302e982d4d
Security Headers
Name Value
Strict-Transport-Security max-age=2592000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

strict-transport-security
max-age=2592000; includeSubDomains
content-encoding
br
x-content-type-options
nosniff
date
Mon, 07 Aug 2023 12:41:58 GMT
via
1.1 9bd09ac7aca1ea8ca6c788136a9ce480.cloudfront.net (CloudFront)
x-amz-cf-pop
AMS50-C1
age
49
x-cache
Hit from cloudfront
cross-origin-resource-policy
cross-origin
etag
W/ea37d1e0bcd47d6c2f7b79a987e66f2b
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
x-cache-hit
1
cache-control
max-age=60
x-amz-cf-id
Xa15hVww9a0XOTSjhP67WPVNhRcyWHqlxhj5LQb06JBHr7J3FpmAGw==
gtm.js
www.googletagmanager.com/
269 KB
92 KB
Script
General
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-MKL9P8B
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:829::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
b842edb195312e35a5ced3bc4b94113b3a5b15c8a52b676706e5efa9a8b694e4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Mon, 07 Aug 2023 12:42:12 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
93761
x-xss-protection
0
last-modified
Mon, 07 Aug 2023 12:00:00 GMT
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Mon, 07 Aug 2023 12:42:12 GMT
fbevents.js
connect.facebook.net/en_US/
172 KB
47 KB
Script
General
Full URL
https://connect.facebook.net/en_US/fbevents.js
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f083:9:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
9b78354357bc04de9fa52562968bad64ef1311b665cc6ea927d2ec08bcc82cd8
Security Headers
Name Value
Content-Security-Policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

content-security-policy
default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; preload; includeSubDomains
date
Mon, 07 Aug 2023 12:42:12 GMT
document-policy
force-load-at-top
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
47151
x-xss-protection
0
pragma
public
x-fb-debug
YIsnHWvrB2uQhof7ID4TytoSZwplopYcpW/H4T5/aNZN4wG7ufHBwTycW+8uCsWuVGKfOto6HC7nW+QyoeyPZQ==
cross-origin-opener-policy
same-origin-allow-popups
vary
Accept-Encoding
x-frame-options
DENY
content-type
application/x-javascript; charset=utf-8
cache-control
public, max-age=1200
x-fb-optimizer
1
permissions-policy
accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), microphone=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=()
expires
Sat, 01 Jan 2000 00:00:00 GMT
Reversing_Labs_November2018-style.min.css
www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/6519964395/1685359416657/Reversing_Labs_November2018_Theme/Coded_Files/
143 KB
25 KB
Stylesheet
General
Full URL
https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/6519964395/1685359416657/Reversing_Labs_November2018_Theme/Coded_Files/Reversing_Labs_November2018-style.min.css
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
61ce08dbad99d88826d7e7d374b628662137c7893a943d6a541cf4b0455c5067
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

content-security-policy
upgrade-insecure-requests
content-encoding
br
age
447
x-amz-request-id
9BY06TDA00GEHJTS
x-amz-server-side-encryption
AES256
x-evy-trace-route-service-name
envoyset-translator
x-amz-replication-status
COMPLETED
x-hs-https-only
worker
x-hs-cf-lambda
us-east-1.enforceAclForReadsProd 20
x-evy-trace-listener
listener_https
etag
W/"3d0f457bdc611022c3f48f57eb877977"
vary
origin, Accept-Encoding
x-amz-meta-created-unix-time-millis
1685359417818
content-type
text/css
x-evy-trace-virtual-host
all
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-hs-cf-lambda-enforce
us-east-1.enforceAclForReadsProd 20
date
Mon, 07 Aug 2023 12:42:12 GMT
strict-transport-security
max-age=31536000
via
1.1 6400936fc4525d1c60e3e8fee9d4806e.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id
AcrfIRW95QY88SeuDIXAFoVt.4x1ZQWb
x-amz-cf-pop
IAD12-P2
x-hs-alternate-content-type
text/plain
x-cache
RefreshHit from cloudfront
x-amz-storage-class
INTELLIGENT_TIERING
x-envoy-upstream-service-time
139
alt-svc
h3=":443"; ma=86400
x-amz-id-2
GkxM6CyUTGG0PBFgMJaDRztxsWFbJcPlZ0/7OioWm4zjLouo3IjGbhgJ83dkKDN715dWTz+6LH0HE9fsUUy+aoo105Uo0mmZotlTj0R0A+k=
x-evy-trace-route-configuration
listener_https/all
x-request-id
87030c20-b4df-4c9a-a844-9982d6c02ddf
last-modified
Mon, 29 May 2023 11:23:38 GMT
server
cloudflare
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zN6d5NCPMiaCRyN0itPBsBO6rSRjEYisaGTpFdGzHSkAXucz7O2T%2BMby9d%2FvuTzRrmLcxckipt5kMtG4WU0ZJRhCOWlgM4GCQb0bLB05Eg9zV9fY0k3HCeUcaLw8EvkukdXOGbhU3HIqTO7WcchMxTlPAA%3D%3D"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod
iad02/cms-hubfs-td/envoy-proxy-fd8f7bc74-9xkdz
access-control-allow-credentials
false
cf-ray
7f2f99247a7b91f6-FRA
x-amz-cf-id
EfnvyHcxkM0r5MgmZNSmpahxHbS44buGtkHilNHaDyIqxvzzMKUqGQ==
1076912843267184
connect.facebook.net/signals/config/
306 KB
87 KB
Script
General
Full URL
https://connect.facebook.net/signals/config/1076912843267184?v=2.9.121&r=stable
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f083:9:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
77b1e37a44606f04534b026795250cfb8f06416adbe129533a6d855e9b573f67
Security Headers
Name Value
Content-Security-Policy default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

content-security-policy
default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; preload; includeSubDomains
date
Mon, 07 Aug 2023 12:42:12 GMT
document-policy
force-load-at-top
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
89044
x-xss-protection
0
pragma
public
x-fb-debug
7NY/uCoCccrXdMiXo52etnGHs5ZYcNoqeQzrtOxSc3obnotvWhzH2vEUyY/olO9yXGKujVKEwmkv7D0v7kCJ3Q==
cross-origin-opener-policy
same-origin-allow-popups
vary
Accept-Encoding
x-frame-options
DENY
content-type
application/x-javascript; charset=utf-8
origin-agent-cluster
?0
cache-control
public, max-age=1200
permissions-policy
accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), microphone=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=()
expires
Sat, 01 Jan 2000 00:00:00 GMT
modules.92ff9978854791af68a7.js
script.hotjar.com/
223 KB
55 KB
Script
General
Full URL
https://script.hotjar.com/modules.92ff9978854791af68a7.js
Requested by
Host: static.hotjar.com
URL: https://static.hotjar.com/c/hotjar-3176008.js?sv=6
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
65.9.95.27 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-65-9-95-27.prg50.r.cloudfront.net
Software
/
Resource Hash
f827ec383239317deb9387ea204a9a0089594aaa0a763922e3d85222010531e2
Security Headers
Name Value
Strict-Transport-Security max-age=2592000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Thu, 03 Aug 2023 15:14:07 GMT
content-encoding
br
x-content-type-options
nosniff
strict-transport-security
max-age=2592000; includeSubDomains
via
1.1 0c8bf5614b4bcc3e76982cb7ff9a7662.cloudfront.net (CloudFront)
x-amz-cf-pop
PRG50-C1
age
336485
x-cache
Hit from cloudfront
cross-origin-resource-policy
cross-origin
content-length
55640
last-modified
Thu, 03 Aug 2023 15:13:59 GMT
etag
"9e14d47807cbae60a1fa1410419e20a1"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=31536000
accept-ranges
bytes
x-robots-tag
none
x-amz-cf-id
dKLFzCANyd4JzNzocuGP-40hDN8Ornl7WST4VLSruYxjY3IN0g3q9Q==
css
fonts.googleapis.com/
16 KB
1 KB
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Roboto:100,300,300i,400,500,700,900&display=swap&subset=latin-ext
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/6519964395/1685359416657/Reversing_Labs_November2018_Theme/Coded_Files/Reversing_Labs_November2018-style.min.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:813::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
e40c8f9d7a3c7c71ee109b2ae4df7dd9b6e3b0cd287d77f9a98312c53392ae25
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/6519964395/1685359416657/Reversing_Labs_November2018_Theme/Coded_Files/Reversing_Labs_November2018-style.min.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Mon, 07 Aug 2023 12:42:12 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Mon, 07 Aug 2023 12:34:49 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Mon, 07 Aug 2023 12:42:12 GMT
analytics.js
www.google-analytics.com/
52 KB
21 KB
Script
General
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MKL9P8B
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
date
Mon, 07 Aug 2023 11:44:24 GMT
last-modified
Mon, 12 Jun 2023 18:23:07 GMT
server
Golfe2
age
3468
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
20994
expires
Mon, 07 Aug 2023 13:44:24 GMT
insight.min.js
snap.licdn.com/li.lms-analytics/
13 KB
5 KB
Script
General
Full URL
https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MKL9P8B
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:3500:16::215:149b Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
fa53fcd8da139d256c0ca83b69cb37473ca627b6052368ed3327c80d9fb61e25
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Mon, 07 Aug 2023 12:42:12 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Mon, 24 Jul 2023 09:07:54 GMT
x-cdn
AKAM
x-amz-server-side-encryption
AES256
vary
Accept-Encoding
content-type
application/x-javascript;charset=utf-8
cache-control
max-age=64332
accept-ranges
bytes
content-length
4862
pixel.js
www.redditstatic.com/ads/
23 KB
8 KB
Script
General
Full URL
https://www.redditstatic.com/ads/pixel.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MKL9P8B
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:400::396 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
snooserv /
Resource Hash
e803e774c7b59fe74f71ed93acaa875cf9a99947ff8ed7615cd0c93c1667250f

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Mon, 07 Aug 2023 12:42:12 GMT
content-encoding
gzip
via
1.1 varnish, 1.1 varnish
last-modified
Thu, 15 Jun 2023 20:49:59 GMT
server
snooserv
nel
{"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.02, "failure_fraction": 0.02}
etag
"4a205643a240cb95fa82289d62b5af7e"
x-amz-server-side-encryption
AES256
vary
Accept-Encoding,Origin
report-to
{"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]}
content-type
application/javascript
cache-control
public, max-age=60
accept-ranges
bytes
content-length
7409
site-script.js
cdn.metadata.io/
6 KB
2 KB
Script
General
Full URL
https://cdn.metadata.io/site-script.js
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:223c:6a00:9:d7d4:1380:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
1d4548c03b28521204ab490e46b39179b8fa196998d45215a24602306b662ab5
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

x-amz-version-id
FA0kpUmjH6379n6SM2OzYViu4FNXSGFq
content-encoding
gzip
via
1.1 4d0ae7ca3bb5e2d6eaa1450e1906adb4.cloudfront.net (CloudFront)
date
Mon, 07 Aug 2023 00:08:40 GMT
x-content-type-options
nosniff
strict-transport-security
max-age=31536000
x-amz-cf-pop
FRA56-P2
age
45213
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-xss-protection
1; mode=block
referrer-policy
strict-origin-when-cross-origin
last-modified
Fri, 04 Aug 2023 00:07:57 GMT
server
AmazonS3
etag
W/"2963b0a1258588f130235cbdfe809b88"
vary
Accept-Encoding, Origin
x-frame-options
SAMEORIGIN
content-type
application/javascript
x-amz-cf-id
ddXVpkzH-77843wqb3h5QFBMCB2odSlQ3NOOEz7TgHY9mnQl3w3weg==
js
www.googletagmanager.com/gtag/
279 KB
94 KB
Script
General
Full URL
https://www.googletagmanager.com/gtag/js?id=G-JVM9Z1XQPL&l=dataLayer&cx=c
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MKL9P8B
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:829::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
6a48eb505b96c82ed638449c65ba9c99abd5d2055f6803c662d282692dd4d794
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Mon, 07 Aug 2023 12:42:12 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
access-control-allow-headers
Cache-Control
content-length
95842
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires
Mon, 07 Aug 2023 12:42:12 GMT
pixel
q.quora.com/_/ad/91aab57be1f94ec2a2ef647592767813/
43 B
416 B
Image
General
Full URL
https://q.quora.com/_/ad/91aab57be1f94ec2a2ef647592767813/pixel?tag=ViewContent&i=gtm&u=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fvmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.21.20.174 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-21-20-174.compute-1.amazonaws.com
Software
nginx /
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

Date
Mon, 07 Aug 2023 12:42:13 GMT
Strict-Transport-Security
max-age=63072000; includeSubDomains; preload
Server
nginx
Connection
keep-alive
Content-Length
43
X-Q-Stat
,05e69c563326299c56a74aa5e7a320bd,10.0.0.113,22826,81.95.5.43,,7401490510,1,1691412133.005,0.002,,.,0,0,0.004,0.004,-,0,0,197,98,49,10,35796,,,,,,-,
Content-Type
image/gif
/
www.facebook.com/tr/
0
185 B
Image
General
Full URL
https://www.facebook.com/tr/?id=1076912843267184&ev=Lead&dl=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fvmconnect-malicious-pypi-packages-imitate-popular-open-source-modules&rl=&if=false&ts=1691412132692&sw=1600&sh=1200&v=2.9.121&r=stable&ec=0&o=30&fbp=fb.1.1691412132689.1333241885&it=1691412132614&coo=false&exp=a1&rqm=GET
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f176:84:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
date
Mon, 07 Aug 2023 12:42:12 GMT
server
proxygen-bolt
content-type
text/plain
access-control-allow-origin
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
0
/
www.facebook.com/tr/
0
31 B
Image
General
Full URL
https://www.facebook.com/tr/?id=1076912843267184&ev=PageView&dl=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fvmconnect-malicious-pypi-packages-imitate-popular-open-source-modules&rl=&if=false&ts=1691412132694&sw=1600&sh=1200&v=2.9.121&r=stable&a=tmgoogletagmanager&ec=1&o=30&fbp=fb.1.1691412132689.1333241885&it=1691412132614&coo=false&exp=a1&rqm=GET
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f176:84:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
date
Mon, 07 Aug 2023 12:42:12 GMT
server
proxygen-bolt
content-type
text/plain
access-control-allow-origin
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
0
hero_bg_small_2019.jpg
www.reversinglabs.com/hubfs/images_redesign_2019/
21 KB
22 KB
Image
General
Full URL
https://www.reversinglabs.com/hubfs/images_redesign_2019/hero_bg_small_2019.jpg
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
716dcc9643502eb35aa1f08b4805ec1f377daad3e67c11f9d00d65c6fc6336cf
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

content-security-policy
upgrade-insecure-requests
x-amz-meta-cache-tag
F-11448703956,FD-11023975807,P-3375217,FLS-ALL
age
21712
x-amz-request-id
QA8X8QDKH7P9XNQQ
edge-cache-tag
F-11448703956,FD-11023975807,P-3375217,FLS-ALL
x-hs-https-only
worker
content-disposition
inline; filename="hero_bg_small_2019.webp"
x-hs-cf-lambda
us-east-1.EnforceAclForReads 2
cf-bgj
imgq:85,h2pri
etag
"1f3df8332048ad0295bff3a1c64cc9a4"
vary
Accept, Accept-Encoding
access-control-allow-methods
GET
content-type
image/webp
access-control-allow-origin
*
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
x-hs-cf-lambda-enforce
us-east-1.EnforceAclForReads 2
date
Mon, 07 Aug 2023 12:42:12 GMT
strict-transport-security
max-age=31536000
via
1.1 9672a97668a5842cedcfaee3e743019e.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id
a5PUnngJgc3ZEsbtfbAJjo5eXZD8MNrM
x-amz-cf-pop
FRA56-P7
cf-polished
qual=85, origFmt=jpeg, origSize=95096
x-cache
RefreshHit from cloudfront
cache-tag
F-11448703956,FD-11023975807,P-3375217,FLS-ALL
alt-svc
h3=":443"; ma=86400
content-length
21652
x-amz-id-2
bR90yqiBJ7Dh9dAqPm1PCyYRStpPFpC6pAebiUQJjEUv7DMavDut9DMDqJdX/XoowM/Spr2H4uY=
last-modified
Sat, 20 Jul 2019 18:01:05 GMT
server
cloudflare
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9COlDdsbIluyfzxaJPkDwWITf9rL7lCbLXNMfrh7vC3OuZUAcszIJ0LXCjbdnfhCo7N7%2BQHIzgGWG4phJwz8xcl9OrIdVcDu%2Bl2DVqOcdV%2Fb7dHoN4lXzGWadks%2FI57owJlQ4SszAxC4y2g%2FV71qAOF25g%3D%3D"}],"group":"cf-nel","max_age":604800}
accept-ranges
bytes
cf-ray
7f2f99256bdc91f6-FRA
x-amz-cf-id
9QahqkLMvEtd_FkZ8LYa1FR_USyTXZvlXY5WNql-D1665D9EsLPY4w==
Tungsten-Semibold.woff
3375217.fs1.hubspotusercontent-na1.net/hubfs/3375217/Reversinglabs_July2018/Fonts/
20 KB
20 KB
Font
General
Full URL
https://3375217.fs1.hubspotusercontent-na1.net/hubfs/3375217/Reversinglabs_July2018/Fonts/Tungsten-Semibold.woff
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/6519964395/1685359416657/Reversing_Labs_November2018_Theme/Coded_Files/Reversing_Labs_November2018-style.min.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:f0f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8ae4a0865523070959595a6df44d592fd924f6a8503d913a2cbfb81b5df45e62

Request headers

Referer
https://www.reversinglabs.com/
Origin
https://www.reversinglabs.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Mon, 07 Aug 2023 12:42:12 GMT
via
1.1 86b463b2b2449ea5ba66d271a3c29922.cloudfront.net (CloudFront)
content-encoding
br
cf-cache-status
HIT
x-amz-meta-cache-tag
F-28202642064,FD-5926386258,P-3375217,FLS-ALL
x-amz-version-id
zHy7ciep2n8U9dRoPSeIZ0ms5UoFs.HW
age
294136
x-amz-cf-pop
FRA56-P7
x-amz-server-side-encryption
AES256
x-amz-request-id
SV1N2KG68HYQ5E1A
edge-cache-tag
F-28202642064,FD-5926386258,P-3375217,FLS-ALL
cache-tag
F-28202642064,FD-5926386258,P-3375217,FLS-ALL
x-cache
RefreshHit from cloudfront
x-hs-cf-lambda
us-east-1.EnforceAclForReads 2
x-amz-id-2
IAozjNmmJ0ucb/0o3rj+EnB0JVC41iisRJPygWOFvQA+gkXd2Qjd75wmwAaqR3EEte3BLyKBZppyirlIzeFti8juZUMeONFqrVmZP0296MA=
last-modified
Fri, 10 Apr 2020 04:06:19 GMT
server
cloudflare
etag
W/"c4cba999623da66f241554c075076b87"
vary
Accept-Encoding
access-control-allow-methods
GET
content-type
application/font-woff
access-control-allow-origin
*
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
cf-ray
7f2f99258f07995c-FRA
x-amz-cf-id
Zh4m-dXASlKyjk2YpE9qKkkj_gUs27vT5I9hUyoD07Xldl5eWFjrSg==
x-hs-cf-lambda-enforce
us-east-1.EnforceAclForReads 2
Tungsten-Book.woff
3375217.fs1.hubspotusercontent-na1.net/hubfs/3375217/Reversinglabs_July2018/Fonts/
21 KB
22 KB
Font
General
Full URL
https://3375217.fs1.hubspotusercontent-na1.net/hubfs/3375217/Reversinglabs_July2018/Fonts/Tungsten-Book.woff
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/6519964395/1685359416657/Reversing_Labs_November2018_Theme/Coded_Files/Reversing_Labs_November2018-style.min.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:f0f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
1a5131ba88c40e02e211f48163838569b854a383f19817b94db2f4e83f5d044d

Request headers

Referer
https://www.reversinglabs.com/
Origin
https://www.reversinglabs.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Mon, 07 Aug 2023 12:42:12 GMT
via
1.1 36d9e1bd4f00d39c57a56679dc44e264.cloudfront.net (CloudFront)
content-encoding
br
cf-cache-status
HIT
x-amz-meta-cache-tag
F-11651164052,FD-5926386258,P-3375217,FLS-ALL
x-amz-version-id
DhZpSF_okm4kqA3d5rsX6px.W1gW4AHr
age
1298325
x-amz-cf-pop
FRA56-C1
x-amz-request-id
3QDQJSSJ8MMGZZKA
edge-cache-tag
F-11651164052,FD-5926386258,P-3375217,FLS-ALL
cache-tag
F-11651164052,FD-5926386258,P-3375217,FLS-ALL
x-cache
RefreshHit from cloudfront
x-hs-cf-lambda
us-east-1.enforceAclForReadsProd 15
x-amz-id-2
ray8vnyquALJVx+kHorNbSvZm5IWo+dO3mHfbHxSDe1WaV/OJJCMqzRPcnosgtNHm+/dRrRo6zk=
last-modified
Sun, 28 Jul 2019 19:57:28 GMT
server
cloudflare
etag
W/"ab8a234e214dd3506e9fada6b6eafdca"
vary
Accept-Encoding
access-control-allow-methods
GET
content-type
application/font-woff
access-control-allow-origin
*
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
cf-ray
7f2f99258f0c995c-FRA
x-amz-cf-id
8tynB1KacC6D_r4ABRLXXyI6MIrIEEZm6XDzSK4BbyRqQD3IEv88Yw==
x-hs-cf-lambda-enforce
us-east-1.enforceAclForReadsProd 15
rl-icons.woff
3375217.fs1.hubspotusercontent-na1.net/hubfs/3375217/Reversing_Labs_November%202018/Font/
4 KB
5 KB
Font
General
Full URL
https://3375217.fs1.hubspotusercontent-na1.net/hubfs/3375217/Reversing_Labs_November%202018/Font/rl-icons.woff
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/6519964395/1685359416657/Reversing_Labs_November2018_Theme/Coded_Files/Reversing_Labs_November2018-style.min.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:f0f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9103cd19fa0db417520474c8682d15529708804e7d5dcee981c8a19a7c083875

Request headers

Referer
https://www.reversinglabs.com/
Origin
https://www.reversinglabs.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Mon, 07 Aug 2023 12:42:12 GMT
via
1.1 9987fa8ab620895e83d1d8f10c40f6d2.cloudfront.net (CloudFront)
content-encoding
br
cf-cache-status
HIT
x-amz-meta-cache-tag
F-6528836102,FD-6528836052,P-3375217,FLS-ALL
x-amz-version-id
7Fg3.Df2IKZXcjymNQNOrpeZRI7DlXZ.
age
444159
x-amz-cf-pop
FRA56-P4
x-amz-server-side-encryption
AES256
x-amz-request-id
QY3YDVS7EE4JNT5W
edge-cache-tag
F-6528836102,FD-6528836052,P-3375217,FLS-ALL
cache-tag
F-6528836102,FD-6528836052,P-3375217,FLS-ALL
x-cache
RefreshHit from cloudfront
x-hs-cf-lambda
us-east-1.enforceAclForReadsProd 20
x-amz-id-2
aQvVcV/XN0Elsnwa2qlYLNKxw2auzld/2F3RJ4EeGvuW1lFPCdjVBKOuW5omhyCCnnSejpnGxQJDc0wrBsWhzbQd7Hf30OIQzWDVU/OZokA=
last-modified
Fri, 24 Apr 2020 14:40:36 GMT
server
cloudflare
etag
W/"97ca286c0b94878b6b2adf44559b6265"
vary
Accept-Encoding
access-control-allow-methods
GET
content-type
application/font-woff
access-control-allow-origin
*
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
cf-ray
7f2f99258f09995c-FRA
x-amz-cf-id
-6on92kr7vCMb6MqqALUFxDYAaOgqTGrA6XxpE6Qxjgev3zOu1lmkQ==
x-hs-cf-lambda-enforce
us-east-1.enforceAclForReadsProd 20
KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v30/
16 KB
16 KB
Font
General
Full URL
https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fBBc4.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:100,300,300i,400,500,700,900&display=swap&subset=latin-ext
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:811::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.reversinglabs.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Sat, 05 Aug 2023 02:35:09 GMT
x-content-type-options
nosniff
age
209223
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
15920
x-xss-protection
0
last-modified
Wed, 11 May 2022 19:24:45 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 04 Aug 2024 02:35:09 GMT
KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v30/
15 KB
16 KB
Font
General
Full URL
https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:100,300,300i,400,500,700,900&display=swap&subset=latin-ext
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:811::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.reversinglabs.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Fri, 04 Aug 2023 04:06:52 GMT
x-content-type-options
nosniff
age
290120
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
15744
x-xss-protection
0
last-modified
Wed, 11 May 2022 19:24:48 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sat, 03 Aug 2024 04:06:52 GMT
TungstenNarrow-Medium.woff
3375217.fs1.hubspotusercontent-na1.net/hubfs/3375217/Reversinglabs_July2018/Fonts/
21 KB
21 KB
Font
General
Full URL
https://3375217.fs1.hubspotusercontent-na1.net/hubfs/3375217/Reversinglabs_July2018/Fonts/TungstenNarrow-Medium.woff
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/6519964395/1685359416657/Reversing_Labs_November2018_Theme/Coded_Files/Reversing_Labs_November2018-style.min.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:f0f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
70d1119d232eb54079a766d9e1564320f2c20e6e71683e31edf766c26e9c678e

Request headers

Referer
https://www.reversinglabs.com/
Origin
https://www.reversinglabs.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Mon, 07 Aug 2023 12:42:12 GMT
via
1.1 4dd80d99fd5d0f6baaaf5179cd921f72.cloudfront.net (CloudFront)
content-encoding
br
cf-cache-status
HIT
x-amz-meta-cache-tag
F-10570558853,FD-5926386258,P-3375217,FLS-ALL
x-amz-version-id
HmXdIK8Bc_0fkfivtLAcWmXE077h5rsG
age
1230907
x-amz-cf-pop
FRA56-P7
x-amz-request-id
DV8B5T4WJ4DACZ5A
edge-cache-tag
F-10570558853,FD-5926386258,P-3375217,FLS-ALL
cache-tag
F-10570558853,FD-5926386258,P-3375217,FLS-ALL
x-cache
RefreshHit from cloudfront
x-hs-cf-lambda
us-east-1.EnforceAclForReads 2
x-amz-id-2
AM80tg4xEENofUxyamgPmkbUrCLc6Rzznr8erp5Ed13rqcZbaIWWDB5ZeoVhRSsGfHayQesAXC0=
last-modified
Tue, 18 Jun 2019 15:58:22 GMT
server
cloudflare
etag
W/"650100235aa1598769f1744ec1674c39"
vary
Accept-Encoding
access-control-allow-methods
GET
content-type
application/font-woff
access-control-allow-origin
*
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
cf-ray
7f2f99258f0b995c-FRA
x-amz-cf-id
EtjULFwChECI0hZJhYnHiZt5mzojpWn-Wqz3XJpTrzeDLt8EXjH47A==
x-hs-cf-lambda-enforce
us-east-1.EnforceAclForReads 2
KFOlCnqEu92Fr1MmSU5fBBc4.woff2
fonts.gstatic.com/s/roboto/v30/
15 KB
15 KB
Font
General
Full URL
https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmSU5fBBc4.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:100,300,300i,400,500,700,900&display=swap&subset=latin-ext
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:811::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
f75911313e1c7802c23345ab57e754d87801581706780c993fb23ff4e0fe62ef
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.reversinglabs.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Fri, 04 Aug 2023 15:22:55 GMT
x-content-type-options
nosniff
age
249557
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
15740
x-xss-protection
0
last-modified
Wed, 11 May 2022 19:24:56 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sat, 03 Aug 2024 15:22:55 GMT
Tungsten-Medium.woff
3375217.fs1.hubspotusercontent-na1.net/hubfs/3375217/Reversinglabs_July2018/Fonts/
19 KB
19 KB
Font
General
Full URL
https://3375217.fs1.hubspotusercontent-na1.net/hubfs/3375217/Reversinglabs_July2018/Fonts/Tungsten-Medium.woff
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/6519964395/1685359416657/Reversing_Labs_November2018_Theme/Coded_Files/Reversing_Labs_November2018-style.min.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:f0f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
84240275eed2746f9d66bb0a5f46915d74ba6a7c6e210ba4634a16e03ca54270

Request headers

Referer
https://www.reversinglabs.com/
Origin
https://www.reversinglabs.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Mon, 07 Aug 2023 12:42:12 GMT
via
1.1 64f5a3ab7bfb476c633b87746aced0ee.cloudfront.net (CloudFront)
content-encoding
br
cf-cache-status
HIT
x-amz-meta-cache-tag
F-10570055973,FD-5926386258,P-3375217,FLS-ALL
x-amz-version-id
8RS6BKpEUu5kELkbXI3oOka23XcEIvrY
age
778610
x-amz-cf-pop
FRA56-P4
x-amz-request-id
ECRHAA8KBPGPF31E
edge-cache-tag
F-10570055973,FD-5926386258,P-3375217,FLS-ALL
cache-tag
F-10570055973,FD-5926386258,P-3375217,FLS-ALL
x-cache
RefreshHit from cloudfront
x-hs-cf-lambda
us-east-1.enforceAclForReadsProd 15
x-amz-id-2
o9T2/mI1OHh12f3WfGPui3zISn5+wl7JP7gG5OXcBxr+kMEF40USv+u6+UnpXb+u62nHglDWBvk=
last-modified
Tue, 18 Jun 2019 15:58:23 GMT
server
cloudflare
etag
W/"e62b1278f1fdeb9765b266aa18905620"
vary
Accept-Encoding
access-control-allow-methods
GET
content-type
application/font-woff
access-control-allow-origin
*
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
cf-ray
7f2f99258f0a995c-FRA
x-amz-cf-id
jh5Dv-FD1oBgSClsYcWm0HHvs3f6YyvUoqiEz3Fb0mrrsY0NxgYNNg==
x-hs-cf-lambda-enforce
us-east-1.enforceAclForReadsProd 15
KFOjCnqEu92Fr1Mu51TjASc6CsQ.woff2
fonts.gstatic.com/s/roboto/v30/
17 KB
17 KB
Font
General
Full URL
https://fonts.gstatic.com/s/roboto/v30/KFOjCnqEu92Fr1Mu51TjASc6CsQ.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:100,300,300i,400,500,700,900&display=swap&subset=latin-ext
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:811::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
bb8007225d94a099cddbade7ea904667c0dd0b68d5e30778e5c6257589ab94d1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.reversinglabs.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Fri, 04 Aug 2023 03:37:34 GMT
x-content-type-options
nosniff
age
291878
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
17508
x-xss-protection
0
last-modified
Wed, 11 May 2022 19:24:41 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sat, 03 Aug 2024 03:37:34 GMT
KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v30/
15 KB
16 KB
Font
General
Full URL
https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:100,300,300i,400,500,700,900&display=swap&subset=latin-ext
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:811::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.reversinglabs.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Sat, 05 Aug 2023 13:37:19 GMT
x-content-type-options
nosniff
age
169493
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
15860
x-xss-protection
0
last-modified
Wed, 11 May 2022 19:24:42 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 04 Aug 2024 13:37:19 GMT
Tungsten-Light.woff
3375217.fs1.hubspotusercontent-na1.net/hubfs/3375217/Reversinglabs_July2018/Fonts/
21 KB
22 KB
Font
General
Full URL
https://3375217.fs1.hubspotusercontent-na1.net/hubfs/3375217/Reversinglabs_July2018/Fonts/Tungsten-Light.woff
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/6519964395/1685359416657/Reversing_Labs_November2018_Theme/Coded_Files/Reversing_Labs_November2018-style.min.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:f0f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3ac9f879f23b53c0856f5a719a5d2913f2890b5e06b60a8879945c245080fc52

Request headers

Referer
https://www.reversinglabs.com/
Origin
https://www.reversinglabs.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Mon, 07 Aug 2023 12:42:12 GMT
via
1.1 4b69099d64ffa1fbe8adbe1235065a14.cloudfront.net (CloudFront)
content-encoding
br
cf-cache-status
HIT
x-amz-meta-cache-tag
F-11651159874,FD-5926386258,P-3375217,FLS-ALL
x-amz-version-id
oZWO71JPrAMaAkHUdMvYTNjF0GR2Ck4O
age
439493
x-amz-cf-pop
FRA56-P7
x-amz-request-id
T16E8HBE2P178JDP
edge-cache-tag
F-11651159874,FD-5926386258,P-3375217,FLS-ALL
cache-tag
F-11651159874,FD-5926386258,P-3375217,FLS-ALL
x-cache
RefreshHit from cloudfront
x-hs-cf-lambda
us-east-1.enforceAclForReadsProd 20
x-amz-id-2
bd7LG2RDPGIfJ35J+iVCGVKgChqn5bZysDCnFBYDFFP+/XvuvGQROhVfWhOrakVlOd+JjGzZYoEFwxDSlKYqpwl2yhTyuPXx1k7tsv4CBzs=
last-modified
Sun, 28 Jul 2019 19:57:28 GMT
server
cloudflare
etag
W/"100aa5d32672286f544f73831e764ee1"
vary
Accept-Encoding
access-control-allow-methods
GET
content-type
application/font-woff
access-control-allow-origin
*
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
cf-ray
7f2f9925efb7995c-FRA
x-amz-cf-id
g76tsnC5ZzLBE2RSU2eBo3kv7UGg7MyaRhPZnsOvkdg5r6WtuT2fzw==
x-hs-cf-lambda-enforce
us-east-1.enforceAclForReadsProd 20
VMConnect-Blog.jpg
www.reversinglabs.com/hs-fs/hubfs/Blog/
152 KB
152 KB
Image
General
Full URL
https://www.reversinglabs.com/hs-fs/hubfs/Blog/VMConnect-Blog.jpg?width=1400&height=732&name=VMConnect-Blog.jpg
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
b99e57a180459ef9973b9bb3f41ce4a28c015ac31ec686c087bf21f42d366608
Security Headers
Name Value
Content-Security-Policy default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Mon, 07 Aug 2023 12:42:12 GMT
strict-transport-security
max-age=31536000
via
1.1 4066580ab3ec717b57597f204d9bb30e.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-content-type-options
nosniff
content-security-policy
default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
cache-tag
F-127998140035,FD-11822274822,P-3375217,FLS-ALL
x-hs-https-only
worker
alt-svc
h3=":443"; ma=86400
content-length
155290
cf-resized
internal=ok/m q=0 n=902+0 c=21+117 v=2023.7.3 l=155290
last-modified
Wed, 02 Aug 2023 12:32:32 GMT
cf-bgj
imgq:86,h2pri
server
cloudflare
etag
"cfNOMcKaoDQTmxnUSgND4a2FbXsvDsvdffkG1yWKzcDQ:7a382c8e2e8d51d238303bd14e4a96b4"
vary
Accept, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dXTPgv0kFmb%2BmOCJBPxma833RYlN9T02E03FLEH08HAZSMIhAq%2B4zOORbdJ2y3lHRxy8I%2BBdul%2BfRZ5Ks1yNKwXr7Bxg4TSK7FAucSqEcBcfD0NMv0L58mLsQBqHO3gX4kgjyAHc%2BHs0%2Fg4mEEWFQ4uYCw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/webp
access-control-allow-origin
*
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
accept-ranges
bytes
cf-ray
7f2f9925fc9491f6-FRA
vmconnect-blog-figure3-config.png
www.reversinglabs.com/hs-fs/hubfs/Blog/
39 KB
40 KB
Image
General
Full URL
https://www.reversinglabs.com/hs-fs/hubfs/Blog/vmconnect-blog-figure3-config.png?width=570&height=226&name=vmconnect-blog-figure3-config.png
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
6e4d408ece6803ecb0c2356f7c16a9e1acdbf01228830ac38274ec1ada687e36
Security Headers
Name Value
Content-Security-Policy default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Mon, 07 Aug 2023 12:42:12 GMT
strict-transport-security
max-age=31536000
via
1.1 fa87f2173bfe5d35fd73cec71ab12a32.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-content-type-options
nosniff
content-security-policy
default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
cache-tag
F-128372297775,FD-11822274822,P-3375217,FLS-ALL
x-hs-https-only
worker
alt-svc
h3=":443"; ma=86400
content-length
40172
cf-resized
internal=ok/m q=0 n=840+0 c=0+26 v=2023.7.3 l=40172
last-modified
Fri, 04 Aug 2023 12:08:01 GMT
cf-bgj
imgq:100,h2pri
server
cloudflare
etag
"cfKEFYek-osWhpe5X8gXArZyh18sSmAPwuejBK1TPFDQ:a4db244b42098e0fbad80bc9b9c81d06"
vary
Accept, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=IUyHCB9p9MVAMGRFOQA7K2Qm0W11vNKL%2BxtO6rsHgjsa0GsyW2EEjXYyS45RnTWADTwUCXd6%2BmlCMiA%2F5ja1EvzMMyUZXqrXUOPp%2BJrqtsQ3GqugiGuao0QU9AtmifaLCUbXcW5ql%2F%2FQ4thzxiPOdJh%2FYQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/webp
access-control-allow-origin
*
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
accept-ranges
bytes
cf-ray
7f2f9925fc9791f6-FRA
json
www.reversinglabs.com/_hcms/forms/embed/v3/form/3375217/24abef2a-a2f4-4889-8899-dd4026584fa9/
16 KB
4 KB
XHR
General
Full URL
https://www.reversinglabs.com/_hcms/forms/embed/v3/form/3375217/24abef2a-a2f4-4889-8899-dd4026584fa9/json?hs_static_app=forms-embed&hs_static_app_version=1.3512&X-HubSpot-Static-App-Info=forms-embed-1.3512
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/_hcms/forms/v2.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
186f40bb344deff6c552b8eee4fb94869a7fcf3648308b2833eb40268ad19cf4
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff

Request headers

Accept
application/json, text/plain, */*
Referer
https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

x-origin-hublet
na1
date
Mon, 07 Aug 2023 12:42:13 GMT
strict-transport-security
max-age=31536000
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
content-security-policy
upgrade-insecure-requests
x-evy-trace-route-service-name
envoyset-translator
x-hubspot-correlation-id
a6d18dc9-32eb-4b97-8395-7759771f6107
content-encoding
br
x-envoy-upstream-service-time
11
x-hs-https-only
worker
alt-svc
h3=":443"; ma=86400
x-evy-trace-route-configuration
listener_https/all
x-evy-trace-listener
listener_https
x-request-id
a6d18dc9-32eb-4b97-8395-7759771f6107
server
cloudflare
x-trace
2BB4947E6DAB3FB62294D41E8C4012C9EC27DB906C000000000000000000
vary
origin, Accept-Encoding
access-control-allow-methods
OPTIONS, GET
content-type
application/json;charset=utf-8
access-control-max-age
180
x-evy-trace-served-by-pod
iad02/star-hubspot-td/envoy-proxy-759c64d45c-9t4kl
access-control-expose-headers
X-Origin-Hublet
cache-control
max-age=0, no-cache, no-store
access-control-allow-credentials
false
x-evy-trace-virtual-host
all
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Cj4EzJFQzy1AMucxdLxThuBEK%2FcpXhJ8xWOk5UzsiTOER64v4%2BhDTVwo0UB%2FqqvRjdB95EYffshlvxxZwqmLc1sWX0kM%2BhOOXEuhvnGhOmhxnIuWMRKSBSGB29DrcLjTga3EjlPmjIAgY8diut7mU%2F4V5A%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray
7f2f9926edaf91f6-FRA
access-control-allow-headers
*
x-robots-tag
none
JrRu3vUM8j33QSR7Bwxw
ws.zoominfo.com/pixel/
3 KB
2 KB
Script
General
Full URL
https://ws.zoominfo.com/pixel/JrRu3vUM8j33QSR7Bwxw
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:650c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / Express
Resource Hash
dc438b796a9b07ef4235c29389a171915adce110e232e6932f0ec4ca040ac566
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Mon, 07 Aug 2023 12:42:13 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
via
1.1 google
server
cloudflare
x-powered-by
Express
vary
Accept-Encoding
content-type
text/javascript
access-control-allow-origin
*
access-control-allow-credentials
true
cf-ray
7f2f99271f395c68-FRA
access-control-allow-headers
Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for, x-ws-collect-type,requestFromZITag,unifiedScriptVerified,_zitok,_vtok
alt-svc
h3=":443"; ma=86400
all.js
connect.facebook.net/en_GB/
3 KB
2 KB
Script
General
Full URL
https://connect.facebook.net/en_GB/all.js
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a03:2880:f083:9:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
415f1b24f09d34ace4333cdd8a1a2ed4c0f74db2f4f6c76967f1a5555e87d0cc
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; preload; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
date
Mon, 07 Aug 2023 12:42:12 GMT
content-md5
DLCVo6WkK1ZtNv/uaQ4nsQ==
document-policy
force-load-at-top
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
1687
x-fb-debug
oFLu+b+GFRaykMOoC+HuMT7vhouHDN4Cy+VvIan8YA/fn1IQh/XqguYsTk57ddDJ7lYbqBgCdLC6kZkcl27eEw==
x-fb-content-md5
b9ecef98197cb0ee143ebb1d276d6a97
cross-origin-opener-policy
same-origin-allow-popups
etag
"549b037e1884b8c7f4948f0b57aab044"
vary
Accept-Encoding
x-frame-options
DENY
content-type
application/x-javascript; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
X-FB-Content-MD5
cache-control
public,max-age=1200,stale-while-revalidate=3600
permissions-policy
accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), microphone=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=()
timing-allow-origin
*
priority
u=3,i
expires
Mon, 07 Aug 2023 12:42:40 GMT
widgets.js
platform.twitter.com/
91 KB
28 KB
Script
General
Full URL
https://platform.twitter.com/widgets.js
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (via/F34A) /
Resource Hash
392c9fa9cd1273a2a89d1a83a69cd1f63f21d1d55e7be21e1d8f51f25145668b

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

Date
Mon, 07 Aug 2023 12:42:12 GMT
Content-Encoding
gzip
Age
244
x-amz-server-side-encryption
AES256
X-Cache
HIT
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server-Timing
x-cache;desc= HIT,x-tw-cdn;desc=VZ
Content-Length
27630
Last-Modified
Tue, 24 Jan 2023 21:41:51 GMT
Server
ECS (via/F34A)
Etag
"9e99725b7a4cd730a934afba2a438bb5+gzip"
Vary
Accept-Encoding
Access-Control-Allow-Methods
GET
Content-Type
application/javascript; charset=utf-8
Access-Control-Allow-Origin
*
x-tw-cdn
VZ
Cache-Control
public, max-age=1800
rp.gif
alb.reddit.com/
42 B
637 B
Image
General
Full URL
https://alb.reddit.com/rp.gif?ts=1691412132948&id=t2_neftrm6a&event=PageVisit&m.itemCount=undefined&m.value=&m.valueDecimal=undefined&m.currency=undefined&m.transactionId=&m.customEventName=&m.products=&m.conversionId=&uuid=1b607989-48a6-4fed-bc86-694ef880ad1e&aaid=&em=&external_id=&idfa=&integration=gtm&opt_out=0&sh=1600&sw=1200&v=rdt_f5bd31b2
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.65.140 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
Varnish /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Mon, 07 Aug 2023 12:42:13 GMT
via
1.1 varnish
nel
{"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.3, "failure_fraction": 0.3}
server
Varnish
report-to
{"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]}
content-type
image/gif
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
content-length
42
retry-after
0
collect
www.google-analytics.com/j/
15 B
225 B
XHR
General
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j101&a=370137491&t=pageview&_s=1&dl=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fvmconnect-malicious-pypi-packages-imitate-popular-open-source-modules&ul=en-us&de=UTF-8&dt=VMConnect%3A%20Malicious%20PyPI%20packages%20imitate%20popular%20open%20source%20modules&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAEABAAAAACAAI~&jid=1047403651&gjid=18159699&cid=851417141.1691412133&tid=UA-32828290-1&_gid=1836868080.1691412133&_r=1&_slc=1&gtm=45He3820n81MKL9P8B&z=1879257036
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e5808455786f658eccda5e658ffcc1073d757dd9b70ea3c931fa7a36d583abbc
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Mon, 07 Aug 2023 12:42:12 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.reversinglabs.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
15
expires
Fri, 01 Jan 1990 00:00:00 GMT
token
cdn.linkedin.oribi.io/partner/976924/domain/reversinglabs.com/
36 B
377 B
XHR
General
Full URL
https://cdn.linkedin.oribi.io/partner/976924/domain/reversinglabs.com/token
Requested by
Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2127:8e00:2:53b2:240:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
7b1eaaaf180a13c29b6dddc3b0ae23333b4397e0f3c065b4c86da2f2530a5f89

Request headers

Accept
*
Referer
https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Mon, 07 Aug 2023 12:01:18 GMT
content-encoding
gzip
via
1.1 badae0844eca8f0bad6677607d947120.cloudfront.net (CloudFront)
x-amz-cf-pop
PRG50-C1
age
2455
vary
accept-encoding
x-cache
Hit from cloudfront
content-type
application/json
access-control-allow-origin
*
cache-control
public, max-age=39449
x-amz-cf-id
s5go0dbA792-r-HpwHsBbAZlWQw8czx4kF8HxExWAfnJ8Tqq_epXKA==
collect
px4.ads.linkedin.com/
Redirect Chain
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=976924&time=1691412132965&url=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fvmconnect-malicious-pypi-packages-imitate-popular-open-source-modules&t...
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=976924&time=1691412132965&url=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fvmconnect-malicious-pypi-packages-imitate-popular-open-source-modules&t...
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D976924%26time%3D1691412132965%26url%3Dhttps%253A%252F%252Fwww.reversinglabs.com%2...
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=976924&time=1691412132965&url=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fvmconnect-malicious-pypi-packages-imitate-popular-open-source-modules&t...
  • https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=976924&time=1691412132965&url=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fvmconnect-malicious-pypi-packages-imitate-popular-open-source-modules&...
0
483 B
Image
General
Full URL
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=976924&time=1691412132965&url=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fvmconnect-malicious-pypi-packages-imitate-popular-open-source-modules&tm=gtmv2&cookiesTest=true&liSync=true&e_ipv6=AQK05CInJCtmcAAAAYnQBPcKxn7ADY69RZnY-B9KABehK8wqFgmBIWUDtPibD2v1
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
Protocol
H2
Server
13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Mon, 07 Aug 2023 12:42:13 GMT
nel
{"report_to":"network-errors","max_age":1296000,"success_fraction":0.00066,"failure_fraction":1,"include_subdomains":true}
x-li-pop
afd-prod-ltx1-x
x-msedge-ref
Ref A: FA51E013EB54453986B918FF9E58B245 Ref B: DUS30EDGE0916 Ref C: 2023-08-07T12:42:13Z
linkedin-action
1
report-to
{"group":"network-errors","max_age":2592000,"endpoints":[{"url":"https://www.linkedin.com/li/rep"}],"include_subdomains":true}
content-type
application/javascript
x-li-fabric
prod-ltx1
x-cache
CONFIG_NOCACHE
x-li-proto
http/2
content-length
0
x-li-uuid
AAYCVJNnzOIS/PZPIfoTDw==

Redirect headers

date
Mon, 07 Aug 2023 12:42:13 GMT
nel
{"report_to":"network-errors","max_age":1296000,"success_fraction":0.00066,"failure_fraction":1,"include_subdomains":true}
x-li-pop
afd-prod-ltx1-x
x-msedge-ref
Ref A: 63F864B485E948DDBBC2C16FA3A31E2C Ref B: FRAEDGE1516 Ref C: 2023-08-07T12:42:13Z
linkedin-action
1
report-to
{"group":"network-errors","max_age":2592000,"endpoints":[{"url":"https://www.linkedin.com/li/rep"}],"include_subdomains":true}
x-li-fabric
prod-ltx1
location
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=976924&time=1691412132965&url=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fvmconnect-malicious-pypi-packages-imitate-popular-open-source-modules&tm=gtmv2&cookiesTest=true&liSync=true&e_ipv6=AQK05CInJCtmcAAAAYnQBPcKxn7ADY69RZnY-B9KABehK8wqFgmBIWUDtPibD2v1
x-cache
CONFIG_NOCACHE
x-li-proto
http/2
content-length
0
x-li-uuid
AAYCVJNk4anRqIjp2b8pYQ==
token
cdn.linkedin.oribi.io/partner/976924/domain/reversinglabs.com/
36 B
376 B
XHR
General
Full URL
https://cdn.linkedin.oribi.io/partner/976924/domain/reversinglabs.com/token
Requested by
Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2127:8e00:2:53b2:240:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
7b1eaaaf180a13c29b6dddc3b0ae23333b4397e0f3c065b4c86da2f2530a5f89

Request headers

Accept
*
Referer
https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Mon, 07 Aug 2023 12:01:18 GMT
content-encoding
gzip
via
1.1 badae0844eca8f0bad6677607d947120.cloudfront.net (CloudFront)
x-amz-cf-pop
PRG50-C1
age
2455
vary
accept-encoding
x-cache
Hit from cloudfront
content-type
application/json
access-control-allow-origin
*
cache-control
public, max-age=39449
x-amz-cf-id
gVWomSgwYCdBm93YvRw9Lkqdp1mJFnXeYPt1G1IPmJS8qLmgbe0jaQ==
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/970567826/
3 KB
2 KB
Script
General
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/970567826/?random=1691412132990&cv=11&fst=1691412132990&bg=ffffff&guid=ON&async=1&gtm=45je3820&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fvmconnect-malicious-pypi-packages-imitate-popular-open-source-modules&hn=www.googleadservices.com&frm=0&tiba=VMConnect%3A%20Malicious%20PyPI%20packages%20imitate%20popular%20open%20source%20modules&auid=1737629636.1691412133&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-JVM9Z1XQPL&l=dataLayer&cx=c
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
c3a0886f92864385930f2f264b78c4a21acb34199893093b2982fdad61c9f248
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 07 Aug 2023 12:42:13 GMT
content-encoding
br
x-content-type-options
nosniff
server
cafe
content-type
text/javascript; charset=UTF-8
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
1390
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
region1.analytics.google.com/g/
0
258 B
Ping
General
Full URL
https://region1.analytics.google.com/g/collect?v=2&tid=G-JVM9Z1XQPL&gtm=45je3820&_p=370137491&_gaz=1&cid=851417141.1691412133&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=1&sid=1691412133&sct=1&seg=0&dl=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fvmconnect-malicious-pypi-packages-imitate-popular-open-source-modules&dt=VMConnect%3A%20Malicious%20PyPI%20packages%20imitate%20popular%20open%20source%20modules&en=page_view&_fv=1&_ss=1
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-JVM9Z1XQPL&l=dataLayer&cx=c
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 07 Aug 2023 12:42:13 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.reversinglabs.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
stats.g.doubleclick.net/g/
0
249 B
Ping
General
Full URL
https://stats.g.doubleclick.net/g/collect?v=2&tid=G-JVM9Z1XQPL&cid=851417141.1691412133&gtm=45je3820&aip=1
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-JVM9Z1XQPL&l=dataLayer&cx=c
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400c:c0c::9c Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 07 Aug 2023 12:42:13 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.reversinglabs.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
region1.analytics.google.com/g/
0
54 B
Ping
General
Full URL
https://region1.analytics.google.com/g/collect?v=2&tid=G-JVM9Z1XQPL&gtm=45je3820&_p=370137491&cid=851417141.1691412133&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=2&sid=1691412133&sct=1&seg=0&dl=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fvmconnect-malicious-pypi-packages-imitate-popular-open-source-modules&dt=VMConnect%3A%20Malicious%20PyPI%20packages%20imitate%20popular%20open%20source%20modules&en=Hubspot%20Form%20-%20Listener&_c=1&_et=2
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-JVM9Z1XQPL&l=dataLayer&cx=c
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 07 Aug 2023 12:42:13 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.reversinglabs.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
region1.analytics.google.com/g/
0
54 B
Ping
General
Full URL
https://region1.analytics.google.com/g/collect?v=2&tid=G-JVM9Z1XQPL&gtm=45je3820&_p=370137491&cid=851417141.1691412133&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=3&sid=1691412133&sct=1&seg=0&dl=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fvmconnect-malicious-pypi-packages-imitate-popular-open-source-modules&dt=VMConnect%3A%20Malicious%20PyPI%20packages%20imitate%20popular%20open%20source%20modules&en=LinkedIn%20Insight&_c=1&_et=1
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-JVM9Z1XQPL&l=dataLayer&cx=c
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 07 Aug 2023 12:42:13 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.reversinglabs.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
region1.analytics.google.com/g/
0
54 B
Ping
General
Full URL
https://region1.analytics.google.com/g/collect?v=2&tid=G-JVM9Z1XQPL&gtm=45je3820&_p=370137491&cid=851417141.1691412133&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=4&sid=1691412133&sct=1&seg=0&dl=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fvmconnect-malicious-pypi-packages-imitate-popular-open-source-modules&dt=VMConnect%3A%20Malicious%20PyPI%20packages%20imitate%20popular%20open%20source%20modules&en=MetaData%20Script%20Landing%20page%20Conv&_c=1&_et=2
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-JVM9Z1XQPL&l=dataLayer&cx=c
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 07 Aug 2023 12:42:13 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.reversinglabs.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
region1.analytics.google.com/g/
0
54 B
Ping
General
Full URL
https://region1.analytics.google.com/g/collect?v=2&tid=G-JVM9Z1XQPL&gtm=45je3820&_p=370137491&cid=851417141.1691412133&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=5&sid=1691412133&sct=1&seg=0&dl=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fvmconnect-malicious-pypi-packages-imitate-popular-open-source-modules&dt=VMConnect%3A%20Malicious%20PyPI%20packages%20imitate%20popular%20open%20source%20modules&en=Reddit%20Conversion%20Tracking&_c=1&_et=1
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-JVM9Z1XQPL&l=dataLayer&cx=c
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 07 Aug 2023 12:42:13 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.reversinglabs.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.de/ads/
42 B
408 B
Image
General
Full URL
https://www.google.de/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-JVM9Z1XQPL&cid=851417141.1691412133&gtm=45je3820&aip=1&z=46210
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 07 Aug 2023 12:42:13 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
leadflows.js
js.hsleadflows.net/
540 KB
86 KB
Script
General
Full URL
https://js.hsleadflows.net/leadflows.js
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/hs/scriptloader/3375217.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:836e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
96ea6b1e986879257e104371bf5f0cb0bf2bb9957a1aa73fa9df8be99aeeb157
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
Origin
https://www.reversinglabs.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

content-encoding
br
age
65176
x-evy-trace-route-service-name
envoyset-translator
x-amz-server-side-encryption
AES256
content-security-policy-report-only
frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=lead-flows-js/static-1.1232/bundle/main/lead-flows-release.js&cfRay=7f2961f47984900a-FRA
x-amz-replication-status
COMPLETED
x-evy-trace-listener
listener_https
etag
W/"039461df2d1d43031520c7d3a853f79e"
vary
Accept-Encoding,Origin,Access-Control-Request-Headers,Access-Control-Request-Method
access-control-allow-methods
GET
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
x-evy-trace-virtual-host
all
cache-control
s-maxage=86400, max-age=0
x-hs-target-asset
lead-flows-js/static-1.1232/bundle/main/lead-flows-release.js
date
Mon, 07 Aug 2023 12:42:13 GMT
x-amz-version-id
RIqU3aMZg9szNHjfbC8NSxVkuKgO4.TB
via
1.1 06c1d28e93bdae8f6401a12c10b2f570.cloudfront.net (CloudFront)
x-content-type-options
nosniff
cf-cache-status
HIT
x-amz-cf-pop
IAD12-P3
x-hubspot-correlation-id
945af940-0845-4330-ba88-2ca3ae5f3975
x-cache
Hit from cloudfront
cache-tag
staticjsapp-lead-flows-cloudflare-web-prod,staticjsapp-prod
x-envoy-upstream-service-time
15
x-evy-trace-route-configuration
listener_https/all
x-request-id
945af940-0845-4330-ba88-2ca3ae5f3975
last-modified
Thu, 03 Aug 2023 01:17:49 UTC
server
cloudflare
access-control-max-age
3000
x-hs-cache-status
MISS
x-evy-trace-served-by-pod
iad02/app-td/envoy-proxy-57ff77fcd-xhv87
cf-ray
7f2f9927cd59bba1-FRA
x-amz-cf-id
UUgz8wDGTNRS4o8UL28RnsWnnAocF09b8xApFOMCPaukgxiLYavpiA==
3375217.js
js.hs-analytics.net/analytics/1691412000000/
66 KB
21 KB
Script
General
Full URL
https://js.hs-analytics.net/analytics/1691412000000/3375217.js
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/hs/scriptloader/3375217.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:89ce , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ff5b2a04410456da0a8e7d8a4db3eacf62ab980e163a500b81781ea6c5b0a73b

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Mon, 07 Aug 2023 12:42:13 GMT
x-amz-version-id
null
content-encoding
br
cf-cache-status
HIT
x-amz-request-id
D3J5WKM41W1QF3ZY
x-evy-trace-route-service-name
envoyset-translator
x-amz-server-side-encryption
AES256
x-hubspot-correlation-id
6cc4462a-4455-4683-88a5-d542ef51e9d8
age
92
x-envoy-upstream-service-time
18
x-amz-id-2
9Ybj+ra4Cd7uVJoC/S1qzLLUdlaajmg5ETYTIzBFpakf+2goz+R7BQ061NnR6pbV9PXNUMM4D44=
x-evy-trace-listener
listener_https
x-request-id
6cc4462a-4455-4683-88a5-d542ef51e9d8
x-evy-trace-route-configuration
listener_https/all
last-modified
Thu, 20 Jul 2023 15:57:16 GMT
server
cloudflare
etag
W/"a3ab9dab97e068beca49a0d2808f012f"
vary
origin, Accept-Encoding
content-type
text/javascript
x-evy-trace-virtual-host
all
x-evy-trace-served-by-pod
iad02/analytics-js-proxy-td/envoy-proxy-7dbb6c8f49-2sbs7
cache-control
max-age=300,public
access-control-allow-credentials
false
cf-ray
7f2f9927cb469b64-FRA
expires
Mon, 07 Aug 2023 12:45:41 GMT
collectedforms.js
js.hscollectedforms.net/
69 KB
25 KB
Script
General
Full URL
https://js.hscollectedforms.net/collectedforms.js
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/hs/scriptloader/3375217.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:6cc7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f54b61a120e0240c98428d76beab031099f4f0379cbc623de071277255088fdc
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
Origin
https://www.reversinglabs.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

content-encoding
br
age
465
x-evy-trace-route-service-name
envoyset-translator
x-amz-server-side-encryption
AES256
content-security-policy-report-only
frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=collected-forms-embed-js/static-1.380/bundles/project.js&cfRay=7f2f8dcdfd913630-FRA
x-amz-replication-status
COMPLETED
x-evy-trace-listener
listener_https
etag
W/"85b7f9af32b27bd6cc93e80bfb2911df"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
x-evy-trace-virtual-host
all
cache-control
s-maxage=600, max-age=300
x-hs-target-asset
collected-forms-embed-js/static-1.380/bundles/project.js
date
Mon, 07 Aug 2023 12:42:13 GMT
x-amz-version-id
3rNMTio6eswfsQ6sgXOFNNmyULDAVi34
via
1.1 4715507645a6516d2df35cd342cb5be0.cloudfront.net (CloudFront)
x-content-type-options
nosniff
cf-cache-status
HIT
x-amz-cf-pop
IAD12-P3
x-hubspot-correlation-id
840219a0-4422-42f6-b057-9429cb558e55
x-cache
Hit from cloudfront
cache-tag
staticjsapp-collected-forms-embed-js-web-prod,staticjsapp-prod
x-envoy-upstream-service-time
3
x-evy-trace-route-configuration
listener_https/all
x-request-id
840219a0-4422-42f6-b057-9429cb558e55
last-modified
Mon, 10 Jul 2023 09:43:19 UTC
server
cloudflare
x-hs-cache-status
HIT
x-evy-trace-served-by-pod
iad02/app-td/envoy-proxy-57ff77fcd-wd7jg
cf-ray
7f2f9927ca8c365c-FRA
x-amz-cf-id
Y5P0d7KnTxCmuW1BPKlUpjPM3WfxvtoeXDGguuGsySDLc_4XiW4C7A==
conversations-embed.js
js.usemessages.com/
76 KB
22 KB
Script
General
Full URL
https://js.usemessages.com/conversations-embed.js
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/hs/scriptloader/3375217.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:61ac , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
1a949852daa2fe2be0d5e7dfbf2d0edf71121b49a82b1d82992aa8aa9b7c2d9b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Mon, 07 Aug 2023 12:42:13 GMT
x-amz-version-id
ODJS4by7FZvkpoRvjuP9B12j3hHA63aR
via
1.1 caafbc8a9aa04b09dd564a3ddef60622.cloudfront.net (CloudFront)
x-content-type-options
nosniff
cf-cache-status
HIT
x-amz-cf-pop
IAD12-P3
age
517
x-amz-server-side-encryption
AES256
x-evy-trace-route-service-name
envoyset-translator
content-security-policy-report-only
frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=conversations-embed/static-1.13717/bundles/project.js&cfRay=7f2f8c899d9c9046-FRA
x-cache
Hit from cloudfront
x-hubspot-correlation-id
80c2ae06-4364-46a5-a5eb-6c0f4a0beede
cache-tag
staticjsapp-conversations-embed-web-prod,staticjsapp-prod
content-encoding
br
x-envoy-upstream-service-time
2
x-amz-replication-status
COMPLETED
x-evy-trace-route-configuration
listener_https/all
x-evy-trace-listener
listener_https
x-request-id
80c2ae06-4364-46a5-a5eb-6c0f4a0beede
last-modified
Tue, 01 Aug 2023 04:58:19 UTC
server
cloudflare
etag
W/"99645c9c8dd31a70b2127da46f42c10f"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
x-hs-cache-status
HIT
x-evy-trace-virtual-host
all
cache-control
max-age=600
x-evy-trace-served-by-pod
iad02/app-td/envoy-proxy-57ff77fcd-ksc82
cf-ray
7f2f9927c881bbec-FRA
x-amz-cf-id
Flk1mGvbwTcd4tvwDJJijD1kmYd96rKgemRbH19S-UUoB1ayD278Cg==
x-hs-target-asset
conversations-embed/static-1.13717/bundles/project.js
3375217.js
js.hs-banner.com/
60 KB
16 KB
Script
General
Full URL
https://js.hs-banner.com/3375217.js
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/hs/scriptloader/3375217.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:19c4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3c50dd5c1727efe22037460b8eaa121b22932d39ab13865d1ecf5b8372d2da4d

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Mon, 07 Aug 2023 12:42:13 GMT
x-amz-version-id
bw3Z1oFRilBSp2nJoqwzp68d0FJwmW7g
content-encoding
br
cf-cache-status
HIT
x-amz-request-id
YCB4T2Q968QCXYJV
x-evy-trace-route-service-name
envoyset-translator
x-amz-server-side-encryption
AES256
age
104
x-envoy-upstream-service-time
34
x-amz-id-2
WxyNIjCFjR5TpNngHSe9JlyJ94K367PL797r3aedc+ni/bf1tSf0z8HitDEIdI3MNKXj8+4NrZI=
x-evy-trace-listener
listener_https
x-request-id
c34f2a8e-4e91-405d-8b17-0e16ddbbbaef
x-evy-trace-route-configuration
listener_https/all
last-modified
Wed, 31 May 2023 09:21:10 GMT
server
cloudflare
etag
W/"4f3650703a78045f1ac9ea0084ff242e"
access-control-max-age
604800
access-control-allow-methods
GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
https://www.reversinglabs.com
x-evy-trace-virtual-host
all
access-control-expose-headers
x-last-modified-timestamp, X-HubSpot-NotFound, X-HS-User-Request, Link, Server-Timing
cache-control
max-age=300,public
access-control-allow-credentials
true
x-evy-trace-served-by-pod
iad02/analytics-js-proxy-td/envoy-proxy-7dbb6c8f49-f4w7q
vary
origin, Accept-Encoding
timing-allow-origin
*
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept, Accept-Charset, Accept-Encoding, X-Override-Internal-Permissions, X-Properties-Source, X-Properties-SourceId, X-Properties-Flag, X-Hubspot-User-Id, X-Hubspot-Trace, X-Hubspot-Callee, X-Hubspot-Offset, X-Hubspot-No-Trace, X-HubSpot-Static-App-Info, X-HubSpot-Messages-Uri, X-HubSpot-Request-Source, X-HubSpot-Request-Reason, Subscription-Billing-Auth-Token, X-App-CSRF, X-Tools-CSRF, Online-Payment-Signing-UUID, X-Source, X-SourceId, X-Origin-UserId, X-Biden-Request-Source, X-HubSpot-CSRF-hubspotapi, X-Force-Cookie-Refresh, X-Force-Cookie-Refresh-No-Cache, X-HS-User-Request, X-Application-Id, X-HS-Referer, X-HubSpot-Correlation-Id
cf-ray
7f2f9927eae403e4-FRA
expires
Mon, 07 Aug 2023 12:45:29 GMT
fb.js
js.hsadspixel.net/
6 KB
3 KB
Script
General
Full URL
https://js.hsadspixel.net/fb.js
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/hs/scriptloader/3375217.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:78be , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e10ce26ead0eca58cd5346843538415611b745bfd29825322efad56424a4c911
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Mon, 07 Aug 2023 12:42:13 GMT
x-amz-version-id
aAzOiTTzU7.XykyGrcpmeR7PTeB2LyLv
via
1.1 53b70ac9dc46d1c13992b291cf22a9aa.cloudfront.net (CloudFront)
x-content-type-options
nosniff
cf-cache-status
HIT
x-amz-cf-pop
IAD12-P3
age
203
x-amz-server-side-encryption
AES256
x-evy-trace-route-service-name
envoyset-translator
content-security-policy-report-only
frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=adsscriptloaderstatic/static-1.387/bundles/pixels-release.js&cfRay=7f2f94350d5968ec-FRA
x-cache
Hit from cloudfront
x-hubspot-correlation-id
84388041-5d5d-4239-8465-e9ccdd6c01de
cache-tag
staticjsapp-AdsScriptLoaderCloudflare-web-prod,staticjsapp-prod
content-encoding
br
x-envoy-upstream-service-time
1
x-amz-replication-status
COMPLETED
x-evy-trace-route-configuration
listener_https/all
x-evy-trace-listener
listener_https
x-request-id
84388041-5d5d-4239-8465-e9ccdd6c01de
last-modified
Tue, 18 Jul 2023 03:27:27 UTC
server
cloudflare
etag
W/"784f994871e489c9943a65326d43e875"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
x-hs-cache-status
HIT
x-evy-trace-virtual-host
all
cache-control
max-age=600
x-evy-trace-served-by-pod
iad02/app-td/envoy-proxy-57ff77fcd-xhv87
cf-ray
7f2f9927fbe36913-FRA
x-amz-cf-id
O55rREIBCR0XYRMwqbM0aqt4Iaz0NxVC7w9I8uukbgJ_UwxxMHZbVA==
x-hs-target-asset
adsscriptloaderstatic/static-1.387/bundles/pixels-release.js
has-permission
app.hubspot.com/content-tools-menu/api/v1/tools-menu/
0
1001 B
Script
General
Full URL
https://app.hubspot.com/content-tools-menu/api/v1/tools-menu/has-permission?portalId=3375217&callback=jsonpHandler
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/hs/hsstatic/HubspotToolsMenu/static-1.191/js/index.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:9b53 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options no-sniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Mon, 07 Aug 2023 12:42:13 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
no-sniff
cf-cache-status
DYNAMIC
x-hs-worker-debug-mode
false
x-evy-trace-route-service-name
envoyset-translator
x-hubspot-correlation-id
7d1150d2-2c52-4077-8c43-7d9db2ed9b00
x-envoy-upstream-service-time
2
alt-svc
h3=":443"; ma=86400
x-evy-trace-route-configuration
listener_https/all
reporting-endpoints
default="https://send.hsbrowserreports.com/csp/reports?cfRay=7f2f9927fded922b&resource=unknown"
x-evy-trace-listener
listener_https
x-request-id
7d1150d2-2c52-4077-8c43-7d9db2ed9b00
server
cloudflare
x-trace
2BC8478ECE71D9C7F3A733AAF76489935D1E60FC05000000000000000000
vary
origin, Accept-Encoding
access-control-allow-methods
GET
report-to
{"group":"default","max_age":86400,"endpoints":[{"url":"https://send.hsbrowserreports.com/csp/reports"}]}
x-evy-trace-served-by-pod
iad02/app-td/envoy-proxy-57ff77fcd-h6thn
x-evy-trace-virtual-host
all
cache-control
max-age=0
access-control-allow-credentials
true
cf-ray
7f2f9927fded922b-FRA
truncated
/
37 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

Content-Type
image/gif
6si.min.js
j.6sc.co/
48 KB
14 KB
Script
General
Full URL
https://j.6sc.co/6si.min.js
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.20.143.57 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-20-143-57.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
ae3536ecd79c98f87387cee9060be3053e0eb8fe0871e7336554812ef8138772
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 07 Aug 2023 12:42:13 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 20 Jul 2023 16:27:10 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"64b9605e-bf6f"
vary
Accept-Encoding
content-type
application/javascript
cache-control
private, no-cache, proxy-revalidate
accept-ranges
bytes
content-length
14190
expires
Mon, 07 Aug 2023 12:42:13 GMT
js
www.googletagmanager.com/gtag/
242 KB
81 KB
Script
General
Full URL
https://www.googletagmanager.com/gtag/js?id=G-6H8MZ60CSB&cx=c&_slc=1
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:829::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
1bcb25af97b820d55089e5d1ad595941b84d3145e92397c21cf2a7acae63d7bd
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Mon, 07 Aug 2023 12:42:13 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
access-control-allow-headers
Cache-Control
content-length
83008
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires
Mon, 07 Aug 2023 12:42:13 GMT
counters.gif
forms.hsforms.com/embed/v3/
35 B
1016 B
Image
General
Full URL
https://forms.hsforms.com/embed/v3/counters.gif?key=forms-embed-v2-DEFINITION_SUCCESS&count=1
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:d3f3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

Date
Mon, 07 Aug 2023 12:42:13 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
X-Content-Type-Options
nosniff
CF-Cache-Status
DYNAMIC
x-evy-trace-route-service-name
envoyset-translator
X-HubSpot-Correlation-Id
82b6504f-14b6-4564-811e-be365e8f018e
x-envoy-upstream-service-time
2
Connection
keep-alive
alt-svc
h3=":443"; ma=86400
Content-Length
35
x-evy-trace-route-configuration
listener_https/all
x-evy-trace-listener
listener_https
x-request-id
82b6504f-14b6-4564-811e-be365e8f018e
Server
cloudflare
X-Trace
2BF5204B24C3440A9D634F77CA4A5DDD19306477B9000000000000000000
Vary
origin
Content-Type
image/gif
x-evy-trace-virtual-host
all
x-evy-trace-served-by-pod
iad02/star-hubspot-td/envoy-proxy-759c64d45c-jkmcj
Access-Control-Expose-Headers
X-Origin-Hublet
Cache-Control
max-age=0, no-cache, no-store
Access-Control-Allow-Credentials
false
X-Robots-Tag
none
CF-RAY
7f2f99284b961c2a-FRA
Tungsten-Book.woff
3375217.fs1.hubspotusercontent-na1.net/hubfs/3375217/Reversinglabs_July2018/Fonts/
21 KB
22 KB
Other
General
Full URL
https://3375217.fs1.hubspotusercontent-na1.net/hubfs/3375217/Reversinglabs_July2018/Fonts/Tungsten-Book.woff
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:f0f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
1a5131ba88c40e02e211f48163838569b854a383f19817b94db2f4e83f5d044d

Request headers

Referer
https://www.reversinglabs.com/
Origin
https://www.reversinglabs.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Mon, 07 Aug 2023 12:42:13 GMT
via
1.1 36d9e1bd4f00d39c57a56679dc44e264.cloudfront.net (CloudFront)
content-encoding
br
cf-cache-status
HIT
x-amz-meta-cache-tag
F-11651164052,FD-5926386258,P-3375217,FLS-ALL
x-amz-version-id
DhZpSF_okm4kqA3d5rsX6px.W1gW4AHr
age
1298326
x-amz-cf-pop
FRA56-C1
x-amz-request-id
3QDQJSSJ8MMGZZKA
edge-cache-tag
F-11651164052,FD-5926386258,P-3375217,FLS-ALL
cache-tag
F-11651164052,FD-5926386258,P-3375217,FLS-ALL
x-cache
RefreshHit from cloudfront
x-hs-cf-lambda
us-east-1.enforceAclForReadsProd 15
x-amz-id-2
ray8vnyquALJVx+kHorNbSvZm5IWo+dO3mHfbHxSDe1WaV/OJJCMqzRPcnosgtNHm+/dRrRo6zk=
last-modified
Sun, 28 Jul 2019 19:57:28 GMT
server
cloudflare
etag
W/"ab8a234e214dd3506e9fada6b6eafdca"
vary
Accept-Encoding
access-control-allow-methods
GET
content-type
application/font-woff
access-control-allow-origin
*
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
cf-ray
7f2f99282b3b995c-FRA
x-amz-cf-id
8tynB1KacC6D_r4ABRLXXyI6MIrIEEZm6XDzSK4BbyRqQD3IEv88Yw==
x-hs-cf-lambda-enforce
us-east-1.enforceAclForReadsProd 15
TungstenNarrow-Medium.woff
3375217.fs1.hubspotusercontent-na1.net/hubfs/3375217/Reversinglabs_July2018/Fonts/
21 KB
21 KB
Other
General
Full URL
https://3375217.fs1.hubspotusercontent-na1.net/hubfs/3375217/Reversinglabs_July2018/Fonts/TungstenNarrow-Medium.woff
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:f0f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
70d1119d232eb54079a766d9e1564320f2c20e6e71683e31edf766c26e9c678e

Request headers

Referer
https://www.reversinglabs.com/
Origin
https://www.reversinglabs.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Mon, 07 Aug 2023 12:42:13 GMT
via
1.1 4dd80d99fd5d0f6baaaf5179cd921f72.cloudfront.net (CloudFront)
content-encoding
br
cf-cache-status
HIT
x-amz-meta-cache-tag
F-10570558853,FD-5926386258,P-3375217,FLS-ALL
x-amz-version-id
HmXdIK8Bc_0fkfivtLAcWmXE077h5rsG
age
1230908
x-amz-cf-pop
FRA56-P7
x-amz-request-id
DV8B5T4WJ4DACZ5A
edge-cache-tag
F-10570558853,FD-5926386258,P-3375217,FLS-ALL
cache-tag
F-10570558853,FD-5926386258,P-3375217,FLS-ALL
x-cache
RefreshHit from cloudfront
x-hs-cf-lambda
us-east-1.EnforceAclForReads 2
x-amz-id-2
AM80tg4xEENofUxyamgPmkbUrCLc6Rzznr8erp5Ed13rqcZbaIWWDB5ZeoVhRSsGfHayQesAXC0=
last-modified
Tue, 18 Jun 2019 15:58:22 GMT
server
cloudflare
etag
W/"650100235aa1598769f1744ec1674c39"
vary
Accept-Encoding
access-control-allow-methods
GET
content-type
application/font-woff
access-control-allow-origin
*
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
cf-ray
7f2f99282b3f995c-FRA
x-amz-cf-id
EtjULFwChECI0hZJhYnHiZt5mzojpWn-Wqz3XJpTrzeDLt8EXjH47A==
x-hs-cf-lambda-enforce
us-east-1.EnforceAclForReads 2
all.js
connect.facebook.net/en_GB/
303 KB
85 KB
Script
General
Full URL
https://connect.facebook.net/en_GB/all.js?hash=cd35d2383f802bc59f9d809c0e58770c
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_GB/all.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a03:2880:f083:9:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
12c8e4eb0826656e26b370c3d2b26d918a04cb80a6c7a44f610127babdc9ca77
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

Referer
https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
Origin
https://www.reversinglabs.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; preload; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
date
Mon, 07 Aug 2023 12:42:13 GMT
content-md5
3DqoxuqBhtIBN5hgT7uMPg==
document-policy
force-load-at-top
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
87049
x-fb-debug
8o9Gmd+6abdpo1ho90L/VQ9qqinTNbdClI2S/O2y396whs5Giv/Qdxh+xtpPkbLJKUrm3J1Vu++18kPGa6rSZw==
x-fb-content-md5
26ad65b6f3ade4c043c190083a02b108
cross-origin-opener-policy
same-origin-allow-popups
etag
"0234788dce3479ba38689b20b799d686"
vary
Accept-Encoding
x-frame-options
DENY
content-type
application/x-javascript; charset=utf-8
access-control-allow-origin
*
origin-agent-cluster
?0
access-control-expose-headers
X-FB-Content-MD5
cache-control
public,max-age=31536000,stale-while-revalidate=3600,immutable
permissions-policy
accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), microphone=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=()
timing-allow-origin
*
priority
u=3,i
expires
Tue, 06 Aug 2024 11:16:40 GMT
widget_iframe.2b2d73daf636805223fb11d48f3e94f7.html
platform.twitter.com/widgets/ Frame 69C4
320 KB
104 KB
Document
General
Full URL
https://platform.twitter.com/widgets/widget_iframe.2b2d73daf636805223fb11d48f3e94f7.html?origin=https%3A%2F%2Fwww.reversinglabs.com
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (via/F33E) /
Resource Hash
4002d65e95f94dc87ae8ad170eb8dbc3644921032ac76dcb376537d9304a6fbf

Request headers

Referer
https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Access-Control-Allow-Methods
GET
Access-Control-Allow-Origin
*
Age
376382
Cache-Control
public, max-age=315360000
Content-Encoding
gzip
Content-Length
105435
Content-Type
text/html; charset=utf-8
Date
Mon, 07 Aug 2023 12:42:13 GMT
Etag
"95e1b50b0c179aefb47b5b211bb347b5+gzip"
Last-Modified
Tue, 24 Jan 2023 21:41:13 GMT
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server
ECS (via/F33E)
Server-Timing
x-cache;desc= HIT,x-tw-cdn;desc=VZ
Vary
Accept-Encoding
X-Cache
HIT
x-amz-server-side-encryption
AES256
x-tw-cdn
VZ
/
www.google.com/pagead/1p-user-list/970567826/
42 B
455 B
Image
General
Full URL
https://www.google.com/pagead/1p-user-list/970567826/?random=1691412132990&cv=11&fst=1691409600000&bg=ffffff&guid=ON&async=1&gtm=45je3820&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fvmconnect-malicious-pypi-packages-imitate-popular-open-source-modules&frm=0&tiba=VMConnect%3A%20Malicious%20PyPI%20packages%20imitate%20popular%20open%20source%20modules&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=357750368&rmt_tld=0&ipr=y
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:811::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 07 Aug 2023 12:42:13 GMT
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/970567826/
42 B
154 B
Image
General
Full URL
https://www.google.de/pagead/1p-user-list/970567826/?random=1691412132990&cv=11&fst=1691409600000&bg=ffffff&guid=ON&async=1&gtm=45je3820&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fvmconnect-malicious-pypi-packages-imitate-popular-open-source-modules&frm=0&tiba=VMConnect%3A%20Malicious%20PyPI%20packages%20imitate%20popular%20open%20source%20modules&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=357750368&rmt_tld=1&ipr=y
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 07 Aug 2023 12:42:13 GMT
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
counters.gif
forms-na1.hsforms.com/embed/v3/
35 B
1016 B
Image
General
Full URL
https://forms-na1.hsforms.com/embed/v3/counters.gif?key=forms-embed-v2-RENDER_SUCCESS&count=1
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:d5f3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

Date
Mon, 07 Aug 2023 12:42:13 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
X-Content-Type-Options
nosniff
CF-Cache-Status
DYNAMIC
x-evy-trace-route-service-name
envoyset-translator
X-HubSpot-Correlation-Id
14c28a12-5d73-44e1-afca-d49878ad8a30
x-envoy-upstream-service-time
3
Connection
keep-alive
alt-svc
h3=":443"; ma=86400
Content-Length
35
x-evy-trace-route-configuration
listener_https/all
x-evy-trace-listener
listener_https
x-request-id
14c28a12-5d73-44e1-afca-d49878ad8a30
Server
cloudflare
X-Trace
2BB885B667E4350B89FD00604550FFA8F59D78FC33000000000000000000
Vary
origin
Content-Type
image/gif
x-evy-trace-virtual-host
all
x-evy-trace-served-by-pod
iad02/star-hubspot-td/envoy-proxy-759c64d45c-dfxrz
Access-Control-Expose-Headers
X-Origin-Hublet
Cache-Control
max-age=0, no-cache, no-store
Access-Control-Allow-Credentials
false
X-Robots-Tag
none
CF-RAY
7f2f99287a85046e-FRA
widget
www.reversinglabs.com/_hcms/livechat/
338 B
2 KB
XHR
General
Full URL
https://www.reversinglabs.com/_hcms/livechat/widget?portalId=3375217&conversations-embed=static-1.13717&mobile=false&messagesUtk=f091c3bf4df44087a634355c7d532699&traceId=f091c3bf4df44087a634355c7d532699
Requested by
Host: js.usemessages.com
URL: https://js.usemessages.com/conversations-embed.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
0d8e30adfec247d61be8172549cc16e36bd1eb63859b8e818aa0f9965b4dcaef
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff

Request headers

Referer
https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
accept-language
de-DE,de;q=0.9
X-HubSpot-Messages-Uri
https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Mon, 07 Aug 2023 12:42:13 GMT
strict-transport-security
max-age=31536000
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
content-security-policy
upgrade-insecure-requests
x-evy-trace-route-service-name
envoyset-translator
x-hubspot-correlation-id
2357d4ce-e171-4a6b-9ef0-2857b50812a2
x-envoy-upstream-service-time
7
x-hs-https-only
worker
alt-svc
h3=":443"; ma=86400
x-evy-trace-route-configuration
listener_https/all
x-evy-trace-listener
listener_https
x-request-id
2357d4ce-e171-4a6b-9ef0-2857b50812a2
server
cloudflare
x-trace
2B443C54F87C43A43B5076E1E35D3823E3FDA9EE26000000000000000000
vary
origin, Accept-Encoding
access-control-allow-methods
GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
content-type
application/json;charset=utf-8
x-evy-trace-served-by-pod
iad02/hubapi-td/envoy-proxy-598c95b5b7-qcqs6
x-evy-trace-virtual-host
all
cache-control
no-cache, no-store, no-transform, must-revalidate, max-age=0
access-control-allow-credentials
false
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zN%2BkxF4CqqPLQPXDP0eJa82u%2BaItOp3H31OfZQtsC64OQNi0CUmc4GHWAa%2BsCKhJybhetD009sJy4%2B4CF0GgqrX4J4r%2FXVneEW9mZ5OSYxexYT6hS7YiF14IN0mS6F1XF%2BIw5J1iQjnd2waW0kPaC50khw%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray
7f2f9928780291f6-FRA
access-control-allow-headers
Accept, Accept-Charset, Accept-Encoding, Accept-Language, Content-Type, Host, Origin, Referer, User-Agent, X-HubSpot-Messages-Uri
json
api.hubapi.com/hs-script-loader-public/v1/config/pixels-and-events/
115 B
1 KB
XHR
General
Full URL
https://api.hubapi.com/hs-script-loader-public/v1/config/pixels-and-events/json?portalId=3375217
Requested by
Host: js.hsadspixel.net
URL: https://js.hsadspixel.net/fb.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:c9cc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
95fbf2ab9776737534e11c42ed7370e97aa96be93bdda3783a252eab6d9a0e70
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Mon, 07 Aug 2023 12:42:13 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-route-service-name
envoyset-translator
x-hubspot-correlation-id
00749c96-7311-4738-9ace-bdff32da4790
content-encoding
br
x-envoy-upstream-service-time
4
alt-svc
h3=":443"; ma=86400
x-evy-trace-route-configuration
listener_https/all
x-evy-trace-listener
listener_https
x-request-id
00749c96-7311-4738-9ace-bdff32da4790
server
cloudflare
x-trace
2B98F8D8985813627EF9581536A6CB1FCE2E889812000000000000000000
vary
origin, Accept-Encoding
access-control-allow-methods
GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
content-type
application/json;charset=utf-8
access-control-allow-origin
https://www.reversinglabs.com
x-evy-trace-served-by-pod
iad02/hubapi-td/envoy-proxy-598c95b5b7-6ft8w
access-control-max-age
180
access-control-allow-credentials
false
x-evy-trace-virtual-host
all
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4txX%2BofSEBQqy%2BB6GyrVNmTb88fTFEGOpEm6iXHNmIZjK%2BjbapuGBsoQ2JbSjY%2BjetWx1EvUSqjY75kp%2FIYDcv0zKIFxFqIzOKOeh9BtyPCU8Xckt55vfAQWH8hAdCj0bgiYmIC32NvcSWZ4"}],"group":"cf-nel","max_age":604800}
cf-ray
7f2f9928bacc3a76-FRA
access-control-allow-headers
*
json
forms.hscollectedforms.net/collected-forms/v1/config/
115 B
437 B
XHR
General
Full URL
https://forms.hscollectedforms.net/collected-forms/v1/config/json?portalId=3375217&utk=
Requested by
Host: js.hscollectedforms.net
URL: https://js.hscollectedforms.net/collectedforms.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:6cc7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
fb71e0d749623b7c583b86934740d866e5f6fc000204c6b3cb7dfe25a888cc60
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Accept
application/json, text/plain, */*
Referer
https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Mon, 07 Aug 2023 12:42:13 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
x-evy-trace-route-service-name
envoyset-translator
x-hubspot-correlation-id
2525cf8f-ca54-4472-a97e-ca6001eb66d7
x-envoy-upstream-service-time
2
x-evy-trace-route-configuration
listener_https/all
x-evy-trace-listener
listener_https
x-request-id
2525cf8f-ca54-4472-a97e-ca6001eb66d7
server
cloudflare
vary
Accept-Encoding
access-control-allow-methods
GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
content-type
application/json;charset=utf-8
access-control-allow-origin
https://www.reversinglabs.com
x-evy-trace-virtual-host
all
cache-control
max-age=0
x-evy-trace-served-by-pod
iad02/app-td/envoy-proxy-57ff77fcd-8rxrz
access-control-max-age
180
x-robots-tag
none
access-control-allow-headers
*
cf-ray
7f2f9928dc3b365c-FRA
/
c.6sc.co/
7 B
197 B
XHR
General
Full URL
https://c.6sc.co/
Requested by
Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.20.143.57 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-20-143-57.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Mon, 07 Aug 2023 12:42:13 GMT
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
text/html
access-control-allow-origin
https://www.reversinglabs.com
access-control-allow-credentials
true
access-control-allow-headers
*
content-length
7
/
ipv6.6sc.co/
14 B
303 B
XHR
General
Full URL
https://ipv6.6sc.co/
Requested by
Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:480:22::1726:62ed Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
74b8942009f393336b393dad1d725947fe03629bd9d58a76eabfc6eaf6762ead

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 07 Aug 2023 12:42:13 GMT
vary
Origin
content-type
text/html
access-control-allow-origin
https://www.reversinglabs.com
cache-control
max-age=0, no-cache, no-store
6si-ipv6
2a01:4a0:2b::6
server-timing
cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1691412133262_389993773_273807993_26_970_6_0_219";dur=1
content-length
14
expires
Mon, 07 Aug 2023 12:42:13 GMT
img.gif
b.6sc.co/v1/beacon/
43 B
483 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=125cf4892bae30e8b53458235ef53f8d&svisitor=null&visitor=5729e792-36c4-44b2-801f-27daa844017e&session=cdebbf34-efbb-4868-8282-c00ce61521af&event=a_pageload&q=%7B%22pageLoadTime%22%3A%22Mon%2C%2007%20Aug%202023%2012%3A42%3A13%20GMT%22%2C%22settings%22%3A%22%5B%7B%5C%22name%5C%22%3A%5C%22enableEventTracking%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Mon%2C%2007%20Aug%202023%2012%3A42%3A13%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setToken%5C%22%2C%5C%22value%5C%22%3A%5C%22125cf4892bae30e8b53458235ef53f8d%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Mon%2C%2007%20Aug%202023%2012%3A42%3A13%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setEndpoint%5C%22%2C%5C%22value%5C%22%3A%5C%22b.6sc.co%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Mon%2C%2007%20Aug%202023%2012%3A42%3A13%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%5D%22%7D&isIframe=false&m=%7B%22description%22%3A%22ReversingLabs%20threat%20researchers%20have%20identified%20a%20new%20malicious%20PyPI%20campaign%20that%20includes%20a%20suspicious%20VMConnect%20package%20published%20to%20the%20PyPI%20repo.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22VMConnect%3A%20Malicious%20PyPI%20packages%20imitate%20popular%20open%20source%20modules%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fvmconnect-malicious-pypi-packages-imitate-popular-open-source-modules&pageViewId=a7452ca3-c61b-41ab-8dab-0a0bfde6bbb8&v=1.1.5
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.20.143.57 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-20-143-57.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Mon, 07 Aug 2023 12:42:13 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Sat, 18 Feb 2023 00:49:36 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"63f020a0-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
collect
region1.google-analytics.com/g/
0
54 B
Ping
General
Full URL
https://region1.google-analytics.com/g/collect?v=2&tid=G-6H8MZ60CSB&gtm=45je3820&_p=370137491&ul=en-us&sr=1600x1200&cid=851417141.1691412133&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_eu=ABAI&_s=1&dl=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fvmconnect-malicious-pypi-packages-imitate-popular-open-source-modules&dt=VMConnect%3A%20Malicious%20PyPI%20packages%20imitate%20popular%20open%20source%20modules&sid=1691412133&sct=1&seg=0&en=page_view&_fv=1&_ss=1&_ee=1
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-6H8MZ60CSB&cx=c&_slc=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 07 Aug 2023 12:42:13 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.reversinglabs.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
settings
syndication.twitter.com/ Frame 69C4
869 B
658 B
Fetch
General
Full URL
https://syndication.twitter.com/settings?session_id=5ef6c48038eb28f4dd4453fdb24e0d992f86fa4c
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/widgets/widget_iframe.2b2d73daf636805223fb11d48f3e94f7.html?origin=https%3A%2F%2Fwww.reversinglabs.com
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.72 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
302da628a6afc3e93f1b86bf7c65e4d6536d8283d78266964822a76d1c645aa4
Security Headers
Name Value
Strict-Transport-Security max-age=631138519

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://platform.twitter.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

x-response-time
119
date
Mon, 07 Aug 2023 12:42:12 GMT
content-encoding
gzip
strict-transport-security
max-age=631138519
last-modified
Mon, 07 Aug 2023 12:42:13 GMT
server
tsa_o
vary
Origin
content-type
application/json; charset=utf-8
access-control-allow-origin
https://platform.twitter.com
x-transaction-id
9da254d9fc17b7cc
cache-control
must-revalidate, max-age=600
access-control-allow-credentials
true
perf
7626143928
x-connection-hash
b65e85922f811f79c14cc29a8af4a8faaaae68592e1e89332d5c352d738b1aab
content-length
337
/
www.facebook.com/tr/ Frame 1F5B
0
76 B
Document
General
Full URL
https://www.facebook.com/tr/
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f176:84:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Content-Type
application/x-www-form-urlencoded
Origin
https://www.reversinglabs.com
Referer
https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-origin
https://www.reversinglabs.com
alt-svc
h3=":443"; ma=86400
content-length
0
content-type
text/plain
cross-origin-resource-policy
cross-origin
date
Mon, 07 Aug 2023 12:42:13 GMT
server
proxygen-bolt
strict-transport-security
max-age=31536000; includeSubDomains
counters.gif
forms.hsforms.com/embed/v3/
35 B
625 B
Image
General
Full URL
https://forms.hsforms.com/embed/v3/counters.gif?key=collected-forms-embed-js-form-bind&count=3
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700::6811:d3f3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Mon, 07 Aug 2023 12:42:13 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
x-evy-trace-route-service-name
envoyset-translator
x-hubspot-correlation-id
4e7365e9-8919-46e1-898e-82e3dcbf6b16
x-envoy-upstream-service-time
2
alt-svc
h3=":443"; ma=86400
content-length
35
x-evy-trace-route-configuration
listener_https/all
x-evy-trace-listener
listener_https
x-request-id
4e7365e9-8919-46e1-898e-82e3dcbf6b16
server
cloudflare
x-trace
2BBADCB18ACA727A671B3825D046A5A08E5DA7E5C0000000000000000000
vary
origin
content-type
image/gif
x-evy-trace-virtual-host
all
x-evy-trace-served-by-pod
iad02/star-hubspot-td/envoy-proxy-759c64d45c-j4dtm
access-control-expose-headers
X-Origin-Hublet
cache-control
max-age=0, no-cache, no-store
access-control-allow-credentials
false
x-robots-tag
none
cf-ray
7f2f9929ca8b1d94-FRA
img.gif
b.6sc.co/v1/beacon/
43 B
485 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=125cf4892bae30e8b53458235ef53f8d&svisitor=null&visitor=5729e792-36c4-44b2-801f-27daa844017e&session=cdebbf34-efbb-4868-8282-c00ce61521af&event=ipv6&q=%7B%22address%22%3A%222a01%3A4a0%3A2b%3A%3A6%22%7D&isIframe=false&m=%7B%22description%22%3A%22ReversingLabs%20threat%20researchers%20have%20identified%20a%20new%20malicious%20PyPI%20campaign%20that%20includes%20a%20suspicious%20VMConnect%20package%20published%20to%20the%20PyPI%20repo.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22VMConnect%3A%20Malicious%20PyPI%20packages%20imitate%20popular%20open%20source%20modules%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fvmconnect-malicious-pypi-packages-imitate-popular-open-source-modules&pageViewId=a7452ca3-c61b-41ab-8dab-0a0bfde6bbb8&v=1.1.5
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.20.143.57 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-20-143-57.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Mon, 07 Aug 2023 12:42:13 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Sat, 18 Feb 2023 02:04:22 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"63f03226-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
js
www.googletagmanager.com/gtag/
279 KB
94 KB
Script
General
Full URL
https://www.googletagmanager.com/gtag/js?id=AW-970567826
Requested by
Host: js.hsadspixel.net
URL: https://js.hsadspixel.net/fb.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:829::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
c46eade3b30b9b2c4735558ff68dae0ef064886b2c6fb53a2c3d64d607992a23
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Mon, 07 Aug 2023 12:42:13 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
access-control-allow-headers
Cache-Control
content-length
95898
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires
Mon, 07 Aug 2023 12:42:13 GMT
up
insight.adsrvr.org/track/ Frame B503
0
182 B
Document
General
Full URL
https://insight.adsrvr.org/track/up?adv=7qhctws&ref=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fvmconnect-malicious-pypi-packages-imitate-popular-open-source-modules&upid=8t4axvj&upv=1.1.0
Requested by
Host: js.adsrvr.org
URL: https://js.adsrvr.org/up_loader.1.1.0.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.223.40.198 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
a6370ebea231e0c9a.awsglobalaccelerator.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

cache-control
private,no-cache, must-revalidate
content-type
text/html
date
Mon, 07 Aug 2023 12:42:14 GMT
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
pragma
no-cache
x-aspnet-version
4.0.30319
__ptq.gif
track.hubspot.com/
45 B
613 B
Image
General
Full URL
https://track.hubspot.com/__ptq.gif?k=1&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=2246696628&v=1.1&a=3375217&pi=128190968732&ct=blog-post&ccu=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fvmconnect-malicious-pypi-packages-imitate-popular-open-source-modules&cpi=128190968732&cgi=5901382633&lpi=128190968732&lvi=128190968732&lvc=en&pu=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fvmconnect-malicious-pypi-packages-imitate-popular-open-source-modules&t=VMConnect%3A+Malicious+PyPI+packages+imitate+popular+open+source+modules&cts=1691412133920&vi=bc2fa23733ffa59b6e273c88aa1f1de6&nc=true&u=60854195.bc2fa23733ffa59b6e273c88aa1f1de6.1691412133917.1691412133917.1691412133917.1&b=60854195.1.1691412133918&cc=15
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:9b53 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Mon, 07 Aug 2023 12:42:14 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-route-service-name
envoyset-translator
x-hubspot-correlation-id
58b9a02e-5a53-4877-a7da-1324879f4240
p3p
CP="NOI CUR ADM OUR NOR STA NID"
x-envoy-upstream-service-time
7
alt-svc
h3=":443"; ma=86400
content-length
45
x-evy-trace-route-configuration
listener_https/all
x-evy-trace-listener
listener_https
x-request-id
58b9a02e-5a53-4877-a7da-1324879f4240
server
cloudflare
vary
origin, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qQwvuukXXpu%2Bau0bCZsdUV12JXCGAEnaNMVGgGC93RKwJZETbNCciESQHKJwUPGqlm0kok0ITRCkdJ0Cd4pca1HJiRianBg20rVHko8uKp3jtrUxxO9lY5yoGo3sz%2FhyCjkJndb%2Fk7v%2F96TltLqY"}],"group":"cf-nel","max_age":604800}
content-type
image/gif
x-evy-trace-served-by-pod
iad02/analytics-tracking-td/envoy-proxy-5f6448c676-8bmqp
x-evy-trace-virtual-host
all
cache-control
no-cache, no-store, no-transform
access-control-allow-credentials
false
cf-ray
7f2f992d0bb3922b-FRA
x-robots-tag
none
__ptq.gif
track.hubspot.com/
45 B
442 B
Image
General
Full URL
https://track.hubspot.com/__ptq.gif?k=15&fi=24abef2a-a2f4-4889-8899-dd4026584fa9&fci=3615b116-e89b-4d83-a52b-f487bff89252&ft=0&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=2246696628&v=1.1&a=3375217&pi=128190968732&ct=blog-post&ccu=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fvmconnect-malicious-pypi-packages-imitate-popular-open-source-modules&cpi=128190968732&cgi=5901382633&lpi=128190968732&lvi=128190968732&lvc=en&pu=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fvmconnect-malicious-pypi-packages-imitate-popular-open-source-modules&t=VMConnect%3A+Malicious+PyPI+packages+imitate+popular+open+source+modules&cts=1691412133921&vi=bc2fa23733ffa59b6e273c88aa1f1de6&nc=true&u=60854195.bc2fa23733ffa59b6e273c88aa1f1de6.1691412133917.1691412133917.1691412133917.1&b=60854195.1.1691412133918&cc=15
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:9b53 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Mon, 07 Aug 2023 12:42:14 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-route-service-name
envoyset-translator
x-hubspot-correlation-id
334a443e-d6c8-46d4-b970-5701166b3364
p3p
CP="NOI CUR ADM OUR NOR STA NID"
x-envoy-upstream-service-time
15
alt-svc
h3=":443"; ma=86400
content-length
45
x-evy-trace-route-configuration
listener_https/all
x-evy-trace-listener
listener_https
x-request-id
334a443e-d6c8-46d4-b970-5701166b3364
server
cloudflare
vary
origin, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=L0rr%2FY6PIyQwjbGqZo5inCY1uou08XSIuRYqEE6D6mPJ6T0sUWXHpi7NT0Xw7AyC6%2BvLGCLNCCuSS3liNU%2B5wPNClmeuh1IE3c9KYe8RQVfJx5h2hadQEstcfQUzw%2BBXlf6Hd1lced4K8Z9%2FahXo"}],"group":"cf-nel","max_age":604800}
content-type
image/gif
x-evy-trace-served-by-pod
iad02/analytics-tracking-td/envoy-proxy-5f6448c676-2c4rt
x-evy-trace-virtual-host
all
cache-control
no-cache, no-store, no-transform
access-control-allow-credentials
false
cf-ray
7f2f992d0bba922b-FRA
x-robots-tag
none
__ptq.gif
track.hubspot.com/
45 B
437 B
Image
General
Full URL
https://track.hubspot.com/__ptq.gif?k=17&fi=24abef2a-a2f4-4889-8899-dd4026584fa9&fci=3615b116-e89b-4d83-a52b-f487bff89252&ft=0&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=2246696628&v=1.1&a=3375217&pi=128190968732&ct=blog-post&ccu=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fvmconnect-malicious-pypi-packages-imitate-popular-open-source-modules&cpi=128190968732&cgi=5901382633&lpi=128190968732&lvi=128190968732&lvc=en&pu=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fvmconnect-malicious-pypi-packages-imitate-popular-open-source-modules&t=VMConnect%3A+Malicious+PyPI+packages+imitate+popular+open+source+modules&cts=1691412133922&vi=bc2fa23733ffa59b6e273c88aa1f1de6&nc=true&u=60854195.bc2fa23733ffa59b6e273c88aa1f1de6.1691412133917.1691412133917.1691412133917.1&b=60854195.1.1691412133918&cc=15
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:9b53 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Mon, 07 Aug 2023 12:42:14 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-route-service-name
envoyset-translator
x-hubspot-correlation-id
ca85da60-7b4c-4f85-8bdc-8ba048cb85d3
p3p
CP="NOI CUR ADM OUR NOR STA NID"
x-envoy-upstream-service-time
8
alt-svc
h3=":443"; ma=86400
content-length
45
x-evy-trace-route-configuration
listener_https/all
x-evy-trace-listener
listener_https
x-request-id
ca85da60-7b4c-4f85-8bdc-8ba048cb85d3
server
cloudflare
vary
origin, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0nhFmxABpINl3QNSnMisr987VvsaFetW6S%2Bas0q2x973f%2BMTDEwqbp4dKk6O2msiSN%2BpfCbwEg89BU%2FteJlUbe4tsZnGQzjTeScPLzQdCz1cCHIugWhQEq0LHAJFeoSPfikD6MhctlFrbE80BCKE"}],"group":"cf-nel","max_age":604800}
content-type
image/gif
x-evy-trace-served-by-pod
iad02/analytics-tracking-td/envoy-proxy-5f6448c676-wnd65
x-evy-trace-virtual-host
all
cache-control
no-cache, no-store, no-transform
access-control-allow-credentials
false
cf-ray
7f2f992d0bbd922b-FRA
x-robots-tag
none
json
forms.hubspot.com/lead-flows-config/v1/config/
178 B
1 KB
XHR
General
Full URL
https://forms.hubspot.com/lead-flows-config/v1/config/json?portalId=3375217&utk=bc2fa23733ffa59b6e273c88aa1f1de6&__hstc=60854195.bc2fa23733ffa59b6e273c88aa1f1de6.1691412133917.1691412133917.1691412133917.1&__hssc=60854195.1.1691412133918&contentId=128190968732&currentUrl=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fvmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
Requested by
Host: js.hsleadflows.net
URL: https://js.hsleadflows.net/leadflows.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:9a53 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
530e9d521b6606c015f4020309f549c788e213c1fd491877bfa7ecbb2c020bec
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Mon, 07 Aug 2023 12:42:14 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-route-service-name
envoyset-translator
x-hubspot-correlation-id
fc663695-4e24-4108-a2f9-6eb58b82cd40
content-encoding
br
x-envoy-upstream-service-time
21
alt-svc
h3=":443"; ma=86400
x-evy-trace-route-configuration
listener_https/all
x-evy-trace-listener
listener_https
x-request-id
fc663695-4e24-4108-a2f9-6eb58b82cd40
server
cloudflare
vary
origin
access-control-allow-methods
GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
content-type
application/json;charset=utf-8
access-control-allow-origin
https://www.reversinglabs.com
x-evy-trace-virtual-host
all
access-control-max-age
180
access-control-allow-credentials
false
cache-control
max-age=0, no-cache, no-store
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=seIZElimy%2BdRE%2F3mL4%2BgPvLKMU7%2B2nVVNroFhOQ3vM%2FdwBt5M7T4IpESwYRsiVo1YrejNjiU40dIFpHa6lvUBnbEE%2FCBBv1%2FE6iik9tm0NwKooGmka%2B%2FFICrc8WqARR1ku1nYAJR2C7BZBqMo0QA"}],"group":"cf-nel","max_age":604800}
x-robots-tag
none
access-control-allow-headers
Accept, Accept-Charset, Accept-Encoding, Accept-Language, Content-Type, Host, Origin, Referer, User-Agent
cf-ray
7f2f992d4e693720-FRA
x-evy-trace-served-by-pod
iad02/star-hubspot-td/envoy-proxy-759c64d45c-g2zls
img.gif
b.6sc.co/v1/beacon/
43 B
484 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=125cf4892bae30e8b53458235ef53f8d&svisitor=null&visitor=5729e792-36c4-44b2-801f-27daa844017e&session=cdebbf34-efbb-4868-8282-c00ce61521af&event=active_time_track&q=%7B%22currentTime%22%3A%22Mon%2C%2007%20Aug%202023%2012%3A42%3A14%20GMT%22%2C%22lastTrackTime%22%3A%22Mon%2C%2007%20Aug%202023%2012%3A42%3A13%20GMT%22%2C%22timeSpent%22%3A%221002%22%2C%22totalTimeSpent%22%3A%221002%22%7D&isIframe=false&m=%7B%22description%22%3A%22ReversingLabs%20threat%20researchers%20have%20identified%20a%20new%20malicious%20PyPI%20campaign%20that%20includes%20a%20suspicious%20VMConnect%20package%20published%20to%20the%20PyPI%20repo.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22VMConnect%3A%20Malicious%20PyPI%20packages%20imitate%20popular%20open%20source%20modules%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fvmconnect-malicious-pypi-packages-imitate-popular-open-source-modules&pageViewId=a7452ca3-c61b-41ab-8dab-0a0bfde6bbb8&v=1.1.5
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.20.143.57 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-20-143-57.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Mon, 07 Aug 2023 12:42:14 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Sat, 18 Feb 2023 00:49:36 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"63f020a0-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
img.gif
b.6sc.co/v1/beacon/
43 B
485 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=125cf4892bae30e8b53458235ef53f8d&svisitor=null&visitor=5729e792-36c4-44b2-801f-27daa844017e&session=cdebbf34-efbb-4868-8282-c00ce61521af&event=active_time_track&q=%7B%22currentTime%22%3A%22Mon%2C%2007%20Aug%202023%2012%3A42%3A15%20GMT%22%2C%22lastTrackTime%22%3A%22Mon%2C%2007%20Aug%202023%2012%3A42%3A14%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%222003%22%7D&isIframe=false&m=%7B%22description%22%3A%22ReversingLabs%20threat%20researchers%20have%20identified%20a%20new%20malicious%20PyPI%20campaign%20that%20includes%20a%20suspicious%20VMConnect%20package%20published%20to%20the%20PyPI%20repo.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22VMConnect%3A%20Malicious%20PyPI%20packages%20imitate%20popular%20open%20source%20modules%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fvmconnect-malicious-pypi-packages-imitate-popular-open-source-modules&pageViewId=a7452ca3-c61b-41ab-8dab-0a0bfde6bbb8&v=1.1.5
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.20.143.57 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-20-143-57.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Mon, 07 Aug 2023 12:42:15 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Sat, 18 Feb 2023 01:45:17 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"63f02dad-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
img.gif
b.6sc.co/v1/beacon/
43 B
484 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=125cf4892bae30e8b53458235ef53f8d&svisitor=null&visitor=5729e792-36c4-44b2-801f-27daa844017e&session=cdebbf34-efbb-4868-8282-c00ce61521af&event=active_time_track&q=%7B%22currentTime%22%3A%22Mon%2C%2007%20Aug%202023%2012%3A42%3A16%20GMT%22%2C%22lastTrackTime%22%3A%22Mon%2C%2007%20Aug%202023%2012%3A42%3A15%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%223004%22%7D&isIframe=false&m=%7B%22description%22%3A%22ReversingLabs%20threat%20researchers%20have%20identified%20a%20new%20malicious%20PyPI%20campaign%20that%20includes%20a%20suspicious%20VMConnect%20package%20published%20to%20the%20PyPI%20repo.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22VMConnect%3A%20Malicious%20PyPI%20packages%20imitate%20popular%20open%20source%20modules%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fvmconnect-malicious-pypi-packages-imitate-popular-open-source-modules&pageViewId=a7452ca3-c61b-41ab-8dab-0a0bfde6bbb8&v=1.1.5
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.20.143.57 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-20-143-57.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Mon, 07 Aug 2023 12:42:16 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Fri, 21 Feb 2020 18:57:20 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"5e502810-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
img.gif
b.6sc.co/v1/beacon/
43 B
484 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=125cf4892bae30e8b53458235ef53f8d&svisitor=null&visitor=5729e792-36c4-44b2-801f-27daa844017e&session=cdebbf34-efbb-4868-8282-c00ce61521af&event=active_time_track&q=%7B%22currentTime%22%3A%22Mon%2C%2007%20Aug%202023%2012%3A42%3A17%20GMT%22%2C%22lastTrackTime%22%3A%22Mon%2C%2007%20Aug%202023%2012%3A42%3A16%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%224005%22%7D&isIframe=false&m=%7B%22description%22%3A%22ReversingLabs%20threat%20researchers%20have%20identified%20a%20new%20malicious%20PyPI%20campaign%20that%20includes%20a%20suspicious%20VMConnect%20package%20published%20to%20the%20PyPI%20repo.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22VMConnect%3A%20Malicious%20PyPI%20packages%20imitate%20popular%20open%20source%20modules%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fvmconnect-malicious-pypi-packages-imitate-popular-open-source-modules&pageViewId=a7452ca3-c61b-41ab-8dab-0a0bfde6bbb8&v=1.1.5
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.20.143.57 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-20-143-57.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Mon, 07 Aug 2023 12:42:17 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Fri, 21 Feb 2020 18:57:20 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"5e502810-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
img.gif
b.6sc.co/v1/beacon/
43 B
485 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=125cf4892bae30e8b53458235ef53f8d&svisitor=null&visitor=5729e792-36c4-44b2-801f-27daa844017e&session=cdebbf34-efbb-4868-8282-c00ce61521af&event=active_time_track&q=%7B%22currentTime%22%3A%22Mon%2C%2007%20Aug%202023%2012%3A42%3A18%20GMT%22%2C%22lastTrackTime%22%3A%22Mon%2C%2007%20Aug%202023%2012%3A42%3A17%20GMT%22%2C%22timeSpent%22%3A%221002%22%2C%22totalTimeSpent%22%3A%225007%22%7D&isIframe=false&m=%7B%22description%22%3A%22ReversingLabs%20threat%20researchers%20have%20identified%20a%20new%20malicious%20PyPI%20campaign%20that%20includes%20a%20suspicious%20VMConnect%20package%20published%20to%20the%20PyPI%20repo.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22VMConnect%3A%20Malicious%20PyPI%20packages%20imitate%20popular%20open%20source%20modules%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fvmconnect-malicious-pypi-packages-imitate-popular-open-source-modules&pageViewId=a7452ca3-c61b-41ab-8dab-0a0bfde6bbb8&v=1.1.5
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.20.143.57 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-20-143-57.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Mon, 07 Aug 2023 12:42:18 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Sat, 18 Feb 2023 01:45:17 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"63f02dad-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT

Verdicts & Comments Add Verdict or Comment

116 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 object| 3 object| 4 object| 5 function| launchLightbox function| hj object| _hjSettings object| dataLayer function| fbq function| _fbq object| vidyardEmbed function| setImmediate function| clearImmediate object| VidyardV4 object| Vidyard object| __core-js_shared__ object| Sslac object| IN object| hjSiteSettings function| hjBootstrap object| hjBootstrapCalled object| hjLazyModules function| postscribe object| google_tag_manager_external object| google_tag_manager object| google_tag_data string| GoogleAnalyticsObject function| ga string| _linkedin_data_partner_id function| rdt string| qp object| _linkedin_data_partner_ids boolean| _already_called_lintrk function| $ function| jQuery function| SimpleLightbox object| hsVars function| hs_i18n_log function| hs_i18n_substituteStrings function| hs_i18n_insertPlaceholders function| hs_i18n_getMessage object| Cookies function| tns undefined| module_28186900061 function| i18n_getmessage function| i18n_getlanguage object| MicroModal undefined| module_8680713 undefined| module_36845096476 object| hubspot object| HubSpotForms object| _hsq object| hbspt object| hsFormsOnReady object| options function| cookieinfo object| cbinstance function| ttd_dom_ready function| TTDUniversalPixelApi object| configArgs number| pixelRatio number| width number| height object| screenSize object| labels object| Metadata object| gaplugins object| gaGlobal object| gaData function| lintrk function| onYouTubeIframeAPIReady object| GooglebQhCsO object| _hsp function| jsonpHandler object| _6si undefined| $checker number| tnsId object| FB object| __twttrll object| twttr object| __twttr boolean| _hspb_ran boolean| _hspb_loaded boolean| hubspot_live_messages_running object| HubSpotConversations object| __hsCollectedFormsDebug object| _paq function| sanitizeKey boolean| _hstc_loaded object| globalRoot undefined| hns function| bindToWindowOnError object| leadflows function| OutpostErrorReporter function| _registerAvailablePopup object| _availablePopups boolean| popupPoliceActive undefined| hns2 undefined| jade undefined| I18n undefined| Pikaday undefined| reqwest undefined| exports undefined| define boolean| LEAD_FLOWS_RAN boolean| COMMON_SETUP_RAN boolean| PIXELS_RAN object| enabledEventSettings object| ziws object| __buffer boolean| _hstc_ran string| __hsUserToken number| expireDateTime boolean| LEAD_FLOW_DOCUMENT_READY_RAN

35 Cookies

Domain/Path Name / Value
.www.reversinglabs.com/ Name: __cf_bm
Value: HxLq8JFwlgJoAhwfbo4Rx_o8x6mHp7wnF8q8VZJKtmU-1691412131-0-AbJfDvzHqyOzbbUnfUkc55Fdj0pJfML/IYIf2tPby0w4zH6Q5v97kujfvUw7v5cuiXhQqIuZRjyN0w6aW/aLwxI=
.www.reversinglabs.com/ Name: __cfruid
Value: 9520a3ebf966d5021cbc531126dcf579e4a63c67-1691412131
.linkedin.com/ Name: lidc
Value: "b=TGST04:s=T:r=T:a=T:p=T:g=2984:u=1:x=1:i=1691412132:t=1691498532:v=2:sig=AQHfZFGLpTbJC5fDRzujBLEgOpUZGp-z"
.reversinglabs.com/ Name: _gcl_au
Value: 1.1.1737629636.1691412133
.reversinglabs.com/ Name: _fbp
Value: fb.1.1691412132689.1333241885
.reversinglabs.com/ Name: _rdt_uuid
Value: 1691412132946.1b607989-48a6-4fed-bc86-694ef880ad1e
.reversinglabs.com/ Name: _gid
Value: GA1.2.1836868080.1691412133
.reversinglabs.com/ Name: _gat_UA-32828290-1
Value: 1
.reversinglabs.com/ Name: _ga
Value: GA1.1.851417141.1691412133
.reversinglabs.com/ Name: _ga_JVM9Z1XQPL
Value: GS1.1.1691412133.1.0.1691412133.60.0.0
.reversinglabs.com/ Name: _hjSessionUser_3176008
Value: eyJpZCI6ImZmYzBjNWFiLWQ2YzctNWI5Zi1iNGE0LWYzZGUwOTE2OTdjZSIsImNyZWF0ZWQiOjE2OTE0MTIxMzI4OTAsImV4aXN0aW5nIjpmYWxzZX0=
.reversinglabs.com/ Name: _hjFirstSeen
Value: 1
.reversinglabs.com/ Name: _hjIncludedInSessionSample_3176008
Value: 0
.reversinglabs.com/ Name: _hjSession_3176008
Value: eyJpZCI6IjYzZjc5MmNmLTQwNWMtNDJmNi1hMWRlLWI0OTJmYmY2YzRjMiIsImNyZWF0ZWQiOjE2OTE0MTIxMzMwNDUsImluU2FtcGxlIjpmYWxzZX0=
.reversinglabs.com/ Name: _hjAbsoluteSessionInProgress
Value: 0
.doubleclick.net/ Name: test_cookie
Value: CheckForPermission
www.reversinglabs.com/ Name: ln_or
Value: eyI5NzY5MjQiOiJkIn0%3D
.linkedin.com/ Name: li_sugr
Value: 22c32724-633c-4198-920d-3c29f456e9d6
.linkedin.com/ Name: bcookie
Value: "v=2&84059581-8f86-479e-84ff-0b91a7b8eeb2"
.ws.zoominfo.com/ Name: visitorId
Value: 4da96aafc5d7e484cdf9021bb7d3c2dd7ba5b75a678215db48a7fbf024bf23e6
.zoominfo.com/ Name: __cf_bm
Value: NLIC4xegk7RRWmK5M5UMmHJH5gt3FuH4VYEqRe5FWu4-1691412133-0-Ac7XDURzWxNRIHKses1EDpn9n9ik60GlTCia7K9Tw6lljQ/07w7C8BeGKJjGfdv2Jh2H02xmI8qZEz3iD+MUSMU=
.zoominfo.com/ Name: _cfuvid
Value: ZQ6YLGsMXCbqEnO4ao.gYfRw02NMf4zjIKd278dBelk-1691412133141-0-604800000
www.reversinglabs.com/ Name: _gd_visitor
Value: 5729e792-36c4-44b2-801f-27daa844017e
www.reversinglabs.com/ Name: _gd_session
Value: cdebbf34-efbb-4868-8282-c00ce61521af
.hubspot.com/ Name: __cf_bm
Value: 3uHpKH1c5_CHGorTerHWRtf17kO8XTWyoa_g2ZnckOA-1691412133-0-AS0B9dheCwS+0dP+eDagLfZUtq5FEWtxmHWbVAaYQz2xpmSSuOhYL412jlOk4MDFM7D4Kcaaz1jlfz87vwyKGP0=
.reversinglabs.com/ Name: _ga_6H8MZ60CSB
Value: GS1.2.1691412133.1.0.1691412133.0.0.0
.linkedin.com/ Name: UserMatchHistory
Value: AQLEltFoKd4BqgAAAYnQBPWGtTV_RvAUYW0ECJyW0riqgRDdq8W3FFLlaFguQjGtYNQPmwMEQULFbg
.linkedin.com/ Name: AnalyticsSyncHistory
Value: AQK7sDB4yVAEJQAAAYnQBPWGLjUx886fB6LDxyS2ufIOuLO0xwfnR3eyDs2AJPA4dSnp83YzQx98iGsCeS4C6Q
.www.linkedin.com/ Name: bscookie
Value: "v=1&2023080712421307f3b896-f046-42fa-817d-e2e44c51db87AQFD7vrEuL9WNs1ad5ibKclwxkxvrd7-"
.linkedin.com/ Name: li_gc
Value: MTswOzE2OTE0MTIxMzM7MjswMjGb6KrQAmhwXxfA+ZsR8YrQlBQqNP/uIGnLnIJwcABcyQ==
.6sc.co/ Name: 6suuid
Value: 358f1402eeb20100a5e6d06465020000b5241f00
.reversinglabs.com/ Name: __hstc
Value: 60854195.bc2fa23733ffa59b6e273c88aa1f1de6.1691412133917.1691412133917.1691412133917.1
.reversinglabs.com/ Name: hubspotutk
Value: bc2fa23733ffa59b6e273c88aa1f1de6
.reversinglabs.com/ Name: __hssrc
Value: 1
.reversinglabs.com/ Name: __hssc
Value: 60854195.1.1691412133918

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=31536000

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

3375217.fs1.hubspotusercontent-na1.net
alb.reddit.com
api.hubapi.com
app.hubspot.com
b.6sc.co
c.6sc.co
cdn.linkedin.oribi.io
cdn.metadata.io
cdn2.hubspot.net
cdnjs.cloudflare.com
connect.facebook.net
cookieinfoscript.com
fonts.googleapis.com
fonts.gstatic.com
forms-na1.hsforms.com
forms.hscollectedforms.net
forms.hsforms.com
forms.hubspot.com
googleads.g.doubleclick.net
insight.adsrvr.org
ipv6.6sc.co
j.6sc.co
js.adsrvr.org
js.hs-analytics.net
js.hs-banner.com
js.hsadspixel.net
js.hscollectedforms.net
js.hsleadflows.net
js.usemessages.com
platform.linkedin.com
platform.twitter.com
play.vidyard.com
px.ads.linkedin.com
px4.ads.linkedin.com
q.quora.com
region1.analytics.google.com
region1.google-analytics.com
script.hotjar.com
snap.licdn.com
static.hotjar.com
static.hsappstatic.net
stats.g.doubleclick.net
syndication.twitter.com
track.hubspot.com
ws.zoominfo.com
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googletagmanager.com
www.linkedin.com
www.redditstatic.com
www.reversinglabs.com
104.244.42.72
13.107.42.14
151.101.193.181
151.101.65.140
2.20.143.57
2001:4860:4802:34::36
2600:9000:2127:8e00:2:53b2:240:93a1
2600:9000:223c:6a00:9:d7d4:1380:93a1
2606:2800:234:59:254c:406:2366:268c
2606:2c40::c73c:671f
2606:4700::6810:650c
2606:4700::6810:78be
2606:4700::6810:89ce
2606:4700::6811:190e
2606:4700::6811:61ac
2606:4700::6811:6cc7
2606:4700::6811:836e
2606:4700::6811:c9cc
2606:4700::6811:d3f3
2606:4700::6811:d5f3
2606:4700::6812:19c4
2606:4700::6812:8f65
2606:4700::6812:cec9
2606:4700::6812:f0f
2606:4700::6813:9a53
2606:4700::6813:9b53
2620:1ec:21::14
2620:1ec:46::60
2a00:1450:4001:806::200e
2a00:1450:4001:811::2003
2a00:1450:4001:811::2004
2a00:1450:4001:813::200a
2a00:1450:4001:829::2008
2a00:1450:4001:831::2002
2a00:1450:4001:831::2003
2a00:1450:400c:c0c::9c
2a02:26f0:3500:16::215:149b
2a02:26f0:480:22::1726:62ed
2a03:2880:f083:9:face:b00c:0:3
2a03:2880:f176:84:face:b00c:0:25de
2a04:4e42:400::396
2a06:98c1:3120::3
52.21.20.174
52.222.139.19
52.223.40.198
65.9.95.27
65.9.99.119
04245f85425b7978fbfd092971444a755772b93d9fb41f4c58f388e520403afd
09d01a00c23781420e6623249a514a995ea7dd8417159f308ca5391078243928
0ab31a97c236988bb6e415187b2197cdbf689664173015dffd6da8eb96b1626f
0d8e30adfec247d61be8172549cc16e36bd1eb63859b8e818aa0f9965b4dcaef
0f631dc190b0572010591fe489a4d434db77ce0ff6156e9e7e9aa745156c095c
12c8e4eb0826656e26b370c3d2b26d918a04cb80a6c7a44f610127babdc9ca77
130eb7bbe1dca232b6636767637e6bdc2a35fc2d412db3a601593d79c1d743a5
186f40bb344deff6c552b8eee4fb94869a7fcf3648308b2833eb40268ad19cf4
199a07091795dc18d5f648c8ae6ea323b953a6232f814e35c0217925de105a94
1a5131ba88c40e02e211f48163838569b854a383f19817b94db2f4e83f5d044d
1a5f6ffeb8930092b29aef8860e2c8ebbe25dd2dcdf70ab4b6b137c4b4592f70
1a949852daa2fe2be0d5e7dfbf2d0edf71121b49a82b1d82992aa8aa9b7c2d9b
1bcb25af97b820d55089e5d1ad595941b84d3145e92397c21cf2a7acae63d7bd
1d4548c03b28521204ab490e46b39179b8fa196998d45215a24602306b662ab5
249d08c8fde3e1912f9d6d25ff14eed26f4adea29df815b794933eb133f8ec37
257855f4e23a1e3d382077b15bfc30971c9c261fc23512c88abfdcda05f28bc4
262c51d03e4bdb5c91511e2df131b608a522b7a96c6a89048ceb90084b3402dc
27215dede1579d37bcf4ab9ef8fc7d968bd02081c4e61d77837a9bb8f6ca9511
29d170b4f372603eff8bafec8eedd2dc57712f5e38b276f31c4a5295eeeb9de3
2e0e46665e34d5b09152a1ab9be9e89802f26f40b6e1a29780bf07ae94bc2376
2e5436b217fb1a7d9d2365cccfcc95e7483fcba03205c3a216d512302e982d4d
302da628a6afc3e93f1b86bf7c65e4d6536d8283d78266964822a76d1c645aa4
350dfd290fcaf704accd61883b7d6dd6e2fcb8d6f10c747ba96707c20bddc000
37eae8190baecf55f16575bf754238976116ad37b55f81e27db05743461cd507
392c9fa9cd1273a2a89d1a83a69cd1f63f21d1d55e7be21e1d8f51f25145668b
3ac9f879f23b53c0856f5a719a5d2913f2890b5e06b60a8879945c245080fc52
3c50dd5c1727efe22037460b8eaa121b22932d39ab13865d1ecf5b8372d2da4d
3dcf5ab0268e05f2e26960055d40e37a5ec0cb225dcc9da43f52967710cea56b
4002d65e95f94dc87ae8ad170eb8dbc3644921032ac76dcb376537d9304a6fbf
415f1b24f09d34ace4333cdd8a1a2ed4c0f74db2f4f6c76967f1a5555e87d0cc
48caefba7197eca695349c196a4fb51a5998c8f3bd365988462d71e3c65a4b1d
4bc7148ba69c82eccc86c4a9b90d4cf456d9129c9503ad143c8005735f3fb8ba
4d923e30c9ba92131920bece76f573c5bc2f6575097264025daf038254d5540c
4ed697a94ae987ec690170223f411112068b61caf8678788cb4c37347249fd00
4fe6def01e693b4ff7f8a5baa5663c2b2eb7a228d7eb28ca379d255b640df211
530e9d521b6606c015f4020309f549c788e213c1fd491877bfa7ecbb2c020bec
548e19007f81a4cc069dc87c3e54afa0aad5519c1640d5f31506b16793729bd2
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
589ec6096d83ed322d2e1cf7b85f978ecfe80dc19aab6ac106ef5e2352e32269
61ce08dbad99d88826d7e7d374b628662137c7893a943d6a541cf4b0455c5067
68858bf90cb3efb40b74dc096a0c14d3d7d8df522e30067cbee82f0640af2bab
6a48eb505b96c82ed638449c65ba9c99abd5d2055f6803c662d282692dd4d794
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
6ba44383bc980179d0772e2785fdb088c71034b7c54607e739bc56c0e1002250
6e4d408ece6803ecb0c2356f7c16a9e1acdbf01228830ac38274ec1ada687e36
70d1119d232eb54079a766d9e1564320f2c20e6e71683e31edf766c26e9c678e
716dcc9643502eb35aa1f08b4805ec1f377daad3e67c11f9d00d65c6fc6336cf
7426c1c0d2289ccde69718bb10ae44a1a6602702194410999afb700e1e580d94
74b8942009f393336b393dad1d725947fe03629bd9d58a76eabfc6eaf6762ead
77b1e37a44606f04534b026795250cfb8f06416adbe129533a6d855e9b573f67
7b1eaaaf180a13c29b6dddc3b0ae23333b4397e0f3c065b4c86da2f2530a5f89
7b1ecc91aa14b48acb2f7655cc2f4285d7839ab8d239982d4473b02917cd55db
7d6d019be5fdd6ed212ab83345278024e52cb55e59e5a577644a58f1c29ae316
84240275eed2746f9d66bb0a5f46915d74ba6a7c6e210ba4634a16e03ca54270
867e2af897e43a15b5cb0cbf905ba563964426f8707d602891643fe039aa2566
86bc7c25a3bf03fad86ce1733e1a562b1395d60635b29960b7b3f68aefa8bc7a
899663bfeab6b11842c974c2417dc0ad88bd79bb7510b1e032384ccf2618dcc1
8ae4a0865523070959595a6df44d592fd924f6a8503d913a2cbfb81b5df45e62
8da927b6b1240ffca4323fbb2a12c8e5abb541040965c2bc5b7d09a2eb963b02
8dc97419c862f91c4279fb9e2d9a0b7b9b63982ae1d3700a351ea1950c46f564
9103cd19fa0db417520474c8682d15529708804e7d5dcee981c8a19a7c083875
94e9a5e460eda83b3532d27cbb92a176ac95f1429ae89f9164d47a29d3370ee2
95fbf2ab9776737534e11c42ed7370e97aa96be93bdda3783a252eab6d9a0e70
96012ea1e665f4555d84592c02ed5ee2ae06ae12e7869c7878a9fb15cf2bd729
96ea6b1e986879257e104371bf5f0cb0bf2bb9957a1aa73fa9df8be99aeeb157
9a612c9ad7bdfdfeb71ed257ea676a5bca9db5694ee8a0f0c1f8a96330429ea3
9b78354357bc04de9fa52562968bad64ef1311b665cc6ea927d2ec08bcc82cd8
9e634b615e771259a6dc723ef2cda097c480ad26dc92faa6450c5e4e16e3288a
a9ff889aa2badd5dcf9989574fa2006fb183febc1685353d19bf1dd28ed7c1b2
abe603cadd5d178715e8d259697dd4470bf63c6ad1115eb0af8715c778640133
ae3536ecd79c98f87387cee9060be3053e0eb8fe0871e7336554812ef8138772
b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e
b452e67d0f273f9147920b2ec0783838b1ee33727eb9c6fae0a7cff22bf0ac85
b842edb195312e35a5ced3bc4b94113b3a5b15c8a52b676706e5efa9a8b694e4
b99e57a180459ef9973b9bb3f41ce4a28c015ac31ec686c087bf21f42d366608
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96
bb8007225d94a099cddbade7ea904667c0dd0b68d5e30778e5c6257589ab94d1
bc595999f7c46e3f7a293c86fcc256c35467e9947bf0051464628416f1db14f0
be806513bf84af0e310b27e6d4c7eaa56119e06690c7b0bc50d728b7e82b3c9f
c3a0886f92864385930f2f264b78c4a21acb34199893093b2982fdad61c9f248
c44bc92eb78d7b1596789095812e8c24f5c3f9b4835318cf329204d1efc37abb
c46eade3b30b9b2c4735558ff68dae0ef064886b2c6fb53a2c3d64d607992a23
c7d36be0a73651297b0f6b15b1aa2e63a204489bb9c552c11e0cf7db771081d4
c889e86e6c42fc475d139233bc09a8fe599673cfeebe015bd3083cd1ea994e93
c9b277f813652ab4fc3476fe4b9771d2d29e10204caef39416ad8d30e45fc5a2
cafcf576874435cca6e41394ae820ab1573b83f8b405d10d3ff8add93614c8fe
cc3652de6720e88bb9378b09d34a2e807d1706b7a59a2d29903a68fa481759d5
cebbc0e23f1d58a574eab9a677d14629b3aa59a6fbfb0133feb3e03f0e43f754
d09af97ee06f58b7c0e071433e4f08dcfc244e3786639a601e31d3227418473a
d0f80d27eb235c529b6f87057ab7763ab82f8eb2396e8d40df573eb80e5364ec
d57a29c035e1164e865f08b030edaa603ee2a60d806138df4c2975eac83cb08f
d58fcc9b037c7817d2d7565a677f19616b2ca13d2575df0a2c82f4ad60b0ec87
d6dc97993d7e4803aeb35d0e9a24f0393eceb43de5f7ff0f0e437f1b05aea4e2
d8f9afbf492e4c139e9d2bcb9ba6ef7c14921eb509fb703bc7a3f911b774eff8
dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4
dc438b796a9b07ef4235c29389a171915adce110e232e6932f0ec4ca040ac566
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
ddb82c84e1cb4f9ed0e23ada938029f0ac7a79f8a8215eee7bd5177726c02c32
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
e10ce26ead0eca58cd5346843538415611b745bfd29825322efad56424a4c911
e2d14bf82ef15e64d7503eed437a43ad5f26d4f5bcac6745870c32f1ed77a8a6
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e40c8f9d7a3c7c71ee109b2ae4df7dd9b6e3b0cd287d77f9a98312c53392ae25
e5808455786f658eccda5e658ffcc1073d757dd9b70ea3c931fa7a36d583abbc
e600901c3822e2410c8113d763d1f8babb08aab7d06aa1c861be265408cdf649
e803e774c7b59fe74f71ed93acaa875cf9a99947ff8ed7615cd0c93c1667250f
eb8d8c2427fab53f2c4d0c70d9661c7d33d995e486cdb923b0c6d65b6b4fef19
ec283af1b220ae388d616832c82a2612f2630ac572784dd39b6d2c5b8e81e7aa
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f35c317df74c5ceaca83bc620ab17f68e882a21e5378933002f20aae3af0517f
f419ad33d162aefac608940b47d2a524fca46eee0c82f877710a6369e68be33c
f54b61a120e0240c98428d76beab031099f4f0379cbc623de071277255088fdc
f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615
f75911313e1c7802c23345ab57e754d87801581706780c993fb23ff4e0fe62ef
f827ec383239317deb9387ea204a9a0089594aaa0a763922e3d85222010531e2
fa53fcd8da139d256c0ca83b69cb37473ca627b6052368ed3327c80d9fb61e25
fb71e0d749623b7c583b86934740d866e5f6fc000204c6b3cb7dfe25a888cc60
fc2fab7ad17829305a9146a6a0db45bf46dba8b104548a2777c5583c0aff059d
fd5e0c3a0682f03217f201588e51e77bf778d5506224074918f505423f0e25a2
fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a
ff5b2a04410456da0a8e7d8a4db3eacf62ab980e163a500b81781ea6c5b0a73b