www.recordedfuture.com Open in urlscan Pro
104.18.43.111 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.recordedfuture.com/bluedelta-exploits-ukrainian-government-roundcube-mail-servers
Submission: On November 23 via api (November 23rd 2023, 4:29:42 am UTC) from US — Scanned from US

Summary HTTP 100 Redirects Links 11 Behaviour Indicators

Summary

This website contacted 31 IPs in 4 countries across 24 domains to perform 100 HTTP transactions. The main IP is 104.18.43.111, located in and belongs to CLOUDFLARENET, US. The main domain is www.recordedfuture.com. The Cisco Umbrella rank of the primary domain is 418266.
TLS certificate: Issued by DigiCert TLS RSA SHA256 2020 CA1 on February 3rd 2023. Valid for: a year.

This is the only time www.recordedfuture.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
35	104.18.43.111 104.18.43.111	13335 (CLOUDFLAR...) (CLOUDFLARENET)
6	151.101.66.216 151.101.66.216	54113 (FASTLY) (FASTLY)
2	2607:f8b0:402... 2607:f8b0:4020:804::2008	15169 (GOOGLE) (GOOGLE)
1	2606:4700:440... 2606:4700:4400::6812:29ab	13335 (CLOUDFLAR...) (CLOUDFLARENET)
17	23.44.203.87 23.44.203.87	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	146.75.32.157 146.75.32.157	54113 (FASTLY) (FASTLY)
2	2001:4860:480... 2001:4860:4802:34::178	15169 (GOOGLE) (GOOGLE)
2	2600:141b:1c0... 2600:141b:1c00:e::172c:c9e4	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	2607:f8b0:400... 2607:f8b0:4006:816::2008	15169 (GOOGLE) (GOOGLE)
1	2607:f8b0:402... 2607:f8b0:4020:805::200a	15169 (GOOGLE) (GOOGLE)
2	2a03:2880:f01... 2a03:2880:f012:10c:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
2	2600:9000:215... 2600:9000:215f:600:c:7d55:b3c0:93a1	16509 (AMAZON-02) (AMAZON-02)
1	2606:4700::68... 2606:4700::6810:be59	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	68.67.160.186 68.67.160.186	29990 (ASN-APPNEX) (ASN-APPNEX)
1	2600:141b:1c0... 2600:141b:1c00:22::1730:e073	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	104.244.42.197 104.244.42.197	13414 (TWITTER) (TWITTER)
1	104.244.42.131 104.244.42.131	13414 (TWITTER) (TWITTER)
1	2607:f8b0:400... 2607:f8b0:4006:81d::200e	15169 (GOOGLE) (GOOGLE)
2	2607:f8b0:400... 2607:f8b0:4004:c06::9a	15169 (GOOGLE) (GOOGLE)
2	3.231.74.244 3.231.74.244	14618 (AMAZON-AES) (AMAZON-AES)
6	2606:4700::68... 2606:4700::6813:9b53	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6810:50ba	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700:440... 2606:4700:4400::6812:22e5	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6812:7a0c	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	3.126.133.169 3.126.133.169	16509 (AMAZON-02) (AMAZON-02)
1	2a03:2880:f11... 2a03:2880:f112:182:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
4 4	2620:1ec:21::14 2620:1ec:21::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	13.107.42.14 13.107.42.14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	2607:f8b0:400... 2607:f8b0:4006:80c::2004	15169 (GOOGLE) (GOOGLE)
1	2606:4700::68... 2606:4700::6812:a07d	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2606:2c40::c7... 2606:2c40::c73c:6702	() ()
100	31

35 104.18.43.111 (None, )

ASN13335 (CLOUDFLARENET, US)

www.recordedfuture.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 151.101.66.216 (United States)

ASN54113 (FASTLY, US)

cms.recordedfuture.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2607:f8b0:4020:804::2008 (Montreal, Canada)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:4400::6812:29ab (United States)

ASN13335 (CLOUDFLARENET, US)

a7zk.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

17 23.44.203.87 (Secaucus, United States)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a23-44-203-87.deploy.static.akamaitechnologies.com

j.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
c.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
b.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 146.75.32.157 (Ashburn, United States)

ASN54113 (FASTLY, US)

static.ads-twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2001:4860:4802:34::178 (United States)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:141b:1c00:e::172c:c9e4 (Secaucus, United States)

ASN20940 (AKAMAI-ASN1, NL)

snap.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2607:f8b0:4006:816::2008 (United States)

ASN15169 (GOOGLE, US)

ssl.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4020:805::200a (Montreal, Canada)

ASN15169 (GOOGLE, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f012:10c:face:b00c:0:3 (Secaucus, United States)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:9000:215f:600:c:7d55:b3c0:93a1 (United States)

ASN16509 (AMAZON-02, US)

cdn.matomo.cloud	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:be59 (United States)

ASN13335 (CLOUDFLARENET, US)

js.hs-scripts.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 68.67.160.186 (Brooklyn, United States)

ASN29990 (ASN-APPNEX, US)
PTR: 675.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

secure.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:141b:1c00:22::1730:e073 (Secaucus, United States)

ASN20940 (AKAMAI-ASN1, NL)

ipv6.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.197 (United States)

ASN13414 (TWITTER, US)

t.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.131 (United States)

ASN13414 (TWITTER, US)

analytics.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4006:81d::200e (United States)

ASN15169 (GOOGLE, US)

analytics.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2607:f8b0:4004:c06::9a (Washington, United States)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 3.231.74.244 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-231-74-244.compute-1.amazonaws.com

epsilon.6sense.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2606:4700::6813:9b53 (United States)

ASN13335 (CLOUDFLARENET, US)

js.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cta-service-cms2.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
track.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
forms.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:50ba (United States)

ASN13335 (CLOUDFLARENET, US)

js.hs-analytics.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:4400::6812:22e5 (United States)

ASN13335 (CLOUDFLARENET, US)

js.hs-banner.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:7a0c (United States)

ASN13335 (CLOUDFLARENET, US)

js.hsleadflows.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 3.126.133.169 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-126-133-169.eu-central-1.compute.amazonaws.com

recordedfuture.matomo.cloud	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a03:2880:f112:182:face:b00c:0:25de (Secaucus, United States)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2620:1ec:21::14 (United States) 4 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.107.42.14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px4.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4006:80c::2004 (United States)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:a07d (United States)

ASN13335 (CLOUDFLARENET, US)

perf-na1.hsforms.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:2c40::c73c:6702 (None, )

ASN- ()

go.recordedfuture.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
43	recordedfuture.com www.recordedfuture.com — Cisco Umbrella Rank: 418266 cms.recordedfuture.com — Cisco Umbrella Rank: 832436 go.recordedfuture.com	2 MB
18	6sc.co j.6sc.co — Cisco Umbrella Rank: 5465 c.6sc.co — Cisco Umbrella Rank: 8564 ipv6.6sc.co — Cisco Umbrella Rank: 5738 b.6sc.co — Cisco Umbrella Rank: 3759	27 KB
6	hubspot.com js.hubspot.com — Cisco Umbrella Rank: 5485 cta-service-cms2.hubspot.com — Cisco Umbrella Rank: 5222 track.hubspot.com — Cisco Umbrella Rank: 2298 forms.hubspot.com — Cisco Umbrella Rank: 4747	28 KB
5	linkedin.com 4 redirects px.ads.linkedin.com — Cisco Umbrella Rank: 377 www.linkedin.com — Cisco Umbrella Rank: 629 px4.ads.linkedin.com — Cisco Umbrella Rank: 6003	5 KB
4	matomo.cloud cdn.matomo.cloud — Cisco Umbrella Rank: 16488 recordedfuture.matomo.cloud — Cisco Umbrella Rank: 769413	128 KB
4	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 27 ssl.google-analytics.com — Cisco Umbrella Rank: 574	38 KB
2	6sense.com epsilon.6sense.com — Cisco Umbrella Rank: 9302	653 B
2	doubleclick.net stats.g.doubleclick.net — Cisco Umbrella Rank: 78	408 B
2	google.com analytics.google.com — Cisco Umbrella Rank: 157 www.google.com — Cisco Umbrella Rank: 2	667 B
2	facebook.net connect.facebook.net — Cisco Umbrella Rank: 174	91 KB
2	licdn.com snap.licdn.com — Cisco Umbrella Rank: 778	7 KB
2	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 35	192 KB
1	hsforms.com perf-na1.hsforms.com — Cisco Umbrella Rank: 5955	1 KB
1	facebook.com www.facebook.com — Cisco Umbrella Rank: 110	185 B
1	hsleadflows.net js.hsleadflows.net — Cisco Umbrella Rank: 4568	88 KB
1	hs-banner.com js.hs-banner.com — Cisco Umbrella Rank: 2155	16 KB
1	hs-analytics.net js.hs-analytics.net — Cisco Umbrella Rank: 2150	21 KB
1	twitter.com analytics.twitter.com — Cisco Umbrella Rank: 747	394 B
1	t.co t.co — Cisco Umbrella Rank: 607	377 B
1	adnxs.com secure.adnxs.com — Cisco Umbrella Rank: 495	578 B
1	hs-scripts.com js.hs-scripts.com — Cisco Umbrella Rank: 2386	1 KB
1	googleapis.com ajax.googleapis.com — Cisco Umbrella Rank: 364	31 KB
1	ads-twitter.com static.ads-twitter.com — Cisco Umbrella Rank: 713	15 KB
1	a7zk.com a7zk.com	92 B
100	24

	Domain	Requested by
35	www.recordedfuture.com	www.recordedfuture.com
14	b.6sc.co	www.recordedfuture.com
6	cms.recordedfuture.com	www.recordedfuture.com
3	track.hubspot.com
3	px.ads.linkedin.com	3 redirects
2	go.recordedfuture.com
2	recordedfuture.matomo.cloud	cdn.matomo.cloud
2	epsilon.6sense.com	j.6sc.co
2	stats.g.doubleclick.net	www.googletagmanager.com www.google-analytics.com
2	cdn.matomo.cloud	www.recordedfuture.com
2	connect.facebook.net	www.recordedfuture.com connect.facebook.net
2	ssl.google-analytics.com	www.recordedfuture.com
2	snap.licdn.com	www.googletagmanager.com snap.licdn.com
2	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com
2	j.6sc.co	www.googletagmanager.com j.6sc.co
2	www.googletagmanager.com	www.recordedfuture.com www.googletagmanager.com
1	forms.hubspot.com	js.hsleadflows.net
1	perf-na1.hsforms.com	www.recordedfuture.com
1	www.google.com	www.recordedfuture.com
1	cta-service-cms2.hubspot.com	js.hubspot.com
1	px4.ads.linkedin.com	www.recordedfuture.com
1	www.linkedin.com	1 redirects
1	www.facebook.com	www.recordedfuture.com
1	js.hsleadflows.net	js.hs-scripts.com
1	js.hs-banner.com	js.hs-scripts.com
1	js.hs-analytics.net	js.hs-scripts.com
1	js.hubspot.com	js.hs-scripts.com
1	analytics.google.com	www.googletagmanager.com
1	analytics.twitter.com	www.recordedfuture.com
1	t.co	www.recordedfuture.com
1	ipv6.6sc.co	j.6sc.co
1	c.6sc.co	j.6sc.co
1	secure.adnxs.com	j.6sc.co
1	js.hs-scripts.com	www.googletagmanager.com
1	ajax.googleapis.com	www.googletagmanager.com
1	static.ads-twitter.com	www.googletagmanager.com
1	a7zk.com	www.recordedfuture.com
100	37

This site contains links to these domains. Also see Links.

Domain
app.recordedfuture.com
go.recordedfuture.com
nvd.nist.gov
cert.gov.ua
www.youtube.com
www.facebook.com
twitter.com
www.instagram.com

Subject Issuer	Validity	Valid
*.recordedfuture.com DigiCert TLS RSA SHA256 2020 CA1	`2023-02-03` - `2024-03-05`	a year	crt.sh
cms.recordedfuture.com R3	`2023-11-15` - `2024-02-13`	3 months	crt.sh
*.google-analytics.com GTS CA 1C3	`2023-10-23` - `2024-01-15`	3 months	crt.sh
a7zk.com E1	`2023-10-13` - `2024-01-11`	3 months	crt.sh
6sc.co R3	`2023-11-03` - `2024-02-01`	3 months	crt.sh
ads-twitter.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-07-21` - `2024-07-19`	a year	crt.sh
snap.licdn.com DigiCert SHA2 Secure Server CA	`2023-02-01` - `2024-01-31`	a year	crt.sh
upload.video.google.com GTS CA 1C3	`2023-10-23` - `2024-01-15`	3 months	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2023-09-01` - `2023-11-30`	3 months	crt.sh
cdn.matomo.cloud Amazon RSA 2048 M03	`2023-10-27` - `2024-11-23`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2023-05-03` - `2024-05-02`	a year	crt.sh
*.adnxs.com GeoTrust ECC CA 2018	`2023-02-13` - `2024-03-15`	a year	crt.sh
t.co DigiCert TLS RSA SHA256 2020 CA1	`2023-02-01` - `2024-02-01`	a year	crt.sh
*.twitter.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-11-07` - `2024-11-05`	a year	crt.sh
*.google.com GTS CA 1C3	`2023-10-23` - `2024-01-15`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2023-10-23` - `2024-01-15`	3 months	crt.sh
*.6sense.com Amazon RSA 2048 M01	`2023-05-24` - `2024-06-21`	a year	crt.sh
hubspot.com Cloudflare Inc ECC CA-3	`2023-02-05` - `2024-02-05`	a year	crt.sh
*.matomo.cloud Amazon RSA 2048 M02	`2023-06-21` - `2024-07-19`	a year	crt.sh
www.google.com GTS CA 1C3	`2023-10-23` - `2024-01-15`	3 months	crt.sh
go.recordedfuture.com GTS CA 1P5	`2023-10-22` - `2024-01-20`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://www.recordedfuture.com/bluedelta-exploits-ukrainian-government-roundcube-mail-servers
Frame ID: E8194EE100FA2055FD7262ADD6B3BD2C
Requests: 101 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

BlueDelta Exploits Ukrainian Government Roundcube Mail Servers to Support Espionage Activities | Recorded Future

Detected technologies

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.(?:net|com)

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

HubSpot Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

js\.hs-analytics\.net/analytics

Linkedin Insight Tag (Analytics) Expand

Overall confidence: 100%
Detected patterns

snap\.licdn\.com/li\.lms-analytics/insight\.min\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

100
Requests

99 %
HTTPS

68 %
IPv6

24
Domains

37
Subdomains

31
IPs

4
Countries

2285 kB
Transfer

6184 kB
Size

40
Cookies

11 Outgoing links

These are links going to different origins than the main page.

URL: https://app.recordedfuture.com/live/login/
Title: Login

Search URL Search Domain Scan URL

URL: https://go.recordedfuture.com/demo?utm_campaign=demo-button-2023-top-nav-bar&utm_source=recordedfuture&utm_medium=website&utm_content=20231003&utm_term=website
Title: Get a demo

Search URL Search Domain Scan URL

URL: https://nvd.nist.gov/vuln/detail/CVE-2020-35730
Title: CVE-2020-35730

Search URL Search Domain Scan URL

URL: https://nvd.nist.gov/vuln/detail/CVE-2023-23397
Title: CVE-2023-23397

Search URL Search Domain Scan URL

URL: https://cert.gov.ua/article/4905829
Title: attributed

Search URL Search Domain Scan URL

URL: https://go.recordedfuture.com/hubfs/reports/cta-2023-0620.pdf
Title: click here

Search URL Search Domain Scan URL

URL: https://go.recordedfuture.com/demo
Title: Get a Demo

Search URL Search Domain Scan URL

URL: https://www.youtube.com/user/RecordedFuture

Search URL Search Domain Scan URL

URL: https://www.facebook.com/RecordedFuture

Search URL Search Domain Scan URL

URL: https://twitter.com/RecordedFuture

Search URL Search Domain Scan URL

URL: https://www.instagram.com/recordedfuture/

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 80

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=3869953&time=1700713767261&url=https%3A%2F%2Fwww.recordedfuture.com%2Fbluedelta-exploits-ukrainian-government-roundcube-mail-servers HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=3869953&time=1700713767261&url=https%3A%2F%2Fwww.recordedfuture.com%2Fbluedelta-exploits-ukrainian-government-roundcube-mail-servers&cookiesTest=true HTTP 302
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D3869953%26time%3D1700713767261%26url%3Dhttps%253A%252F%252Fwww.recordedfuture.com%252Fbluedelta-exploits-ukrainian-government-roundcube-mail-servers%26cookiesTest%3Dtrue%26liSync%3Dtrue HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=3869953&time=1700713767261&url=https%3A%2F%2Fwww.recordedfuture.com%2Fbluedelta-exploits-ukrainian-government-roundcube-mail-servers&cookiesTest=true&liSync=true HTTP 302
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=3869953&time=1700713767261&url=https%3A%2F%2Fwww.recordedfuture.com%2Fbluedelta-exploits-ukrainian-government-roundcube-mail-servers&cookiesTest=true&liSync=true&e_ipv6=AQJxzOGyTVtTaAAAAYv6cKHsSa-yI-yD8EEqOrdgfhW8Hy2dRm1tWAYIaRzOw5KRQKi9caXd8K7C6USyPzA55PxyktchiQ

100 HTTP transactions
2 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request bluedelta-exploits-ukrainian-government-roundcube-mail-servers Show response
www.recordedfuture.com/ 69 KB
15 KB 49ms
20ms Document
text/html 104.18.43.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/bluedelta-exploits-ukrainian-government-roundcube-mail-servers

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.43.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Next.js

Resource Hash

61524ea7f93906805f1db6216c6bdb4f12b5811b42844c0d04000e618f2c2b99

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

age: 19
cache-control: s-maxage=30, stale-while-revalidate
cf-cache-status: DYNAMIC
cf-ray: 82a6abce5c53c342-EWR
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Thu, 23 Nov 2023 04:29:26 GMT
server: cloudflare
strict-transport-security: max-age=31536000; includeSubDomains
traceresponse: 00-179a26246a05d05dea0c1b6be7d3dd5c-a510961a2077e4b5-01
vary: Accept-Encoding
via: 1.1 varnish
x-cache: HIT
x-cache-hits: 1
x-content-type-options: nosniff
x-debug-info: eyJyZXRyaWVzIjowfQ==
x-nextjs-cache: HIT
x-platform-server: i-be21b5795622437d8136c8a0cedbd8d0 i-be21b5795622437d8136c8a0cedbd8d0
x-powered-by: Next.js
x-served-by: cache-lga21976-LGA

GET
H2 200 brand_logo_long_black_f2ead5b5c6.svg
cms.recordedfuture.com/uploads/ 4 KB
1 KB 27ms
11ms Image
image/svg+xml 151.101.66.216
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cms.recordedfuture.com/uploads/brand_logo_long_black_f2ead5b5c6.svg?w=1920

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/bluedelta-exploits-ukrainian-government-roundcube-mail-servers

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.66.216 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

1d0ca87959e23cb77cff2f1d7fe2337ecc770de12b1d20762373321d7d287183

Security Headers

Name	Value
Strict-Transport-Security	max-age=31557600

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

x-cache-hits: 4
date: Thu, 23 Nov 2023 04:29:26 GMT
content-encoding: gzip
via: 1.1 varnish
strict-transport-security: max-age=31557600
x-platform-server: i-72f68d9e5fc844fb8d11227fc18ff9f4, i-72f68d9e5fc844fb8d11227fc18ff9f4
age: 192
traceresponse: 00-1799d35d497610b040bf8f382dff4f68-9d94ecd85e0e7af6-01
x-cache: HIT
content-length: 1262
x-served-by: cache-lga21948-LGA
last-modified: Thu, 10 Mar 2022 10:37:46 GMT
etag: W/"6229d4fa-eab"
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: max-age=300
x-debug-info: eyJyZXRyaWVzIjowfQ==
accept-ranges: bytes
expires: Wed, 22 Nov 2023 03:17:11 GMT

GET
H2 200 fonts.css
www.recordedfuture.com/fonts/ 1 KB
407 B 52ms
50ms Stylesheet
text/css 104.18.43.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/fonts/fonts.css

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/bluedelta-exploits-ukrainian-government-roundcube-mail-servers

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.43.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

712a64e252b8b2276803abea9f4ec37e39bc91a63c34159f311b690f988c3a3f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.recordedfuture.com/bluedelta-exploits-ukrainian-government-roundcube-mail-servers
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Thu, 23 Nov 2023 04:29:26 GMT
content-encoding: gzip
via: 1.1 varnish
strict-transport-security: max-age=31536000; includeSubDomains
x-platform-server: i-72f68d9e5fc844fb8d11227fc18ff9f4, i-72f68d9e5fc844fb8d11227fc18ff9f4
x-content-type-options: nosniff
cf-cache-status: MISS
traceresponse: 00-179a2628dac2ae569ca0a76bbe0501ff-63b746078a6b6f27-01
x-cache: MISS
content-length: 208
x-served-by: cache-lga21963-LGA
last-modified: Wed, 22 Nov 2023 15:45:28 GMT
server: cloudflare
etag: W/"416-18bf7b52dc0"
vary: Accept-Encoding
content-type: text/css; charset=UTF-8
cache-control: public, max-age=0
x-debug-info: eyJyZXRyaWVzIjowfQ==
accept-ranges: bytes
cf-ray: 82a6abce8c6fc342-EWR
x-cache-hits: 0

GET
H2 200 841e6f84b80033df.css
www.recordedfuture.com/_next/static/css/ 50 KB
12 KB 35ms
34ms Stylesheet
text/css 104.18.43.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/_next/static/css/841e6f84b80033df.css

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/bluedelta-exploits-ukrainian-government-roundcube-mail-servers

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.43.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

73632a42b38d54b93e34b633f23dae5275918f41c8a73d6787caef5747dccea0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.recordedfuture.com/bluedelta-exploits-ukrainian-government-roundcube-mail-servers
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Thu, 23 Nov 2023 04:29:26 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 varnish
cf-cache-status: HIT
x-platform-server: i-bac7380798664d7697b0cf11d33520e7, i-bac7380798664d7697b0cf11d33520e7
x-content-type-options: nosniff
age: 23523
traceresponse: 00-1799f2d78df2478274705b575e6de654-489a653e8238cb87-01
cf-polished: origSize=51612
content-encoding: gzip
x-cache: HIT
x-served-by: cache-lga21977-LGA
cf-bgj: minify
last-modified: Wed, 22 Nov 2023 12:48:57 GMT
server: cloudflare
etag: W/"c99c-18bf7139518"
vary: Accept-Encoding
content-type: text/css; charset=UTF-8
cache-control: public, max-age=31536000, immutable
x-debug-info: eyJyZXRyaWVzIjowfQ==
cf-ray: 82a6abce8c71c342-EWR
x-cache-hits: 1

GET
H2 200 599962ae99da3cfe.css
www.recordedfuture.com/_next/static/css/ 15 KB
4 KB 39ms
38ms Stylesheet
text/css 104.18.43.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/_next/static/css/599962ae99da3cfe.css

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/bluedelta-exploits-ukrainian-government-roundcube-mail-servers

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.43.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

12e873630ce3c58cd366af78f4038495ab6cd993ca06ced50d211489faeab6ec

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.recordedfuture.com/bluedelta-exploits-ukrainian-government-roundcube-mail-servers
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Thu, 23 Nov 2023 04:29:26 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 varnish
cf-cache-status: HIT
x-platform-server: i-72f68d9e5fc844fb8d11227fc18ff9f4, i-72f68d9e5fc844fb8d11227fc18ff9f4
x-content-type-options: nosniff
age: 23523
traceresponse: 00-1795a90d47743edb245d5b22f3877ead-ca88f3fdf2c344e8-01
cf-polished: origSize=14950
content-encoding: gzip
x-cache: HIT
x-served-by: cache-lga21979-LGA
cf-bgj: minify
last-modified: Tue, 07 Nov 2023 21:44:59 GMT
server: cloudflare
etag: W/"3a66-18babbeefa5"
vary: Accept-Encoding
content-type: text/css; charset=UTF-8
cache-control: public, max-age=31536000, immutable
x-debug-info: eyJyZXRyaWVzIjowfQ==
cf-ray: 82a6abce8c72c342-EWR
x-cache-hits: 1

GET
H2 200 webpack-42cdea76c8170223.js Show response
www.recordedfuture.com/_next/static/chunks/ 2 KB
1 KB 22ms
13ms Script
application/javascript 104.18.43.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/_next/static/chunks/webpack-42cdea76c8170223.js

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/bluedelta-exploits-ukrainian-government-roundcube-mail-servers

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.43.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ee5aeb11ca1c2946b0e4501f44497b479a76e49b4e56eeac61332f533390cfb4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.recordedfuture.com/bluedelta-exploits-ukrainian-government-roundcube-mail-servers
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Thu, 23 Nov 2023 04:29:26 GMT
content-encoding: gzip
via: 1.1 varnish
strict-transport-security: max-age=31536000; includeSubDomains
x-platform-server: i-bac7380798664d7697b0cf11d33520e7, i-bac7380798664d7697b0cf11d33520e7
x-content-type-options: nosniff
cf-cache-status: HIT
age: 23523
traceresponse: 00-17932f7af8604c6657f1d7e2823e429d-f42397a88810f7d3-01
x-cache: HIT
content-length: 1074
x-served-by: cache-lga21972-LGA
last-modified: Tue, 31 Oct 2023 11:56:33 GMT
server: cloudflare
etag: W/"8ea-18b8597b2c2"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31536000, immutable
x-debug-info: eyJyZXRyaWVzIjowfQ==
accept-ranges: bytes
cf-ray: 82a6abcecc95c342-EWR
x-cache-hits: 1

GET
H2 200 framework-5f4595e5518b5600.js Show response
www.recordedfuture.com/_next/static/chunks/ 127 KB
41 KB 38ms
30ms Script
application/javascript 104.18.43.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/_next/static/chunks/framework-5f4595e5518b5600.js

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/bluedelta-exploits-ukrainian-government-roundcube-mail-servers

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.43.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8e89e1175a6145d737446d673ffa073f4c469c8fe3972f5287b1e7e9b241282b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.recordedfuture.com/bluedelta-exploits-ukrainian-government-roundcube-mail-servers
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Thu, 23 Nov 2023 04:29:26 GMT
content-encoding: gzip
via: 1.1 varnish
strict-transport-security: max-age=31536000; includeSubDomains
x-platform-server: i-72f68d9e5fc844fb8d11227fc18ff9f4, i-72f68d9e5fc844fb8d11227fc18ff9f4
x-content-type-options: nosniff
cf-cache-status: HIT
age: 23523
traceresponse: 00-17993df6bd0fd8f332569b59a09a195a-8e02db2e0f867afb-01
x-cache: HIT
content-length: 42154
x-served-by: cache-lga21957-LGA
last-modified: Thu, 16 Nov 2023 12:39:44 GMT
server: cloudflare
etag: W/"1fbbb-18bd824fc16"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31536000, immutable
x-debug-info: eyJyZXRyaWVzIjowfQ==
accept-ranges: bytes
cf-ray: 82a6abcecc96c342-EWR
x-cache-hits: 1

GET
H2 200 main-16e79bd25f9f0c89.js Show response
www.recordedfuture.com/_next/static/chunks/ 106 KB
30 KB 23ms
15ms Script
application/javascript 104.18.43.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/_next/static/chunks/main-16e79bd25f9f0c89.js

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/bluedelta-exploits-ukrainian-government-roundcube-mail-servers

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.43.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

45fc78a1cfca8c877b45081dc363233ab7bacef32b75250af4a8834eda308c50

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.recordedfuture.com/bluedelta-exploits-ukrainian-government-roundcube-mail-servers
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Thu, 23 Nov 2023 04:29:26 GMT
content-encoding: gzip
via: 1.1 varnish
strict-transport-security: max-age=31536000; includeSubDomains
x-platform-server: i-72f68d9e5fc844fb8d11227fc18ff9f4, i-72f68d9e5fc844fb8d11227fc18ff9f4
x-content-type-options: nosniff
cf-cache-status: HIT
age: 23523
traceresponse: 00-1797d63b0f860fc2c922c4a69f8e2444-9cf15a3d88cfb2c2-01
x-cache: HIT
content-length: 30859
x-served-by: cache-lga21953-LGA
last-modified: Mon, 13 Nov 2023 13:41:02 GMT
server: cloudflare
etag: W/"1a64b-18bc8ea08a5"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31536000, immutable
x-debug-info: eyJyZXRyaWVzIjowfQ==
accept-ranges: bytes
cf-ray: 82a6abcecc97c342-EWR
x-cache-hits: 1

GET
H2 200 _app-bfae6f41525acf46.js Show response
www.recordedfuture.com/_next/static/chunks/pages/ 119 KB
39 KB 36ms
28ms Script
application/javascript 104.18.43.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/_next/static/chunks/pages/_app-bfae6f41525acf46.js

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/bluedelta-exploits-ukrainian-government-roundcube-mail-servers

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.43.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9282876e4f06631f0e308eb406708e42642da0833d4d78c4b686303933471891

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.recordedfuture.com/bluedelta-exploits-ukrainian-government-roundcube-mail-servers
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Thu, 23 Nov 2023 04:29:26 GMT
content-encoding: gzip
via: 1.1 varnish
strict-transport-security: max-age=31536000; includeSubDomains
x-platform-server: i-be21b5795622437d8136c8a0cedbd8d0, i-be21b5795622437d8136c8a0cedbd8d0
x-content-type-options: nosniff
cf-cache-status: HIT
age: 23523
traceresponse: 00-1799fcbe0e94a879b274293e9dfd6b19-30494fff794007e9-01
x-cache: HIT
content-length: 39354
x-served-by: cache-lga21933-LGA
last-modified: Wed, 22 Nov 2023 15:49:57 GMT
server: cloudflare
etag: W/"1dc24-18bf7b94a40"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31536000, immutable
x-debug-info: eyJyZXRyaWVzIjowfQ==
accept-ranges: bytes
cf-ray: 82a6abcecc98c342-EWR
x-cache-hits: 1

GET
H2 200 29107295-fbcfe2172188e46f.js Show response
www.recordedfuture.com/_next/static/chunks/ 70 KB
24 KB 37ms
29ms Script
application/javascript 104.18.43.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/_next/static/chunks/29107295-fbcfe2172188e46f.js

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/bluedelta-exploits-ukrainian-government-roundcube-mail-servers

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.43.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

50f24e516ae1c0492e06b1c81d1fd961f22cb35a5f9f55ec8bb8f4a10b7f5d51

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.recordedfuture.com/bluedelta-exploits-ukrainian-government-roundcube-mail-servers
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Thu, 23 Nov 2023 04:29:26 GMT
content-encoding: gzip
via: 1.1 varnish
strict-transport-security: max-age=31536000; includeSubDomains
x-platform-server: i-72f68d9e5fc844fb8d11227fc18ff9f4, i-72f68d9e5fc844fb8d11227fc18ff9f4
x-content-type-options: nosniff
cf-cache-status: HIT
age: 23523
traceresponse: 00-1797d6342d78f6bd638a66b13f15856f-9dfe195c6f23a398-01
x-cache: HIT
content-length: 24696
x-served-by: cache-lga21931-LGA
last-modified: Mon, 13 Nov 2023 13:41:02 GMT
server: cloudflare
etag: W/"11809-18bc8ea0811"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31536000, immutable
x-debug-info: eyJyZXRyaWVzIjowfQ==
accept-ranges: bytes
cf-ray: 82a6abcecc99c342-EWR
x-cache-hits: 1

GET
H2 200 439-7cb059f25b66c462.js Show response
www.recordedfuture.com/_next/static/chunks/ 233 KB
71 KB 38ms
30ms Script
application/javascript 104.18.43.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/_next/static/chunks/439-7cb059f25b66c462.js

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/bluedelta-exploits-ukrainian-government-roundcube-mail-servers

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.43.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f2c23fdfbd2f59b66d6478ec0cc0863e748bc789b863fec8872e64fcc639a9dd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.recordedfuture.com/bluedelta-exploits-ukrainian-government-roundcube-mail-servers
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Thu, 23 Nov 2023 04:29:26 GMT
content-encoding: gzip
via: 1.1 varnish
strict-transport-security: max-age=31536000; includeSubDomains
x-platform-server: i-be21b5795622437d8136c8a0cedbd8d0, i-be21b5795622437d8136c8a0cedbd8d0
x-content-type-options: nosniff
cf-cache-status: HIT
age: 23523
traceresponse: 00-17959ac5d00008b8c9732985f3fd9695-a1abee265e155bd5-01
x-cache: HIT
content-length: 71929
x-served-by: cache-lga21939-LGA
last-modified: Tue, 07 Nov 2023 21:44:58 GMT
server: cloudflare
etag: W/"3a56c-18babbeee2b"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31536000, immutable
x-debug-info: eyJyZXRyaWVzIjowfQ==
accept-ranges: bytes
cf-ray: 82a6abcecc9ac342-EWR
x-cache-hits: 1

GET
H2 200 343-929c6f8aa9ef87d4.js Show response
www.recordedfuture.com/_next/static/chunks/ 74 KB
23 KB 31ms
24ms Script
application/javascript 104.18.43.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/_next/static/chunks/343-929c6f8aa9ef87d4.js

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/bluedelta-exploits-ukrainian-government-roundcube-mail-servers

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.43.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7d586f2cef17b222ee811d4fa790d89b3a613e8d83981d109b289a0b45350b19

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.recordedfuture.com/bluedelta-exploits-ukrainian-government-roundcube-mail-servers
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Thu, 23 Nov 2023 04:29:26 GMT
content-encoding: gzip
via: 1.1 varnish
strict-transport-security: max-age=31536000; includeSubDomains
x-platform-server: i-be21b5795622437d8136c8a0cedbd8d0, i-be21b5795622437d8136c8a0cedbd8d0
x-content-type-options: nosniff
cf-cache-status: HIT
age: 23523
traceresponse: 00-1797d6342ac0a2e15d454d64fc9ebe32-abf8ba6bd4752976-01
x-cache: HIT
content-length: 23709
x-served-by: cache-lga21973-LGA
last-modified: Mon, 13 Nov 2023 13:41:02 GMT
server: cloudflare
etag: W/"1286e-18bc8ea0823"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31536000, immutable
x-debug-info: eyJyZXRyaWVzIjowfQ==
accept-ranges: bytes
cf-ray: 82a6abcecc9bc342-EWR
x-cache-hits: 1

GET
H2 200 747-baea2dd0f4995258.js Show response
www.recordedfuture.com/_next/static/chunks/ 59 KB
12 KB 24ms
17ms Script
application/javascript 104.18.43.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/_next/static/chunks/747-baea2dd0f4995258.js

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/bluedelta-exploits-ukrainian-government-roundcube-mail-servers

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.43.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4bab55f97018f753772c29adb94d121e883edd0baecdb075600ad7e9db8f6a70

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.recordedfuture.com/bluedelta-exploits-ukrainian-government-roundcube-mail-servers
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Thu, 23 Nov 2023 04:29:26 GMT
content-encoding: gzip
via: 1.1 varnish
strict-transport-security: max-age=31536000; includeSubDomains
x-platform-server: i-72f68d9e5fc844fb8d11227fc18ff9f4, i-72f68d9e5fc844fb8d11227fc18ff9f4
x-content-type-options: nosniff
cf-cache-status: HIT
age: 23523
traceresponse: 00-1792da997de5ce31e23f2353cc3fe9da-60f18f0866fbdd17-01
x-cache: HIT
content-length: 12063
x-served-by: cache-lga21946-LGA
last-modified: Mon, 30 Oct 2023 09:47:48 GMT
server: cloudflare
etag: W/"ed8b-18b7ffb7722"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31536000, immutable
x-debug-info: eyJyZXRyaWVzIjowfQ==
accept-ranges: bytes
cf-ray: 82a6abcecc9cc342-EWR
x-cache-hits: 1

GET
H2 200 970-d136366932f2f4ed.js Show response
www.recordedfuture.com/_next/static/chunks/ 125 KB
25 KB 31ms
26ms Script
application/javascript 104.18.43.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/_next/static/chunks/970-d136366932f2f4ed.js

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/bluedelta-exploits-ukrainian-government-roundcube-mail-servers

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.43.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4043057ae272c64c228e1b21d5b6a934dfdfceaca47c2edbcac8bf9deff8b4b9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.recordedfuture.com/bluedelta-exploits-ukrainian-government-roundcube-mail-servers
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Thu, 23 Nov 2023 04:29:26 GMT
content-encoding: gzip
via: 1.1 varnish
strict-transport-security: max-age=31536000; includeSubDomains
x-platform-server: i-72f68d9e5fc844fb8d11227fc18ff9f4, i-72f68d9e5fc844fb8d11227fc18ff9f4
x-content-type-options: nosniff
cf-cache-status: HIT
age: 23523
traceresponse: 00-179384da3b81c5b3ab666b574c0f765f-35ea06129f11b0eb-01
x-cache: HIT
content-length: 24947
x-served-by: cache-lga21920-LGA
last-modified: Wed, 01 Nov 2023 14:05:25 GMT
server: cloudflare
etag: W/"1f2c5-18b8b340ace"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31536000, immutable
x-debug-info: eyJyZXRyaWVzIjowfQ==
accept-ranges: bytes
cf-ray: 82a6abcecc9dc342-EWR
x-cache-hits: 1

GET
H2 200 835-e7b5490ff0d68d08.js Show response
www.recordedfuture.com/_next/static/chunks/ 41 KB
11 KB 34ms
29ms Script
application/javascript 104.18.43.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/_next/static/chunks/835-e7b5490ff0d68d08.js

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/bluedelta-exploits-ukrainian-government-roundcube-mail-servers

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.43.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ded012bacb2e23d267671ea46e0770d1fa79701d0746e3171700fd78322e4e63

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.recordedfuture.com/bluedelta-exploits-ukrainian-government-roundcube-mail-servers
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Thu, 23 Nov 2023 04:29:26 GMT
content-encoding: gzip
via: 1.1 varnish
strict-transport-security: max-age=31536000; includeSubDomains
x-platform-server: i-72f68d9e5fc844fb8d11227fc18ff9f4, i-72f68d9e5fc844fb8d11227fc18ff9f4
x-content-type-options: nosniff
cf-cache-status: HIT
age: 23523
traceresponse: 00-1799ea1eec4582c788143c5bfa60a512-30f6a27d88501a5b-01
x-cache: HIT
content-length: 10689
x-served-by: cache-lga21930-LGA
last-modified: Wed, 22 Nov 2023 10:05:24 GMT
server: cloudflare
etag: W/"a3f1-18bf67dd950"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31536000, immutable
x-debug-info: eyJyZXRyaWVzIjowfQ==
accept-ranges: bytes
cf-ray: 82a6abcecc9ec342-EWR
x-cache-hits: 1

GET
H2 200 417-70f7254f4a0a8d33.js Show response
www.recordedfuture.com/_next/static/chunks/ 30 KB
6 KB 36ms
31ms Script
application/javascript 104.18.43.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/_next/static/chunks/417-70f7254f4a0a8d33.js

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/bluedelta-exploits-ukrainian-government-roundcube-mail-servers

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.43.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

273f161ef31ed8a2ab9bc38c299bfec4d397623748b2c1842d7c2fc709514f9a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.recordedfuture.com/bluedelta-exploits-ukrainian-government-roundcube-mail-servers
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Thu, 23 Nov 2023 04:29:26 GMT
content-encoding: gzip
via: 1.1 varnish
strict-transport-security: max-age=31536000; includeSubDomains
x-platform-server: i-72f68d9e5fc844fb8d11227fc18ff9f4, i-72f68d9e5fc844fb8d11227fc18ff9f4
x-content-type-options: nosniff
cf-cache-status: HIT
age: 23523
traceresponse: 00-1799e92c773abf145f69542f45d755a6-9ea33bb8e0e39bd5-01
x-cache: HIT
content-length: 5952
x-served-by: cache-lga21954-LGA
last-modified: Wed, 22 Nov 2023 09:50:36 GMT
server: cloudflare
etag: W/"77be-18bf6704db4"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31536000, immutable
x-debug-info: eyJyZXRyaWVzIjowfQ==
accept-ranges: bytes
cf-ray: 82a6abcedca0c342-EWR
x-cache-hits: 1

GET
H2 200 %5B%5B...slug%5D%5D-98dd5e6c3c40606b.js Show response
www.recordedfuture.com/_next/static/chunks/pages/ 91 KB
19 KB 36ms
32ms Script
application/javascript 104.18.43.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/_next/static/chunks/pages/%5B%5B...slug%5D%5D-98dd5e6c3c40606b.js

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/bluedelta-exploits-ukrainian-government-roundcube-mail-servers

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.43.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

89ee3396394e8602a969823aa4e8d7bbaacfe45f04ace64d9a64c5fa5a035014

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.recordedfuture.com/bluedelta-exploits-ukrainian-government-roundcube-mail-servers
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Thu, 23 Nov 2023 04:29:26 GMT
content-encoding: gzip
via: 1.1 varnish
strict-transport-security: max-age=31536000; includeSubDomains
x-platform-server: i-bac7380798664d7697b0cf11d33520e7, i-bac7380798664d7697b0cf11d33520e7
x-content-type-options: nosniff
cf-cache-status: HIT
age: 23523
traceresponse: 00-1799e92c777efb117b54b461415437e7-c467d8be30ec2a81-01
x-cache: HIT
content-length: 18988
x-served-by: cache-lga21927-LGA
last-modified: Wed, 22 Nov 2023 09:50:37 GMT
server: cloudflare
etag: W/"16a1d-18bf6704e40"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31536000, immutable
x-debug-info: eyJyZXRyaWVzIjowfQ==
accept-ranges: bytes
cf-ray: 82a6abcedca1c342-EWR
x-cache-hits: 1

GET
H2 200 _buildManifest.js Show response
www.recordedfuture.com/_next/static/scsjqnXJ_EeQaa6GljD5a/ 2 KB
855 B 37ms
32ms Script
application/javascript 104.18.43.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/_next/static/scsjqnXJ_EeQaa6GljD5a/_buildManifest.js

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/bluedelta-exploits-ukrainian-government-roundcube-mail-servers

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.43.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8a769108133cffad7744d8bfe5e2b74146db10755d99203b2d20a88ed47f4e40

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.recordedfuture.com/bluedelta-exploits-ukrainian-government-roundcube-mail-servers
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Thu, 23 Nov 2023 04:29:26 GMT
content-encoding: gzip
via: 1.1 varnish
strict-transport-security: max-age=31536000; includeSubDomains
x-platform-server: i-be21b5795622437d8136c8a0cedbd8d0, i-be21b5795622437d8136c8a0cedbd8d0
x-content-type-options: nosniff
cf-cache-status: HIT
age: 23523
traceresponse: 00-1799fccadb66155ee1a9f358972a6e2f-d787ecbd03ce26b2-01
x-cache: HIT
content-length: 676
x-served-by: cache-lga21963-LGA
last-modified: Wed, 22 Nov 2023 15:49:57 GMT
server: cloudflare
etag: W/"783-18bf7b94c29"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31536000, immutable
x-debug-info: eyJyZXRyaWVzIjowfQ==
accept-ranges: bytes
cf-ray: 82a6abcedca2c342-EWR
x-cache-hits: 1

GET
H2 200 _ssgManifest.js Show response
www.recordedfuture.com/_next/static/scsjqnXJ_EeQaa6GljD5a/ 173 B
253 B 35ms
31ms Script
application/javascript 104.18.43.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/_next/static/scsjqnXJ_EeQaa6GljD5a/_ssgManifest.js

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/bluedelta-exploits-ukrainian-government-roundcube-mail-servers

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.43.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

020a19839813fdee2eacf5a88bb1c537c26cb6cffb8cb3fffdbac86d5cf939fd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.recordedfuture.com/bluedelta-exploits-ukrainian-government-roundcube-mail-servers
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Thu, 23 Nov 2023 04:29:26 GMT
via: 1.1 varnish
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
x-platform-server: i-be21b5795622437d8136c8a0cedbd8d0, i-be21b5795622437d8136c8a0cedbd8d0
cf-cache-status: HIT
age: 23523
traceresponse: 00-1799fcbe0d61967ddd4470ac2dfc328f-1e831653ca413e12-01
content-encoding: gzip
x-cache: HIT
x-served-by: cache-lga21960-LGA
last-modified: Wed, 22 Nov 2023 15:49:57 GMT
server: cloudflare
etag: W/"ad-18bf7b94c37"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31536000, immutable
x-debug-info: eyJyZXRyaWVzIjowfQ==
cf-ray: 82a6abcedca3c342-EWR
x-cache-hits: 1

GET
H2 200 insikt_group_logo_updated_3_300x48_b5390f4ff2.png
cms.recordedfuture.com/uploads/ 2 KB
3 KB 24ms
9ms Image
image/png 151.101.66.216
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cms.recordedfuture.com/uploads/insikt_group_logo_updated_3_300x48_b5390f4ff2.png

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/bluedelta-exploits-ukrainian-government-roundcube-mail-servers

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.66.216 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

a18bee42454d2847fd47b2e4fc37156fe94b9e9263653bdb5d30b0b4e8e04070

Security Headers

Name	Value
Strict-Transport-Security	max-age=31557600

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

expires: Wed, 22 Nov 2023 21:20:52 GMT
date: Thu, 23 Nov 2023 04:29:26 GMT
via: 1.1 varnish
strict-transport-security: max-age=31557600
x-platform-server: i-bac7380798664d7697b0cf11d33520e7, i-bac7380798664d7697b0cf11d33520e7
fastly-io-served-by: vpop-mnz1300710
traceresponse: 00-179a0e8005e1ab99b4e1e715e19adb73-9ff1d520f0b52fcc-01
age: 204
x-cache: HIT
fastly-io-info: ifsz=2186 idim=300x48 ifmt=png ofsz=2186 odim=300x48 ofmt=png
fastly-stats: io=1
content-length: 2186
fastly-io-warning: Failed to shrink image
x-served-by: cache-lga21948-LGA
etag: "EbYSum01FIklEjAVbBxNbvSeI3ULDZ+M77H+n4IBChg"
vary: Accept-Encoding
content-type: image/png
cache-control: max-age=300
x-debug-info: eyJyZXRyaWVzIjowfQ==
accept-ranges: bytes
x-cache-hits: 2

GET
H2 200 bluedelta_exploits_ukrainian_government_001_4551bbfd5e.png
cms.recordedfuture.com/uploads/ 73 KB
73 KB 27ms
12ms Image
image/png 151.101.66.216
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cms.recordedfuture.com/uploads/bluedelta_exploits_ukrainian_government_001_4551bbfd5e.png

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/bluedelta-exploits-ukrainian-government-roundcube-mail-servers

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.66.216 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

c513ed8036bba12f205b10503334730a0aefe9e319d939fac360dd41bdbe0432

Security Headers

Name	Value
Strict-Transport-Security	max-age=31557600

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

expires: Thu, 23 Nov 2023 00:26:10 GMT
date: Thu, 23 Nov 2023 04:29:26 GMT
via: 1.1 varnish
strict-transport-security: max-age=31557600
x-platform-server: i-be21b5795622437d8136c8a0cedbd8d0, i-be21b5795622437d8136c8a0cedbd8d0
fastly-io-served-by: vpop-mnz1300718
traceresponse: 00-179a189cbb2862d9e32f114e85c38f65-84864f57dc0422d4-01
age: 123
x-cache: HIT
fastly-io-info: ifsz=74947 idim=1600x932 ifmt=png ofsz=74947 odim=1600x932 ofmt=png
fastly-stats: io=1
content-length: 74947
fastly-io-warning: Failed to shrink image
x-served-by: cache-lga21948-LGA
etag: "rgEIfvE4XX2WQd54RBbDKdPygm0kxbTdu9ZQdvo61BY"
vary: Accept-Encoding
content-type: image/png
cache-control: max-age=300
x-debug-info: eyJyZXRyaWVzIjowfQ==
accept-ranges: bytes
x-cache-hits: 1

GET
DATA 200
OK truncated
/ 42 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Content-Type: image/gif

GET
DATA 200
OK truncated
/ 79 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 495d4afe192ab4d5f4a550a952f4c54e9aac52f1b502772b594770db983995c2

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 x-social-media-black-icon.svg
www.recordedfuture.com/images/ 456 B
465 B 68ms
52ms Image
image/svg+xml 104.18.43.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.recordedfuture.com/images/x-social-media-black-icon.svg

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/_next/static/css/841e6f84b80033df.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.43.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f8837339f39b4de89bcdc5b4705e44d0007a8728881c70d1010f9973dff06306

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.recordedfuture.com/_next/static/css/841e6f84b80033df.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Thu, 23 Nov 2023 04:29:26 GMT
via: 1.1 varnish
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
x-platform-server: i-be21b5795622437d8136c8a0cedbd8d0, i-be21b5795622437d8136c8a0cedbd8d0
cf-cache-status: MISS
content-encoding: gzip
traceresponse: 00-179a2628dfaa3e1f3c631b9f2c4ef9b7-0e0edf1e390faca2-01
x-cache: MISS
x-served-by: cache-lga21930-LGA
last-modified: Wed, 22 Nov 2023 15:45:28 GMT
server: cloudflare
etag: W/"1c8-18bf7b52dc0"
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=0
x-debug-info: eyJyZXRyaWVzIjowfQ==
cf-ray: 82a6abcf0ccec342-EWR
x-cache-hits: 0

GET
H2 200 Inter-Regular.86422bf3.ttf
www.recordedfuture.com/_next/static/media/ 303 KB
144 KB 29ms
14ms Font
font/ttf 104.18.43.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/_next/static/media/Inter-Regular.86422bf3.ttf

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/_next/static/css/841e6f84b80033df.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.43.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

494a9c8817786531126dd245c93f8a85aa6afa405c7b8a2e45b667538470ce7a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.recordedfuture.com/_next/static/css/841e6f84b80033df.css
Origin: https://www.recordedfuture.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Thu, 23 Nov 2023 04:29:26 GMT
content-encoding: gzip
via: 1.1 varnish
strict-transport-security: max-age=31536000; includeSubDomains
x-platform-server: i-72f68d9e5fc844fb8d11227fc18ff9f4, i-72f68d9e5fc844fb8d11227fc18ff9f4
x-content-type-options: nosniff
cf-cache-status: HIT
age: 23523
traceresponse: 00-1795a90d53fcd51e4713ffe6d8fa3e62-37389cfe7a4fd03e-01
x-cache: HIT
content-length: 147167
x-served-by: cache-lga21950-LGA
last-modified: Tue, 07 Nov 2023 21:44:59 GMT
server: cloudflare
etag: W/"4ba44-18babbef03f"
vary: Accept-Encoding
content-type: font/ttf
cache-control: public, max-age=31536000, immutable
x-debug-info: eyJyZXRyaWVzIjowfQ==
accept-ranges: bytes
cf-ray: 82a6abcf0cc8c342-EWR
x-cache-hits: 1

GET
H2 200 Inter-Bold.0b1aaf81.ttf
www.recordedfuture.com/_next/static/media/ 309 KB
154 KB 28ms
17ms Font
font/ttf 104.18.43.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/_next/static/media/Inter-Bold.0b1aaf81.ttf

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/_next/static/css/841e6f84b80033df.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.43.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2ad83f2446566c5ecf7c261cc07884a5d5f71965b5df8fd7bb809f83a42bf470

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.recordedfuture.com/_next/static/css/841e6f84b80033df.css
Origin: https://www.recordedfuture.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Thu, 23 Nov 2023 04:29:26 GMT
content-encoding: gzip
via: 1.1 varnish
strict-transport-security: max-age=31536000; includeSubDomains
x-platform-server: i-bac7380798664d7697b0cf11d33520e7, i-bac7380798664d7697b0cf11d33520e7
x-content-type-options: nosniff
cf-cache-status: HIT
age: 23523
traceresponse: 00-17918630e583dbc85b5f92259072bfb8-1af4b07c6d248e03-01
x-cache: HIT
content-length: 157388
x-served-by: cache-lga21977-LGA
last-modified: Tue, 24 Oct 2023 15:13:55 GMT
server: cloudflare
etag: W/"4d2c4-18b623fdfbf"
vary: Accept-Encoding
content-type: font/ttf
cache-control: public, max-age=31536000, immutable
x-debug-info: eyJyZXRyaWVzIjowfQ==
accept-ranges: bytes
cf-ray: 82a6abcf0cc9c342-EWR
x-cache-hits: 1

GET
H2 200 icomoon.ttf
www.recordedfuture.com/icons/fonts/ 5 KB
3 KB 53ms
42ms Font
font/ttf 104.18.43.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/icons/fonts/icomoon.ttf?j8daoh

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/_next/static/css/841e6f84b80033df.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.43.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e1bffb95aa906bfc9cfdc78a26496ba5b627521e1c9ee09edcf1cd7464405905

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.recordedfuture.com/_next/static/css/841e6f84b80033df.css
Origin: https://www.recordedfuture.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Thu, 23 Nov 2023 04:29:26 GMT
content-encoding: gzip
via: 1.1 varnish
strict-transport-security: max-age=31536000; includeSubDomains
x-platform-server: i-72f68d9e5fc844fb8d11227fc18ff9f4, i-72f68d9e5fc844fb8d11227fc18ff9f4
x-content-type-options: nosniff
cf-cache-status: MISS
traceresponse: 00-179a2628df177709c4fe5ddd6f64fdac-8d389d3b01e4d72a-01
x-cache: MISS
content-length: 3149
x-served-by: cache-lga21940-LGA
last-modified: Wed, 22 Nov 2023 15:45:28 GMT
server: cloudflare
etag: W/"152c-18bf7b52dc0"
vary: Accept-Encoding
content-type: font/ttf
cache-control: public, max-age=0
x-debug-info: eyJyZXRyaWVzIjowfQ==
accept-ranges: bytes
cf-ray: 82a6abcf0ccac342-EWR
x-cache-hits: 0

GET
H2 200 Inter-SemiBold.ebaf29e9.ttf
www.recordedfuture.com/_next/static/media/ 308 KB
153 KB 33ms
23ms Font
font/ttf 104.18.43.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/_next/static/media/Inter-SemiBold.ebaf29e9.ttf

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/_next/static/css/841e6f84b80033df.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.43.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f036a45770ce2ad43dfee7f4eac8f8b3784608a24ff00c63dd56704434e014e8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.recordedfuture.com/_next/static/css/841e6f84b80033df.css
Origin: https://www.recordedfuture.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Thu, 23 Nov 2023 04:29:26 GMT
content-encoding: gzip
via: 1.1 varnish
strict-transport-security: max-age=31536000; includeSubDomains
x-platform-server: i-be21b5795622437d8136c8a0cedbd8d0, i-be21b5795622437d8136c8a0cedbd8d0
x-content-type-options: nosniff
cf-cache-status: HIT
age: 23523
traceresponse: 00-179591416b3a2341670e332a8ac94102-0f74becd01f97a63-01
x-cache: HIT
content-length: 156755
x-served-by: cache-lga21923-LGA
last-modified: Tue, 07 Nov 2023 21:44:59 GMT
server: cloudflare
etag: W/"4d16c-18babbef05f"
vary: Accept-Encoding
content-type: font/ttf
cache-control: public, max-age=31536000, immutable
x-debug-info: eyJyZXRyaWVzIjowfQ==
accept-ranges: bytes
cf-ray: 82a6abcf0ccbc342-EWR
x-cache-hits: 1

GET
H2 200 Inter-ExtraBold.d19caa02.ttf
www.recordedfuture.com/_next/static/media/ 309 KB
154 KB 31ms
21ms Font
font/ttf 104.18.43.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/_next/static/media/Inter-ExtraBold.d19caa02.ttf

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/_next/static/css/841e6f84b80033df.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.43.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6fb3140db2839cabd3662044ef7791206df377b2211046abc71dd039f05fe082

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.recordedfuture.com/_next/static/css/841e6f84b80033df.css
Origin: https://www.recordedfuture.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Thu, 23 Nov 2023 04:29:26 GMT
content-encoding: gzip
via: 1.1 varnish
strict-transport-security: max-age=31536000; includeSubDomains
x-platform-server: i-72f68d9e5fc844fb8d11227fc18ff9f4, i-72f68d9e5fc844fb8d11227fc18ff9f4
x-content-type-options: nosniff
cf-cache-status: HIT
age: 23523
traceresponse: 00-1797d6343f23333e1e9f3fcbbc62a5c1-bb07c3d199d5399d-01
x-cache: HIT
content-length: 157010
x-served-by: cache-lga21921-LGA
last-modified: Mon, 13 Nov 2023 13:41:03 GMT
server: cloudflare
etag: W/"4d52c-18bc8ea0a24"
vary: Accept-Encoding
content-type: font/ttf
cache-control: public, max-age=31536000, immutable
x-debug-info: eyJyZXRyaWVzIjowfQ==
accept-ranges: bytes
cf-ray: 82a6abcf0cccc342-EWR
x-cache-hits: 1

GET
H2 200 Inter-Medium.6ee661b3.ttf
www.recordedfuture.com/_next/static/media/ 307 KB
152 KB 44ms
33ms Font
font/ttf 104.18.43.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/_next/static/media/Inter-Medium.6ee661b3.ttf

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/_next/static/css/841e6f84b80033df.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.43.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a0b1f949528f7a3a2d2ff3b6df67c6c1b5cb8f62a2eba6eb5e06adff2d5795f3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.recordedfuture.com/_next/static/css/841e6f84b80033df.css
Origin: https://www.recordedfuture.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Thu, 23 Nov 2023 04:29:26 GMT
content-encoding: gzip
via: 1.1 varnish
strict-transport-security: max-age=31536000; includeSubDomains
x-platform-server: i-bac7380798664d7697b0cf11d33520e7, i-bac7380798664d7697b0cf11d33520e7
x-content-type-options: nosniff
cf-cache-status: HIT
age: 23523
traceresponse: 00-1797d6343ecc3af97a06f8050687c56b-7245be9f51a242a9-01
x-cache: HIT
content-length: 155503
x-served-by: cache-lga21972-LGA
last-modified: Mon, 13 Nov 2023 13:41:03 GMT
server: cloudflare
etag: W/"4cd58-18bc8ea0a5d"
vary: Accept-Encoding
content-type: font/ttf
cache-control: public, max-age=31536000, immutable
x-debug-info: eyJyZXRyaWVzIjowfQ==
accept-ranges: bytes
cf-ray: 82a6abcf0ccdc342-EWR
x-cache-hits: 2

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 314 KB
100 KB 98ms
52ms Script
application/javascript 2607:f8b0:4020:804::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-539N74N

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/bluedelta-exploits-ukrainian-government-roundcube-mail-servers

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:804::2008 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

cf1b2c4162d046db8fa6f9e7ed2cbe1f7db65cd88375ba0e8e025b5105058c70

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Thu, 23 Nov 2023 04:29:26 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 102061
x-xss-protection: 0
last-modified: Thu, 23 Nov 2023 03:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 23 Nov 2023 04:29:26 GMT

GET
H2 200 resource-sidebars Show response
cms.recordedfuture.com/api/ 82 B
821 B 11ms
3ms XHR
application/json 151.101.66.216
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cms.recordedfuture.com/api/resource-sidebars?populate[0]=type&populate[1]=blocks&populate[2]=blocks.image&populate[3]=blocks.image.desktop&populate[4]=blocks.image.tablet&populate[5]=blocks.image.mobile&populate[6]=blocks.link&populate[7]=blocks.link.page&filters[type][key][$eq]=research

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/_next/static/chunks/343-929c6f8aa9ef87d4.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.66.216 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

/ Strapi <strapi.io>

Resource Hash

6f2a66b7c2567498349c8dc31d361a2208aa2babd36fdaabe7ef20aefe992bd9

Security Headers

Name	Value
Content-Security-Policy	connect-src 'self' https:;img-src 'self' data: blob: https://market-assets.strapi.io;media-src 'self' data: blob:;default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline'
Strict-Transport-Security	max-age=31557600
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Accept: application/json, text/plain, */*
Referer: https://www.recordedfuture.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

content-security-policy: connect-src 'self' https:;img-src 'self' data: blob: https://market-assets.strapi.io;media-src 'self' data: blob:;default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline'
date: Thu, 23 Nov 2023 04:29:26 GMT
x-content-type-options: nosniff
strict-transport-security: max-age=31557600
x-platform-server: i-bac7380798664d7697b0cf11d33520e7, i-bac7380798664d7697b0cf11d33520e7
x-permitted-cross-domain-policies: none
via: 1.1 varnish
traceresponse: 00-179a2567c99f8c47e603aaa71686b02a-e438bab99c91aa81-01
x-powered-by: Strapi <strapi.io>
age: 829
x-dns-prefetch-control: off
x-cache: HIT
content-length: 82
x-served-by: cache-lga21943-LGA
referrer-policy: no-referrer
x-download-options: noopen
x-frame-options: SAMEORIGIN
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.recordedfuture.com
x-debug-info: eyJyZXRyaWVzIjowfQ==
accept-ranges: bytes
x-cache-hits: 8

GET
H2 200 resources Show response
cms.recordedfuture.com/api/ 17 KB
17 KB 115ms
109ms XHR
application/json 151.101.66.216
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cms.recordedfuture.com/api/resources?populate[0]=cardImage&populate[1]=cardImage.desktop&populate[2]=cardImage.mobile&populate[3]=cardImage.tablet&populate[4]=countryTags&populate[5]=downloadResource&populate[6]=downloadResource.type&populate[7]=eventResource&populate[8]=eventResource.type&populate[9]=industryTags&populate[10]=integrationResource&populate[11]=integrationResource.tags&populate[12]=newsAndResearchResource&populate[13]=newsAndResearchResource.researchPreviewImage&populate[14]=newsAndResearchResource.researchPreviewImageDesktop&populate[15]=newsAndResearchResource.researchPreviewImageMobile&populate[16]=newsAndResearchResource.researchPreviewImageTablet&populate[17]=newsAndResearchResource.type&populate[18]=page&populate[19]=productTags&populate[20]=threatTags&populate[21]=topicTags&filters[$or][0][downloadResource][type][key][$in]=&filters[$or][1][eventResource][type][key][$in]=&filters[$or][2][newsAndResearchResource][type][key][$in][0]=research&filters[$and][0][$or][0][showFrom][$null]=true&filters[$and][0][$or][1][showFrom][$lte]=2023-11-23T04%3A29%3A26Z&pagination%5BpageSize%5D=4&pagination%5Bpage%5D=1&sort%5B0%5D=eventResource.startDate%3Aasc&sort%5B1%5D=publishedAt%3Adesc

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/_next/static/chunks/343-929c6f8aa9ef87d4.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.66.216 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

/ Strapi <strapi.io>

Resource Hash

da03d0303eb55ab800aa94ea6018b93025ecb7ce73104c6362a4c0cfec93918f

Security Headers

Name	Value
Content-Security-Policy	connect-src 'self' https:;img-src 'self' data: blob: https://market-assets.strapi.io;media-src 'self' data: blob:;default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline'
Strict-Transport-Security	max-age=31557600
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Accept: application/json, text/plain, */*
Referer: https://www.recordedfuture.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

content-security-policy: connect-src 'self' https:;img-src 'self' data: blob: https://market-assets.strapi.io;media-src 'self' data: blob:;default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline'
date: Thu, 23 Nov 2023 04:29:26 GMT
x-content-type-options: nosniff
strict-transport-security: max-age=31557600
x-platform-server: i-72f68d9e5fc844fb8d11227fc18ff9f4, i-72f68d9e5fc844fb8d11227fc18ff9f4
x-permitted-cross-domain-policies: none
via: 1.1 varnish
traceresponse: 00-179a2628e9b185c8b474cd28c46f9c7f-999ed1b543747aa9-01
x-powered-by: Strapi <strapi.io>
age: 0
x-dns-prefetch-control: off
x-cache: MISS
content-length: 17622
x-served-by: cache-lga21943-LGA
referrer-policy: no-referrer
x-download-options: noopen
x-frame-options: SAMEORIGIN
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.recordedfuture.com
x-debug-info: eyJyZXRyaWVzIjowfQ==
accept-ranges: bytes
x-cache-hits: 0

GET
H2 200 0f96674e-0e09-4164-8881-d8567d21e16a.png
a7zk.com/images/ 92 B
92 B 283ms
249ms Image
image/png 2606:4700:4400::6812:29ab
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://a7zk.com/images/0f96674e-0e09-4164-8881-d8567d21e16a.png?l=aHR0cHM6Ly93d3cucmVjb3JkZWRmdXR1cmUuY29tL2JsdWVkZWx0YS1leHBsb2l0cy11a3JhaW5pYW4tZ292ZXJubWVudC1yb3VuZGN1YmUtbWFpbC1zZXJ2ZXJz
Requested by: Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/bluedelta-exploits-ukrainian-government-roundcube-mail-servers
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::6812:29ab , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Thu, 23 Nov 2023 04:29:26 GMT
cache-control: no-store
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 82a6abd07f667289-EWR
content-length: 92
content-type: image/png;charset=utf-8

GET
H2 200 bluedelta_exploits_ukrainian_government_main_44a532e5b0.jpg
cms.recordedfuture.com/uploads/ 132 KB
133 KB 14ms
13ms Image
image/jpeg 151.101.66.216
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cms.recordedfuture.com/uploads/bluedelta_exploits_ukrainian_government_main_44a532e5b0.jpg?w=1920

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/bluedelta-exploits-ukrainian-government-roundcube-mail-servers

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.66.216 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

ee7202fb4a4c7c9799ad4f468579c35d2b025e936404e1b86f48028b8b0e9889

Security Headers

Name	Value
Strict-Transport-Security	max-age=31557600

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

expires: Thu, 23 Nov 2023 00:26:11 GMT
date: Thu, 23 Nov 2023 04:29:26 GMT
via: 1.1 varnish
strict-transport-security: max-age=31557600
x-platform-server: i-bac7380798664d7697b0cf11d33520e7, i-bac7380798664d7697b0cf11d33520e7
fastly-io-served-by: vpop-mnz1300702
traceresponse: 00-179a189cced64966720174e04fd45ca1-9686d7f7dae45e7e-01
age: 123
x-cache: HIT
fastly-io-info: ifsz=135499 idim=1600x600 ifmt=jpeg ofsz=135499 odim=1600x600 ofmt=jpeg
fastly-stats: io=1
content-length: 135499
fastly-io-warning: Failed to shrink image
x-served-by: cache-lga21948-LGA
etag: "KMRyLq0wYpx9bUa4NhAc1qu1xP0ud9M4LvarUpZ/jY4"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: max-age=300
x-debug-info: eyJyZXRyaWVzIjowfQ==
accept-ranges: bytes
x-cache-hits: 1

GET
H2 200 careers.json Show response
www.recordedfuture.com/_next/data/scsjqnXJ_EeQaa6GljD5a/ 69 KB
13 KB 26ms
26ms Fetch
application/json 104.18.43.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/_next/data/scsjqnXJ_EeQaa6GljD5a/careers.json?slug=careers

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/_next/static/chunks/main-16e79bd25f9f0c89.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.43.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4e122c393dd676bf7fb18443181e894ec74a8b44afca1e8aabf4fed53f71f5b4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

purpose: prefetch
x-nextjs-data: 1
Referer: https://www.recordedfuture.com/bluedelta-exploits-ukrainian-government-roundcube-mail-servers
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Thu, 23 Nov 2023 04:29:26 GMT
content-encoding: gzip
x-nextjs-matched-path: /[[...slug]]
strict-transport-security: max-age=31536000; includeSubDomains
x-platform-server: i-bac7380798664d7697b0cf11d33520e7, i-bac7380798664d7697b0cf11d33520e7
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
via: 1.1 varnish
traceresponse: 00-179a2627fcd3c4d8f1a08bdc8ee8fe01-83e93546ddb8a001-01
age: 4
x-cache: HIT
x-nextjs-cache: STALE
content-length: 12723
x-served-by: cache-lga21930-LGA
server: cloudflare
etag: "11430-l068B+QctAjNxon0b40Al0Fi0GM"
vary: Accept-Encoding
content-type: application/json
cache-control: s-maxage=30, stale-while-revalidate
x-debug-info: eyJyZXRyaWVzIjowfQ==
accept-ranges: bytes
cf-ray: 82a6abd0adcbc342-EWR
x-cache-hits: 1

GET
H2 200 contact.json Show response
www.recordedfuture.com/_next/data/scsjqnXJ_EeQaa6GljD5a/ 45 KB
9 KB 29ms
23ms Fetch
application/json 104.18.43.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/_next/data/scsjqnXJ_EeQaa6GljD5a/contact.json?slug=contact

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/_next/static/chunks/main-16e79bd25f9f0c89.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.43.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

71b42166e2662b6c5e09c8ec2e79cdf2c146b998b6a80a5a5a0dd5dde4590b06

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

purpose: prefetch
x-nextjs-data: 1
Referer: https://www.recordedfuture.com/bluedelta-exploits-ukrainian-government-roundcube-mail-servers
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Thu, 23 Nov 2023 04:29:26 GMT
content-encoding: gzip
x-nextjs-matched-path: /[[...slug]]
strict-transport-security: max-age=31536000; includeSubDomains
x-platform-server: i-be21b5795622437d8136c8a0cedbd8d0, i-be21b5795622437d8136c8a0cedbd8d0
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
via: 1.1 varnish
traceresponse: 00-179a26288e453ce0fe4a9d4609caf06e-75c1858559c5a099-01
age: 2
x-cache: HIT
x-nextjs-cache: STALE
content-length: 9095
x-served-by: cache-lga21976-LGA
server: cloudflare
etag: "b21c-PC49RMVtKx0iqKMPxglPK/lpFJM"
vary: Accept-Encoding
content-type: application/json
cache-control: s-maxage=30, stale-while-revalidate
x-debug-info: eyJyZXRyaWVzIjowfQ==
accept-ranges: bytes
cf-ray: 82a6abd0adcec342-EWR
x-cache-hits: 1

GET
H2 200 index.json Show response
www.recordedfuture.com/_next/data/scsjqnXJ_EeQaa6GljD5a/ 150 KB
23 KB 19ms
14ms Fetch
application/json 104.18.43.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/_next/data/scsjqnXJ_EeQaa6GljD5a/index.json

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/_next/static/chunks/main-16e79bd25f9f0c89.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.43.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7376fe1082b03155ec4ac8c991defa5e5b2e661360ff6df011e5120a02008f1d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

purpose: prefetch
x-nextjs-data: 1
Referer: https://www.recordedfuture.com/bluedelta-exploits-ukrainian-government-roundcube-mail-servers
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Thu, 23 Nov 2023 04:29:26 GMT
content-encoding: gzip
x-nextjs-matched-path: /[[...slug]]
strict-transport-security: max-age=31536000; includeSubDomains
x-platform-server: i-bac7380798664d7697b0cf11d33520e7, i-bac7380798664d7697b0cf11d33520e7
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
via: 1.1 varnish
traceresponse: 00-179a24dc720feee5d99d6f572dccaeab-90ec90ea55bffc21-01
age: 1428
x-cache: HIT
x-nextjs-cache: STALE
content-length: 22832
x-served-by: cache-lga21927-LGA
server: cloudflare
etag: "25889-wgsQ/Q4zzzN8HBkUtpsmSne6Z1Q"
vary: Accept-Encoding
content-type: application/json
x-debug-info: eyJyZXRyaWVzIjowfQ==
accept-ranges: bytes
cf-ray: 82a6abd0adcfc342-EWR
x-cache-hits: 16

GET
H2 200 intelligence-cloud.json Show response
www.recordedfuture.com/_next/data/scsjqnXJ_EeQaa6GljD5a/platform/ 65 KB
12 KB 28ms
24ms Fetch
application/json 104.18.43.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/_next/data/scsjqnXJ_EeQaa6GljD5a/platform/intelligence-cloud.json

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/_next/static/chunks/main-16e79bd25f9f0c89.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.43.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

24286674631e993c662f2bb1443cd8eedb7638e0b3b91236de8ca5811412592c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

purpose: prefetch
x-nextjs-data: 1
Referer: https://www.recordedfuture.com/bluedelta-exploits-ukrainian-government-roundcube-mail-servers
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Thu, 23 Nov 2023 04:29:26 GMT
content-encoding: gzip
x-nextjs-matched-path: /[[...slug]]
strict-transport-security: max-age=31536000; includeSubDomains
x-platform-server: i-bac7380798664d7697b0cf11d33520e7, i-bac7380798664d7697b0cf11d33520e7
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
via: 1.1 varnish
traceresponse: 00-179a2627b7fddd7ee085b4d17cdd2ef9-e89c85d372a7173f-01
age: 5
x-cache: HIT
x-nextjs-cache: STALE
content-length: 11983
x-served-by: cache-lga21921-LGA
server: cloudflare
etag: "1041c-9Yx9vjcuE6x5790nA52mV05xIhE"
vary: Accept-Encoding
content-type: application/json
cache-control: s-maxage=30, stale-while-revalidate
x-debug-info: eyJyZXRyaWVzIjowfQ==
accept-ranges: bytes
cf-ray: 82a6abd0add1c342-EWR
x-cache-hits: 1

GET
H2 200 why-recorded-future.json Show response
www.recordedfuture.com/_next/data/scsjqnXJ_EeQaa6GljD5a/ 46 KB
9 KB 22ms
18ms Fetch
application/json 104.18.43.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/_next/data/scsjqnXJ_EeQaa6GljD5a/why-recorded-future.json

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/_next/static/chunks/main-16e79bd25f9f0c89.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.43.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

845b4eaf67f8f5264caa8c3182c0f552e9e3c6d95823b13fcafd631a577e3a3a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

purpose: prefetch
x-nextjs-data: 1
Referer: https://www.recordedfuture.com/bluedelta-exploits-ukrainian-government-roundcube-mail-servers
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Thu, 23 Nov 2023 04:29:26 GMT
content-encoding: gzip
x-nextjs-matched-path: /[[...slug]]
strict-transport-security: max-age=31536000; includeSubDomains
x-platform-server: i-bac7380798664d7697b0cf11d33520e7, i-bac7380798664d7697b0cf11d33520e7
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
via: 1.1 varnish
traceresponse: 00-179a2626095e98365ab225598cb6a209-2beb19cff84bc2f1-01
age: 12
x-cache: HIT
x-nextjs-cache: STALE
content-length: 8769
x-served-by: cache-lga21921-LGA
server: cloudflare
etag: "b7d0-RE/KgNtViWvoRegy/1JBBC9C/PM"
vary: Accept-Encoding
content-type: application/json
cache-control: s-maxage=30, stale-while-revalidate
x-debug-info: eyJyZXRyaWVzIjowfQ==
accept-ranges: bytes
cf-ray: 82a6abd0add2c342-EWR
x-cache-hits: 2

GET
H2 200 client-success.json Show response
www.recordedfuture.com/_next/data/scsjqnXJ_EeQaa6GljD5a/services-support/ 40 KB
8 KB 23ms
19ms Fetch
application/json 104.18.43.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/_next/data/scsjqnXJ_EeQaa6GljD5a/services-support/client-success.json

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/_next/static/chunks/main-16e79bd25f9f0c89.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.43.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f6fe618578c475777192fa59c2d84d95263999461e617a0ffe165f6d4bafb1e8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

purpose: prefetch
x-nextjs-data: 1
Referer: https://www.recordedfuture.com/bluedelta-exploits-ukrainian-government-roundcube-mail-servers
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Thu, 23 Nov 2023 04:29:26 GMT
content-encoding: gzip
x-nextjs-matched-path: /[[...slug]]
strict-transport-security: max-age=31536000; includeSubDomains
x-platform-server: i-be21b5795622437d8136c8a0cedbd8d0, i-be21b5795622437d8136c8a0cedbd8d0
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
via: 1.1 varnish
traceresponse: 00-179a26263ab3c625765f2ea9019effff-2d692bcb131edc6d-01
age: 12
x-cache: HIT
x-nextjs-cache: STALE
content-length: 8000
x-served-by: cache-lga21926-LGA
server: cloudflare
etag: "9e34-1YchYD92w0LmSUQkIYEo9E4kxDY"
vary: Accept-Encoding
content-type: application/json
cache-control: s-maxage=30, stale-while-revalidate
x-debug-info: eyJyZXRyaWVzIjowfQ==
accept-ranges: bytes
cf-ray: 82a6abd0add3c342-EWR
x-cache-hits: 1

GET
H2 200 research.json Show response
www.recordedfuture.com/_next/data/scsjqnXJ_EeQaa6GljD5a/ 52 KB
10 KB 28ms
25ms Fetch
application/json 104.18.43.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/_next/data/scsjqnXJ_EeQaa6GljD5a/research.json?slug=research

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/_next/static/chunks/main-16e79bd25f9f0c89.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.43.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

303e51988c9260a2cff3363c4750588e224fb5d0cd13bd716659ae013ff6c5db

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

purpose: prefetch
x-nextjs-data: 1
Referer: https://www.recordedfuture.com/bluedelta-exploits-ukrainian-government-roundcube-mail-servers
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Thu, 23 Nov 2023 04:29:26 GMT
content-encoding: gzip
x-nextjs-matched-path: /[[...slug]]
strict-transport-security: max-age=31536000; includeSubDomains
x-platform-server: i-bac7380798664d7697b0cf11d33520e7, i-bac7380798664d7697b0cf11d33520e7
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
via: 1.1 varnish
traceresponse: 00-179a2621f7813835ae45cf605e3daa72-97ed48dfff64a38f-01
age: 30
x-cache: HIT
x-nextjs-cache: STALE
content-length: 10005
x-served-by: cache-lga21930-LGA
server: cloudflare
etag: "cea5-+/5IEqQgK/FG5Dqeo+Kikz1zKdg"
vary: Accept-Encoding
content-type: application/json
cache-control: s-maxage=30, stale-while-revalidate
x-debug-info: eyJyZXRyaWVzIjowfQ==
accept-ranges: bytes
cf-ray: 82a6abd0add5c342-EWR
x-cache-hits: 1

GET
H2 200 resources.json Show response
www.recordedfuture.com/_next/data/scsjqnXJ_EeQaa6GljD5a/ 42 KB
8 KB 29ms
26ms Fetch
application/json 104.18.43.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/_next/data/scsjqnXJ_EeQaa6GljD5a/resources.json?slug=resources

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/_next/static/chunks/main-16e79bd25f9f0c89.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.43.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

af24692b77970ac7b3ff702ee87c99ca5069acf4533afc922fce0431f8894e6f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

purpose: prefetch
x-nextjs-data: 1
Referer: https://www.recordedfuture.com/bluedelta-exploits-ukrainian-government-roundcube-mail-servers
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Thu, 23 Nov 2023 04:29:26 GMT
content-encoding: gzip
x-nextjs-matched-path: /[[...slug]]
strict-transport-security: max-age=31536000; includeSubDomains
x-platform-server: i-be21b5795622437d8136c8a0cedbd8d0, i-be21b5795622437d8136c8a0cedbd8d0
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
via: 1.1 varnish
traceresponse: 00-179a2621f770c5e4f0e7951119a48b5f-53dbb66125ecb54b-01
age: 30
x-cache: HIT
x-nextjs-cache: STALE
content-length: 7875
x-served-by: cache-lga21940-LGA
server: cloudflare
etag: "a602-RbIX2LxulDNC0kKjwG0SCf98k00"
vary: Accept-Encoding
content-type: application/json
cache-control: s-maxage=30, stale-while-revalidate
x-debug-info: eyJyZXRyaWVzIjowfQ==
accept-ranges: bytes
cf-ray: 82a6abd0add6c342-EWR
x-cache-hits: 2

GET
H2 200 company.json Show response
www.recordedfuture.com/_next/data/scsjqnXJ_EeQaa6GljD5a/ 41 KB
8 KB 24ms
20ms Fetch
application/json 104.18.43.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/_next/data/scsjqnXJ_EeQaa6GljD5a/company.json?slug=company

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/_next/static/chunks/main-16e79bd25f9f0c89.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.43.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6a2a12407e61c14e1eb31aa6fe59b3b8009ac3e6df694c30a8f722090071c05e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

purpose: prefetch
x-nextjs-data: 1
Referer: https://www.recordedfuture.com/bluedelta-exploits-ukrainian-government-roundcube-mail-servers
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Thu, 23 Nov 2023 04:29:26 GMT
content-encoding: gzip
x-nextjs-matched-path: /[[...slug]]
strict-transport-security: max-age=31536000; includeSubDomains
x-platform-server: i-bac7380798664d7697b0cf11d33520e7, i-bac7380798664d7697b0cf11d33520e7
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
via: 1.1 varnish
traceresponse: 00-179a2621f77f67064099009e5105e7e5-b7138479989740bc-01
age: 30
x-cache: HIT
x-nextjs-cache: STALE
content-length: 8365
x-served-by: cache-lga21927-LGA
server: cloudflare
etag: "a339-Pj90uHPTq/lOoSqe+loZympsFLE"
vary: Accept-Encoding
content-type: application/json
cache-control: s-maxage=30, stale-while-revalidate
x-debug-info: eyJyZXRyaWVzIjowfQ==
accept-ranges: bytes
cf-ray: 82a6abd0add8c342-EWR
x-cache-hits: 1

GET
H2 200 64dc3ec5-330c-4652-88d3-147ee65e90ba.js Show response
j.6sc.co/j/ 6 KB
2 KB 20ms
4ms Script
application/javascript 23.44.203.87
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://j.6sc.co/j/64dc3ec5-330c-4652-88d3-147ee65e90ba.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-539N74N
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.44.203.87 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-44-203-87.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 39e8ab0a041d182020ae83f95a3a1d50281858c8aa1799ddd36efaef1d27070d

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

x-amz-version-id: 7m0OBCt5BkATksBixYP52UCbW6Y94DqA
content-encoding: gzip
date: Thu, 23 Nov 2023 04:29:26 GMT
x-amz-cf-pop: PHL50-C1
x-amz-server-side-encryption: AES256
x-amz-meta-content-type: application/json
content-length: 1885
pragma: no-cache
last-modified: Wed, 08 Nov 2023 15:40:25 GMT
server: AmazonS3
etag: "7f38a1a4384d2ace8d6716d4fa030233"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
x-amz-cf-id: KU-Wf_re43ykgXNKzxaLWGz6B4cTX-YX0xPmn9y5S6w3wQOrC5nvuw==
expires: Thu, 23 Nov 2023 04:29:26 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 280 KB
92 KB 45ms
44ms Script
application/javascript 2607:f8b0:4020:804::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-MHTMF48BZH&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-539N74N

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:804::2008 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

75d6a3ef500d60b35482a4c8ce8273b77c604e437d03b1be70e3e48e9cf69aad

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Thu, 23 Nov 2023 04:29:26 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 93885
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Thu, 23 Nov 2023 04:29:26 GMT

GET
H2 200 uwt.js Show response
static.ads-twitter.com/ 56 KB
15 KB 41ms
10ms Script
application/javascript 146.75.32.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://static.ads-twitter.com/uwt.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-539N74N
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 146.75.32.157 Ashburn, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: cf7fcc9f75c8717897bfaef72f303fab423ce1b70c98512aeb3677e4af988dee

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Thu, 23 Nov 2023 04:29:26 GMT
content-encoding: gzip
last-modified: Thu, 27 Oct 2022 18:55:37 GMT
x-amz-server-side-encryption: AES256
etag: "32ad004436155ec972bc50e6238b5b67+gzip"
vary: Accept-Encoding,Host
x-cache: HIT
content-type: application/javascript; charset=utf-8
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
x-tw-cdn: FT
cache-control: no-cache
accept-ranges: bytes
content-length: 15375
x-served-by: cache-iad-kjyo7100111-IAD

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 52 KB
21 KB 42ms
12ms Script
text/javascript 2001:4860:4802:34::178
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-539N74N

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2001:4860:4802:34::178 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Thu, 23 Nov 2023 03:49:09 GMT
last-modified: Mon, 12 Jun 2023 18:23:07 GMT
server: Golfe2
age: 2417
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20994
expires: Thu, 23 Nov 2023 05:49:09 GMT

GET
H2 200 insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 12 KB
4 KB 64ms
5ms Script
application/javascript 2600:141b:1c00:e::172c:c9e4
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://snap.licdn.com/li.lms-analytics/insight.min.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-539N74N

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2600:141b:1c00:e::172c:c9e4 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

f88f89a0cead9c36ddbe19508f32f64bd91e94e92b6006dd575e8d0deb317d7f

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Thu, 23 Nov 2023 04:29:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 15 Nov 2023 09:07:27 GMT
x-cdn: AKAM
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
content-type: application/javascript;charset=utf-8
cache-control: max-age=34360
accept-ranges: bytes
content-length: 3840

GET
H2 200 ga.js Show response
ssl.google-analytics.com/ 45 KB
17 KB 63ms
7ms Script
text/javascript 2607:f8b0:4006:816::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ssl.google-analytics.com/ga.js

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/bluedelta-exploits-ukrainian-government-roundcube-mail-servers

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:816::2008 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Thu, 23 Nov 2023 03:37:13 GMT
last-modified: Mon, 12 Jun 2023 18:23:07 GMT
server: Golfe2
age: 3133
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 17168
expires: Thu, 23 Nov 2023 05:37:13 GMT

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/3.6.0/ 87 KB
31 KB 93ms
36ms Script
text/javascript 2607:f8b0:4020:805::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/3.6.0/jquery.min.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-539N74N

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:805::200a Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Wed, 22 Nov 2023 20:55:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 27227
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 31017
x-xss-protection: 0
last-modified: Wed, 10 Mar 2021 14:28:09 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
vary: Accept-Encoding
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 21 Nov 2024 20:55:39 GMT

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 202 KB
54 KB 20ms
7ms Script
application/x-javascript 2a03:2880:f012:10c:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/bluedelta-exploits-ukrainian-government-roundcube-mail-servers

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f012:10c:face:b00c:0:3 Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

3e136e77083bfc6ef14ffc5abd19da89a82bf12fc0cda3c603e01582b93303c8

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Thu, 23 Nov 2023 04:29:26 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 54273
x-xss-protection: 0
reporting-endpoints
pragma: public
x-fb-debug: bSF93YxyFVQ+/jLFH0sgIzPfFSvWq/DosGRa9KetDibYDQuBq72M5tkA4o3q5SULlOl3J/XDurmjdfUo10YxpA==
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
origin-agent-cluster: ?0
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=()
timing-allow-origin: *
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 container_nbhoRDM8.js Show response
cdn.matomo.cloud/recordedfuture.matomo.cloud/ 242 KB
70 KB 124ms
69ms Script
application/javascript 2600:9000:215f:600:c:7d55:b3c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.matomo.cloud/recordedfuture.matomo.cloud/container_nbhoRDM8.js

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/bluedelta-exploits-ukrainian-government-roundcube-mail-servers

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:215f:600:c:7d55:b3c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

CloudFront /

Resource Hash

ea0c1155e62434800a334c2894a667bf619bec5883b6bf9f0656fe1e78702438

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Thu, 23 Nov 2023 00:00:41 GMT
x-amz-version-id: gbzPSaeJh2dFnwv6IMY4SL4SfIXw5F6W
content-encoding: gzip
strict-transport-security: max-age=31536000
via: 1.1 39379e6e28640430f64b963528b44426.cloudfront.net (CloudFront)
x-amz-cf-pop: YUL62-C2
age: 16126
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Sun, 19 Nov 2023 19:34:34 GMT
server: CloudFront
etag: W/"654d641a0156e0c4d8f34c7b62148d76"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=691200
x-amz-cf-id: dzhmvxpibAF5Wo7ibR9YCJNMuTKDP_WIt82I9Ub6EMKIllX41fa6DQ==

GET
H2 200 matomo.js Show response
cdn.matomo.cloud/recordedfuture.matomo.cloud/ 199 KB
58 KB 90ms
37ms Script
application/javascript 2600:9000:215f:600:c:7d55:b3c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.matomo.cloud/recordedfuture.matomo.cloud/matomo.js

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/bluedelta-exploits-ukrainian-government-roundcube-mail-servers

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:215f:600:c:7d55:b3c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

CloudFront /

Resource Hash

1316977a854f25689e72527007b6254a726799eae07123b23392d71b50f17305

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Thu, 23 Nov 2023 00:00:41 GMT
x-amz-version-id: 4.QmMWSqKXej0qnsAeUsu70FYPg7q0sT
content-encoding: gzip
strict-transport-security: max-age=31536000
via: 1.1 39379e6e28640430f64b963528b44426.cloudfront.net (CloudFront)
x-amz-cf-pop: YUL62-C2
age: 16126
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Sun, 19 Nov 2023 19:34:34 GMT
server: CloudFront
etag: W/"c28e87bb18e482bd1fa8843fb632e29a"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=691200
x-amz-cf-id: tovYCvrT_eBahJ3-dlg7g91Zhth-SKviYL3n07WPXXhQ47UtFwhk-g==

GET
H2 200 252628.js Show response
js.hs-scripts.com/ 2 KB
1 KB 44ms
25ms Script
application/javascript 2606:4700::6810:be59
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js.hs-scripts.com/252628.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-539N74N

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:be59 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5573900bd39dcadd05c932d95d9ea1dc92a1881a94437e1aad73fbcb68b627e6

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Thu, 23 Nov 2023 04:29:26 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
x-hubspot-correlation-id: b95d2841-be8c-40fd-ac31-a6b6b24197d9
x-evy-trace-route-service-name: envoyset-translator
cf-polished: origSize=1972
age: 53
x-envoy-upstream-service-time: 5
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: b95d2841-be8c-40fd-ac31-a6b6b24197d9
cf-bgj: minify
last-modified: Thu, 23 Nov 2023 04:28:33 GMT
server: cloudflare
x-trace: 2B73350E45FA9B3E3FB7C56A2CC9AC68F50130234D000000000000000000
access-control-max-age: 3600
vary: origin, Accept-Encoding
content-type: application/javascript;charset=utf-8
access-control-allow-origin: https://www.recordedfuture.com
x-evy-trace-served-by-pod: iad02/hubapi-td/envoy-proxy-66c9b4c4f4-gbg5c
cache-control: public, max-age=60
access-control-allow-credentials: true
x-evy-trace-virtual-host: all
cf-ray: 82a6abd1fb42c448-EWR
expires: Thu, 23 Nov 2023 04:30:26 GMT

GET
H2 200 6si.min.js Show response
j.6sc.co/ 63 KB
17 KB 6ms
5ms Script
application/javascript 23.44.203.87
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://j.6sc.co/6si.min.js

Requested by

Host: j.6sc.co
URL: https://j.6sc.co/j/64dc3ec5-330c-4652-88d3-147ee65e90ba.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.44.203.87 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-44-203-87.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

8c2b5a2945535269c1cefe505e56b663f26b3d322d35ab4fa835a24c543226dc

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 23 Nov 2023 04:29:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 15 Nov 2023 22:43:30 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "65554992-fd89"
vary: Accept-Encoding
content-type: application/javascript
cache-control: private, no-cache, proxy-revalidate
accept-ranges: bytes
content-length: 17416
expires: Thu, 23 Nov 2023 04:29:26 GMT

GET
H2 200 getuidj Show response
secure.adnxs.com/ 11 B
578 B 438ms
11ms XHR
application/json 68.67.160.186
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/getuidj

Requested by

Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.186 Brooklyn, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

675.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

nginx/1.21.3 /

Resource Hash

31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 23 Nov 2023 04:29:27 GMT
an-x-request-uuid: 54a04653-73be-4b75-81b5-1aaaa178c31f
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.recordedfuture.com
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 5.181.234.132; 5.181.234.132; 675.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 11
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 / Show response
c.6sc.co/ 7 B
198 B 19ms
12ms XHR
text/html 23.44.203.87
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://c.6sc.co/
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.44.203.87 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-44-203-87.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Thu, 23 Nov 2023 04:29:26 GMT
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: text/html
access-control-allow-origin: https://www.recordedfuture.com
access-control-allow-credentials: true
access-control-allow-headers: *
content-length: 7

GET
H2 200 / Show response
ipv6.6sc.co/ 36 B
343 B 441ms
9ms XHR
text/html 2600:141b:1c00:22::1730:e073
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://ipv6.6sc.co/
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:141b:1c00:22::1730:e073 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: 11ef5bc53ce7476b9975fc5f8194a2825fc0074c5426cfb42aabd2efc48cd800

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 23 Nov 2023 04:29:27 GMT
vary: Origin
content-type: text/html
access-control-allow-origin: https://www.recordedfuture.com
cache-control: max-age=0, no-cache, no-store
6si-ipv6: 2a0d:5600:24:1500:1011:67ef:4487:c70
server-timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1700713766793_398664787_1244152017_18_618_5_389_219";dur=1
content-length: 36
expires: Thu, 23 Nov 2023 04:29:27 GMT

GET
H2 200 194163687656043 Show response
connect.facebook.net/signals/config/ 141 KB
37 KB 8ms
7ms Script
application/x-javascript 2a03:2880:f012:10c:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/194163687656043?v=2.9.138&r=stable&domain=www.recordedfuture.com

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f012:10c:face:b00c:0:3 Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

8483361f3796e4d45a1da8e3dfdaff5d41e08c3e016599d56a0b1b493ff6bfec

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Thu, 23 Nov 2023 04:29:26 GMT
document-policy: force-load-at-top
content-security-policy-report-only: default-src https: data: wss: blob: chrome-extension: 'unsafe-inline' 'unsafe-eval';report-uri https://www.facebook.com/csp/reporting/?minimize=0;require-trusted-types-for 'script';
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 37109
x-xss-protection: 0
reporting-endpoints
pragma: public
x-fb-debug: 5Bk1HkVK4es2+cq4GwXVUr5zg8fl+HY669QI93cVOfX4eJlsiRxQNVAX807KWhYXow0/2UMa/mJhF0FJSBtTEQ==
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
origin-agent-cluster: ?0
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=()
timing-allow-origin: *
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 adsct
t.co/i/ 43 B
377 B 472ms
109ms Image
image/gif 104.244.42.197
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?bci=3&eci=2&event_id=4d365ae7-afbb-4eba-8228-543ad9401ccb&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=87d6c583-5fe0-4bf3-8b78-a81b12d3d866&tw_document_href=https%3A%2F%2Fwww.recordedfuture.com%2Fbluedelta-exploits-ukrainian-government-roundcube-mail-servers&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=nv0r6&type=javascript&version=2.3.29

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/bluedelta-exploits-ukrainian-government-roundcube-mail-servers

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.197 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_b /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

x-response-time: 77
date: Thu, 23 Nov 2023 04:29:26 GMT
strict-transport-security: max-age=0
server: tsa_b
content-type: image/gif;charset=utf-8
x-transaction-id: c7bc3d70416f449d
cache-control: no-cache, no-store, max-age=0
perf: 7626143928
x-connection-hash: a9cbc13133e6fc459f51e5eb80801128786424c9528e1f1bf70acd1009a2dd15
content-length: 43

GET
H2 200 adsct
analytics.twitter.com/i/ 43 B
394 B 473ms
114ms Image
image/gif 104.244.42.131
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://analytics.twitter.com/i/adsct?bci=3&eci=2&event_id=4d365ae7-afbb-4eba-8228-543ad9401ccb&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=87d6c583-5fe0-4bf3-8b78-a81b12d3d866&tw_document_href=https%3A%2F%2Fwww.recordedfuture.com%2Fbluedelta-exploits-ukrainian-government-roundcube-mail-servers&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=nv0r6&type=javascript&version=2.3.29

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/bluedelta-exploits-ukrainian-government-roundcube-mail-servers

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.131 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_b /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

x-response-time: 82
date: Thu, 23 Nov 2023 04:29:26 GMT
strict-transport-security: max-age=631138519
server: tsa_b
content-type: image/gif;charset=utf-8
x-transaction-id: 54e405ed40c229c5
cache-control: no-cache, no-store, max-age=0
perf: 7626143928
x-connection-hash: b657f7a8904180766e2413a5a90c666b5204fdf5e67f099cab167d1d7b02d034
content-length: 43

POST
H2 200 collect Show response
www.google-analytics.com/j/ 4 B
214 B 18ms
17ms XHR
text/plain 2001:4860:4802:34::178
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=60543951&t=pageview&_s=1&dl=https%3A%2F%2Fwww.recordedfuture.com%2Fbluedelta-exploits-ukrainian-government-roundcube-mail-servers&ul=en-us&de=UTF-8&dt=BlueDelta%20Exploits%20Ukrainian%20Government%20Roundcube%20Mail%20Servers%20to%20Support%20Espionage%20Activities%20%7C%20Recorded%20Future&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAEABAAAAACAAI~&jid=1529073716&gjid=1972290906&cid=716194572.1700713767&tid=UA-9153858-2&_gid=1319865362.1700713767&_r=1&_slc=1&gtm=45He3b81n81539N74Nv830966511&gcd=11l1l1l1l1&dma=0&z=1809322915

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2001:4860:4802:34::178 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.recordedfuture.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 23 Nov 2023 04:29:26 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.recordedfuture.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 insight.old.min.js Show response
snap.licdn.com/li.lms-analytics/ 8 KB
3 KB 5ms
3ms Script
application/x-javascript 2600:141b:1c00:e::172c:c9e4
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://snap.licdn.com/li.lms-analytics/insight.old.min.js

Requested by

Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2600:141b:1c00:e::172c:c9e4 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

5b3086a886aa8649ecbf496ac913a1aa443926cd2fff610be2d136c9598bcd8b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Thu, 23 Nov 2023 04:29:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Sun, 15 Oct 2023 08:32:45 GMT
x-cdn: AKAM
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
content-type: application/x-javascript;charset=utf-8
cache-control: max-age=11684
accept-ranges: bytes
content-length: 3272

GET
H2 200 __utm.gif
ssl.google-analytics.com/r/ 35 B
197 B 20ms
18ms Image
image/gif 2607:f8b0:4006:816::2008
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ssl.google-analytics.com/r/__utm.gif?utmwv=5.7.2&utms=1&utmn=81877325&utmhn=www.recordedfuture.com&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=BlueDelta%20Exploits%20Ukrainian%20Government%20Roundcube%20Mail%20Servers%20to%20Support%20Espionage%20Activities%20%7C%20Recorded%20Future&utmhid=60543951&utmr=-&utmp=%2Fbluedelta-exploits-ukrainian-government-roundcube-mail-servers&utmht=1700713766887&utmac=UA-XXXYYYZZZ-1&utmcc=__utma%3D93161374.716194572.1700713767.1700713767.1700713767.1%3B%2B__utmz%3D93161374.1700713767.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=1229407747&utmredir=1&utmu=qhAgAAAAAAAAAAAAAAABAAAE~

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/bluedelta-exploits-ukrainian-government-roundcube-mail-servers

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:816::2008 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 23 Nov 2023 04:29:26 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
analytics.google.com/g/ 0
259 B 246ms
29ms Ping
text/plain 2607:f8b0:4006:81d::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.google.com/g/collect?v=2&tid=G-MHTMF48BZH&gtm=45je3b81v873499763z8830966511&_p=1700713766401&_gaz=1&gcd=11l1l1l1l1&dma=0&cid=716194572.1700713767&ul=en-us&sr=1600x1200&ir=1&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_eu=EA&_s=1&sid=1700713766&sct=1&seg=0&dl=https%3A%2F%2Fwww.recordedfuture.com%2Fbluedelta-exploits-ukrainian-government-roundcube-mail-servers&dt=BlueDelta%20Exploits%20Ukrainian%20Government%20Roundcube%20Mail%20Servers%20to%20Support%20Espionage%20Activities%20%7C%20Recorded%20Future&en=page_view&_fv=1&_ss=1&tfd=859
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-MHTMF48BZH&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4006:81d::200e , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 23 Nov 2023 04:29:27 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.recordedfuture.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
259 B 262ms
27ms Ping
text/plain 2607:f8b0:4004:c06::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-MHTMF48BZH&cid=716194572.1700713767&gtm=45je3b81v873499763z8830966511&aip=1&dma=0&gcd=11l1l1l1l1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-MHTMF48BZH&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4004:c06::9a Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 23 Nov 2023 04:29:27 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.recordedfuture.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 details Show response
epsilon.6sense.com/v3/company/ 686 B
653 B 44ms
18ms XHR
application/json 3.231.74.244
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://epsilon.6sense.com/v3/company/details
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.231.74.244 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-231-74-244.compute-1.amazonaws.com
Software: nginx /
Resource Hash: e627ca4a11edcdbf1eb55965c8b404ae294260bd3765ccdf7cd5eb6048673653

Request headers

Referer: https://www.recordedfuture.com/
accept-language: en-US,en;q=0.9
Authorization: Token 47c555096cc32557d3e6e7a333d7cb3ea692cee1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
X-6s-CustomID: WebTag 64dc3ec5-330c-4652-88d3-147ee65e90ba

Response headers

date: Thu, 23 Nov 2023 04:29:27 GMT
content-encoding: gzip
server: nginx
vary: Accept-Encoding
content-type: application/json
x-6si-region: us-east-1a
access-control-allow-origin: https://www.recordedfuture.com
access-control-expose-headers: X-6si-Region
access-control-allow-credentials: true
timing-allow-origin: https://6sense.com, https://www.ssga.com
content-length: 366

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
484 B 34ms
32ms Image
image/gif 23.44.203.87
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=f2675e8089b7d209a58fce8ad312f51c&svisitor=null&visitor=67b4f3d3-3486-488e-8035-75061a379467&session=68b5cfa8-b891-4ba2-8b39-89f47ce55686&event=a_pageload&q=%7B%22pageLoadTime%22%3A%22Thu%2C%2023%20Nov%202023%2004%3A29%3A26%20GMT%22%7D&isIframe=false&m=%7B%22description%22%3A%22A%20new%20report%20details%20a%20campaign%20by%20the%20threat%20actor%2C%20BlueDelta%2C%20likely%20intended%20to%20enable%20intelligence-gathering%20to%20support%20Russia%E2%80%99s%20invasion%20of%20Ukraine.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22BlueDelta%20Exploits%20Ukrainian%20Government%20Roundcube%20Mail%20Servers%20to%20Support%20Espionage%20Activities%20%7C%20Recorded%20Future%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.recordedfuture.com%2Fbluedelta-exploits-ukrainian-government-roundcube-mail-servers&pageViewId=08ad2242-9c2f-4016-8157-485e48251953&webTagId=64dc3ec5-330c-4652-88d3-147ee65e90ba&v=1.1.11

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/bluedelta-exploits-ukrainian-government-roundcube-mail-servers

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.44.203.87 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-44-203-87.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Thu, 23 Nov 2023 04:29:27 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Fri, 21 Feb 2020 18:57:20 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "5e502810-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
484 B 34ms
33ms Image
image/gif 23.44.203.87
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=f2675e8089b7d209a58fce8ad312f51c&svisitor=null&visitor=67b4f3d3-3486-488e-8035-75061a379467&session=68b5cfa8-b891-4ba2-8b39-89f47ce55686&event=ni%3AasyncSettingsAudit&q=%7B%22settings%22%3A%22%5B%7B%5C%22name%5C%22%3A%5C%22setToken%5C%22%2C%5C%22value%5C%22%3A%5C%22f2675e8089b7d209a58fce8ad312f51c%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2023%20Nov%202023%2004%3A29%3A26%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22disableCookies%5C%22%2C%5C%22value%5C%22%3A%5C%22false%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2023%20Nov%202023%2004%3A29%3A26%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setEpsilonKey%5C%22%2C%5C%22value%5C%22%3A%5C%2247c555096cc32557d3e6e7a333d7cb3ea692cee1%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2023%20Nov%202023%2004%3A29%3A26%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableIPv6Ping%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2023%20Nov%202023%2004%3A29%3A26%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableIgnorePageUrlHash%5C%22%2C%5C%22value%5C%22%3A%5C%22false%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2023%20Nov%202023%2004%3A29%3A26%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableRetargeting%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2023%20Nov%202023%2004%3A29%3A26%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setWhiteListFields%5C%22%2C%5C%22value%5C%22%3A%5C%22%5B%5D%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2023%20Nov%202023%2004%3A29%3A26%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setCustomMetatags%5C%22%2C%5C%22value%5C%22%3A%5C%22%5B%5D%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2023%20Nov%202023%2004%3A29%3A26%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22storeTagId%5C%22%2C%5C%22value%5C%22%3A%5C%2264dc3ec5-330c-4652-88d3-147ee65e90ba%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2023%20Nov%202023%2004%3A29%3A26%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableEventTracking%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2023%20Nov%202023%2004%3A29%3A26%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setCompanyDetailsExpiration%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2023%20Nov%202023%2004%3A29%3A26%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableCompanyDetails%5C%22%2C%5C%22value%5C%22%3A%5C%22%5Btrue%2Cnull%2C3%5D%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2023%20Nov%202023%2004%3A29%3A26%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%5D%22%7D&isIframe=false&m=%7B%22description%22%3A%22A%20new%20report%20details%20a%20campaign%20by%20the%20threat%20actor%2C%20BlueDelta%2C%20likely%20intended%20to%20enable%20intelligence-gathering%20to%20support%20Russia%E2%80%99s%20invasion%20of%20Ukraine.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22BlueDelta%20Exploits%20Ukrainian%20Government%20Roundcube%20Mail%20Servers%20to%20Support%20Espionage%20Activities%20%7C%20Recorded%20Future%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.recordedfuture.com%2Fbluedelta-exploits-ukrainian-government-roundcube-mail-servers&pageViewId=08ad2242-9c2f-4016-8157-485e48251953&webTagId=64dc3ec5-330c-4652-88d3-147ee65e90ba&v=1.1.11

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/bluedelta-exploits-ukrainian-government-roundcube-mail-servers

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.44.203.87 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-44-203-87.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Thu, 23 Nov 2023 04:29:27 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Fri, 21 Feb 2020 18:57:20 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "5e502810-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H2 200 web-interactives-embed.js Show response
js.hubspot.com/ 78 KB
23 KB 209ms
29ms Script
application/javascript 2606:4700::6813:9b53
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js.hubspot.com/web-interactives-embed.js

Requested by

Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/252628.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6813:9b53 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b5b3233d5d02cfdfc077b3e67483603395059c3fb90f3e0bbf376d43e84e7c3e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.recordedfuture.com/
Origin: https://www.recordedfuture.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

content-encoding: br
age: 362
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
content-security-policy-report-only: frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=web-interactives-embed/static-2.700/bundles/project.js&cfRay=82a6a2fdaaf043fd-EWR
x-amz-replication-status: COMPLETED
x-evy-trace-listener: listener_https
etag: W/"4e97934db1377f0d43c2d27811add59e"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
x-evy-trace-virtual-host: all
cache-control: max-age=600
x-hs-target-asset: web-interactives-embed/static-2.700/bundles/project.js
date: Thu, 23 Nov 2023 04:29:27 GMT
x-amz-version-id: IoSVIvmdsNDANnV4L0lMf2ovJHFGDTUt
via: 1.1 3c43e000c50d5633eb558057710f3c54.cloudfront.net (CloudFront)
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-cf-pop: IAD12-P3
x-hubspot-correlation-id: 5f2390ce-516e-4698-8856-49239419dcde
x-cache: Hit from cloudfront
cache-tag: staticjsapp-web-interactives-embed-web-prod,staticjsapp-prod
x-envoy-upstream-service-time: 2
x-evy-trace-route-configuration: listener_https/all
x-request-id: 5f2390ce-516e-4698-8856-49239419dcde
last-modified: Wed, 22 Nov 2023 11:55:20 UTC
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=phEwoqpV%2FmDA7g2qo7ixxeUoX29WZaDmblZZOoAOcn%2Ff8S50KBSeUIiXW8udOMhxfuLQ6XO7DACodU8wap9Dhue572CtBuxRy6%2FO1XKdduorCWlrnaec6DER9MMeEaD83MSQwEhAIw6ZBp6M"}],"group":"cf-nel","max_age":604800}
x-hs-cache-status: HIT
x-evy-trace-served-by-pod: iad02/app-td/envoy-proxy-7b7f9459cc-4wqck
cf-ray: 82a6abd4eae56a50-EWR
x-amz-cf-id: J9hi2fcLnOW-6wmDN8IkHabw_eI8EcsvZyrHYfPJVA9DMZbGANDaSQ==

GET
H2 200 252628.js Show response
js.hs-analytics.net/analytics/1700713500000/ 67 KB
21 KB 229ms
31ms Script
text/javascript 2606:4700::6810:50ba
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hs-analytics.net/analytics/1700713500000/252628.js
Requested by: Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/252628.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:50ba , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d3c7d955218a0234e7e7305226cf4b816ba28a798d23f6e9d390d51f618f4391

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Thu, 23 Nov 2023 04:29:27 GMT
x-amz-version-id: null
content-encoding: br
cf-cache-status: HIT
x-amz-request-id: 00QHHS4CZ7WETFT0
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
x-hubspot-correlation-id: 8681ba00-a675-480c-8ca2-f044c699f7cb
age: 260
x-envoy-upstream-service-time: 23
x-amz-id-2: eAlH1wcslV14l9jTfSvd+OStqmFdhPauSbfU1KH1oBWYzs0gxqx+ij37ZJZW71hZY7zIuQMzF+0=
x-evy-trace-listener: listener_https
x-request-id: 8681ba00-a675-480c-8ca2-f044c699f7cb
x-evy-trace-route-configuration: listener_https/all
last-modified: Wed, 15 Nov 2023 17:11:58 GMT
server: cloudflare
etag: W/"2339bb23fde7cfa726c0931328200b59"
vary: origin, Accept-Encoding
content-type: text/javascript
x-evy-trace-virtual-host: all
x-evy-trace-served-by-pod: iad02/analytics-js-proxy-td/envoy-proxy-6849bc8697-wfchk
cache-control: max-age=300,public
access-control-allow-credentials: false
cf-ray: 82a6abd50a6e4344-EWR
expires: Thu, 23 Nov 2023 04:30:07 GMT

GET
H2 200 252628.js Show response
js.hs-banner.com/ 60 KB
16 KB 221ms
24ms Script
text/javascript 2606:4700:4400::6812:22e5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hs-banner.com/252628.js
Requested by: Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/252628.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::6812:22e5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9239f316beef45cfc6ba7c2b31298e0da40af5924c7c20894960238ede334d68

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Thu, 23 Nov 2023 04:29:27 GMT
x-amz-version-id: 1DTjZqz8w6c0vLd7dsrtWpmr4CMJx9XZ
content-encoding: br
cf-cache-status: HIT
x-amz-request-id: BRWDYHG823S5JQZJ
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
x-hubspot-correlation-id: 183dc3d7-9e3d-45bf-828b-24d2dbbe3062
age: 112
x-envoy-upstream-service-time: 53
x-amz-id-2: lIiMYd/kHlGXmURgYe1fU8plhyBSTht9xdPAi/NJtuNHbbgAo9AA5SS+VQX54RZiowSOcZ7IF0KF6Vymipk0x2Ks/+RS9cH/V4Z4qSiuXqA=
x-evy-trace-listener: listener_https
x-request-id: 183dc3d7-9e3d-45bf-828b-24d2dbbe3062
x-evy-trace-route-configuration: listener_https/all
last-modified: Mon, 17 Apr 2023 14:55:34 GMT
server: cloudflare
etag: W/"07022bb1d6cfa926ffae0fefc0ebffb7"
access-control-max-age: 604800
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: https://go.recordedfuture.com
x-evy-trace-virtual-host: all
access-control-expose-headers: x-last-modified-timestamp, X-HubSpot-NotFound, X-HS-User-Request, Link, Server-Timing
cache-control: max-age=300,public
access-control-allow-credentials: true
x-evy-trace-served-by-pod: iad02/analytics-js-proxy-td/envoy-proxy-85c95667b4-fc6l5
vary: origin, Accept-Encoding
timing-allow-origin: *
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Accept-Charset, Accept-Encoding, X-Override-Internal-Permissions, X-Properties-Source, X-Properties-SourceId, X-Properties-Flag, X-Hubspot-User-Id, X-Hubspot-Trace, X-Hubspot-Callee, X-Hubspot-Offset, X-Hubspot-No-Trace, X-HubSpot-Static-App-Info, X-HubSpot-Messages-Uri, X-HubSpot-Request-Source, X-HubSpot-Request-Reason, Subscription-Billing-Auth-Token, X-App-CSRF, X-Tools-CSRF, Online-Payment-Signing-UUID, X-Source, X-SourceId, X-Origin-UserId, X-Biden-Request-Source, X-HubSpot-CSRF-hubspotapi, X-Force-Cookie-Refresh, X-Force-Cookie-Refresh-No-Cache, X-HS-User-Request, X-Application-Id, X-HS-Referer, X-HubSpot-Correlation-Id
cf-ray: 82a6abd50c868c4e-EWR
expires: Thu, 23 Nov 2023 04:32:35 GMT

GET
H2 200 leadflows.js Show response
js.hsleadflows.net/ 551 KB
88 KB 205ms
28ms Script
application/javascript 2606:4700::6812:7a0c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js.hsleadflows.net/leadflows.js

Requested by

Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/252628.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:7a0c , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ee041148b4d2b4bfb2a9dbff837265a3484bb6ef80a18174ee45309237654c74

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.recordedfuture.com/
Origin: https://www.recordedfuture.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

content-encoding: br
age: 3543
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
content-security-policy-report-only: frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=lead-flows-js/static-1.1275/bundle/main/lead-flows-release.js&cfRay=82a655542b510f3b-EWR
x-amz-replication-status: COMPLETED
x-evy-trace-listener: listener_https
etag: W/"df7c200fc1e8a1a0c9d50df4fbec7e86"
vary: Accept-Encoding,Origin,Access-Control-Request-Headers,Access-Control-Request-Method
access-control-allow-methods: GET
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
x-evy-trace-virtual-host: all
cache-control: s-maxage=86400, max-age=0
x-hs-target-asset: lead-flows-js/static-1.1275/bundle/main/lead-flows-release.js
date: Thu, 23 Nov 2023 04:29:27 GMT
x-amz-version-id: RTyeMetKvg_dT1r75rKZucXAeC83sdPJ
via: 1.1 1f1067e4f193aaabd2c24b99bcdc4e88.cloudfront.net (CloudFront)
x-content-type-options: nosniff
cf-cache-status: HIT
x-amz-cf-pop: IAD12-P3
x-hubspot-correlation-id: f8bd04d6-f3df-40c5-ad3b-aea085577d12
x-cache: Hit from cloudfront
cache-tag: staticjsapp-lead-flows-cloudflare-web-prod,staticjsapp-prod
x-envoy-upstream-service-time: 8
x-evy-trace-route-configuration: listener_https/all
x-request-id: f8bd04d6-f3df-40c5-ad3b-aea085577d12
last-modified: Wed, 25 Oct 2023 14:35:17 UTC
server: cloudflare
access-control-max-age: 3000
x-hs-cache-status: MISS
x-evy-trace-served-by-pod: iad02/app-td/envoy-proxy-7b7f9459cc-lkcx6
cf-ray: 82a6abd4efbc0f55-EWR
x-amz-cf-id: pC9soeeoMPjGnPtawGwsNaywsP0R4z2NCJzA7QhlAfzr4bCXTy5vUQ==

POST
H2 204 matomo.php
recordedfuture.matomo.cloud/ 0
173 B 334ms
127ms Ping
text/plain 3.126.133.169
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://recordedfuture.matomo.cloud/matomo.php?action_name=www.recordedfuture.com%2FBlueDelta%20Exploits%20Ukrainian%20Government%20Roundcube%20Mail%20Servers%20to%20Support%20Espionage%20Activities%20%7C%20Recorded%20Future&idsite=1&rec=1&r=385486&h=18&m=29&s=27&url=https%3A%2F%2Fwww.recordedfuture.com%2Fbluedelta-exploits-ukrainian-government-roundcube-mail-servers&_id=&_idn=1&send_image=0&_refts=0&pv_id=o7eS8T&pf_net=25&pf_srv=21&pf_tfr=1&pf_dm1=55&uadata=%7B%22fullVersionList%22%3A%5B%5D%2C%22mobile%22%3Afalse%2C%22model%22%3A%22%22%2C%22platform%22%3A%22%22%2C%22platformVersion%22%3A%22%22%7D&pdf=1&qt=0&realp=0&wma=0&fla=0&java=0&ag=0&cookie=1&res=1600x1200
Requested by: Host: cdn.matomo.cloud
URL: https://cdn.matomo.cloud/recordedfuture.matomo.cloud/matomo.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.126.133.169 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-126-133-169.eu-central-1.compute.amazonaws.com
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.recordedfuture.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=utf-8

Response headers

access-control-allow-origin: https://www.recordedfuture.com
date: Thu, 23 Nov 2023 04:29:27 GMT
access-control-allow-credentials: true
server: Apache
vary: X-Forwarded-Port-Override,X-Forwarded-Proto-Override,User-Agent

GET
H2 200 configs.php Show response
recordedfuture.matomo.cloud/plugins/HeatmapSessionRecording/ 116 B
291 B 294ms
99ms Script
application/javascript 3.126.133.169
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://recordedfuture.matomo.cloud/plugins/HeatmapSessionRecording/configs.php?idsite=1&trackerid=3vu5VO&url=https%3A%2F%2Fwww.recordedfuture.com%2Fbluedelta-exploits-ukrainian-government-roundcube-mail-servers
Requested by: Host: cdn.matomo.cloud
URL: https://cdn.matomo.cloud/recordedfuture.matomo.cloud/matomo.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.126.133.169 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-126-133-169.eu-central-1.compute.amazonaws.com
Software: Apache /
Resource Hash: 1a6a117c6ce1040054357aca8d0242f7c7126c20bce811345cf8d8cee66d4684

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Thu, 23 Nov 2023 04:29:27 GMT
content-encoding: gzip
server: Apache
content-length: 119
vary: X-Forwarded-Port-Override,X-Forwarded-Proto-Override,Accept-Encoding,User-Agent
content-type: application/javascript

GET
H2 200 599962ae99da3cfe.css Show response
www.recordedfuture.com/_next/static/css/ 15 KB
5 KB 16ms
15ms Fetch
text/css 104.18.43.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/_next/static/css/599962ae99da3cfe.css

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/_next/static/chunks/main-16e79bd25f9f0c89.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.43.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

12e873630ce3c58cd366af78f4038495ab6cd993ca06ced50d211489faeab6ec

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.recordedfuture.com/bluedelta-exploits-ukrainian-government-roundcube-mail-servers
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Thu, 23 Nov 2023 04:29:27 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 varnish
cf-cache-status: HIT
x-platform-server: i-72f68d9e5fc844fb8d11227fc18ff9f4, i-72f68d9e5fc844fb8d11227fc18ff9f4
x-content-type-options: nosniff
age: 23524
traceresponse: 00-1795a90d47743edb245d5b22f3877ead-ca88f3fdf2c344e8-01
cf-polished: origSize=14950
content-encoding: gzip
x-cache: HIT
x-served-by: cache-lga21979-LGA
cf-bgj: minify
last-modified: Tue, 07 Nov 2023 21:44:59 GMT
server: cloudflare
etag: W/"3a66-18babbeefa5"
vary: Accept-Encoding
content-type: text/css; charset=UTF-8
cache-control: public, max-age=31536000, immutable
x-debug-info: eyJyZXRyaWVzIjowfQ==
cf-ray: 82a6abd3ffecc342-EWR
x-cache-hits: 1

OPTIONS
H2 200 details
epsilon.6sense.com/v3/company/ 0
0 240ms
21ms Preflight 3.231.74.244
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://epsilon.6sense.com/v3/company/details
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.231.74.244 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-231-74-244.compute-1.amazonaws.com
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: authorization,x-6s-customid
Access-Control-Request-Method: GET
Origin: https://www.recordedfuture.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: authorization,x-6s-customid
access-control-allow-methods: OPTIONS,GET
access-control-allow-origin: https://www.recordedfuture.com
access-control-expose-headers: X-6si-Region
access-control-max-age: 1800
date: Thu, 23 Nov 2023 04:29:27 GMT
server: nginx
timing-allow-origin: https://6sense.com, https://www.ssga.com
x-6si-region: us-east-1a

GET
H2 200 /
www.facebook.com/tr/ 0
185 B 59ms
7ms Image
text/plain 2a03:2880:f112:182:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=194163687656043&ev=PageView&dl=https%3A%2F%2Fwww.recordedfuture.com%2Fbluedelta-exploits-ukrainian-government-roundcube-mail-servers&rl=&if=false&ts=1700713767214&sw=1600&sh=1200&v=2.9.138&r=stable&ec=0&o=4126&fbp=fb.1.1700713767203.1748664404&cs_est=true&ler=empty&it=1700713766801&coo=false&rqm=GET

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/bluedelta-exploits-ukrainian-government-roundcube-mail-servers

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f112:182:face:b00c:0:25de Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
date: Thu, 23 Nov 2023 04:29:27 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
484 B 29ms
28ms Image
image/gif 23.44.203.87
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=f2675e8089b7d209a58fce8ad312f51c&svisitor=null&visitor=67b4f3d3-3486-488e-8035-75061a379467&session=68b5cfa8-b891-4ba2-8b39-89f47ce55686&event=ipv6&q=%7B%22address%22%3A%222a0d%3A5600%3A24%3A1500%3A1011%3A67ef%3A4487%3Ac70%22%7D&isIframe=false&m=%7B%22description%22%3A%22A%20new%20report%20details%20a%20campaign%20by%20the%20threat%20actor%2C%20BlueDelta%2C%20likely%20intended%20to%20enable%20intelligence-gathering%20to%20support%20Russia%E2%80%99s%20invasion%20of%20Ukraine.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22BlueDelta%20Exploits%20Ukrainian%20Government%20Roundcube%20Mail%20Servers%20to%20Support%20Espionage%20Activities%20%7C%20Recorded%20Future%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.recordedfuture.com%2Fbluedelta-exploits-ukrainian-government-roundcube-mail-servers&pageViewId=08ad2242-9c2f-4016-8157-485e48251953&an_uid=0&webTagId=64dc3ec5-330c-4652-88d3-147ee65e90ba&v=1.1.11

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/bluedelta-exploits-ukrainian-government-roundcube-mail-servers

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.44.203.87 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-44-203-87.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Thu, 23 Nov 2023 04:29:27 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Tue, 05 Oct 2021 22:17:52 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "615ccf10-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 2 B
149 B 25ms
20ms XHR
text/plain 2607:f8b0:4004:c06::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-9153858-2&cid=716194572.1700713767&jid=1529073716&gjid=1972290906&_gid=1319865362.1700713767&_u=YEBAAEAAAAAAACAAI~&z=109431632

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c06::9a Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6068f86ff5e6d3a3e100e95fd0ab03a5fb9ebfca9386b2c0ee131361a62526c2

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.recordedfuture.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
date: Thu, 23 Nov 2023 04:29:27 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.recordedfuture.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

collect
px4.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=3869953&time=1700713767261&url=https%3A%2F%2Fwww.recordedfuture.com%2Fbluedelta-exploits-ukrainian-government-roundcube-mail-servers
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=3869953&time=1700713767261&url=https%3A%2F%2Fwww.recordedfuture.com%2Fbluedelta-exploits-ukrainian-government-roundcube-mail-servers&cookiesTest=true
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D3869953%26time%3D1700713767261%26url%3Dhttps%253A%252F%252Fwww.recordedfuture.com...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=3869953&time=1700713767261&url=https%3A%2F%2Fwww.recordedfuture.com%2Fbluedelta-exploits-ukrainian-government-roundcube-mail-servers&cookiesTest=t...
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=3869953&time=1700713767261&url=https%3A%2F%2Fwww.recordedfuture.com%2Fbluedelta-exploits-ukrainian-government-roundcube-mail-servers&cookiesTest=...

0
488 B

39ms
21ms

Image
application/javascript

13.107.42.14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=3869953&time=1700713767261&url=https%3A%2F%2Fwww.recordedfuture.com%2Fbluedelta-exploits-ukrainian-government-roundcube-mail-servers&cookiesTest=true&liSync=true&e_ipv6=AQJxzOGyTVtTaAAAAYv6cKHsSa-yI-yD8EEqOrdgfhW8Hy2dRm1tWAYIaRzOw5KRQKi9caXd8K7C6USyPzA55PxyktchiQ
Requested by: Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/bluedelta-exploits-ukrainian-government-roundcube-mail-servers
Protocol: H2
Server: 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Thu, 23 Nov 2023 04:29:27 GMT
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: 8B4EC72EA9E3472E98526554D1A0249F Ref B: EWR30EDGE1407 Ref C: 2023-11-23T04:29:27Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
content-type: application/javascript
x-li-fabric: prod-lva1
x-li-proto: http/2
content-length: 0
x-li-uuid: AAYKykf5B/qu0CrgO741CQ==

Redirect headers

date: Thu, 23 Nov 2023 04:29:26 GMT
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: BDFA24BF514E4D34A08770C1A39394B0 Ref B: EWR30EDGE1016 Ref C: 2023-11-23T04:29:27Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-lva1
location: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=3869953&time=1700713767261&url=https%3A%2F%2Fwww.recordedfuture.com%2Fbluedelta-exploits-ukrainian-government-roundcube-mail-servers&cookiesTest=true&liSync=true&e_ipv6=AQJxzOGyTVtTaAAAAYv6cKHsSa-yI-yD8EEqOrdgfhW8Hy2dRm1tWAYIaRzOw5KRQKi9caXd8K7C6USyPzA55PxyktchiQ
x-li-proto: http/2
content-length: 0
x-li-uuid: AAYKykf4ZE9GfmSUU8YA9A==

GET
H2 200 combinedConfigs Show response
cta-service-cms2.hubspot.com/web-interactives/public/v1/embed/ 369 B
1 KB 44ms
40ms Fetch
application/json 2606:4700::6813:9b53
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cta-service-cms2.hubspot.com/web-interactives/public/v1/embed/combinedConfigs?portalId=252628&currentUrl=https%3A%2F%2Fwww.recordedfuture.com%2Fbluedelta-exploits-ukrainian-government-roundcube-mail-servers

Requested by

Host: js.hubspot.com
URL: https://js.hubspot.com/web-interactives-embed.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6813:9b53 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

14103b64df9857f9f7ad1f02efaafba97ce4772e8d8b448857de69c3537c338d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Thu, 23 Nov 2023 04:29:27 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: 981e35c9-66dc-4bb4-8f06-d5a90ac36760
content-encoding: br
x-envoy-upstream-service-time: 8
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 981e35c9-66dc-4bb4-8f06-d5a90ac36760
server: cloudflare
vary: origin
access-control-allow-methods: OPTIONS, GET
content-type: application/json;charset=utf-8
access-control-allow-origin: https://www.recordedfuture.com
x-evy-trace-virtual-host: all
access-control-max-age: 180
access-control-allow-credentials: true
cache-control: max-age=0, no-cache, no-store
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Wcst6aNaRiXoVRAZ7fPH9J8PU3cgxQ9IvWbUxvibYX%2BNrEW1tPYO9kEUJkhSQLAY3drIJ%2FkeYSzopFriFuryASmFo06iZov%2BVku2VOdlAGqC4iTItAaVKYlVfkqbO6hhfRdWyclSG1gXExHQkgsiay0w2TomXKxf4G8%3D"}],"group":"cf-nel","max_age":604800}
x-robots-tag: noindex, follow
access-control-allow-headers: Accept, Accept-Charset, Accept-Encoding, Accept-Language, Content-Type, Host, Origin, Referer, User-Agent
cf-ray: 82a6abd59b6e6a50-EWR
x-evy-trace-served-by-pod: iad02/star-hubspot-td/envoy-proxy-56dcc87b5c-2jf6w

GET
H2 200 ga-audiences
www.google.com/ads/ 42 B
408 B 59ms
23ms Image
image/gif 2607:f8b0:4006:80c::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-9153858-2&cid=716194572.1700713767&jid=1529073716&_u=YEBAAEAAAAAAACAAI~&z=249900796

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/bluedelta-exploits-ukrainian-government-roundcube-mail-servers

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80c::2004 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 23 Nov 2023 04:29:27 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK counters.gif
perf-na1.hsforms.com/embed/v3/ 35 B
1 KB 59ms
36ms Image
image/gif 2606:4700::6812:a07d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://perf-na1.hsforms.com/embed/v3/counters.gif?key=config-loaded-success&value=1

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/bluedelta-exploits-ukrainian-government-roundcube-mail-servers

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:a07d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Thu, 23 Nov 2023 04:29:27 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
X-Content-Type-Options: nosniff
CF-Cache-Status: MISS
x-evy-trace-route-service-name: envoyset-translator
X-HubSpot-Correlation-Id: 87bd5457-00bc-4bea-8d84-6bbce0e73d87
x-envoy-upstream-service-time: 3
Connection: keep-alive
alt-svc: h3=":443"; ma=86400
Content-Length: 35
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 87bd5457-00bc-4bea-8d84-6bbce0e73d87
Last-Modified: Thu, 23 Nov 2023 04:29:27 GMT
Server: cloudflare
X-Trace: 2B6D7D8B20D144255901FE58FFB5975B05097F1A6C000000000000000000
Vary: origin, Accept-Encoding
Content-Type: image/gif
x-evy-trace-virtual-host: all
x-evy-trace-served-by-pod: iad02/star-hubspot-td/envoy-proxy-56dcc87b5c-2jf6w
Access-Control-Expose-Headers: X-Origin-Hublet
Cache-Control: max-age=0, no-cache, no-store
Access-Control-Allow-Credentials: false
Accept-Ranges: bytes
X-Robots-Tag: none
CF-RAY: 82a6abd60b54c416-EWR

GET
H2 200 __ptq.gif
track.hubspot.com/ 45 B
1 KB 54ms
39ms Image
image/gif 2606:4700::6813:9b53
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://track.hubspot.com/__ptq.gif?k=1&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=220916345&v=1.1&a=252628&rcu=https%3A%2F%2Fwww.recordedfuture.com%2Fbluedelta-exploits-ukrainian-government-roundcube-mail-servers&pu=https%3A%2F%2Fwww.recordedfuture.com%2Fbluedelta-exploits-ukrainian-government-roundcube-mail-servers&t=BlueDelta+Exploits+Ukrainian+Government+Roundcube+Mail+Servers+to+Support+Espionage+Activities+%7C+Recorded+Future&cts=1700713767461&vi=32aace1b293bd7b126926e3d08a9f2ef&nc=true&u=57501621.32aace1b293bd7b126926e3d08a9f2ef.1700713767457.1700713767457.1700713767457.1&b=57501621.1.1700713767457&pt=0&cc=15

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6813:9b53 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Thu, 23 Nov 2023 04:29:27 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: f3c90e56-cc57-4944-bf4c-8d1852db6087
p3p: CP="NOI CUR ADM OUR NOR STA NID"
x-envoy-upstream-service-time: 8
content-length: 45
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: f3c90e56-cc57-4944-bf4c-8d1852db6087
server: cloudflare
vary: origin, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2xvuE8mnxYKLUw5DpYncB0shTNS1klHe0Kbs4rBJW%2BKbW%2BV6bG5yam0JKnd%2BnYS6qfdG%2BTRunh98lu6I6bfW9zXOEa%2FusaVbU8A3J9KrMi6iZ0PLgaSILBniPn0uxiFEoJv4TkGFr4jw49a4T1%2FO"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
x-evy-trace-served-by-pod: iad02/analytics-tracking-td/envoy-proxy-7d79fcfc45-j7r4z
x-evy-trace-virtual-host: all
cache-control: no-cache, no-store, no-transform
access-control-allow-credentials: false
cf-ray: 82a6abd6c9d55e7d-EWR
x-robots-tag: none

GET
H2 200 json Show response
forms.hubspot.com/lead-flows-config/v1/config/ 2 KB
2 KB 57ms
56ms XHR
application/json 2606:4700::6813:9b53
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://forms.hubspot.com/lead-flows-config/v1/config/json?portalId=252628&utk=32aace1b293bd7b126926e3d08a9f2ef&__hstc=57501621.32aace1b293bd7b126926e3d08a9f2ef.1700713767457.1700713767457.1700713767457.1&__hssc=57501621.1.1700713767457&currentUrl=https%3A%2F%2Fwww.recordedfuture.com%2Fbluedelta-exploits-ukrainian-government-roundcube-mail-servers

Requested by

Host: js.hsleadflows.net
URL: https://js.hsleadflows.net/leadflows.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6813:9b53 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

63229c52f918a0d265a55ed925a5d1a640cd41fb0ea9c712788b516ab8742d31

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Thu, 23 Nov 2023 04:29:27 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: 19e240ec-ddf7-4b96-af34-651b2239269b
content-encoding: br
x-envoy-upstream-service-time: 20
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 19e240ec-ddf7-4b96-af34-651b2239269b
server: cloudflare
vary: origin
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
content-type: application/json;charset=utf-8
access-control-allow-origin: https://www.recordedfuture.com
x-evy-trace-virtual-host: all
access-control-max-age: 180
access-control-allow-credentials: false
cache-control: max-age=0, no-cache, no-store
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xd8ifzHxWuzQfHjBAG%2FXsQpLET4y9MwFBHhE6c0N49nqRNhWZr6igCsxChJFcWWNBHZJwiFQb4Ga6Wpa5i%2F7mCJtdTDb6KsscCV0oQgq7qfTyyglphss64drbqW2NKg5HUOhSuJ4gGFEkXFUou2m"}],"group":"cf-nel","max_age":604800}
x-robots-tag: none
access-control-allow-headers: Accept, Accept-Charset, Accept-Encoding, Accept-Language, Content-Type, Host, Origin, Referer, User-Agent
cf-ray: 82a6abd71c996a50-EWR
x-evy-trace-served-by-pod: iad02/star-hubspot-td/envoy-proxy-56dcc87b5c-22dgm

GET
H2 200 __ptq.gif
track.hubspot.com/ 45 B
434 B 42ms
41ms Image
image/gif 2606:4700::6813:9b53
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://track.hubspot.com/__ptq.gif?k=16&fi=e887dce6-7b34-4ba5-9eac-4d2ca9a2983c&lfi=2694383&ft=1&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=220916345&v=1.1&a=252628&rcu=https%3A%2F%2Fwww.recordedfuture.com%2Fbluedelta-exploits-ukrainian-government-roundcube-mail-servers&pu=https%3A%2F%2Fwww.recordedfuture.com%2Fbluedelta-exploits-ukrainian-government-roundcube-mail-servers&t=BlueDelta+Exploits+Ukrainian+Government+Roundcube+Mail+Servers+to+Support+Espionage+Activities+%7C+Recorded+Future&cts=1700713767591&vi=32aace1b293bd7b126926e3d08a9f2ef&nc=true&u=57501621.32aace1b293bd7b126926e3d08a9f2ef.1700713767457.1700713767457.1700713767457.1&b=57501621.1.1700713767457&pt=0&cc=15

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6813:9b53 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Thu, 23 Nov 2023 04:29:27 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: 508d30b5-238d-4dd5-9ef4-57f8421f213b
p3p: CP="NOI CUR ADM OUR NOR STA NID"
x-envoy-upstream-service-time: 8
content-length: 45
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 508d30b5-238d-4dd5-9ef4-57f8421f213b
server: cloudflare
vary: origin, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KIlexnvbDF8izhHkxwRhbP3WuWPSPtfvX0EDMU0Spa2ii4Mec%2BZZyLMnq7cnePbD7kqQJSvteMKE9WWmq9DZHwQNDfvUrGXRGD7NhW7WAy%2FN20syX58fGAvNnfXTLGM26jHvwpgO9Xpy6ut3hepG"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
x-evy-trace-served-by-pod: iad02/analytics-tracking-td/envoy-proxy-7d79fcfc45-q5wn5
x-evy-trace-virtual-host: all
cache-control: no-cache, no-store, no-transform
access-control-allow-credentials: false
cf-ray: 82a6abd77a635e7d-EWR
x-robots-tag: none

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
485 B 33ms
33ms Image
image/gif 23.44.203.87
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=f2675e8089b7d209a58fce8ad312f51c&svisitor=null&visitor=67b4f3d3-3486-488e-8035-75061a379467&session=68b5cfa8-b891-4ba2-8b39-89f47ce55686&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2023%20Nov%202023%2004%3A29%3A27%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2023%20Nov%202023%2004%3A29%3A26%20GMT%22%2C%22timeSpent%22%3A%221017%22%2C%22totalTimeSpent%22%3A%221017%22%7D&isIframe=false&m=%7B%22description%22%3A%22A%20new%20report%20details%20a%20campaign%20by%20the%20threat%20actor%2C%20BlueDelta%2C%20likely%20intended%20to%20enable%20intelligence-gathering%20to%20support%20Russia%E2%80%99s%20invasion%20of%20Ukraine.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22BlueDelta%20Exploits%20Ukrainian%20Government%20Roundcube%20Mail%20Servers%20to%20Support%20Espionage%20Activities%20%7C%20Recorded%20Future%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.recordedfuture.com%2Fbluedelta-exploits-ukrainian-government-roundcube-mail-servers&pageViewId=08ad2242-9c2f-4016-8157-485e48251953&an_uid=0&webTagId=64dc3ec5-330c-4652-88d3-147ee65e90ba&v=1.1.11

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.44.203.87 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-44-203-87.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Thu, 23 Nov 2023 04:29:27 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Sat, 18 Feb 2023 01:45:17 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "63f02dad-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H2 200 iphone-cd1.jpg
go.recordedfuture.com/hubfs/ 83 KB
85 KB 290ms
29ms Image
image/webp 2606:2c40::c73c:6702

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://go.recordedfuture.com/hubfs/iphone-cd1.jpg

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:2c40::c73c:6702 -, , ASN (),

Reverse DNS

Software

cloudflare /

Resource Hash

ab221b9e81a8439634c9f73c15c96457f75d3632fea1f6256fa4833acc6a314a

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
x-amz-meta-cache-tag: F-99167145604,P-252628,FLS-ALL
age: 1165305
x-amz-request-id: Z1JNH5J762K4MSRB
x-amz-server-side-encryption: AES256
edge-cache-tag: F-99167145604,P-252628,FLS-ALL
x-amz-replication-status: COMPLETED
x-hs-https-only: worker
content-disposition: inline; filename="iphone-cd1.webp"
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
cf-bgj: imgq:85,h2pri
etag: "f5c3d1b581a50e5c3637310137a43f0e"
vary: Accept, Accept-Encoding
access-control-allow-methods: GET
content-type: image/webp
access-control-allow-origin: *
x-amz-meta-created-unix-time-millis: 1674144065940
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
x-robots-tag: all
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
date: Thu, 23 Nov 2023 04:29:28 GMT
strict-transport-security: max-age=31536000
via: 1.1 6e810acc9d798bdf126180508d1b511e.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id: CyJHfLHHqfqm77ShwrX4xZ78eMxn5Xvx
x-amz-cf-pop: JFK50-P6
x-hs-alternate-content-type: text/plain
cf-polished: qual=85, origFmt=jpeg, origSize=229013
x-cache: Miss from cloudfront
cache-tag: F-99167145604,P-252628,FLS-ALL
x-amz-meta-index-tag: all
x-amz-storage-class: INTELLIGENT_TIERING
alt-svc: h3=":443"; ma=86400
content-length: 85082
x-amz-id-2: 0o7vHnwkZ+nsnITF1tdh+XaRLqYVlURXHXjHRkU4BhIVTOJBADjj0tzwNjCRzbZxfNMRJETI6LE=
last-modified: Thu, 19 Jan 2023 16:01:07 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kpwMmlXTnZpnqGTQqT1rgdEEOhbmhovv98IIhKJKS30lWJC9Rd%2FcHOM%2FlTSickDdB70R%2F3CnGTW3ooU1s5OK9fjatGoUN2zR%2FlSPGSbyEgFhMisgOatlEmsJ1Dp0ATR%2BGAIvYpXLNbdfbhj%2FcX%2Byx3AJSQ%3D%3D"}],"group":"cf-nel","max_age":604800}
accept-ranges: bytes
cf-ray: 82a6abdf5d0943f7-EWR
x-amz-cf-id: w85G8sBsPsP6AJzB9sx9aik3dWoKzcFOYbOabTJv_kCDLHuTV7c47A==

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
484 B 30ms
29ms Image
image/gif 23.44.203.87
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=f2675e8089b7d209a58fce8ad312f51c&svisitor=null&visitor=67b4f3d3-3486-488e-8035-75061a379467&session=68b5cfa8-b891-4ba2-8b39-89f47ce55686&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2023%20Nov%202023%2004%3A29%3A28%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2023%20Nov%202023%2004%3A29%3A27%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%222018%22%7D&isIframe=false&m=%7B%22description%22%3A%22A%20new%20report%20details%20a%20campaign%20by%20the%20threat%20actor%2C%20BlueDelta%2C%20likely%20intended%20to%20enable%20intelligence-gathering%20to%20support%20Russia%E2%80%99s%20invasion%20of%20Ukraine.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22BlueDelta%20Exploits%20Ukrainian%20Government%20Roundcube%20Mail%20Servers%20to%20Support%20Espionage%20Activities%20%7C%20Recorded%20Future%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.recordedfuture.com%2Fbluedelta-exploits-ukrainian-government-roundcube-mail-servers&pageViewId=08ad2242-9c2f-4016-8157-485e48251953&an_uid=0&webTagId=64dc3ec5-330c-4652-88d3-147ee65e90ba&v=1.1.11

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.44.203.87 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-44-203-87.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Thu, 23 Nov 2023 04:29:28 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Sat, 18 Feb 2023 00:49:36 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "63f020a0-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
485 B 23ms
22ms Image
image/gif 23.44.203.87
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=f2675e8089b7d209a58fce8ad312f51c&svisitor=null&visitor=67b4f3d3-3486-488e-8035-75061a379467&session=68b5cfa8-b891-4ba2-8b39-89f47ce55686&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2023%20Nov%202023%2004%3A29%3A29%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2023%20Nov%202023%2004%3A29%3A28%20GMT%22%2C%22timeSpent%22%3A%221002%22%2C%22totalTimeSpent%22%3A%223020%22%7D&isIframe=false&m=%7B%22description%22%3A%22A%20new%20report%20details%20a%20campaign%20by%20the%20threat%20actor%2C%20BlueDelta%2C%20likely%20intended%20to%20enable%20intelligence-gathering%20to%20support%20Russia%E2%80%99s%20invasion%20of%20Ukraine.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22BlueDelta%20Exploits%20Ukrainian%20Government%20Roundcube%20Mail%20Servers%20to%20Support%20Espionage%20Activities%20%7C%20Recorded%20Future%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.recordedfuture.com%2Fbluedelta-exploits-ukrainian-government-roundcube-mail-servers&pageViewId=08ad2242-9c2f-4016-8157-485e48251953&an_uid=0&webTagId=64dc3ec5-330c-4652-88d3-147ee65e90ba&v=1.1.11

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.44.203.87 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-44-203-87.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Thu, 23 Nov 2023 04:29:29 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Sat, 05 Jun 2021 07:56:05 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "60bb2e15-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
485 B 25ms
25ms Image
image/gif 23.44.203.87
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=f2675e8089b7d209a58fce8ad312f51c&svisitor=null&visitor=67b4f3d3-3486-488e-8035-75061a379467&session=68b5cfa8-b891-4ba2-8b39-89f47ce55686&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2023%20Nov%202023%2004%3A29%3A30%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2023%20Nov%202023%2004%3A29%3A29%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%224021%22%7D&isIframe=false&m=%7B%22description%22%3A%22A%20new%20report%20details%20a%20campaign%20by%20the%20threat%20actor%2C%20BlueDelta%2C%20likely%20intended%20to%20enable%20intelligence-gathering%20to%20support%20Russia%E2%80%99s%20invasion%20of%20Ukraine.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22BlueDelta%20Exploits%20Ukrainian%20Government%20Roundcube%20Mail%20Servers%20to%20Support%20Espionage%20Activities%20%7C%20Recorded%20Future%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.recordedfuture.com%2Fbluedelta-exploits-ukrainian-government-roundcube-mail-servers&pageViewId=08ad2242-9c2f-4016-8157-485e48251953&an_uid=0&webTagId=64dc3ec5-330c-4652-88d3-147ee65e90ba&v=1.1.11

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.44.203.87 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-44-203-87.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Thu, 23 Nov 2023 04:29:30 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Sat, 18 Feb 2023 02:04:22 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "63f03226-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
484 B 24ms
23ms Image
image/gif 23.44.203.87
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=f2675e8089b7d209a58fce8ad312f51c&svisitor=null&visitor=67b4f3d3-3486-488e-8035-75061a379467&session=68b5cfa8-b891-4ba2-8b39-89f47ce55686&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2023%20Nov%202023%2004%3A29%3A31%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2023%20Nov%202023%2004%3A29%3A30%20GMT%22%2C%22timeSpent%22%3A%221002%22%2C%22totalTimeSpent%22%3A%225023%22%7D&isIframe=false&m=%7B%22description%22%3A%22A%20new%20report%20details%20a%20campaign%20by%20the%20threat%20actor%2C%20BlueDelta%2C%20likely%20intended%20to%20enable%20intelligence-gathering%20to%20support%20Russia%E2%80%99s%20invasion%20of%20Ukraine.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22BlueDelta%20Exploits%20Ukrainian%20Government%20Roundcube%20Mail%20Servers%20to%20Support%20Espionage%20Activities%20%7C%20Recorded%20Future%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.recordedfuture.com%2Fbluedelta-exploits-ukrainian-government-roundcube-mail-servers&pageViewId=08ad2242-9c2f-4016-8157-485e48251953&an_uid=0&webTagId=64dc3ec5-330c-4652-88d3-147ee65e90ba&v=1.1.11

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.44.203.87 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-44-203-87.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Thu, 23 Nov 2023 04:29:31 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Fri, 21 Feb 2020 18:57:20 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "5e502810-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
484 B 25ms
23ms Image
image/gif 23.44.203.87
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=f2675e8089b7d209a58fce8ad312f51c&svisitor=null&visitor=67b4f3d3-3486-488e-8035-75061a379467&session=68b5cfa8-b891-4ba2-8b39-89f47ce55686&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2023%20Nov%202023%2004%3A29%3A32%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2023%20Nov%202023%2004%3A29%3A31%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%226024%22%7D&isIframe=false&m=%7B%22description%22%3A%22A%20new%20report%20details%20a%20campaign%20by%20the%20threat%20actor%2C%20BlueDelta%2C%20likely%20intended%20to%20enable%20intelligence-gathering%20to%20support%20Russia%E2%80%99s%20invasion%20of%20Ukraine.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22BlueDelta%20Exploits%20Ukrainian%20Government%20Roundcube%20Mail%20Servers%20to%20Support%20Espionage%20Activities%20%7C%20Recorded%20Future%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.recordedfuture.com%2Fbluedelta-exploits-ukrainian-government-roundcube-mail-servers&pageViewId=08ad2242-9c2f-4016-8157-485e48251953&an_uid=0&webTagId=64dc3ec5-330c-4652-88d3-147ee65e90ba&v=1.1.11

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.44.203.87 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-44-203-87.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Thu, 23 Nov 2023 04:29:32 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Tue, 05 Oct 2021 22:17:52 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "615ccf10-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
486 B 21ms
21ms Image
image/gif 23.44.203.87
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=f2675e8089b7d209a58fce8ad312f51c&svisitor=null&visitor=67b4f3d3-3486-488e-8035-75061a379467&session=68b5cfa8-b891-4ba2-8b39-89f47ce55686&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2023%20Nov%202023%2004%3A29%3A33%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2023%20Nov%202023%2004%3A29%3A32%20GMT%22%2C%22timeSpent%22%3A%221004%22%2C%22totalTimeSpent%22%3A%227028%22%7D&isIframe=false&m=%7B%22description%22%3A%22A%20new%20report%20details%20a%20campaign%20by%20the%20threat%20actor%2C%20BlueDelta%2C%20likely%20intended%20to%20enable%20intelligence-gathering%20to%20support%20Russia%E2%80%99s%20invasion%20of%20Ukraine.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22BlueDelta%20Exploits%20Ukrainian%20Government%20Roundcube%20Mail%20Servers%20to%20Support%20Espionage%20Activities%20%7C%20Recorded%20Future%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.recordedfuture.com%2Fbluedelta-exploits-ukrainian-government-roundcube-mail-servers&pageViewId=08ad2242-9c2f-4016-8157-485e48251953&an_uid=0&webTagId=64dc3ec5-330c-4652-88d3-147ee65e90ba&v=1.1.11

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.44.203.87 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-44-203-87.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Thu, 23 Nov 2023 04:29:33 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Sat, 18 Feb 2023 01:45:17 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "63f02dad-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H2 200 iphone-cd1.jpg
go.recordedfuture.com/hubfs/ 83 KB
84 KB 29ms
27ms Image
image/webp 2606:2c40::c73c:6702

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://go.recordedfuture.com/hubfs/iphone-cd1.jpg

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:2c40::c73c:6702 -, , ASN (),

Reverse DNS

Software

cloudflare /

Resource Hash

ab221b9e81a8439634c9f73c15c96457f75d3632fea1f6256fa4833acc6a314a

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
x-amz-meta-cache-tag: F-99167145604,P-252628,FLS-ALL
age: 1165311
x-amz-request-id: Z1JNH5J762K4MSRB
x-amz-server-side-encryption: AES256
edge-cache-tag: F-99167145604,P-252628,FLS-ALL
x-amz-replication-status: COMPLETED
x-hs-https-only: worker
content-disposition: inline; filename="iphone-cd1.webp"
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
cf-bgj: imgq:85,h2pri
etag: "f5c3d1b581a50e5c3637310137a43f0e"
vary: Accept, Accept-Encoding
access-control-allow-methods: GET
content-type: image/webp
access-control-allow-origin: *
x-amz-meta-created-unix-time-millis: 1674144065940
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
x-robots-tag: all
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
date: Thu, 23 Nov 2023 04:29:34 GMT
strict-transport-security: max-age=31536000
via: 1.1 6e810acc9d798bdf126180508d1b511e.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id: CyJHfLHHqfqm77ShwrX4xZ78eMxn5Xvx
x-amz-cf-pop: JFK50-P6
x-hs-alternate-content-type: text/plain
cf-polished: qual=85, origFmt=jpeg, origSize=229013
x-cache: Miss from cloudfront
cache-tag: F-99167145604,P-252628,FLS-ALL
x-amz-meta-index-tag: all
x-amz-storage-class: INTELLIGENT_TIERING
alt-svc: h3=":443"; ma=86400
content-length: 85082
x-amz-id-2: 0o7vHnwkZ+nsnITF1tdh+XaRLqYVlURXHXjHRkU4BhIVTOJBADjj0tzwNjCRzbZxfNMRJETI6LE=
last-modified: Thu, 19 Jan 2023 16:01:07 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rOclYAvV0%2BWxO6365vGModpKutDaX0ShgCzcYOblbOP5JgkvUqankPP79U8%2FT5GDZUK8MPb1arJU3rulyCnnqWHA6WO0IuDNN0WZ%2FI1IeSJ6Tkc5IMLDG33fcRnkXa%2BwMHOQAVQTb5%2F4NbviMeQBQI4O%2Bg%3D%3D"}],"group":"cf-nel","max_age":604800}
accept-ranges: bytes
cf-ray: 82a6ac035a3043f7-EWR
x-amz-cf-id: w85G8sBsPsP6AJzB9sx9aik3dWoKzcFOYbOabTJv_kCDLHuTV7c47A==

GET
H2 200 __ptq.gif
track.hubspot.com/ 45 B
422 B 38ms
37ms Image
image/gif 2606:4700::6813:9b53
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://track.hubspot.com/__ptq.gif?k=15&fi=e887dce6-7b34-4ba5-9eac-4d2ca9a2983c&lfi=2694383&ft=1&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=220916345&v=1.1&a=252628&rcu=https%3A%2F%2Fwww.recordedfuture.com%2Fbluedelta-exploits-ukrainian-government-roundcube-mail-servers&pu=https%3A%2F%2Fwww.recordedfuture.com%2Fbluedelta-exploits-ukrainian-government-roundcube-mail-servers&t=BlueDelta+Exploits+Ukrainian+Government+Roundcube+Mail+Servers+to+Support+Espionage+Activities+%7C+Recorded+Future&cts=1700713774604&vi=32aace1b293bd7b126926e3d08a9f2ef&nc=true&u=57501621.32aace1b293bd7b126926e3d08a9f2ef.1700713767457.1700713767457.1700713767457.1&b=57501621.1.1700713767457&pt=0&cc=15

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6813:9b53 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Thu, 23 Nov 2023 04:29:34 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: 63e0ead2-e5e7-4c2f-8b16-4dabd0915380
p3p: CP="NOI CUR ADM OUR NOR STA NID"
x-envoy-upstream-service-time: 5
content-length: 45
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 63e0ead2-e5e7-4c2f-8b16-4dabd0915380
server: cloudflare
vary: origin, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=B7ENh3Hn%2FO3sQx7FK%2FMAXh9%2FmekiiTLRqe43J5A7AzcQ%2FtHDLP2D8QQcUDPLHK30dZFIL449n21qruI0xuM%2FUWta2DjEXeufoUwT79NapNNkzxHsBF9dYCj%2BMwCYtG1e6nr6X4E59bU1dzgujqTf"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
x-evy-trace-served-by-pod: iad02/analytics-tracking-td/envoy-proxy-7d79fcfc45-q5wn5
x-evy-trace-virtual-host: all
cache-control: no-cache, no-store, no-transform
access-control-allow-credentials: false
cf-ray: 82a6ac035af85e7d-EWR
x-robots-tag: none

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
485 B 22ms
22ms Image
image/gif 23.44.203.87
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=f2675e8089b7d209a58fce8ad312f51c&svisitor=null&visitor=67b4f3d3-3486-488e-8035-75061a379467&session=68b5cfa8-b891-4ba2-8b39-89f47ce55686&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2023%20Nov%202023%2004%3A29%3A34%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2023%20Nov%202023%2004%3A29%3A33%20GMT%22%2C%22timeSpent%22%3A%221002%22%2C%22totalTimeSpent%22%3A%228030%22%7D&isIframe=false&m=%7B%22description%22%3A%22A%20new%20report%20details%20a%20campaign%20by%20the%20threat%20actor%2C%20BlueDelta%2C%20likely%20intended%20to%20enable%20intelligence-gathering%20to%20support%20Russia%E2%80%99s%20invasion%20of%20Ukraine.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22BlueDelta%20Exploits%20Ukrainian%20Government%20Roundcube%20Mail%20Servers%20to%20Support%20Espionage%20Activities%20%7C%20Recorded%20Future%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.recordedfuture.com%2Fbluedelta-exploits-ukrainian-government-roundcube-mail-servers&pageViewId=08ad2242-9c2f-4016-8157-485e48251953&an_uid=0&webTagId=64dc3ec5-330c-4652-88d3-147ee65e90ba&v=1.1.11

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.44.203.87 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-44-203-87.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Thu, 23 Nov 2023 04:29:34 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Tue, 05 Oct 2021 22:17:52 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "615ccf10-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
486 B 24ms
23ms Image
image/gif 23.44.203.87
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=f2675e8089b7d209a58fce8ad312f51c&svisitor=null&visitor=67b4f3d3-3486-488e-8035-75061a379467&session=68b5cfa8-b891-4ba2-8b39-89f47ce55686&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2023%20Nov%202023%2004%3A29%3A35%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2023%20Nov%202023%2004%3A29%3A34%20GMT%22%2C%22timeSpent%22%3A%221002%22%2C%22totalTimeSpent%22%3A%229032%22%7D&isIframe=false&m=%7B%22description%22%3A%22A%20new%20report%20details%20a%20campaign%20by%20the%20threat%20actor%2C%20BlueDelta%2C%20likely%20intended%20to%20enable%20intelligence-gathering%20to%20support%20Russia%E2%80%99s%20invasion%20of%20Ukraine.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22BlueDelta%20Exploits%20Ukrainian%20Government%20Roundcube%20Mail%20Servers%20to%20Support%20Espionage%20Activities%20%7C%20Recorded%20Future%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.recordedfuture.com%2Fbluedelta-exploits-ukrainian-government-roundcube-mail-servers&pageViewId=08ad2242-9c2f-4016-8157-485e48251953&an_uid=0&webTagId=64dc3ec5-330c-4652-88d3-147ee65e90ba&v=1.1.11

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.44.203.87 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-44-203-87.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Thu, 23 Nov 2023 04:29:35 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Sat, 18 Feb 2023 01:45:17 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "63f02dad-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
485 B 27ms
27ms Image
image/gif 23.44.203.87
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=f2675e8089b7d209a58fce8ad312f51c&svisitor=null&visitor=67b4f3d3-3486-488e-8035-75061a379467&session=68b5cfa8-b891-4ba2-8b39-89f47ce55686&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2023%20Nov%202023%2004%3A29%3A36%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2023%20Nov%202023%2004%3A29%3A35%20GMT%22%2C%22timeSpent%22%3A%221003%22%2C%22totalTimeSpent%22%3A%2210035%22%7D&isIframe=false&m=%7B%22description%22%3A%22A%20new%20report%20details%20a%20campaign%20by%20the%20threat%20actor%2C%20BlueDelta%2C%20likely%20intended%20to%20enable%20intelligence-gathering%20to%20support%20Russia%E2%80%99s%20invasion%20of%20Ukraine.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22BlueDelta%20Exploits%20Ukrainian%20Government%20Roundcube%20Mail%20Servers%20to%20Support%20Espionage%20Activities%20%7C%20Recorded%20Future%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.recordedfuture.com%2Fbluedelta-exploits-ukrainian-government-roundcube-mail-servers&pageViewId=08ad2242-9c2f-4016-8157-485e48251953&an_uid=0&webTagId=64dc3ec5-330c-4652-88d3-147ee65e90ba&v=1.1.11

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.44.203.87 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-44-203-87.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Thu, 23 Nov 2023 04:29:36 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Tue, 05 Oct 2021 22:17:52 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "615ccf10-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
485 B 30ms
22ms Image
image/gif 23.44.203.87
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=f2675e8089b7d209a58fce8ad312f51c&svisitor=null&visitor=67b4f3d3-3486-488e-8035-75061a379467&session=68b5cfa8-b891-4ba2-8b39-89f47ce55686&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2023%20Nov%202023%2004%3A29%3A39%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2023%20Nov%202023%2004%3A29%3A36%20GMT%22%2C%22timeSpent%22%3A%223004%22%2C%22totalTimeSpent%22%3A%2213039%22%7D&isIframe=false&m=%7B%22description%22%3A%22A%20new%20report%20details%20a%20campaign%20by%20the%20threat%20actor%2C%20BlueDelta%2C%20likely%20intended%20to%20enable%20intelligence-gathering%20to%20support%20Russia%E2%80%99s%20invasion%20of%20Ukraine.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22BlueDelta%20Exploits%20Ukrainian%20Government%20Roundcube%20Mail%20Servers%20to%20Support%20Espionage%20Activities%20%7C%20Recorded%20Future%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.recordedfuture.com%2Fbluedelta-exploits-ukrainian-government-roundcube-mail-servers&pageViewId=08ad2242-9c2f-4016-8157-485e48251953&an_uid=0&webTagId=64dc3ec5-330c-4652-88d3-147ee65e90ba&v=1.1.11

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.44.203.87 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-44-203-87.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Thu, 23 Nov 2023 04:29:39 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Sat, 18 Feb 2023 00:49:36 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "63f020a0-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

Verdicts & Comments Add Verdict or Comment

106 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

40 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.recordedfuture.com/	1969-12-31 23:59:59	Name: _cfuvid Value: KMJfx.yNCHEOIFl3gNxZTRFpPK0opztriOqS2XXWLq8-1700713766147-0-604800000
.recordedfuture.com/	1970-01-20 18:34:49	Name: _gcl_au Value: 1.1.1560258338.1700713767
.a7zk.com/	1969-12-31 23:59:59	Name: _cfuvid Value: 6t0XhvBH_GdIPJ2C3KmvmfLDwagd_SIR8rhEbh12ms8-1700713766499-0-604800000
.recordedfuture.com/	1970-01-20 16:26:40	Name: _gid Value: GA1.2.1319865362.1700713767
.recordedfuture.com/	1970-01-20 16:25:13	Name: _gat_UA-9153858-2 Value: 1
.recordedfuture.com/	1970-01-21 02:01:13	Name: __utma Value: 93161374.716194572.1700713767.1700713767.1700713767.1
.recordedfuture.com/	1969-12-31 23:59:59	Name: __utmc Value: 93161374
.recordedfuture.com/	1970-01-20 20:48:01	Name: __utmz Value: 93161374.1700713767.1.1.utmcsr=(direct)\|utmccn=(direct)\|utmcmd=(none)
.recordedfuture.com/	1970-01-20 16:25:14	Name: __utmt_sfga Value: 1
.recordedfuture.com/	1970-01-20 16:25:15	Name: __utmb Value: 93161374.1.10.1700713767
.recordedfuture.com/	1970-01-21 02:01:13	Name: _ga_MHTMF48BZH Value: GS1.1.1700713766.1.0.1700713766.60.0.0
.recordedfuture.com/	1970-01-21 02:01:13	Name: _ga Value: GA1.1.716194572.1700713767
www.recordedfuture.com/	1970-01-21 02:01:13	Name: _gd_visitor Value: 67b4f3d3-3486-488e-8035-75061a379467
www.recordedfuture.com/	1970-01-20 16:25:28	Name: _gd_session Value: 68b5cfa8-b891-4ba2-8b39-89f47ce55686
.6sc.co/	1970-01-21 02:01:13	Name: 6suuid Value: 3759c817cb8c2f0027d55e6511000000475c6400
.recordedfuture.com/	1970-01-20 18:34:49	Name: _fbp Value: fb.1.1700713767203.1748664404
www.recordedfuture.com/	1970-01-20 16:35:18	Name: _an_uid Value: 0
.t.co/	1970-01-21 02:01:13	Name: muc_ads Value: 7559cbdf-3253-4de7-85b8-ce6f17cc1092
.twitter.com/	1970-01-21 02:01:13	Name: personalization_id Value: "v1_o98mTtuUMLu4ySXsJm5F1g=="
.linkedin.com/	1970-01-20 18:34:49	Name: li_sugr Value: 47761fda-df54-4def-a200-8169d72610b8
.linkedin.com/	1970-01-21 01:10:49	Name: bcookie Value: "v=2&b2629625-0033-4f8a-84df-22f452008391"
.linkedin.com/	1970-01-20 16:26:40	Name: lidc Value: "b=VGST05:s=V:r=V:a=V:p=V:g=2910:u=1:x=1:i=1700713767:t=1700800167:v=2:sig=AQERSRebDgnQXB8Pbhvvm_umRmP_HtvR"
.linkedin.com/	1970-01-20 17:08:25	Name: UserMatchHistory Value: AQLVs9qucGt_gQAAAYv6cKGh5mYNv56l4WGdmlwgHGznGLXvWAPCuqKcaB8XGAqsaj_zVMVNAbyx2g
.linkedin.com/	1970-01-20 17:08:25	Name: AnalyticsSyncHistory Value: AQIHfPV5UH1uqAAAAYv6cKGhEtu8zrK2EER0dScG1sQzcXiDcTdCRsF6UYLX75YCodJewVvl9WmhB0-6nOx0HQ
.www.linkedin.com/	1970-01-21 01:10:49	Name: bscookie Value: "v=1&2023112304292740b0cada-2e6d-4749-8d47-e0302702e3e3AQFtTrjE7ZaDqpEIA_uGh43vu-Rj4E1M"
.recordedfuture.com/	1970-01-20 20:44:25	Name: __hstc Value: 57501621.32aace1b293bd7b126926e3d08a9f2ef.1700713767457.1700713767457.1700713767457.1
.recordedfuture.com/	1970-01-20 20:44:25	Name: hubspotutk Value: 32aace1b293bd7b126926e3d08a9f2ef
.recordedfuture.com/	1969-12-31 23:59:59	Name: __hssrc Value: 1
.recordedfuture.com/	1970-01-20 16:25:15	Name: __hssc Value: 57501621.1.1700713767457
.hubspot.com/	1970-01-20 16:25:15	Name: __cf_bm Value: d5Nx.tjA5snhR8c4hos7bTIxwtpQtCbq_djK_TZpaKU-1700713767-0-ARg5bxMWdW0y6gXf6nYCtgCZRWASpmhhRBlHnXDE6Cun7tkUuZNqW6EoGLJMQkDyhKAPuv6PYbAvjaBDYr1NGj4=
.hubspot.com/	1969-12-31 23:59:59	Name: _cfuvid Value: W3WBAPPEQrvYhpu1ML7fL3gfhYhSPF43dIKgCtXazws-1700713767520-0-604800000
.go.recordedfuture.com/	1970-01-20 16:25:15	Name: __cf_bm Value: xK3cGiJpEWv9_wx2EZvPLqmY18_YZVc4tTQ4ndxjIrM-1700713768-0-AWb+HRuohEb23yYtI0fGyrjlCkEfsfOyclu+3XAlo2IS3a7rF2nuyc3LzXeEmrWoPyEsWPLAO7jnbL+n/Q5M0rY=
.go.recordedfuture.com/	1969-12-31 23:59:59	Name: __cfruid Value: f30619946f52c3e448769b402464a1a534f489b3-1700713768
.recordedfuture.com/	1970-01-20 16:26:40	Name: source Value: (direct)
.recordedfuture.com/	1970-01-20 16:26:40	Name: medium Value: (none)
.recordedfuture.com/	1970-01-20 16:26:40	Name: content Value: undefined
.recordedfuture.com/	1970-01-20 16:26:40	Name: keyword Value: undefined
.recordedfuture.com/	1970-01-20 16:26:40	Name: campaign Value:
.recordedfuture.com/	1970-01-20 16:26:40	Name: landing_page Value: /bluedelta-exploits-ukrainian-government-roundcube-mail-servers
.recordedfuture.com/	1970-01-20 16:26:40	Name: conversion_page Value: /bluedelta-exploits-ukrainian-government-roundcube-mail-servers

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	warning	URL: https://www.recordedfuture.com/bluedelta-exploits-ukrainian-government-roundcube-mail-servers Message: The resource https://www.recordedfuture.com/fonts/fonts.css was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

a7zk.com
ajax.googleapis.com
analytics.google.com
analytics.twitter.com
b.6sc.co
c.6sc.co
cdn.matomo.cloud
cms.recordedfuture.com
connect.facebook.net
cta-service-cms2.hubspot.com
epsilon.6sense.com
forms.hubspot.com
go.recordedfuture.com
ipv6.6sc.co
j.6sc.co
js.hs-analytics.net
js.hs-banner.com
js.hs-scripts.com
js.hsleadflows.net
js.hubspot.com
perf-na1.hsforms.com
px.ads.linkedin.com
px4.ads.linkedin.com
recordedfuture.matomo.cloud
secure.adnxs.com
snap.licdn.com
ssl.google-analytics.com
static.ads-twitter.com
stats.g.doubleclick.net
t.co
track.hubspot.com
www.facebook.com
www.google-analytics.com
www.google.com
www.googletagmanager.com
www.linkedin.com
www.recordedfuture.com
104.18.43.111
104.244.42.131
104.244.42.197
13.107.42.14
146.75.32.157
151.101.66.216
2001:4860:4802:34::178
23.44.203.87
2600:141b:1c00:22::1730:e073
2600:141b:1c00:e::172c:c9e4
2600:9000:215f:600:c:7d55:b3c0:93a1
2606:2c40::c73c:6702
2606:4700:4400::6812:22e5
2606:4700:4400::6812:29ab
2606:4700::6810:50ba
2606:4700::6810:be59
2606:4700::6812:7a0c
2606:4700::6812:a07d
2606:4700::6813:9b53
2607:f8b0:4004:c06::9a
2607:f8b0:4006:80c::2004
2607:f8b0:4006:816::2008
2607:f8b0:4006:81d::200e
2607:f8b0:4020:804::2008
2607:f8b0:4020:805::200a
2620:1ec:21::14
2a03:2880:f012:10c:face:b00c:0:3
2a03:2880:f112:182:face:b00c:0:25de
3.126.133.169
3.231.74.244
68.67.160.186
020a19839813fdee2eacf5a88bb1c537c26cb6cffb8cb3fffdbac86d5cf939fd
11ef5bc53ce7476b9975fc5f8194a2825fc0074c5426cfb42aabd2efc48cd800
1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f
12e873630ce3c58cd366af78f4038495ab6cd993ca06ced50d211489faeab6ec
1316977a854f25689e72527007b6254a726799eae07123b23392d71b50f17305
14103b64df9857f9f7ad1f02efaafba97ce4772e8d8b448857de69c3537c338d
1a6a117c6ce1040054357aca8d0242f7c7126c20bce811345cf8d8cee66d4684
1d0ca87959e23cb77cff2f1d7fe2337ecc770de12b1d20762373321d7d287183
24286674631e993c662f2bb1443cd8eedb7638e0b3b91236de8ca5811412592c
273f161ef31ed8a2ab9bc38c299bfec4d397623748b2c1842d7c2fc709514f9a
2ad83f2446566c5ecf7c261cc07884a5d5f71965b5df8fd7bb809f83a42bf470
303e51988c9260a2cff3363c4750588e224fb5d0cd13bd716659ae013ff6c5db
31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d
39e8ab0a041d182020ae83f95a3a1d50281858c8aa1799ddd36efaef1d27070d
3e136e77083bfc6ef14ffc5abd19da89a82bf12fc0cda3c603e01582b93303c8
4043057ae272c64c228e1b21d5b6a934dfdfceaca47c2edbcac8bf9deff8b4b9
45fc78a1cfca8c877b45081dc363233ab7bacef32b75250af4a8834eda308c50
494a9c8817786531126dd245c93f8a85aa6afa405c7b8a2e45b667538470ce7a
495d4afe192ab4d5f4a550a952f4c54e9aac52f1b502772b594770db983995c2
4bab55f97018f753772c29adb94d121e883edd0baecdb075600ad7e9db8f6a70
4e122c393dd676bf7fb18443181e894ec74a8b44afca1e8aabf4fed53f71f5b4
50f24e516ae1c0492e06b1c81d1fd961f22cb35a5f9f55ec8bb8f4a10b7f5d51
5573900bd39dcadd05c932d95d9ea1dc92a1881a94437e1aad73fbcb68b627e6
5b3086a886aa8649ecbf496ac913a1aa443926cd2fff610be2d136c9598bcd8b
6068f86ff5e6d3a3e100e95fd0ab03a5fb9ebfca9386b2c0ee131361a62526c2
61524ea7f93906805f1db6216c6bdb4f12b5811b42844c0d04000e618f2c2b99
63229c52f918a0d265a55ed925a5d1a640cd41fb0ea9c712788b516ab8742d31
6a2a12407e61c14e1eb31aa6fe59b3b8009ac3e6df694c30a8f722090071c05e
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
6f2a66b7c2567498349c8dc31d361a2208aa2babd36fdaabe7ef20aefe992bd9
6fb3140db2839cabd3662044ef7791206df377b2211046abc71dd039f05fe082
712a64e252b8b2276803abea9f4ec37e39bc91a63c34159f311b690f988c3a3f
71b42166e2662b6c5e09c8ec2e79cdf2c146b998b6a80a5a5a0dd5dde4590b06
73632a42b38d54b93e34b633f23dae5275918f41c8a73d6787caef5747dccea0
7376fe1082b03155ec4ac8c991defa5e5b2e661360ff6df011e5120a02008f1d
75d6a3ef500d60b35482a4c8ce8273b77c604e437d03b1be70e3e48e9cf69aad
7d586f2cef17b222ee811d4fa790d89b3a613e8d83981d109b289a0b45350b19
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
845b4eaf67f8f5264caa8c3182c0f552e9e3c6d95823b13fcafd631a577e3a3a
8483361f3796e4d45a1da8e3dfdaff5d41e08c3e016599d56a0b1b493ff6bfec
89ee3396394e8602a969823aa4e8d7bbaacfe45f04ace64d9a64c5fa5a035014
8a769108133cffad7744d8bfe5e2b74146db10755d99203b2d20a88ed47f4e40
8c2b5a2945535269c1cefe505e56b663f26b3d322d35ab4fa835a24c543226dc
8e89e1175a6145d737446d673ffa073f4c469c8fe3972f5287b1e7e9b241282b
9239f316beef45cfc6ba7c2b31298e0da40af5924c7c20894960238ede334d68
9282876e4f06631f0e308eb406708e42642da0833d4d78c4b686303933471891
a0b1f949528f7a3a2d2ff3b6df67c6c1b5cb8f62a2eba6eb5e06adff2d5795f3
a18bee42454d2847fd47b2e4fc37156fe94b9e9263653bdb5d30b0b4e8e04070
ab221b9e81a8439634c9f73c15c96457f75d3632fea1f6256fa4833acc6a314a
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
af24692b77970ac7b3ff702ee87c99ca5069acf4533afc922fce0431f8894e6f
b5b3233d5d02cfdfc077b3e67483603395059c3fb90f3e0bbf376d43e84e7c3e
c513ed8036bba12f205b10503334730a0aefe9e319d939fac360dd41bdbe0432
cf1b2c4162d046db8fa6f9e7ed2cbe1f7db65cd88375ba0e8e025b5105058c70
cf7fcc9f75c8717897bfaef72f303fab423ce1b70c98512aeb3677e4af988dee
d3c7d955218a0234e7e7305226cf4b816ba28a798d23f6e9d390d51f618f4391
da03d0303eb55ab800aa94ea6018b93025ecb7ce73104c6362a4c0cfec93918f
dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
ded012bacb2e23d267671ea46e0770d1fa79701d0746e3171700fd78322e4e63
e1bffb95aa906bfc9cfdc78a26496ba5b627521e1c9ee09edcf1cd7464405905
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e627ca4a11edcdbf1eb55965c8b404ae294260bd3765ccdf7cd5eb6048673653
ea0c1155e62434800a334c2894a667bf619bec5883b6bf9f0656fe1e78702438
ee041148b4d2b4bfb2a9dbff837265a3484bb6ef80a18174ee45309237654c74
ee5aeb11ca1c2946b0e4501f44497b479a76e49b4e56eeac61332f533390cfb4
ee7202fb4a4c7c9799ad4f468579c35d2b025e936404e1b86f48028b8b0e9889
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f036a45770ce2ad43dfee7f4eac8f8b3784608a24ff00c63dd56704434e014e8
f2c23fdfbd2f59b66d6478ec0cc0863e748bc789b863fec8872e64fcc639a9dd
f6fe618578c475777192fa59c2d84d95263999461e617a0ffe165f6d4bafb1e8
f8837339f39b4de89bcdc5b4705e44d0007a8728881c70d1010f9973dff06306
f88f89a0cead9c36ddbe19508f32f64bd91e94e92b6006dd575e8d0deb317d7f
fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

www.recordedfuture.com Open in urlscan Pro 104.18.43.111 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

100 Requests

99 %HTTPS

68 %IPv6

24 Domains

37 Subdomains

31 IPs

4 Countries

2285 kBTransfer

6184 kBSize

40 Cookies

11 Outgoing links

Redirected requests

100 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

www.recordedfuture.com Open in urlscan Pro
104.18.43.111 Public Scan

Screenshot
Live screenshot

Full Image

100
Requests

99 %
HTTPS

68 %
IPv6

24
Domains

37
Subdomains

31
IPs

4
Countries

2285 kB
Transfer

6184 kB
Size

40
Cookies

100 HTTP transactions
2 data transactions