urlscan.io logo urlscan.io
SecurityTrails logo

www.helpnetsecurity.com Open in urlscan Pro
52.40.162.54  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://t.co/r0PJD5t4sw
Effective URL: https://www.helpnetsecurity.com/2020/11/13/malware-activity-q3-2020/
Submission: On November 17 via api from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 12 IPs in 4 countries across 8 domains to perform 38 HTTP transactions. The main IP is 52.40.162.54, located in Boardman, United States and belongs to AMAZON-02, US. The main domain is www.helpnetsecurity.com.
TLS certificate: Issued by Amazon on October 16th 2020. Valid for: a year.
This is the only time www.helpnetsecurity.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 104.244.42.69 13414 (TWITTER)
9 52.40.162.54 16509 (AMAZON-02)
1 2a00:1450:400... 15169 (GOOGLE)
2 2001:4de0:ac1... 20446 (HIGHWINDS3)
6 2606:4700::68... 13335 (CLOUDFLAR...)
1 2a04:4e42:1b:... 54113 (FASTLY)
1 2600:9000:205... 16509 (AMAZON-02)
3 2a00:1450:400... 15169 (GOOGLE)
1 65.9.96.97 16509 (AMAZON-02)
11 99.86.2.75 16509 (AMAZON-02)
2 18.196.53.208 16509 (AMAZON-02)
38 12
1    104.244.42.69 (United States)

ASN13414 (TWITTER, US)
t.co
9    52.40.162.54 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-40-162-54.us-west-2.compute.amazonaws.com
www.helpnetsecurity.com
1    2a00:1450:4001:808::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.googleapis.com
2    2001:4de0:ac19::1:b:3b (Netherlands)

ASN20446 (HIGHWINDS3, US)
stackpath.bootstrapcdn.com
6    2606:4700::6810:135e (United States)

ASN13335 (CLOUDFLARENET, US)
cdnjs.cloudflare.com
1    2a04:4e42:1b::621 (Ascension Island)

ASN54113 (FASTLY, US)
cdn.jsdelivr.net
1    2600:9000:2057:6800:c:7d55:b3c0:93a1 (United States)

ASN16509 (AMAZON-02, US)
cdn.matomo.cloud
3    2a00:1450:4001:80b::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.gstatic.com
1    65.9.96.97 (Seattle, United States)

ASN16509 (AMAZON-02, US)
img2.helpnetsecurity.com
11    99.86.2.75 (Seattle, United States)

ASN16509 (AMAZON-02, US)
img.helpnetsecurity.com
2    18.196.53.208 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
helpnetsecurity.matomo.cloud
Domain Requested by
11 img.helpnetsecurity.com www.helpnetsecurity.com
9 www.helpnetsecurity.com t.co
www.helpnetsecurity.com
6 cdnjs.cloudflare.com www.helpnetsecurity.com
cdnjs.cloudflare.com
3 fonts.gstatic.com fonts.googleapis.com
2 helpnetsecurity.matomo.cloud www.helpnetsecurity.com
cdn.matomo.cloud
2 stackpath.bootstrapcdn.com www.helpnetsecurity.com
1 img2.helpnetsecurity.com www.helpnetsecurity.com
1 cdn.matomo.cloud www.helpnetsecurity.com
1 cdn.jsdelivr.net www.helpnetsecurity.com
1 fonts.googleapis.com www.helpnetsecurity.com
1 t.co
38 11

This site contains links to these domains. Also see Links.

Domain
twitter.com
helpnet.pro
www.facebook.com
www.linkedin.com
www.eac.gov
www.google.com
Subject Issuer Validity Valid
t.co
DigiCert SHA2 High Assurance Server CA		 2020-03-05 -
2021-03-02		 a year crt.sh
*.helpnetsecurity.com
Amazon		 2020-10-16 -
2021-11-14		 a year crt.sh
upload.video.google.com
GTS CA 1O1		 2020-10-28 -
2021-01-20		 3 months crt.sh
*.bootstrapcdn.com
Sectigo RSA Domain Validation Secure Server CA		 2020-09-22 -
2021-10-12		 a year crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2020-10-21 -
2021-10-20		 a year crt.sh
f3.shared.global.fastly.net
GlobalSign CloudSSL CA - SHA256 - G3		 2020-10-26 -
2021-04-17		 6 months crt.sh
cdn.matomo.cloud
Amazon		 2020-02-28 -
2021-03-28		 a year crt.sh
*.gstatic.com
GTS CA 1O1		 2020-10-28 -
2021-01-20		 3 months crt.sh
img2.helpnetsecurity.com
Amazon		 2020-10-10 -
2021-11-10		 a year crt.sh
img.helpnetsecurity.com
Amazon		 2020-10-10 -
2021-11-10		 a year crt.sh
*.matomo.cloud
Let's Encrypt Authority X3		 2020-10-14 -
2021-01-12		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://www.helpnetsecurity.com/2020/11/13/malware-activity-q3-2020/
Frame ID: EB1E552BED2962C24C242C8C7237DA00
Requests: 41 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. https://t.co/r0PJD5t4sw Page URL
  2. https://www.helpnetsecurity.com/2020/11/13/malware-activity-q3-2020/ Page URL

Page Statistics

38
Requests

100 %
HTTPS

55 %
IPv6

8
Domains

11
Subdomains

12
IPs

4
Countries

565 kB
Transfer

1034 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://t.co/r0PJD5t4sw Page URL
  2. https://www.helpnetsecurity.com/2020/11/13/malware-activity-q3-2020/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

38 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
r0PJD5t4sw
t.co/ 		363 B
524 B 		Document
General
Check archive.org
Download Go to
Full URL
https://t.co/r0PJD5t4sw
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.244.42.69 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
417f73552688f01697ef34fedfa43a0f0f33a6180860e9fef3e0ee8016dd97c2
Security Headers
Name Value
Strict-Transport-Security max-age=0
X-Xss-Protection 0

Request headers

:method
GET
:authority
t.co
:scheme
https
:path
/r0PJD5t4sw
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status
200
cache-control
private,max-age=300
content-encoding
gzip
content-length
216
content-type
text/html; charset=utf-8
date
Tue, 17 Nov 2020 19:06:16 GMT
expires
Tue, 17 Nov 2020 19:11:16 GMT
server
tsa_o
set-cookie
muc=1ae79437-224d-41ec-baff-e5a3a56db4f2; Max-Age=63072000; Expires=Thu, 17 Nov 2022 19:06:16 GMT; Domain=t.co; Secure; SameSite=None
strict-transport-security
max-age=0
vary
Origin
x-connection-hash
bc2b94cec1991b917d18ae2c08bfea18
x-response-time
122
x-xss-protection
0
Primary Request /
www.helpnetsecurity.com/2020/11/13/malware-activity-q3-2020/ 		62 KB
13 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.helpnetsecurity.com/2020/11/13/malware-activity-q3-2020/
Requested by
Host: t.co
URL: https://t.co/r0PJD5t4sw
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.40.162.54 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-40-162-54.us-west-2.compute.amazonaws.com
Software
Apache /
Resource Hash
78eea6c2cf09985bafc88446f1a8e78c97266faae5c8d1205958211831f0042c

Request headers

:method
GET
:authority
www.helpnetsecurity.com
:scheme
https
:path
/2020/11/13/malware-activity-q3-2020/
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
document
referer
https://t.co/r0PJD5t4sw
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://t.co/r0PJD5t4sw

Response headers

status
200
date
Tue, 17 Nov 2020 19:06:17 GMT
content-type
text/html; charset=UTF-8
content-length
13203
server
Apache
set-cookie
SSESS4decf0f010bae5a263354c26060a9ea3=uupaqju7s5sfc3pjnu1ue8rkpb; path=/; domain=.helpnetsecurity.com; secure; HttpOnly
link
<https://www.helpnetsecurity.com/wp-json/>; rel="https://api.w.org/" <https://www.helpnetsecurity.com/wp-json/wp/v2/posts/162182>; rel="alternate"; type="application/json" <https://www.helpnetsecurity.com/?p=162182>; rel=shortlink
cache-control
max-age=0
expires
Tue, 17 Nov 2020 19:06:16 GMT
vary
Accept-Encoding
content-encoding
gzip
x-ua-compatible
IE=edge
style.min.css
www.helpnetsecurity.com/wp-includes/css/dist/block-library/ 		53 KB
8 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.helpnetsecurity.com/wp-includes/css/dist/block-library/style.min.css?ver=5.5.3
Requested by
Host: www.helpnetsecurity.com
URL: https://www.helpnetsecurity.com/2020/11/13/malware-activity-q3-2020/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.40.162.54 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-40-162-54.us-west-2.compute.amazonaws.com
Software
Apache /
Resource Hash
8c626f0f9b5c109539b256b73e72c02b300a184f46b4535c2eb86599215c78af

Request headers

Referer
https://www.helpnetsecurity.com/2020/11/13/malware-activity-q3-2020/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 17 Nov 2020 19:06:17 GMT
content-encoding
gzip
last-modified
Mon, 31 Dec 1979 04:08:00 GMT
server
Apache
vary
Accept-Encoding
content-type
text/css; charset=utf-8
status
200
cache-control
max-age=31536000
accept-ranges
bytes
content-length
7907
expires
Wed, 17 Nov 2021 19:06:17 GMT
css
fonts.googleapis.com/ 		16 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Roboto%3A300%2C300i%2C400%2C400i%2C500%2C500i%2C700%2C700i&subset=latin%2Clatin-ext
Requested by
Host: www.helpnetsecurity.com
URL: https://www.helpnetsecurity.com/2020/11/13/malware-activity-q3-2020/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
064005714ba5c313aae22c250fa2d70be1ff36a314598c591a9b2be436446812
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://www.helpnetsecurity.com/2020/11/13/malware-activity-q3-2020/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
status
200
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Tue, 17 Nov 2020 19:06:17 GMT
server
ESF
date
Tue, 17 Nov 2020 19:06:17 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Tue, 17 Nov 2020 19:06:17 GMT
bootstrap.min.css
stackpath.bootstrapcdn.com/bootstrap/4.5.2/css/ 		157 KB
24 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://stackpath.bootstrapcdn.com/bootstrap/4.5.2/css/bootstrap.min.css?ver=4.5.2
Requested by
Host: www.helpnetsecurity.com
URL: https://www.helpnetsecurity.com/2020/11/13/malware-activity-q3-2020/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4de0:ac19::1:b:3b , Netherlands, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software
/
Resource Hash
5b0fbe5b7ad705f6a937c4998ad02f73d8f0d976fe231b74aef0ec996990c93a
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.helpnetsecurity.com/2020/11/13/malware-activity-q3-2020/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 17 Nov 2020 19:06:17 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 06 Aug 2020 16:43:41 GMT
status
200
etag
"1596732221"
vary
Accept-Encoding
x-cache
HIT
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
timing-allow-origin
*
content-length
23876
lightbox.min.css
cdnjs.cloudflare.com/ajax/libs/lightbox2/2.11.3/css/ 		2 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/lightbox2/2.11.3/css/lightbox.min.css?ver=2.11.3
Requested by
Host: www.helpnetsecurity.com
URL: https://www.helpnetsecurity.com/2020/11/13/malware-activity-q3-2020/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:135e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b41c65a254473fdb8cb0414a564fa193ffde90e9573a2c4b2afc9ee56d964797
Security Headers
Name Value
Strict-Transport-Security max-age=15780000

Request headers

Referer
https://www.helpnetsecurity.com/2020/11/13/malware-activity-q3-2020/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 17 Nov 2020 19:06:17 GMT
content-encoding
br
vary
Accept-Encoding
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
744113
x-via
cfworker/kv
status
200
content-length
683
cf-request-id
067932d14100002bb9ab388000000001
timing-allow-origin
*
last-modified
Sat, 11 Jul 2020 03:47:52 GMT
server
cloudflare
etag
"5f093668-9e4"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15780000
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=pDgdyK%2B6x%2BdEXaJ7dJ%2BM%2Frwzm2tF8cmAKmyjQRXX0dkKgbS0qoyrIaQ75m%2FXG%2Bzrve4yTD7QHbUfDclT5znrQZzs7YoqKzbeEeoYYCKaWS6aJJzvP4ACUQ97UW9s4pGY2w%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=30672000
accept-ranges
bytes
cf-ray
5f3bba620e9b2bb9-FRA
expires
Sun, 07 Nov 2021 19:06:17 GMT
style-1602516265.min.css
www.helpnetsecurity.com/wp-content/themes/hns20/dist/css/ 		66 KB
13 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.helpnetsecurity.com/wp-content/themes/hns20/dist/css/style-1602516265.min.css?ver=5.5.3
Requested by
Host: www.helpnetsecurity.com
URL: https://www.helpnetsecurity.com/2020/11/13/malware-activity-q3-2020/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.40.162.54 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-40-162-54.us-west-2.compute.amazonaws.com
Software
Apache /
Resource Hash
e4b727904102a785b90a224022a651ef9d1d2bccc309c12a2d00fe0d34397b33

Request headers

Referer
https://www.helpnetsecurity.com/2020/11/13/malware-activity-q3-2020/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 17 Nov 2020 19:06:17 GMT
content-encoding
gzip
last-modified
Mon, 31 Dec 1979 04:08:00 GMT
server
Apache
vary
Accept-Encoding
content-type
text/css; charset=utf-8
status
200
cache-control
max-age=31536000
accept-ranges
bytes
content-length
12925
expires
Wed, 17 Nov 2021 19:06:17 GMT
jquery.js
www.helpnetsecurity.com/wp-includes/js/jquery/ 		95 KB
33 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.helpnetsecurity.com/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp
Requested by
Host: www.helpnetsecurity.com
URL: https://www.helpnetsecurity.com/2020/11/13/malware-activity-q3-2020/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.40.162.54 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-40-162-54.us-west-2.compute.amazonaws.com
Software
Apache /
Resource Hash
1db21d816296e6939ba1f42962496e4134ae2b0081e26970864c40c6d02bb1df

Request headers

Referer
https://www.helpnetsecurity.com/2020/11/13/malware-activity-q3-2020/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 17 Nov 2020 19:06:17 GMT
content-encoding
gzip
last-modified
Mon, 31 Dec 1979 04:08:00 GMT
server
Apache
vary
Accept-Encoding
content-type
text/javascript; charset=utf-8
status
200
cache-control
max-age=2592000
accept-ranges
bytes
content-length
33776
expires
Thu, 17 Dec 2020 19:06:17 GMT
logo.svg
www.helpnetsecurity.com/wp-content/themes/hns20/assets/images/ 		2 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.helpnetsecurity.com/wp-content/themes/hns20/assets/images/logo.svg
Requested by
Host: www.helpnetsecurity.com
URL: https://www.helpnetsecurity.com/2020/11/13/malware-activity-q3-2020/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.40.162.54 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-40-162-54.us-west-2.compute.amazonaws.com
Software
Apache /
Resource Hash
465cd839800ade38f127d512ea3e361c56e472f1977b1032d0794edd5c1fa0e4

Request headers

Referer
https://www.helpnetsecurity.com/2020/11/13/malware-activity-q3-2020/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 17 Nov 2020 19:06:17 GMT
content-encoding
gzip
last-modified
Mon, 31 Dec 1979 04:08:00 GMT
server
Apache
vary
Accept-Encoding
content-type
image/svg+xml
status
200
cache-control
max-age=2592000
accept-ranges
bytes
content-length
956
expires
Thu, 17 Dec 2020 19:06:17 GMT
lazysizes.min.js
www.helpnetsecurity.com/wp-content/themes/hns20/dist/lib/js/ 		8 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.helpnetsecurity.com/wp-content/themes/hns20/dist/lib/js/lazysizes.min.js?ver=5.5.3
Requested by
Host: www.helpnetsecurity.com
URL: https://www.helpnetsecurity.com/2020/11/13/malware-activity-q3-2020/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.40.162.54 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-40-162-54.us-west-2.compute.amazonaws.com
Software
Apache /
Resource Hash
fb649fcae62177dfe63e67081ddceb830b5ce1f05a4184e9bbb7d87ac4b8f4e5

Request headers

Referer
https://www.helpnetsecurity.com/2020/11/13/malware-activity-q3-2020/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 17 Nov 2020 19:06:17 GMT
content-encoding
gzip
last-modified
Mon, 31 Dec 1979 04:08:00 GMT
server
Apache
vary
Accept-Encoding
content-type
text/javascript; charset=utf-8
status
200
cache-control
max-age=2592000
accept-ranges
bytes
content-length
3457
expires
Thu, 17 Dec 2020 19:06:17 GMT
popper.min.js
cdn.jsdelivr.net/npm/popper.js@1.16.0/dist/umd/ 		21 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.jsdelivr.net/npm/popper.js@1.16.0/dist/umd/popper.min.js?ver=1.16.0
Requested by
Host: www.helpnetsecurity.com
URL: https://www.helpnetsecurity.com/2020/11/13/malware-activity-q3-2020/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::621 , Ascension Island, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
c776195ad46333c6c9a9fe3c74502ffea9a02faf122388ea3567922cc65a3060
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.helpnetsecurity.com/2020/11/13/malware-activity-q3-2020/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
age
9605074
x-cache
HIT, HIT
status
200
content-length
7510
etag
W/"5309-YvI45zNIx3656GVCan0bfeI8uy0"
x-served-by
cache-fra19170-FRA, cache-hhn4030-HHN
date
Tue, 17 Nov 2020 19:06:17 GMT
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=31536000, s-maxage=31536000, immutable
accept-ranges
bytes
timing-allow-origin
*
bootstrap.min.js
stackpath.bootstrapcdn.com/bootstrap/4.5.2/js/ 		59 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://stackpath.bootstrapcdn.com/bootstrap/4.5.2/js/bootstrap.min.js?ver=4.5.2
Requested by
Host: www.helpnetsecurity.com
URL: https://www.helpnetsecurity.com/2020/11/13/malware-activity-q3-2020/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4de0:ac19::1:b:3b , Netherlands, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software
/
Resource Hash
79c599dd760cec0c1621a1af49d9a2a49da5d45e1b37d4575bace0a5e0226582
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.helpnetsecurity.com/2020/11/13/malware-activity-q3-2020/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 17 Nov 2020 19:06:17 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 06 Aug 2020 16:43:44 GMT
status
200
etag
"1596732224"
vary
Accept-Encoding
x-cache
HIT
content-type
text/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
timing-allow-origin
*
content-length
14811
lightbox.min.js
cdnjs.cloudflare.com/ajax/libs/lightbox2/2.11.3/js/ 		9 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/lightbox2/2.11.3/js/lightbox.min.js?ver=2.11.3
Requested by
Host: www.helpnetsecurity.com
URL: https://www.helpnetsecurity.com/2020/11/13/malware-activity-q3-2020/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:135e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
18b528527b6032b3510f50941de3acd9933fcb99964d6c47966380f42ac28f23
Security Headers
Name Value
Strict-Transport-Security max-age=15780000

Request headers

Referer
https://www.helpnetsecurity.com/2020/11/13/malware-activity-q3-2020/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 17 Nov 2020 19:06:17 GMT
content-encoding
br
vary
Accept-Encoding
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
1088889
x-via
cfworker/kv
status
200
content-length
2495
cf-request-id
067932d2b600002bb909bdb000000001
timing-allow-origin
*
last-modified
Sat, 11 Jul 2020 03:47:52 GMT
server
cloudflare
etag
"5f093668-250b"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15780000
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=rmnvJiwLFvPhQiMSbbRuWf%2BzmBn037p6YeEqqt1KP0WslOtHy%2B0KPI3JE2abY557PFW4wzsRcZD5M2%2F3tSpIjHVbD5b7pTK2DiRaX2A0YiJEf%2BAr3iLwOo3vqZBisARgeA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=30672000
accept-ranges
bytes
cf-ray
5f3bba645d1f2bb9-FRA
expires
Sun, 07 Nov 2021 19:06:17 GMT
ads.min.js
www.helpnetsecurity.com/wp-content/themes/hns20/dist/js/ 		114 B
345 B 		Script
General
Check archive.org
Download Go to
Full URL
https://www.helpnetsecurity.com/wp-content/themes/hns20/dist/js/ads.min.js?ver=1.0
Requested by
Host: www.helpnetsecurity.com
URL: https://www.helpnetsecurity.com/2020/11/13/malware-activity-q3-2020/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.40.162.54 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-40-162-54.us-west-2.compute.amazonaws.com
Software
Apache /
Resource Hash
c011d580928507688184324c0f7d2a2a6d40c744598b9ffded038984c67b0eb1

Request headers

Referer
https://www.helpnetsecurity.com/2020/11/13/malware-activity-q3-2020/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 17 Nov 2020 19:06:17 GMT
content-encoding
gzip
last-modified
Mon, 31 Dec 1979 04:08:00 GMT
server
Apache
vary
Accept-Encoding
content-type
text/javascript; charset=utf-8
status
200
cache-control
max-age=2592000
accept-ranges
bytes
content-length
113
expires
Thu, 17 Dec 2020 19:06:17 GMT
init-1602516265.min.js
www.helpnetsecurity.com/wp-content/themes/hns20/dist/js/ 		8 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.helpnetsecurity.com/wp-content/themes/hns20/dist/js/init-1602516265.min.js?ver=5.5.3
Requested by
Host: www.helpnetsecurity.com
URL: https://www.helpnetsecurity.com/2020/11/13/malware-activity-q3-2020/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.40.162.54 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-40-162-54.us-west-2.compute.amazonaws.com
Software
Apache /
Resource Hash
e140f6c297fefa76cdc5c893bcfc14797bc69615d9887ffd81b00479d9bb2463

Request headers

Referer
https://www.helpnetsecurity.com/2020/11/13/malware-activity-q3-2020/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 17 Nov 2020 19:06:17 GMT
content-encoding
gzip
last-modified
Mon, 31 Dec 1979 04:08:00 GMT
server
Apache
vary
Accept-Encoding
content-type
text/javascript; charset=utf-8
status
200
cache-control
max-age=2592000
accept-ranges
bytes
content-length
2748
expires
Thu, 17 Dec 2020 19:06:17 GMT
wp-embed.min.js
www.helpnetsecurity.com/wp-includes/js/ 		1 KB
1001 B 		Script
General
Check archive.org
Download Go to
Full URL
https://www.helpnetsecurity.com/wp-includes/js/wp-embed.min.js?ver=5.5.3
Requested by
Host: www.helpnetsecurity.com
URL: https://www.helpnetsecurity.com/2020/11/13/malware-activity-q3-2020/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.40.162.54 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-40-162-54.us-west-2.compute.amazonaws.com
Software
Apache /
Resource Hash
6ebcda7a3a41ef97f0b4071160ceb1020e540fdc0f790079a5c2ef01ab654fe0

Request headers

Referer
https://www.helpnetsecurity.com/2020/11/13/malware-activity-q3-2020/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 17 Nov 2020 19:06:17 GMT
content-encoding
gzip
last-modified
Mon, 31 Dec 1979 04:08:00 GMT
server
Apache
vary
Accept-Encoding
content-type
text/javascript; charset=utf-8
status
200
cache-control
max-age=2592000
accept-ranges
bytes
content-length
769
expires
Thu, 17 Dec 2020 19:06:17 GMT
matomo.js
cdn.matomo.cloud/helpnetsecurity.matomo.cloud/ 		69 KB
24 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.matomo.cloud/helpnetsecurity.matomo.cloud/matomo.js
Requested by
Host: www.helpnetsecurity.com
URL: https://www.helpnetsecurity.com/2020/11/13/malware-activity-q3-2020/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2057:6800:c:7d55:b3c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
0995371a359a4a701d66f8b183de6144de9a042e5bac84b6f920968f51567742

Request headers

Referer
https://www.helpnetsecurity.com/2020/11/13/malware-activity-q3-2020/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-server-side-encryption
AES256
date
Tue, 17 Nov 2020 17:10:18 GMT
content-encoding
gzip
last-modified
Tue, 01 Sep 2020 07:01:47 GMT
server
AmazonS3
age
6960
etag
W/"434f3d0418b4425917954bf073f4d262"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript; charset=utf-8
status
200
cache-control
max-age=691200
x-amz-cf-pop
FRA6-C1
x-amz-cf-id
Cka1Koh1bv_PHtvc1BgqYDxmKgtyemh84lJRgB7wcoWF5lnX_1nEYg==
via
1.1 8cdf0467c0468ddfe8e9873c6bb8304c.cloudfront.net (CloudFront)
truncated
/ 		154 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
4d0a8079bf1c328084ea4e2e6c543cd9f45f2b3503556a65df6e2382ef2e9138

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		152 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b870340b8b7ac49a8fb8cd44b364d4bbae3b0a2c6802d940fdcb6d696703cbb3

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
image/svg+xml
KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2
fonts.gstatic.com/s/roboto/v20/ 		11 KB
11 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v20/KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A300%2C300i%2C400%2C400i%2C500%2C500i%2C700%2C700i&subset=latin%2Clatin-ext
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
5d1bc9b443f3f81fa4b4ad4634c1bb9702194c1898e3a9de0ab5e2cdc0e9f479
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://www.helpnetsecurity.com
Referer
https://fonts.googleapis.com/css?family=Roboto%3A300%2C300i%2C400%2C400i%2C500%2C500i%2C700%2C700i&subset=latin%2Clatin-ext
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sun, 15 Nov 2020 11:20:35 GMT
x-content-type-options
nosniff
last-modified
Wed, 24 Jul 2019 01:18:50 GMT
server
sffe
age
200742
status
200
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
11016
x-xss-protection
0
expires
Mon, 15 Nov 2021 11:20:35 GMT
KFOlCnqEu92Fr1MmWUlfBBc4AMP6lQ.woff2
fonts.gstatic.com/s/roboto/v20/ 		11 KB
11 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmWUlfBBc4AMP6lQ.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A300%2C300i%2C400%2C400i%2C500%2C500i%2C700%2C700i&subset=latin%2Clatin-ext
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
0d9fd7ccabde9b202de45ee6b65878ce9594975d8e8810b0878d3f3fa3637d0e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://www.helpnetsecurity.com
Referer
https://fonts.googleapis.com/css?family=Roboto%3A300%2C300i%2C400%2C400i%2C500%2C500i%2C700%2C700i&subset=latin%2Clatin-ext
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sun, 15 Nov 2020 20:01:10 GMT
x-content-type-options
nosniff
last-modified
Wed, 24 Jul 2019 01:18:58 GMT
server
sffe
age
169507
status
200
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
11020
x-xss-protection
0
expires
Mon, 15 Nov 2021 20:01:10 GMT
KFOlCnqEu92Fr1MmSU5fBBc4AMP6lQ.woff2
fonts.gstatic.com/s/roboto/v20/ 		11 KB
11 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmSU5fBBc4AMP6lQ.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A300%2C300i%2C400%2C400i%2C500%2C500i%2C700%2C700i&subset=latin%2Clatin-ext
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
92606bd38901e67d069f2ef883715b6e5ae07d72ae3bead3ad92346528374afc
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://www.helpnetsecurity.com
Referer
https://fonts.googleapis.com/css?family=Roboto%3A300%2C300i%2C400%2C400i%2C500%2C500i%2C700%2C700i&subset=latin%2Clatin-ext
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Fri, 13 Nov 2020 20:05:03 GMT
x-content-type-options
nosniff
last-modified
Wed, 24 Jul 2019 01:18:52 GMT
server
sffe
age
342074
status
200
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
11180
x-xss-protection
0
expires
Sat, 13 Nov 2021 20:05:03 GMT
quote_Greg-Lesnewich_13112020.jpg
img2.helpnetsecurity.com/posts2020/ 		58 KB
58 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://img2.helpnetsecurity.com/posts2020/quote_Greg-Lesnewich_13112020.jpg
Requested by
Host: www.helpnetsecurity.com
URL: https://www.helpnetsecurity.com/2020/11/13/malware-activity-q3-2020/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
65.9.96.97 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
1d06d9c1d3f57c285e200e6190e890b73585de2e472b5a72016d643a9c30690e

Request headers

Referer
https://www.helpnetsecurity.com/2020/11/13/malware-activity-q3-2020/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 17 Nov 2020 11:00:30 GMT
via
1.1 93fcd07b66eaf26b036f14e2ec9d73eb.cloudfront.net (CloudFront)
last-modified
Thu, 12 Nov 2020 10:28:21 GMT
server
AmazonS3
age
29148
etag
"32d4d171a5c6553c15cf83f83f71a6ab"
x-cache
Hit from cloudfront
x-amz-version-id
iiIAFeeHaPpxk4c3EsmiXaz5P9YRkPZr
status
200
x-amz-cf-pop
PRG50-C1
accept-ranges
bytes
content-type
image/jpeg
content-length
59068
x-amz-cf-id
eSeQNp4Gqf1IXCBthvHfV47c5BE19yU29TYElAVfqsX84KA-DBSEFA==
cisco-pattern-logo-100x100.jpg
img.helpnetsecurity.com/wp-content/uploads/2020/09/01102838/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://img.helpnetsecurity.com/wp-content/uploads/2020/09/01102838/cisco-pattern-logo-100x100.jpg
Requested by
Host: www.helpnetsecurity.com
URL: https://www.helpnetsecurity.com/2020/11/13/malware-activity-q3-2020/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
99.86.2.75 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
ffb6d5b9f95c18e43980065f8471ec2bbfd7bdd36192716f9c49f1bd9fd20085

Request headers

Referer
https://www.helpnetsecurity.com/2020/11/13/malware-activity-q3-2020/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 17 Nov 2020 11:45:38 GMT
via
1.1 6e432daa93321d42e8840614082fcdc3.cloudfront.net (CloudFront)
age
26440
x-cache
Hit from cloudfront
status
200
content-length
3033
last-modified
Tue, 01 Sep 2020 08:28:39 GMT
server
AmazonS3
etag
"725f2975dc5022049d419a465e8e4869"
x-amz-version-id
ptuqj0ftKWLl5iIqpbWRT1CYVNfVHiUy
cache-control
max-age=31536000
x-amz-cf-pop
FRA6-C1
accept-ranges
bytes
content-type
image/jpeg
x-amz-cf-id
8-y3P793B-G90pMVzyVmWJZNO8foawgM3phKpOJIFhbJtRpjowJkdQ==
expires
Wed, 01 Sep 2021 08:28:38 GMT
lock-red-lines-100x100.jpg
img.helpnetsecurity.com/wp-content/uploads/2020/11/16142116/ 		4 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://img.helpnetsecurity.com/wp-content/uploads/2020/11/16142116/lock-red-lines-100x100.jpg
Requested by
Host: www.helpnetsecurity.com
URL: https://www.helpnetsecurity.com/2020/11/13/malware-activity-q3-2020/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
99.86.2.75 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
4213dd1007ac1764c0fb6dd44e754cb1972de6eef93433e293f8b1f020226ed7

Request headers

Referer
https://www.helpnetsecurity.com/2020/11/13/malware-activity-q3-2020/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 16 Nov 2020 13:47:08 GMT
via
1.1 6e432daa93321d42e8840614082fcdc3.cloudfront.net (CloudFront)
age
105550
x-cache
Hit from cloudfront
status
200
content-length
3883
last-modified
Mon, 16 Nov 2020 13:21:18 GMT
server
AmazonS3
etag
"5483cf06a7eec2f5e86fa82e06c13e3a"
x-amz-version-id
hsIMK54tSnipwW._HLV2.6m5heeVJWyA
cache-control
max-age=31536000
x-amz-cf-pop
FRA6-C1
accept-ranges
bytes
content-type
image/jpeg
x-amz-cf-id
Aq_oJPWRLcflCFvHzNpCUe2mUP5QratByum3uHcecAOegwW4eAypXw==
expires
Tue, 16 Nov 2021 13:21:17 GMT
thief-100x100.jpg
img.helpnetsecurity.com/wp-content/uploads/2018/11/09095826/ 		4 KB
5 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://img.helpnetsecurity.com/wp-content/uploads/2018/11/09095826/thief-100x100.jpg
Requested by
Host: www.helpnetsecurity.com
URL: https://www.helpnetsecurity.com/2020/11/13/malware-activity-q3-2020/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
99.86.2.75 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
4c99b555cb8a98014cfe35f790886c3ef4678599335034b96febde9b5b4ce7dc

Request headers

Referer
https://www.helpnetsecurity.com/2020/11/13/malware-activity-q3-2020/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 17 Nov 2020 06:32:48 GMT
via
1.1 6e432daa93321d42e8840614082fcdc3.cloudfront.net (CloudFront)
age
45210
x-cache
Hit from cloudfront
status
200
content-length
4303
last-modified
Sat, 09 Nov 2019 09:02:52 GMT
server
AmazonS3
etag
"d4f55f3187405f3eb2e469291f8c2352"
x-amz-version-id
XrV9igrC3xu15_D33IvVrfWfUuRHBeDY
cache-control
max-age=31536000
x-amz-cf-pop
FRA6-C1
accept-ranges
bytes
content-type
image/jpeg
x-amz-cf-id
Z0RveuhZUUwhFd2j58nJp8rOzRqZR6-rENwry6d1uFG-RM1x8gbBeg==
expires
Sun, 08 Nov 2020 08:58:26 GMT
any-run-100x100.jpg
img.helpnetsecurity.com/wp-content/uploads/2020/11/17111953/ 		4 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://img.helpnetsecurity.com/wp-content/uploads/2020/11/17111953/any-run-100x100.jpg
Requested by
Host: www.helpnetsecurity.com
URL: https://www.helpnetsecurity.com/2020/11/13/malware-activity-q3-2020/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
99.86.2.75 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
4d86491ad5a7f3a12cb51e5b124cfe2822155e5bf82360decf1bcd9ffb82f757

Request headers

Referer
https://www.helpnetsecurity.com/2020/11/13/malware-activity-q3-2020/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 17 Nov 2020 10:34:33 GMT
via
1.1 6e432daa93321d42e8840614082fcdc3.cloudfront.net (CloudFront)
age
30705
x-cache
Hit from cloudfront
status
200
content-length
3899
last-modified
Tue, 17 Nov 2020 10:19:55 GMT
server
AmazonS3
etag
"16968beb5973f04372f5c6e33e1006c3"
x-amz-version-id
q.dpe_PPw9igMJGZtis22XWi7TPAeihe
cache-control
max-age=31536000
x-amz-cf-pop
FRA6-C1
accept-ranges
bytes
content-type
image/jpeg
x-amz-cf-id
zWTdlpAbLOVUwfrzB2ca-hOnSpaV7Nk1wZCtlvNJBJFpceffvCS4HQ==
expires
Wed, 17 Nov 2021 10:19:54 GMT
matomo.php
helpnetsecurity.matomo.cloud/ 		43 B
376 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://helpnetsecurity.matomo.cloud/matomo.php?action_name=Malware%20activity%20spikes%20128%25%2C%20Office%20document%20phishing%20skyrockets%20-%20Help%20Net%20Security&idsite=1&rec=1&r=618744&h=20&m=6&s=17&url=https%3A%2F%2Fwww.helpnetsecurity.com%2F2020%2F11%2F13%2Fmalware-activity-q3-2020%2F&urlref=https%3A%2F%2Ft.co%2Fr0PJD5t4sw&_id=&_idts=1605639978&_idvc=1&_idn=1&_refts=1605639978&_viewts=1605639978&_ref=https%3A%2F%2Ft.co%2Fr0PJD5t4sw&send_image=1&cookie=1&res=1600x1200&gt_ms=363&pv_id=ScHLCr
Requested by
Host: www.helpnetsecurity.com
URL: https://www.helpnetsecurity.com/2020/11/13/malware-activity-q3-2020/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.196.53.208 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Apache /
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Referer
https://www.helpnetsecurity.com/2020/11/13/malware-activity-q3-2020/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Tue, 17 Nov 2020 19:06:17 GMT
Content-Encoding
gzip
Server
Apache
Vary
X-Forwarded-Port-Override,X-Forwarded-Proto-Override,Accept-Encoding,User-Agent
Content-Type
image/gif
Cache-Control
no-store, max-age=31536000
Content-Length
50
Expires
Wed, 17 Nov 2021 19:06:17 GMT
1450275992_key-100x100.png
img.helpnetsecurity.com/wp-content/uploads/2015/12/09195727/ 		2 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://img.helpnetsecurity.com/wp-content/uploads/2015/12/09195727/1450275992_key-100x100.png
Requested by
Host: www.helpnetsecurity.com
URL: https://www.helpnetsecurity.com/2020/11/13/malware-activity-q3-2020/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
99.86.2.75 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
978b36ee204db17a725e4007a0c391adbe09b03c1703be68a0d1fe9420cc3fb7

Request headers

Referer
https://www.helpnetsecurity.com/2020/11/13/malware-activity-q3-2020/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 19 Oct 2020 08:23:28 GMT
via
1.1 6e432daa93321d42e8840614082fcdc3.cloudfront.net (CloudFront)
age
2544170
x-cache
Hit from cloudfront
status
200
content-length
2243
last-modified
Sat, 09 Nov 2019 19:01:54 GMT
server
AmazonS3
etag
"fa3716c74779d32c01ea5f5f5599df7a"
x-amz-version-id
sE8Fq0TPoxli3YBFdhCfrkUGmg7xWXHu
cache-control
max-age=31536000
x-amz-cf-pop
FRA6-C1
accept-ranges
bytes
content-type
image/png
x-amz-cf-id
xwFIpNtbLt5jvjRiK2Sl3GhhR52ctCSquwV4g6wxW6x1OgpGduX1-Q==
expires
Sun, 08 Nov 2020 18:57:27 GMT
identity-400x200.jpg
img.helpnetsecurity.com/wp-content/uploads/2018/10/09100001/ 		14 KB
15 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://img.helpnetsecurity.com/wp-content/uploads/2018/10/09100001/identity-400x200.jpg
Requested by
Host: www.helpnetsecurity.com
URL: https://www.helpnetsecurity.com/2020/11/13/malware-activity-q3-2020/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
99.86.2.75 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
8ee5c83abd8a534a9194a8cc41755d4ac122d3f531ab1ae344c86bb90ce5faa0

Request headers

Referer
https://www.helpnetsecurity.com/2020/11/13/malware-activity-q3-2020/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 17 Nov 2020 05:56:03 GMT
via
1.1 6e432daa93321d42e8840614082fcdc3.cloudfront.net (CloudFront)
age
47415
x-cache
Hit from cloudfront
status
200
content-length
14765
last-modified
Sat, 09 Nov 2019 09:04:29 GMT
server
AmazonS3
etag
"aa9c38e34f5a40c51f03a97e34fc0bac"
x-amz-version-id
R.cWvR2DEsFrq2OFSurn9NWgdK.cnWTb
cache-control
max-age=31536000
x-amz-cf-pop
FRA6-C1
accept-ranges
bytes
content-type
image/jpeg
x-amz-cf-id
0pksPLOPPOo_ha4bZmJfa7tWdUTWalDsU89fygSvY2Eyoxv8o-2IWA==
expires
Sun, 08 Nov 2020 09:00:01 GMT
prev.png
cdnjs.cloudflare.com/ajax/libs/lightbox2/2.11.3/images/ 		1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cdnjs.cloudflare.com/ajax/libs/lightbox2/2.11.3/images/prev.png
Requested by
Host: cdnjs.cloudflare.com
URL: https://cdnjs.cloudflare.com/ajax/libs/lightbox2/2.11.3/css/lightbox.min.css?ver=2.11.3
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:135e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
7fd9273f20fdb1229c224341271a119020a5eee74ccf6b4605730917c864caf2
Security Headers
Name Value
Strict-Transport-Security max-age=15780000

Request headers

Referer
https://cdnjs.cloudflare.com/ajax/libs/lightbox2/2.11.3/css/lightbox.min.css?ver=2.11.3
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 17 Nov 2020 19:06:17 GMT
content-encoding
br
vary
Accept-Encoding
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
1182630
x-via
cfworker/kv
status
200
content-length
1359
cf-request-id
067932d38000002bb9e2313000000001
timing-allow-origin
*
last-modified
Sat, 11 Jul 2020 03:47:52 GMT
server
cloudflare
etag
"5f093668-550"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15780000
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=5J5%2BVBaFkgfIi4E7PQ7oLAW3e9%2FbA1tEj7IgYlW%2FWMrezeHPO5DsufZutJpujTceW6SHT%2BapNDcWU5nPR4rifdAHQwWd7FLwE%2FM3AbDpfZiMN9UZhRmGdCI7cuevbGf0PA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=30672000
accept-ranges
bytes
cf-ray
5f3bba6598992bb9-FRA
expires
Sun, 07 Nov 2021 19:06:17 GMT
next.png
cdnjs.cloudflare.com/ajax/libs/lightbox2/2.11.3/images/ 		1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cdnjs.cloudflare.com/ajax/libs/lightbox2/2.11.3/images/next.png
Requested by
Host: cdnjs.cloudflare.com
URL: https://cdnjs.cloudflare.com/ajax/libs/lightbox2/2.11.3/css/lightbox.min.css?ver=2.11.3
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:135e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
15b869b02c6fbaa8c6c26445a2dd2d9bad80fd27b1409f8179e5dd89dc89d90a
Security Headers
Name Value
Strict-Transport-Security max-age=15780000

Request headers

Referer
https://cdnjs.cloudflare.com/ajax/libs/lightbox2/2.11.3/css/lightbox.min.css?ver=2.11.3
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 17 Nov 2020 19:06:17 GMT
content-encoding
br
vary
Accept-Encoding
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
1079904
x-via
cfworker/kv
status
200
content-length
1351
cf-request-id
067932d38000002bb9e93f8000000001
timing-allow-origin
*
last-modified
Sat, 11 Jul 2020 03:47:52 GMT
server
cloudflare
etag
"5f093668-546"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15780000
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=fSbbCaXKbtQoXMxdUGKsEMzRhGQot6EySbFhJt0sqzBNCD5BSnaMBTm68ufuIrEYF6aupyQn6T1in2OHZmABszPV6hvF14FwRf0czIy09ot51qJXI%2F59G1Sr%2FPhDPGtAyQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=30672000
accept-ranges
bytes
cf-ray
5f3bba65989d2bb9-FRA
expires
Sun, 07 Nov 2021 19:06:17 GMT
loading.gif
cdnjs.cloudflare.com/ajax/libs/lightbox2/2.11.3/images/ 		8 KB
8 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cdnjs.cloudflare.com/ajax/libs/lightbox2/2.11.3/images/loading.gif
Requested by
Host: cdnjs.cloudflare.com
URL: https://cdnjs.cloudflare.com/ajax/libs/lightbox2/2.11.3/css/lightbox.min.css?ver=2.11.3
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:135e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
225aa88b6ab02c06222ec9468d62e15fa188e39cdb9431d1f55401ad380753ed
Security Headers
Name Value
Strict-Transport-Security max-age=15780000

Request headers

Referer
https://cdnjs.cloudflare.com/ajax/libs/lightbox2/2.11.3/css/lightbox.min.css?ver=2.11.3
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 17 Nov 2020 19:06:17 GMT
content-encoding
br
vary
Accept-Encoding
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
923550
x-via
cfworker/kv
status
200
content-length
7695
cf-request-id
067932d38000002bb99c3b6000000001
timing-allow-origin
*
last-modified
Sat, 11 Jul 2020 03:47:52 GMT
server
cloudflare
etag
"5f093668-211c"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15780000
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=XTSVRvRsZuBFkX8W7%2BY%2FGwdXc3yvSvdI8D2fJ6c%2FC1prdlWbNajKCo3NygRANRXllBKWvis9lU%2BHeXLN%2BYl1vbjGh5W0za4tCqz7W6MLBggb1fjUIOgmG9bjCfMCsSilyg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/gif; charset=utf-8
cache-control
public, max-age=30672000
accept-ranges
bytes
cf-ray
5f3bba6598a02bb9-FRA
expires
Sun, 07 Nov 2021 19:06:17 GMT
close.png
cdnjs.cloudflare.com/ajax/libs/lightbox2/2.11.3/images/ 		280 B
627 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cdnjs.cloudflare.com/ajax/libs/lightbox2/2.11.3/images/close.png
Requested by
Host: cdnjs.cloudflare.com
URL: https://cdnjs.cloudflare.com/ajax/libs/lightbox2/2.11.3/css/lightbox.min.css?ver=2.11.3
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:135e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5d62e6c90005bfb71f6abb440f9e4753681cb23bbd5e60477ab6f442d2f0e69c
Security Headers
Name Value
Strict-Transport-Security max-age=15780000

Request headers

Referer
https://cdnjs.cloudflare.com/ajax/libs/lightbox2/2.11.3/css/lightbox.min.css?ver=2.11.3
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 17 Nov 2020 19:06:17 GMT
content-encoding
br
vary
Accept-Encoding
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
905859
x-via
cfworker/kv
status
200
content-length
284
cf-request-id
067932d38100002bb9df36e000000001
timing-allow-origin
*
last-modified
Sat, 11 Jul 2020 03:47:52 GMT
server
cloudflare
etag
"5f093668-118"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15780000
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=NNtA8OKmEnimbVsiYHJdIkClZ3BsUjQrTdWl%2Bti3SGhMIbeZS5qXtfwLaXBLnXVNA%2B6BO3UTIa4Q9uWFKZL6QWMWUpXh4k58H7tb%2BxR7%2BNp2WjYgo9sgdDeZrbR3yP27Ow%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=30672000
accept-ranges
bytes
cf-ray
5f3bba6598a42bb9-FRA
expires
Sun, 07 Nov 2021 19:06:17 GMT
truncated
/ 		43 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
image/gif
cobalt_m.png
img.helpnetsecurity.com/wp-content/uploads/2020/11/09144158/ 		111 KB
112 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://img.helpnetsecurity.com/wp-content/uploads/2020/11/09144158/cobalt_m.png
Requested by
Host: www.helpnetsecurity.com
URL: https://www.helpnetsecurity.com/2020/11/13/malware-activity-q3-2020/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
99.86.2.75 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
6c2a239b7e9c0f0f2fa1169a8e0ae13104d277ba18d0c3ba767ec892ec23857f

Request headers

Referer
https://www.helpnetsecurity.com/2020/11/13/malware-activity-q3-2020/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 17 Nov 2020 11:21:49 GMT
via
1.1 6e432daa93321d42e8840614082fcdc3.cloudfront.net (CloudFront)
age
27869
x-cache
Hit from cloudfront
status
200
content-length
113724
last-modified
Mon, 09 Nov 2020 13:41:59 GMT
server
AmazonS3
etag
"928ffead97ce1da7f84fbf9d821e3548"
x-amz-version-id
C7jGqp2pzNQuKc_veYNy9tJBj1qTkP8Y
cache-control
max-age=31536000
x-amz-cf-pop
FRA6-C1
accept-ranges
bytes
content-type
image/png
x-amz-cf-id
hBJcYkfl6oLmBQk8NnKqwf6N1YJ4GX7uUfrpdopMpdyxuKb8T0FekQ==
expires
Tue, 09 Nov 2021 13:41:58 GMT
hitb_re-paul_opt.png
img.helpnetsecurity.com/wp-content/uploads/2020/11/10152338/ 		103 KB
103 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://img.helpnetsecurity.com/wp-content/uploads/2020/11/10152338/hitb_re-paul_opt.png
Requested by
Host: www.helpnetsecurity.com
URL: https://www.helpnetsecurity.com/2020/11/13/malware-activity-q3-2020/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
99.86.2.75 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
2a6d10882994cb4fa23ee54997a9302c1d8e989d63792396f044935f2361dd18

Request headers

Referer
https://www.helpnetsecurity.com/2020/11/13/malware-activity-q3-2020/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 12 Nov 2020 14:21:25 GMT
via
1.1 6e432daa93321d42e8840614082fcdc3.cloudfront.net (CloudFront)
age
449093
x-cache
Hit from cloudfront
status
200
content-length
105374
last-modified
Tue, 10 Nov 2020 14:23:39 GMT
server
AmazonS3
etag
"5c90b257d2952b5ee8a37d9a4c2cbad0"
x-amz-version-id
qjilNLHU02bKoS8MBb0V63U7KGX.94Pa
cache-control
max-age=31536000
x-amz-cf-pop
FRA6-C1
accept-ranges
bytes
content-type
image/png
x-amz-cf-id
lSV7bx8VKq1RL4NYRu95vMiALUqDGGS2mVPb2z0bNSAm8kUpO9H7Bw==
expires
Wed, 10 Nov 2021 14:23:38 GMT
isc2year_cissp-l.jpg
img.helpnetsecurity.com/wp-content/uploads/2020/10/05132245/ 		52 KB
53 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://img.helpnetsecurity.com/wp-content/uploads/2020/10/05132245/isc2year_cissp-l.jpg
Requested by
Host: www.helpnetsecurity.com
URL: https://www.helpnetsecurity.com/2020/11/13/malware-activity-q3-2020/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
99.86.2.75 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
34c1b75454d0322afc75ff11ce0339b2e96a4910c82ef28b9c8d1a5effae0e41

Request headers

Referer
https://www.helpnetsecurity.com/2020/11/13/malware-activity-q3-2020/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 09 Nov 2020 14:18:40 GMT
via
1.1 6e432daa93321d42e8840614082fcdc3.cloudfront.net (CloudFront)
age
708458
x-cache
Hit from cloudfront
status
200
content-length
53373
last-modified
Mon, 05 Oct 2020 11:22:46 GMT
server
AmazonS3
etag
"6002c373c88dfcdbb527849358e0e088"
x-amz-version-id
ks8nBlO35Tea2nYbvU_wYKfuDeSgHjPZ
cache-control
max-age=31536000
x-amz-cf-pop
FRA6-C1
accept-ranges
bytes
content-type
image/jpeg
x-amz-cf-id
bcb85DLX_HLakF88iwH-q0ihaolxaHh2S5u6sSfJbu8Z3Lb_K88dAw==
expires
Tue, 05 Oct 2021 11:22:45 GMT
thief-100x100.jpg
img.helpnetsecurity.com/wp-content/uploads/2018/11/09095826/ 		4 KB
5 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://img.helpnetsecurity.com/wp-content/uploads/2018/11/09095826/thief-100x100.jpg
Requested by
Host: www.helpnetsecurity.com
URL: https://www.helpnetsecurity.com/wp-content/themes/hns20/dist/lib/js/lazysizes.min.js?ver=5.5.3
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
99.86.2.75 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
4c99b555cb8a98014cfe35f790886c3ef4678599335034b96febde9b5b4ce7dc

Request headers

Referer
https://www.helpnetsecurity.com/2020/11/13/malware-activity-q3-2020/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 17 Nov 2020 06:32:48 GMT
via
1.1 6e432daa93321d42e8840614082fcdc3.cloudfront.net (CloudFront)
age
45211
x-cache
Hit from cloudfront
status
200
content-length
4303
last-modified
Sat, 09 Nov 2019 09:02:52 GMT
server
AmazonS3
etag
"d4f55f3187405f3eb2e469291f8c2352"
x-amz-version-id
XrV9igrC3xu15_D33IvVrfWfUuRHBeDY
cache-control
max-age=31536000
x-amz-cf-pop
FRA6-C1
accept-ranges
bytes
content-type
image/jpeg
x-amz-cf-id
NMLuVm01Zu-wWbg1p8xF5uBljaNLfTbrb7rM75ez2W1GWQVRt7mHRQ==
expires
Sun, 08 Nov 2020 08:58:26 GMT
any-run-100x100.jpg
img.helpnetsecurity.com/wp-content/uploads/2020/11/17111953/ 		4 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://img.helpnetsecurity.com/wp-content/uploads/2020/11/17111953/any-run-100x100.jpg
Requested by
Host: www.helpnetsecurity.com
URL: https://www.helpnetsecurity.com/wp-content/themes/hns20/dist/lib/js/lazysizes.min.js?ver=5.5.3
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
99.86.2.75 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
4d86491ad5a7f3a12cb51e5b124cfe2822155e5bf82360decf1bcd9ffb82f757

Request headers

Referer
https://www.helpnetsecurity.com/2020/11/13/malware-activity-q3-2020/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 17 Nov 2020 10:34:33 GMT
via
1.1 6e432daa93321d42e8840614082fcdc3.cloudfront.net (CloudFront)
age
30706
x-cache
Hit from cloudfront
status
200
content-length
3899
last-modified
Tue, 17 Nov 2020 10:19:55 GMT
server
AmazonS3
etag
"16968beb5973f04372f5c6e33e1006c3"
x-amz-version-id
q.dpe_PPw9igMJGZtis22XWi7TPAeihe
cache-control
max-age=31536000
x-amz-cf-pop
FRA6-C1
accept-ranges
bytes
content-type
image/jpeg
x-amz-cf-id
fuRkcfU2LgMAUe6c-CYTfKNj5AvHYUb4hc54PQWBcgyX8Y6pvq4TLw==
expires
Wed, 17 Nov 2021 10:19:54 GMT
matomo.php
helpnetsecurity.matomo.cloud/ 		44 B
470 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://helpnetsecurity.matomo.cloud/matomo.php
Requested by
Host: cdn.matomo.cloud
URL: https://cdn.matomo.cloud/helpnetsecurity.matomo.cloud/matomo.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.196.53.208 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Apache /
Resource Hash
af036ddb924595bf99466df38e7537e02454e041b5f508c83b8dd0d44e7047a4

Request headers

Referer
https://www.helpnetsecurity.com/2020/11/13/malware-activity-q3-2020/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

Date
Tue, 17 Nov 2020 19:06:20 GMT
Content-Encoding
gzip
Server
Apache
Vary
X-Forwarded-Port-Override,X-Forwarded-Proto-Override,Accept-Encoding,User-Agent
Content-Type
application/json
Access-Control-Allow-Origin
https://www.helpnetsecurity.com
Cache-Control
max-age=691200
Access-Control-Allow-Credentials
true
Content-Length
62
Expires
Wed, 25 Nov 2020 19:06:20 GMT

Verdicts & Comments Add Verdict or Comment

23 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes undefined| $ function| jQuery object| _paq object| JSON_PIWIK object| Piwik object| Matomo object| AnalyticsTracker function| piwik_log object| lazySizes function| Popper object| bootstrap object| jQuery1124003051484975367713 object| lightbox object| e function| isBlockerActive function| getUserCountry function| onModalBoxReadyCountdown object| wp object| hnsMagicBoxes

1 Cookies

Domain/Path Name / Value
.helpnetsecurity.com/ Name: SSESS4decf0f010bae5a263354c26060a9ea3
Value: uupaqju7s5sfc3pjnu1ue8rkpb

1 Console Messages

Source Level URL
Text
console-api log URL: https://www.helpnetsecurity.com/2020/11/13/malware-activity-q3-2020/(Line 793)
Message:
[object Object],[object Object],[object Object]

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=0
X-Xss-Protection 0

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.jsdelivr.net
cdn.matomo.cloud
cdnjs.cloudflare.com
fonts.googleapis.com
fonts.gstatic.com
helpnetsecurity.matomo.cloud
img.helpnetsecurity.com
img2.helpnetsecurity.com
stackpath.bootstrapcdn.com
t.co
www.helpnetsecurity.com
104.244.42.69
18.196.53.208
2001:4de0:ac19::1:b:3b
2600:9000:2057:6800:c:7d55:b3c0:93a1
2606:4700::6810:135e
2a00:1450:4001:808::200a
2a00:1450:4001:80b::2003
2a04:4e42:1b::621
52.40.162.54
65.9.96.97
99.86.2.75
064005714ba5c313aae22c250fa2d70be1ff36a314598c591a9b2be436446812
0995371a359a4a701d66f8b183de6144de9a042e5bac84b6f920968f51567742
0d9fd7ccabde9b202de45ee6b65878ce9594975d8e8810b0878d3f3fa3637d0e
15b869b02c6fbaa8c6c26445a2dd2d9bad80fd27b1409f8179e5dd89dc89d90a
18b528527b6032b3510f50941de3acd9933fcb99964d6c47966380f42ac28f23
1d06d9c1d3f57c285e200e6190e890b73585de2e472b5a72016d643a9c30690e
1db21d816296e6939ba1f42962496e4134ae2b0081e26970864c40c6d02bb1df
225aa88b6ab02c06222ec9468d62e15fa188e39cdb9431d1f55401ad380753ed
2a6d10882994cb4fa23ee54997a9302c1d8e989d63792396f044935f2361dd18
34c1b75454d0322afc75ff11ce0339b2e96a4910c82ef28b9c8d1a5effae0e41
417f73552688f01697ef34fedfa43a0f0f33a6180860e9fef3e0ee8016dd97c2
4213dd1007ac1764c0fb6dd44e754cb1972de6eef93433e293f8b1f020226ed7
465cd839800ade38f127d512ea3e361c56e472f1977b1032d0794edd5c1fa0e4
4c99b555cb8a98014cfe35f790886c3ef4678599335034b96febde9b5b4ce7dc
4d0a8079bf1c328084ea4e2e6c543cd9f45f2b3503556a65df6e2382ef2e9138
4d86491ad5a7f3a12cb51e5b124cfe2822155e5bf82360decf1bcd9ffb82f757
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
5b0fbe5b7ad705f6a937c4998ad02f73d8f0d976fe231b74aef0ec996990c93a
5d1bc9b443f3f81fa4b4ad4634c1bb9702194c1898e3a9de0ab5e2cdc0e9f479
5d62e6c90005bfb71f6abb440f9e4753681cb23bbd5e60477ab6f442d2f0e69c
6c2a239b7e9c0f0f2fa1169a8e0ae13104d277ba18d0c3ba767ec892ec23857f
6ebcda7a3a41ef97f0b4071160ceb1020e540fdc0f790079a5c2ef01ab654fe0
78eea6c2cf09985bafc88446f1a8e78c97266faae5c8d1205958211831f0042c
79c599dd760cec0c1621a1af49d9a2a49da5d45e1b37d4575bace0a5e0226582
7fd9273f20fdb1229c224341271a119020a5eee74ccf6b4605730917c864caf2
8c626f0f9b5c109539b256b73e72c02b300a184f46b4535c2eb86599215c78af
8ee5c83abd8a534a9194a8cc41755d4ac122d3f531ab1ae344c86bb90ce5faa0
92606bd38901e67d069f2ef883715b6e5ae07d72ae3bead3ad92346528374afc
978b36ee204db17a725e4007a0c391adbe09b03c1703be68a0d1fe9420cc3fb7
af036ddb924595bf99466df38e7537e02454e041b5f508c83b8dd0d44e7047a4
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b41c65a254473fdb8cb0414a564fa193ffde90e9573a2c4b2afc9ee56d964797
b870340b8b7ac49a8fb8cd44b364d4bbae3b0a2c6802d940fdcb6d696703cbb3
c011d580928507688184324c0f7d2a2a6d40c744598b9ffded038984c67b0eb1
c776195ad46333c6c9a9fe3c74502ffea9a02faf122388ea3567922cc65a3060
e140f6c297fefa76cdc5c893bcfc14797bc69615d9887ffd81b00479d9bb2463
e4b727904102a785b90a224022a651ef9d1d2bccc309c12a2d00fe0d34397b33
fb649fcae62177dfe63e67081ddceb830b5ce1f05a4184e9bbb7d87ac4b8f4e5
ffb6d5b9f95c18e43980065f8471ec2bbfd7bdd36192716f9c49f1bd9fd20085