urlscan.io logo urlscan.io
SecurityTrails logo

www.cyberforum.ru Open in urlscan Pro
185.112.80.14  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://www.cyberforum.ru/viruses/thread1083273.html
Effective URL: http://www.cyberforum.ru/viruses/thread1083273.html
Submission: On November 22 via manual from RU
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 26 IPs in 7 countries across 21 domains to perform 116 HTTP transactions. The main IP is 185.112.80.14, located in Russian Federation and belongs to RUWEB, RU. The main domain is www.cyberforum.ru.
This is the only time www.cyberforum.ru was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 185.112.80.14 49189 (RUWEB)
28 93.171.221.121 49189 (RUWEB)
3 2a00:1450:400... 15169 (GOOGLE)
4 2606:4700:e2:... 13335 (CLOUDFLAR...)
1 3 2606:4700:30:... 13335 (CLOUDFLAR...)
1 176.32.179.2 24739 (SEVEREN-T...)
1 17 176.9.32.236 24940 (HETZNER-AS)
1 2a00:1450:400... 15169 (GOOGLE)
15 2a02:6b8:20::215 13238 (YANDEX)
1 10 2a02:6b8::90 13238 (YANDEX)
3 2a00:1450:400... 15169 (GOOGLE)
1 3 195.201.130.19 24940 (HETZNER-AS)
1 2a04:4e42:3::621 54113 (FASTLY)
1 5 2a00:1450:400... 15169 (GOOGLE)
3 3 104.111.214.74 16625 (AKAMAI-AS)
2 23.45.102.209 20940 (AKAMAI-ASN1)
1 2 88.212.201.216 39134 (UNITEDNET)
1 13 2a02:6b8::1:119 13238 (YANDEX)
2 3 2a00:1450:400... 15169 (GOOGLE)
1 2 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
1 195.24.73.119 5577 (ROOT)
1 2 23.45.236.130 20940 (AKAMAI-ASN1)
4 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
116 26
1    185.112.80.14 (Russian Federation)

ASN49189 (RUWEB, RU)
PTR: cyber.deserv.net
www.cyberforum.ru
28    93.171.221.121 (Russian Federation)

ASN49189 (RUWEB, RU)
PTR: mensa.deserv.net
cyberstatic.net
3    2a00:1450:4001:81b::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)
ajax.googleapis.com
4    2606:4700:e2::ac40:8c25 (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
aliadvert.ru
3    2606:4700:30::681c:1eba (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
nohope.ru
1    176.32.179.2 (St Petersburg, Russian Federation)

ASN24739 (SEVEREN-TELECOM St.Petersburg, Russia, RU)
video.market-place.su
17    176.9.32.236 (Germany)

ASN24940 (HETZNER-AS, DE)
PTR: static.236.32.9.176.clients.your-server.de
s.frolvid.ru
frolvid.ru
1    2a00:1450:4001:808::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)
www.googletagmanager.com
15    2a02:6b8:20::215 (Russian Federation)

ASN13238 (YANDEX, RU)
yastatic.net
site.yandex.net
10    2a02:6b8::90 (Moscow, Russian Federation)

ASN13238 (YANDEX, RU)
an.yandex.ru
3    2a00:1450:4001:814::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)
cse.google.com
clients1.google.com
3    195.201.130.19 (Germany)

ASN24940 (HETZNER-AS, DE)
PTR: static.19.130.201.195.clients.your-server.de
cdn.4736.in
4736.in
1    2a04:4e42:3::621 (Ascension Island)

ASN54113 (FASTLY - Fastly, US)
cdn.jsdelivr.net
5    2a00:1450:4001:818::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)
www.google.com
3    104.111.214.74 (Netherlands)

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a104-111-214-74.deploy.static.akamaitechnologies.com
s.click.aliexpress.com
2    23.45.102.209 (Netherlands)

ASN20940 (AKAMAI-ASN1, US)
PTR: a23-45-102-209.deploy.static.akamaitechnologies.com
ru.aliexpress.com
2    88.212.201.216 (Russian Federation)

ASN39134 (UNITEDNET, RU)
PTR: host216.rax.ru
counter.yadro.ru
13    2a02:6b8::1:119 (Moscow, Russian Federation)

ASN13238 (YANDEX, RU)
mc.yandex.ru
3    2a00:1450:4001:81b::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)
www.google-analytics.com
2    2a00:1450:400c:c08::9b (Brussels, Belgium)

ASN15169 (GOOGLE - Google LLC, US)
stats.g.doubleclick.net
1    2a00:1450:4001:806::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)
www.google.de
1    195.24.73.119 (Luxembourg)

ASN5577 (ROOT, LU)
PTR: ip-static-195-24-73-119.server.lu
epnclick.ru
2    23.45.236.130 (United States)

ASN20940 (AKAMAI-ASN1, US)
PTR: a23-45-236-130.deploy.static.akamaitechnologies.com
sale.aliexpress.com
4    2a00:1450:4001:816::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)
imasdk.googleapis.com
1    2a00:1450:4001:800::2006 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)
s0.2mdn.net
1    2a00:1450:4001:81d::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)
adservice.google.com
Domain Requested by
28 cyberstatic.net www.cyberforum.ru
15 s.frolvid.ru 1 redirects www.cyberforum.ru
s.frolvid.ru
13 mc.yandex.ru 1 redirects www.cyberforum.ru
yastatic.net
mc.yandex.ru
10 an.yandex.ru 1 redirects www.cyberforum.ru
an.yandex.ru
10 yastatic.net www.cyberforum.ru
site.yandex.net
an.yandex.ru
yastatic.net
5 www.google.com 1 redirects cse.google.com
www.cyberforum.ru
5 site.yandex.net www.cyberforum.ru
site.yandex.net
4 imasdk.googleapis.com s.frolvid.ru
imasdk.googleapis.com
4 aliadvert.ru www.cyberforum.ru
aliadvert.ru
3 www.google-analytics.com 2 redirects cdn.jsdelivr.net
3 s.click.aliexpress.com 3 redirects
3 nohope.ru 1 redirects www.cyberforum.ru
3 ajax.googleapis.com www.cyberforum.ru
2 frolvid.ru s.frolvid.ru
2 sale.aliexpress.com 1 redirects www.cyberforum.ru
2 stats.g.doubleclick.net 1 redirects www.cyberforum.ru
2 4736.in cdn.jsdelivr.net
www.cyberforum.ru
2 counter.yadro.ru 1 redirects www.cyberforum.ru
2 ru.aliexpress.com www.cyberforum.ru
2 cse.google.com www.cyberforum.ru
www.google.com
1 adservice.google.com imasdk.googleapis.com
1 s0.2mdn.net imasdk.googleapis.com
1 epnclick.ru aliadvert.ru
1 www.google.de www.cyberforum.ru
1 clients1.google.com www.cyberforum.ru
1 cdn.jsdelivr.net www.cyberforum.ru
1 cdn.4736.in 1 redirects
1 www.googletagmanager.com www.cyberforum.ru
1 video.market-place.su www.cyberforum.ru
1 www.cyberforum.ru
116 30
Subject Issuer Validity Valid
sni.cloudflaressl.com
CloudFlare Inc ECC CA-2		 2019-10-28 -
2020-10-09		 a year crt.sh
s.frolvid.ru
Let's Encrypt Authority X3		 2019-10-14 -
2020-01-12		 3 months crt.sh
*.google-analytics.com
GTS CA 1O1		 2019-11-05 -
2020-01-28		 3 months crt.sh
*.google.com
GTS CA 1O1		 2019-11-05 -
2020-01-28		 3 months crt.sh
f3.shared.global.fastly.net
GlobalSign CloudSSL CA - SHA256 - G3		 2019-05-29 -
2020-04-23		 a year crt.sh
www.google.com
GTS CA 1O1		 2019-11-05 -
2020-01-28		 3 months crt.sh
ru.aliexpress.com
DigiCert SHA2 Secure Server CA		 2019-07-03 -
2020-05-27		 a year crt.sh
static.yandex.net
Yandex CA		 2019-09-06 -
2020-09-05		 a year crt.sh
bs.yandex.ru
Yandex CA		 2019-09-24 -
2020-09-23		 a year crt.sh
mc.yandex.ru
Yandex CA		 2019-09-23 -
2020-09-22		 a year crt.sh
4736.in
Let's Encrypt Authority X3		 2019-09-24 -
2019-12-23		 3 months crt.sh
*.g.doubleclick.net
GTS CA 1O1		 2019-11-05 -
2020-01-28		 3 months crt.sh
www.google.de
GTS CA 1O1		 2019-11-05 -
2020-01-28		 3 months crt.sh
*.epnclick.ru
Let's Encrypt Authority X3		 2019-11-19 -
2020-02-17		 3 months crt.sh
ae01.alicdn.com
DigiCert SHA2 Secure Server CA		 2019-05-18 -
2020-08-16		 a year crt.sh
frolvid.ru
Let's Encrypt Authority X3		 2019-10-14 -
2020-01-12		 3 months crt.sh
*.googleapis.com
GTS CA 1O1		 2019-11-05 -
2020-01-28		 3 months crt.sh
*.doubleclick.net
GTS CA 1O1		 2019-11-05 -
2020-01-28		 3 months crt.sh

This page contains 14 frames:

Primary Page: http://www.cyberforum.ru/viruses/thread1083273.html
Frame ID: 7F946900776158EFB52C6F140F8F679B
Requests: 110 HTTP requests in this frame

Frame: https://ru.aliexpress.com/?dp=ru_cforum&aff_platform=link-c-tool&cpt=1574422770657&sk=Cvg22nO0&aff_trace_key=720095bda6af42a5a880f2a707be66d6-1574422770657-01119-Cvg22nO0&terminal_id=33cd002f02b843b6976af3ff12ac7cde
Frame ID: 6D0800744A8556BDCD4C29A8CD681A8D
Requests: 1 HTTP requests in this frame

Frame: https://4736.in/sync-iframe/
Frame ID: CAB6ECD901A459F7B64751F915B359B2
Requests: 1 HTTP requests in this frame

Frame: https://epnclick.ru/redirect/cpa/o/psmm3rf4havca49b2h5036s1vs0olsny/?sub=cyberforumru&sub1=cyberforumru&af_sub=245&click_id=658867&sub2=28
Frame ID: 6674215E27925FF6C93CF56390536CB8
Requests: 1 HTTP requests in this frame

Frame: https://yastatic.net/safeframe-bundles/0.69/1-1-0/render.html
Frame ID: 8F5742022417E2B9A89EF8DB5D6A352D
Requests: 1 HTTP requests in this frame

Frame: https://yastatic.net/safeframe-bundles/0.69/1-1-0/render.html
Frame ID: D8CF66EDBA0966329E6225FEF01E8DCA
Requests: 1 HTTP requests in this frame

Frame: https://yastatic.net/safeframe-bundles/0.69/1-1-0/render.html
Frame ID: 9FAB49CB212E9E4D99ACFFFB80C5AE56
Requests: 1 HTTP requests in this frame

Frame: https://yastatic.net/safeframe-bundles/0.69/1-1-0/render.html
Frame ID: 2EB420EA28A27436B479DBEB8F11F911
Requests: 1 HTTP requests in this frame

Frame: https://yastatic.net/safeframe-bundles/0.69/1-1-0/render.html
Frame ID: 452626B3C29ED1D30A6D1D82A167642D
Requests: 1 HTTP requests in this frame

Frame: https://yastatic.net/safeframe-bundles/0.69/1-1-0/render.html
Frame ID: D8CA350D12FA94BB87265CC60BE85397
Requests: 1 HTTP requests in this frame

Frame: http://imasdk.googleapis.com/js/core/bridge3.353.0_en.html
Frame ID: 63BADB0317F3AA1890B77ACB89D62E13
Requests: 1 HTTP requests in this frame

Frame: http://imasdk.googleapis.com/js/core/bridge3.353.0_en.html
Frame ID: 43661F9834FC7790AAD55D7FCA7019A6
Requests: 1 HTTP requests in this frame

Frame: http://imasdk.googleapis.com/js/core/bridge3.353.0_en.html
Frame ID: 63F6678147404AB79ABBE579CDB95E4C
Requests: 1 HTTP requests in this frame

Frame: https://ru.aliexpress.com/?dp=ru_cforum&aff_platform=link-c-tool&cpt=1574422782140&sk=Cvg22nO0&aff_trace_key=b717ce2a51bf4c19b207d76f9fd7c535-1574422782140-00022-Cvg22nO0&terminal_id=9aaf87f7803b48619390b9ea1d91562e
Frame ID: 0B41033B51E860E0714C70FAF71F7165
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Detected technologies

Overall confidence: 100%
Detected patterns
  • script /2mdn\.net/i
Overall confidence: 100%
Detected patterns
  • script /2mdn\.net/i
Overall confidence: 100%
Detected patterns
  • script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i
Overall confidence: 100%
Detected patterns
  • script /(?:\/yui\/|yui\.yahooapis\.com)/i
Overall confidence: 100%
Detected patterns
  • script /https?:\/\/an\.yandex\.ru\//i
Overall confidence: 100%
Detected patterns
  • script /\/([\d.]+)\/jquery(?:\.min)?\.js/i
  • script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

116
Requests

60 %
HTTPS

62 %
IPv6

21
Domains

30
Subdomains

26
IPs

7
Countries

1362 kB
Transfer

4223 kB
Size

32
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 25
  • https://nohope.ru/a HTTP 302
  • https://nohope.ru/reklama/2019/cyberforumru/banner/80000k/exe.php?size=970x250&dp=cforum
Request Chain 27
  • http://s.frolvid.ru/static/dist/fly.js HTTP 301
  • https://s.frolvid.ru/static/dist/fly.js
Request Chain 40
  • https://cdn.4736.in/js/contentroll.js HTTP 302
  • https://cdn.jsdelivr.net/npm/cdn4script@1.1.210/dist/codes/croll2.js
Request Chain 45
  • https://s.click.aliexpress.com/e/Cvg22nO0?dp=ru_cforum HTTP 302
  • https://ru.aliexpress.com/?dp=ru_cforum&aff_platform=link-c-tool&cpt=1574422770657&sk=Cvg22nO0&aff_trace_key=720095bda6af42a5a880f2a707be66d6-1574422770657-01119-Cvg22nO0&terminal_id=33cd002f02b843b6976af3ff12ac7cde
Request Chain 49
  • http://counter.yadro.ru/hit?t12.2;r;s1600*1200*24;uhttp%3A//www.cyberforum.ru/viruses/thread1083273.html;h%u043F%u043E%u0434%u043E%u0437%u0440%u0435%u043D%u0438%u0435%20%u043D%u0430%20Trojan%20%2C%u043F%u043E%u0434%u043E%u0437%u0440%u0435%u043D%u0438%u0435%20%u043D%u0430%20Exploit.Win32.IH_Infector.12%20%u0438%20%u041C%u0430%u0441%u043A%u0438%u0440%u043E%u0432%u043A%u0430%20%u043F%u0440;0.5818091402964503 HTTP 302
  • http://counter.yadro.ru/hit?q;t12.2;r;s1600*1200*24;uhttp%3A//www.cyberforum.ru/viruses/thread1083273.html;h%u043F%u043E%u0434%u043E%u0437%u0440%u0435%u043D%u0438%u0435%20%u043D%u0430%20Trojan%20%2C%u043F%u043E%u0434%u043E%u0437%u0440%u0435%u043D%u0438%u0435%20%u043D%u0430%20Exploit.Win32.IH_Infector.12%20%u0438%20%u041C%u0430%u0441%u043A%u0438%u0440%u043E%u0432%u043A%u0430%20%u043F%u0440;0.5818091402964503
Request Chain 62
  • https://www.google-analytics.com/r/collect?v=1&_v=j79&a=1811489031&t=pageview&_s=1&dl=http%3A%2F%2Fwww.cyberforum.ru%2Fviruses%2Fthread1083273.html&ul=en-us&de=UTF-8&dt=%D0%BF%D0%BE%D0%B4%D0%BE%D0%B7%D1%80%D0%B5%D0%BD%D0%B8%D0%B5%20%D0%BD%D0%B0%20Trojan%20%2C%D0%BF%D0%BE%D0%B4%D0%BE%D0%B7%D1%80%D0%B5%D0%BD%D0%B8%D0%B5%20%D0%BD%D0%B0%20Exploit.Win32.IH_Infector.12%20%D0%B8%20%D0%9C%D0%B0%D1%81%D0%BA%D0%B8%D1%80%D0%BE%D0%B2%D0%BA%D0%B0%20%D0%BF%D1%80%D0%BE%D1%86%D0%B5%D1%81%D1%81%D0%B0%20-%20%D0%A3%D0%B4%D0%B0%D0%BB%D0%B5%D0%BD%D0%B8%D0%B5%20%D0%B2%D0%B8%D1%80%D1%83%D1%81%D0%BE%D0%B2%20-%20%D0%9A%D0%B8%D0%B1%D0%B5%D1%80%D1%84%D0%BE%D1%80%D1%83%D0%BC&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&_u=IEBAAEAB~&jid=1283257664&gjid=1471484640&cid=1743422902.1574422771&tid=UA-109426955-32&_gid=264877262.1574422771&_r=1&z=1611292114 HTTP 302
  • https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-109426955-32&cid=1743422902.1574422771&jid=1283257664&_gid=264877262.1574422771&gjid=1471484640&_v=j79&z=1611292114
Request Chain 63
  • https://www.google-analytics.com/r/collect?v=1&_v=j79&a=1811489031&t=pageview&_s=1&dl=http%3A%2F%2Fwww.cyberforum.ru%2Fviruses%2Fthread1083273.html&ul=en-us&de=UTF-8&dt=%D0%BF%D0%BE%D0%B4%D0%BE%D0%B7%D1%80%D0%B5%D0%BD%D0%B8%D0%B5%20%D0%BD%D0%B0%20Trojan%20%2C%D0%BF%D0%BE%D0%B4%D0%BE%D0%B7%D1%80%D0%B5%D0%BD%D0%B8%D0%B5%20%D0%BD%D0%B0%20Exploit.Win32.IH_Infector.12%20%D0%B8%20%D0%9C%D0%B0%D1%81%D0%BA%D0%B8%D1%80%D0%BE%D0%B2%D0%BA%D0%B0%20%D0%BF%D1%80%D0%BE%D1%86%D0%B5%D1%81%D1%81%D0%B0%20-%20%D0%A3%D0%B4%D0%B0%D0%BB%D0%B5%D0%BD%D0%B8%D0%B5%20%D0%B2%D0%B8%D1%80%D1%83%D1%81%D0%BE%D0%B2%20-%20%D0%9A%D0%B8%D0%B1%D0%B5%D1%80%D1%84%D0%BE%D1%80%D1%83%D0%BC&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&_u=IEDAAUAB~&jid=416891654&gjid=220206980&cid=1743422902.1574422771&tid=UA-595018-2&_gid=264877262.1574422771&_r=1&gtm=2ouav9&z=1342028841 HTTP 302
  • https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-595018-2&cid=1743422902.1574422771&jid=416891654&_gid=264877262.1574422771&gjid=220206980&_v=j79&z=1342028841 HTTP 302
  • https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-595018-2&cid=1743422902.1574422771&jid=416891654&_v=j79&z=1342028841 HTTP 302
  • https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-595018-2&cid=1743422902.1574422771&jid=416891654&_v=j79&z=1342028841&slf_rd=1&random=2052656658
Request Chain 73
  • https://s.click.aliexpress.com/e/DziQooLW?dp=cyberforumru HTTP 302
  • https://sale.aliexpress.com/aff_new_user.htm?lan=en&tmLog=best_to_affi_new_v2_4860&dp=cyberforumru&aff_platform=link-c-tool&cpt=1574422770820&sk=DziQooLW&aff_trace_key=cf4a9ce4b0b2497a912ffa46458787f0-1574422770820-04791-DziQooLW&terminal_id=740406f87d5d4ed1841b3d829353104e HTTP 302
  • https://sale.aliexpress.com/__pc/aff_new_user.htm?lan=en&tmLog=best_to_affi_new_v2_4860&dp=cyberforumru&aff_platform=link-c-tool&cpt=1574422770820&sk=DziQooLW&aff_trace_key=cf4a9ce4b0b2497a912ffa46458787f0-1574422770820-04791-DziQooLW&terminal_id=740406f87d5d4ed1841b3d829353104e
Request Chain 75
  • https://an.yandex.ru/meta/29317?grab=dNC_0L7QtNC-0LfRgNC10L3QuNC1INC90LAgVHJvamFuICzQv9C-0LTQvtC30YDQtdC90LjQtSDQvdCwIEV4cGxvaXQuV2luMzIuSUhfSW5mZWN0b3IuMTIg0Lgg0JzQsNGB0LrQuNGA0L7QstC60LAg0L_RgNC-0YbQtdGB0YHQsCAtINCj0LTQsNC70LXQvdC40LUg0LLQuNGA0YPRgdC-0LIgLSDQmtC40LHQtdGA0YTQvtGA0YPQvAox0L_QvtC00L7Qt9GA0LXQvdC40LUg0L3QsCBUcm9qYW4gLNC_0L7QtNC-0LfRgNC10L3QuNC1INC90LAgRXhwbG9pdC5XaW4zMi5JSF9JbmZlY3Rvci4xMiDQuCDQnNCw0YHQutC40YDQvtCy0LrQsCDQv9GA0L7RhtC10YHRgdCwIAo%3D&target-ref=http%3A%2F%2Fwww.cyberforum.ru%2Fviruses%2Fthread1083273.html&charset=utf-8&imp-id=1&enable-flat-highlight=1&test-tag=337550069727234&ad-session-id=3386441574422770509&target-id=17181348&pcode-version=9830&flash-ver=0&layout-config=%7B%22win_width%22%3A1600%2C%22win_height%22%3A1200%2C%22width%22%3A0%2C%22height%22%3A0%2C%22left%22%3A793%2C%22top%22%3A122%2C%22visible%22%3A1%2C%22ad_no%22%3A0%2C%22req_no%22%3A0%7D&callback=Ya%5B2755144854384%5D HTTP 302
  • https://an.yandex.ru/meta/29317?redir-setuniq=1&grab=dNC_0L7QtNC-0LfRgNC10L3QuNC1INC90LAgVHJvamFuICzQv9C-0LTQvtC30YDQtdC90LjQtSDQvdCwIEV4cGxvaXQuV2luMzIuSUhfSW5mZWN0b3IuMTIg0Lgg0JzQsNGB0LrQuNGA0L7QstC60LAg0L_RgNC-0YbQtdGB0YHQsCAtINCj0LTQsNC70LXQvdC40LUg0LLQuNGA0YPRgdC-0LIgLSDQmtC40LHQtdGA0YTQvtGA0YPQvAox0L_QvtC00L7Qt9GA0LXQvdC40LUg0L3QsCBUcm9qYW4gLNC_0L7QtNC-0LfRgNC10L3QuNC1INC90LAgRXhwbG9pdC5XaW4zMi5JSF9JbmZlY3Rvci4xMiDQuCDQnNCw0YHQutC40YDQvtCy0LrQsCDQv9GA0L7RhtC10YHRgdCwIAo%3D&target-ref=http%3A%2F%2Fwww.cyberforum.ru%2Fviruses%2Fthread1083273.html&charset=utf-8&imp-id=1&enable-flat-highlight=1&test-tag=337550069727234&ad-session-id=3386441574422770509&target-id=17181348&pcode-version=9830&flash-ver=0&layout-config=%7B%22win_width%22%3A1600%2C%22win_height%22%3A1200%2C%22width%22%3A0%2C%22height%22%3A0%2C%22left%22%3A793%2C%22top%22%3A122%2C%22visible%22%3A1%2C%22ad_no%22%3A0%2C%22req_no%22%3A0%7D&callback=Ya%5B2755144854384%5D
Request Chain 76
  • https://mc.yandex.ru/watch/26812653?wmode=7&page-url=http%3A%2F%2Fwww.cyberforum.ru%2Fviruses%2Fthread1083273.html&charset=utf-8&site-info=%7B%22jquery%22%3Atrue%2C%22version%22%3A%222.2.4%22%2C%22shareVersion%22%3A2%7D&browser-info=ti%3A10%3Ans%3A1574422769473%3As%3A1600x1200x24%3Ask%3A1%3Ahdl%3A1%3Afpr%3A216613626101%3Acn%3A1%3Aw%3A1585x1200%3Az%3A60%3Ai%3A20191122123930%3Aet%3A1574422771%3Aen%3Autf-8%3Ac%3A1%3Ala%3Aen-us%3Apv%3A1%3Arn%3A470496104%3Ahid%3A125359108%3Ads%3A1%2C18%2C513%2C47%2C1%2C0%2C0%2C560%2C22%2C%2C%2C%2C1100%3Afp%3A834%3Agdpr%3A14%3Av%3A1744%3Ast%3A1574422771%3Au%3A1574422771233816621%3At%3A%D0%BF%D0%BE%D0%B4%D0%BE%D0%B7%D1%80%D0%B5%D0%BD%D0%B8%D0%B5%20%D0%BD%D0%B0%20Trojan%20%2C%D0%BF%D0%BE%D0%B4%D0%BE%D0%B7%D1%80%D0%B5%D0%BD%D0%B8%D0%B5%20%D0%BD%D0%B0%20Exploit.Win32.IH_Infector.12%20%D0%B8%20%D0%9C%D0%B0%D1%81%D0%BA%D0%B8%D1%80%D0%BE%D0%B2%D0%BA%D0%B0%20%D0%BF%D1%80%D0%BE%D1%86%D0%B5%D1%81%D1%81%D0%B0%20-%20%D0%A3%D0%B4%D0%B0%D0%BB%D0%B5%D0%BD%D0%B8%D0%B5%20%D0%B2%D0%B8%D1%80%D1%83%D1%81%D0%BE%D0%B2%20-%20%D0%9A%D0%B8%D0%B1%D0%B5%D1%80%D1%84%D0%BE%D1%80%D1%83%D0%BC HTTP 302
  • https://mc.yandex.ru/watch/26812653/1?wmode=7&page-url=http%3A%2F%2Fwww.cyberforum.ru%2Fviruses%2Fthread1083273.html&charset=utf-8&site-info=%7B%22jquery%22%3Atrue%2C%22version%22%3A%222.2.4%22%2C%22shareVersion%22%3A2%7D&browser-info=ti%3A10%3Ans%3A1574422769473%3As%3A1600x1200x24%3Ask%3A1%3Ahdl%3A1%3Afpr%3A216613626101%3Acn%3A1%3Aw%3A1585x1200%3Az%3A60%3Ai%3A20191122123930%3Aet%3A1574422771%3Aen%3Autf-8%3Ac%3A1%3Ala%3Aen-us%3Apv%3A1%3Arn%3A470496104%3Ahid%3A125359108%3Ads%3A1%2C18%2C513%2C47%2C1%2C0%2C0%2C560%2C22%2C%2C%2C%2C1100%3Afp%3A834%3Agdpr%3A14%3Av%3A1744%3Ast%3A1574422771%3Au%3A1574422771233816621%3At%3A%D0%BF%D0%BE%D0%B4%D0%BE%D0%B7%D1%80%D0%B5%D0%BD%D0%B8%D0%B5%20%D0%BD%D0%B0%20Trojan%20%2C%D0%BF%D0%BE%D0%B4%D0%BE%D0%B7%D1%80%D0%B5%D0%BD%D0%B8%D0%B5%20%D0%BD%D0%B0%20Exploit.Win32.IH_Infector.12%20%D0%B8%20%D0%9C%D0%B0%D1%81%D0%BA%D0%B8%D1%80%D0%BE%D0%B2%D0%BA%D0%B0%20%D0%BF%D1%80%D0%BE%D1%86%D0%B5%D1%81%D1%81%D0%B0%20-%20%D0%A3%D0%B4%D0%B0%D0%BB%D0%B5%D0%BD%D0%B8%D0%B5%20%D0%B2%D0%B8%D1%80%D1%83%D1%81%D0%BE%D0%B2%20-%20%D0%9A%D0%B8%D0%B1%D0%B5%D1%80%D1%84%D0%BE%D1%80%D1%83%D0%BC
Request Chain 121
  • https://s.click.aliexpress.com/e/Cvg22nO0?dp=ru_cforum HTTP 302
  • https://ru.aliexpress.com/?dp=ru_cforum&aff_platform=link-c-tool&cpt=1574422782140&sk=Cvg22nO0&aff_trace_key=b717ce2a51bf4c19b207d76f9fd7c535-1574422782140-00022-Cvg22nO0&terminal_id=9aaf87f7803b48619390b9ea1d91562e

116 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request Cookie set thread1083273.html
www.cyberforum.ru/viruses/ 		86 KB
18 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://www.cyberforum.ru/viruses/thread1083273.html
Protocol
HTTP/1.1
Server
185.112.80.14 , Russian Federation, ASN49189 (RUWEB, RU),
Reverse DNS
cyber.deserv.net
Software
ngjit /
Resource Hash
3df5aac1c3aa2796cc74184a49609bb0b7a4fd8c5b585db9cde197e9abe004cc
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

Host
www.cyberforum.ru
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Server
ngjit
Connection
keep-alive
Keep-Alive
timeout=60
Set-Cookie
__ddg1=E7200A639E3249414C009773E75157D3B629AEA4; Domain=.cyberforum.ru; HttpOnly; Path=/; Max-Age=31536000 cforig_cookieuser=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/ cfsessionhash=19002155852f83ced42bcb271f888aaf; path=/; HttpOnly cflastvisit=1574422769; expires=Sat, 21-Nov-2020 11:39:29 GMT; Max-Age=31536000; path=/ cflastactivity=0; expires=Sat, 21-Nov-2020 11:39:29 GMT; Max-Age=31536000; path=/ vbseo_loggedin=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/
Date
Fri, 22 Nov 2019 11:39:29 GMT
Content-Type
text/html; charset=utf-8
Cache-Control
private
Pragma
private
X-Frame-Options
SAMEORIGIN
Content-Encoding
gzip
Transfer-Encoding
chunked
cyberforum.css
cyberstatic.net/clientscript/vbulletin_css/ 		14 KB
3 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://cyberstatic.net/clientscript/vbulletin_css/cyberforum.css
Requested by
Host: www.cyberforum.ru
URL: http://www.cyberforum.ru/viruses/thread1083273.html
Protocol
HTTP/1.1
Server
93.171.221.121 , Russian Federation, ASN49189 (RUWEB, RU),
Reverse DNS
mensa.deserv.net
Software
nginx /
Resource Hash
c602a1d1e40c7d55e25c97d867e6dc6d6dff1be6b6bb0607100158848e7f77c0

Request headers

Referer
http://www.cyberforum.ru/viruses/thread1083273.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Date
Fri, 22 Nov 2019 11:39:30 GMT
Content-Encoding
gzip
Last-Modified
Thu, 21 Nov 2019 09:46:11 GMT
Server
nginx
ETag
W/"5dd65ce3-3657"
Vary
Accept-Encoding
Content-Type
text/css
Transfer-Encoding
chunked
Connection
keep-alive
vbulletin_important.css
cyberstatic.net/clientscript/ 		2 KB
869 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://cyberstatic.net/clientscript/vbulletin_important.css?v=389
Requested by
Host: www.cyberforum.ru
URL: http://www.cyberforum.ru/viruses/thread1083273.html
Protocol
HTTP/1.1
Server
93.171.221.121 , Russian Federation, ASN49189 (RUWEB, RU),
Reverse DNS
mensa.deserv.net
Software
nginx /
Resource Hash
cc61c44a97e0a7d64a8a1f791a518903f1f9f075fa802590e46b13175f51ae8d

Request headers

Referer
http://www.cyberforum.ru/viruses/thread1083273.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Date
Fri, 22 Nov 2019 11:39:30 GMT
Content-Encoding
gzip
Last-Modified
Sat, 21 Oct 2017 17:55:37 GMT
Server
nginx
ETag
W/"59eb8a19-67b"
Vary
Accept-Encoding
Content-Type
text/css
Transfer-Encoding
chunked
Connection
keep-alive
yahoo-dom-event.js
ajax.googleapis.com/ajax/libs/yui/2.9.0/build/yahoo-dom-event/ 		37 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://ajax.googleapis.com/ajax/libs/yui/2.9.0/build/yahoo-dom-event/yahoo-dom-event.js?v=389
Requested by
Host: www.cyberforum.ru
URL: http://www.cyberforum.ru/viruses/thread1083273.html
Protocol
HTTP/1.1
Server
2a00:1450:4001:81b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
34e4be92ec5b080fa8861ec31ab78bf63baad3b2242b5975a38de8d2807857aa
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
http://www.cyberforum.ru/viruses/thread1083273.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Date
Tue, 19 Nov 2019 09:01:10 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Last-Modified
Tue, 20 Dec 2016 18:17:03 GMT
Server
sffe
Age
268700
Vary
Accept-Encoding
Content-Type
text/javascript; charset=UTF-8
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=31536000, stale-while-revalidate=2592000
Accept-Ranges
bytes
Timing-Allow-Origin
*
Content-Length
13289
X-XSS-Protection
0
Expires
Wed, 18 Nov 2020 09:01:10 GMT
connection-min.js
ajax.googleapis.com/ajax/libs/yui/2.9.0/build/connection/ 		13 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://ajax.googleapis.com/ajax/libs/yui/2.9.0/build/connection/connection-min.js?v=389
Requested by
Host: www.cyberforum.ru
URL: http://www.cyberforum.ru/viruses/thread1083273.html
Protocol
HTTP/1.1
Server
2a00:1450:4001:81b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
c1287adfc1c6761dcb4221e342113981bfcf6067e0f65adbf417674f5e83da4d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
http://www.cyberforum.ru/viruses/thread1083273.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Date
Thu, 21 Nov 2019 23:44:40 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Last-Modified
Tue, 20 Dec 2016 18:17:03 GMT
Server
sffe
Age
42890
Vary
Accept-Encoding
Content-Type
text/javascript; charset=UTF-8
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=31536000, stale-while-revalidate=2592000
Accept-Ranges
bytes
Timing-Allow-Origin
*
Content-Length
4463
X-XSS-Protection
0
Expires
Fri, 20 Nov 2020 23:44:40 GMT
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/2.2.4/ 		84 KB
30 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js
Requested by
Host: www.cyberforum.ru
URL: http://www.cyberforum.ru/viruses/thread1083273.html
Protocol
HTTP/1.1
Server
2a00:1450:4001:81b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
http://www.cyberforum.ru/viruses/thread1083273.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Date
Thu, 21 Nov 2019 23:35:28 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Last-Modified
Tue, 20 Dec 2016 18:17:03 GMT
Server
sffe
Age
43442
Vary
Accept-Encoding
Content-Type
text/javascript; charset=UTF-8
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=31536000, stale-while-revalidate=2592000
Accept-Ranges
bytes
Timing-Allow-Origin
*
Content-Length
30028
X-XSS-Protection
0
Expires
Fri, 20 Nov 2020 23:35:28 GMT
jquery.browser.min.js
cyberstatic.net/clientscript/custom/ 		1 KB
855 B 		Script
General
Check archive.org
Download Go to
Full URL
http://cyberstatic.net/clientscript/custom/jquery.browser.min.js
Requested by
Host: www.cyberforum.ru
URL: http://www.cyberforum.ru/viruses/thread1083273.html
Protocol
HTTP/1.1
Server
93.171.221.121 , Russian Federation, ASN49189 (RUWEB, RU),
Reverse DNS
mensa.deserv.net
Software
nginx /
Resource Hash
1b2113191e228a2c56eb76957a87c565f375f0fdaa5fd606a03b7723054d98cf

Request headers

Referer
http://www.cyberforum.ru/viruses/thread1083273.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Date
Fri, 22 Nov 2019 11:39:30 GMT
Content-Encoding
gzip
Last-Modified
Sat, 21 Oct 2017 17:55:39 GMT
Server
nginx
ETag
W/"59eb8a1b-4db"
Vary
Accept-Encoding
Content-Type
application/javascript
Transfer-Encoding
chunked
Connection
keep-alive
vbulletin_global.js
cyberstatic.net/clientscript/ 		25 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://cyberstatic.net/clientscript/vbulletin_global.js?v=389
Requested by
Host: www.cyberforum.ru
URL: http://www.cyberforum.ru/viruses/thread1083273.html
Protocol
HTTP/1.1
Server
93.171.221.121 , Russian Federation, ASN49189 (RUWEB, RU),
Reverse DNS
mensa.deserv.net
Software
nginx /
Resource Hash
872d751d8312e0c745053ce5ef4f60a8e4c91475147341adca71f48d17d6d7b9

Request headers

Referer
http://www.cyberforum.ru/viruses/thread1083273.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Date
Fri, 22 Nov 2019 11:39:30 GMT
Content-Encoding
gzip
Last-Modified
Tue, 03 Jul 2018 11:56:09 GMT
Server
nginx
ETag
W/"5b3b6459-6248"
Vary
Accept-Encoding
Content-Type
application/javascript
Transfer-Encoding
chunked
Connection
keep-alive
vbulletin_menu.js
cyberstatic.net/clientscript/ 		17 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://cyberstatic.net/clientscript/vbulletin_menu.js?v=389
Requested by
Host: www.cyberforum.ru
URL: http://www.cyberforum.ru/viruses/thread1083273.html
Protocol
HTTP/1.1
Server
93.171.221.121 , Russian Federation, ASN49189 (RUWEB, RU),
Reverse DNS
mensa.deserv.net
Software
nginx /
Resource Hash
45a81fb6dc99a3b2e0e03ed11f1661f189f705ced277866f1a8b02916f27e172

Request headers

Referer
http://www.cyberforum.ru/viruses/thread1083273.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Date
Fri, 22 Nov 2019 11:39:30 GMT
Content-Encoding
gzip
Last-Modified
Sat, 21 Oct 2017 17:55:37 GMT
Server
nginx
ETag
W/"59eb8a19-4374"
Vary
Accept-Encoding
Content-Type
application/javascript
Transfer-Encoding
chunked
Connection
keep-alive
vbulletin_vbpost.js
cyberstatic.net/clientscript/ 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://cyberstatic.net/clientscript/vbulletin_vbpost.js
Requested by
Host: www.cyberforum.ru
URL: http://www.cyberforum.ru/viruses/thread1083273.html
Protocol
HTTP/1.1
Server
93.171.221.121 , Russian Federation, ASN49189 (RUWEB, RU),
Reverse DNS
mensa.deserv.net
Software
nginx /
Resource Hash
b4e9ccfcb7d5ca026a1262a7075b7e6e6f30446fb8fc35205fe6edfa6f5a9b5a

Request headers

Referer
http://www.cyberforum.ru/viruses/thread1083273.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Date
Fri, 22 Nov 2019 11:39:30 GMT
Content-Encoding
gzip
Last-Modified
Sat, 21 Oct 2017 17:55:39 GMT
Server
nginx
ETag
W/"59eb8a1b-c4a"
Vary
Accept-Encoding
Content-Type
application/javascript
Transfer-Encoding
chunked
Connection
keep-alive
vbulletin_post_loader.js
cyberstatic.net/clientscript/ 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://cyberstatic.net/clientscript/vbulletin_post_loader.js?v=389
Requested by
Host: www.cyberforum.ru
URL: http://www.cyberforum.ru/viruses/thread1083273.html
Protocol
HTTP/1.1
Server
93.171.221.121 , Russian Federation, ASN49189 (RUWEB, RU),
Reverse DNS
mensa.deserv.net
Software
nginx /
Resource Hash
c25f3f18658ceca1cc19c38d7e1ce8db3a148d2b69c65c2dbda0062ce4b93d03

Request headers

Referer
http://www.cyberforum.ru/viruses/thread1083273.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Date
Fri, 22 Nov 2019 11:39:30 GMT
Content-Encoding
gzip
Last-Modified
Sat, 21 Oct 2017 17:55:38 GMT
Server
nginx
ETag
W/"59eb8a1a-e04"
Vary
Accept-Encoding
Content-Type
application/javascript
Transfer-Encoding
chunked
Connection
keep-alive
vbulletin_md5.js
cyberstatic.net/clientscript/ 		10 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://cyberstatic.net/clientscript/vbulletin_md5.js?v=389
Requested by
Host: www.cyberforum.ru
URL: http://www.cyberforum.ru/viruses/thread1083273.html
Protocol
HTTP/1.1
Server
93.171.221.121 , Russian Federation, ASN49189 (RUWEB, RU),
Reverse DNS
mensa.deserv.net
Software
nginx /
Resource Hash
f4ad7c81a625a0702dcdd837b046d8c5950d51ccad59e12b6d729ba758b2e1a5

Request headers

Referer
http://www.cyberforum.ru/viruses/thread1083273.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Date
Fri, 22 Nov 2019 11:39:30 GMT
Content-Encoding
gzip
Last-Modified
Sat, 21 Oct 2017 17:55:37 GMT
Server
nginx
ETag
W/"59eb8a19-2700"
Vary
Accept-Encoding
Content-Type
application/javascript
Transfer-Encoding
chunked
Connection
keep-alive
geshi.css
cyberstatic.net/clientscript/vbulletin_css/ 		51 KB
12 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://cyberstatic.net/clientscript/vbulletin_css/geshi.css
Requested by
Host: www.cyberforum.ru
URL: http://www.cyberforum.ru/viruses/thread1083273.html
Protocol
HTTP/1.1
Server
93.171.221.121 , Russian Federation, ASN49189 (RUWEB, RU),
Reverse DNS
mensa.deserv.net
Software
nginx /
Resource Hash
466b7bee0f1befc421af448d6adb079163536ea2d4b9d9e514425fad899b2251

Request headers

Referer
http://www.cyberforum.ru/viruses/thread1083273.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Date
Fri, 22 Nov 2019 11:39:30 GMT
Content-Encoding
gzip
Last-Modified
Sat, 21 Oct 2017 17:55:41 GMT
Server
nginx
ETag
W/"59eb8a1d-cbbf"
Vary
Accept-Encoding
Content-Type
text/css
Transfer-Encoding
chunked
Connection
keep-alive
spoiler.css
cyberstatic.net/clientscript/vbulletin_css/ 		798 B
656 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://cyberstatic.net/clientscript/vbulletin_css/spoiler.css
Requested by
Host: www.cyberforum.ru
URL: http://www.cyberforum.ru/viruses/thread1083273.html
Protocol
HTTP/1.1
Server
93.171.221.121 , Russian Federation, ASN49189 (RUWEB, RU),
Reverse DNS
mensa.deserv.net
Software
nginx /
Resource Hash
27f28f040d744fd271be425ee09bf36026eeec1cdca6d6889b672f0050b8c988

Request headers

Referer
http://www.cyberforum.ru/viruses/thread1083273.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Date
Fri, 22 Nov 2019 11:39:30 GMT
Content-Encoding
gzip
Last-Modified
Sat, 21 Oct 2017 17:55:41 GMT
Server
nginx
ETag
W/"59eb8a1d-31e"
Vary
Accept-Encoding
Content-Type
text/css
Transfer-Encoding
chunked
Connection
keep-alive
sorttable.js
cyberstatic.net/clientscript/ 		7 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://cyberstatic.net/clientscript/sorttable.js
Requested by
Host: www.cyberforum.ru
URL: http://www.cyberforum.ru/viruses/thread1083273.html
Protocol
HTTP/1.1
Server
93.171.221.121 , Russian Federation, ASN49189 (RUWEB, RU),
Reverse DNS
mensa.deserv.net
Software
nginx /
Resource Hash
b271a70ce1ba380a80c924c6435b3e77c03408cd4d4a7389928970f7658d962a

Request headers

Referer
http://www.cyberforum.ru/viruses/thread1083273.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Date
Fri, 22 Nov 2019 11:39:30 GMT
Content-Encoding
gzip
Last-Modified
Sat, 21 Oct 2017 17:55:35 GMT
Server
nginx
ETag
W/"59eb8a17-1b5d"
Vary
Accept-Encoding
Content-Type
application/javascript
Transfer-Encoding
chunked
Connection
keep-alive
addedit.js
cyberstatic.net/clientscript/kr_scripts/tests/ 		39 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://cyberstatic.net/clientscript/kr_scripts/tests/addedit.js
Requested by
Host: www.cyberforum.ru
URL: http://www.cyberforum.ru/viruses/thread1083273.html
Protocol
HTTP/1.1
Server
93.171.221.121 , Russian Federation, ASN49189 (RUWEB, RU),
Reverse DNS
mensa.deserv.net
Software
nginx /
Resource Hash
43f67cee90d69b2ceb8944ab3d3106abda2e40a33a324ab4ce1ef828ec2ae4a3

Request headers

Referer
http://www.cyberforum.ru/viruses/thread1083273.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Date
Fri, 22 Nov 2019 11:39:30 GMT
Content-Encoding
gzip
Last-Modified
Sat, 21 Oct 2017 17:55:44 GMT
Server
nginx
ETag
W/"59eb8a20-9af5"
Vary
Accept-Encoding
Content-Type
application/javascript
Transfer-Encoding
chunked
Connection
keep-alive
bestanswer.js
cyberstatic.net/clientscript/kr_scripts/bestanswer/ 		10 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://cyberstatic.net/clientscript/kr_scripts/bestanswer/bestanswer.js
Requested by
Host: www.cyberforum.ru
URL: http://www.cyberforum.ru/viruses/thread1083273.html
Protocol
HTTP/1.1
Server
93.171.221.121 , Russian Federation, ASN49189 (RUWEB, RU),
Reverse DNS
mensa.deserv.net
Software
nginx /
Resource Hash
b27f8c0281546dbd8050053a7d6971ab660d7aeb0c93f00ac2b06c9a48bfa601

Request headers

Referer
http://www.cyberforum.ru/viruses/thread1083273.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Date
Fri, 22 Nov 2019 11:39:30 GMT
Content-Encoding
gzip
Last-Modified
Sat, 21 Oct 2017 17:55:43 GMT
Server
nginx
ETag
W/"59eb8a1f-2984"
Vary
Accept-Encoding
Content-Type
application/javascript
Transfer-Encoding
chunked
Connection
keep-alive
thumbs.css
cyberstatic.net/clientscript/kr_scripts/thumbsup/ 		3 KB
982 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://cyberstatic.net/clientscript/kr_scripts/thumbsup/thumbs.css
Requested by
Host: www.cyberforum.ru
URL: http://www.cyberforum.ru/viruses/thread1083273.html
Protocol
HTTP/1.1
Server
93.171.221.121 , Russian Federation, ASN49189 (RUWEB, RU),
Reverse DNS
mensa.deserv.net
Software
nginx /
Resource Hash
1b82b243f5e7f2c56730773716844b1a275f10bbc8b66d4285aad996f675bf9d

Request headers

Referer
http://www.cyberforum.ru/viruses/thread1083273.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Date
Fri, 22 Nov 2019 11:39:30 GMT
Content-Encoding
gzip
Last-Modified
Sat, 21 Oct 2017 21:19:50 GMT
Server
nginx
ETag
W/"59ebb9f6-cd2"
Vary
Accept-Encoding
Content-Type
text/css
Transfer-Encoding
chunked
Connection
keep-alive
thumbsup.js
cyberstatic.net/clientscript/kr_scripts/thumbsup/ 		18 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://cyberstatic.net/clientscript/kr_scripts/thumbsup/thumbsup.js
Requested by
Host: www.cyberforum.ru
URL: http://www.cyberforum.ru/viruses/thread1083273.html
Protocol
HTTP/1.1
Server
93.171.221.121 , Russian Federation, ASN49189 (RUWEB, RU),
Reverse DNS
mensa.deserv.net
Software
nginx /
Resource Hash
c7e70d434e17a158fe1bf1ff44515243cb0eb2cda8d6b72ee956a17a31505607

Request headers

Referer
http://www.cyberforum.ru/viruses/thread1083273.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Date
Fri, 22 Nov 2019 11:39:30 GMT
Content-Encoding
gzip
Last-Modified
Sat, 21 Oct 2017 17:55:45 GMT
Server
nginx
ETag
W/"59eb8a21-494d"
Vary
Accept-Encoding
Content-Type
application/javascript
Transfer-Encoding
chunked
Connection
keep-alive
cyberforum_logo.png
cyberstatic.net/images/ 		11 KB
11 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://cyberstatic.net/images/cyberforum_logo.png
Requested by
Host: www.cyberforum.ru
URL: http://www.cyberforum.ru/viruses/thread1083273.html
Protocol
HTTP/1.1
Server
93.171.221.121 , Russian Federation, ASN49189 (RUWEB, RU),
Reverse DNS
mensa.deserv.net
Software
nginx /
Resource Hash
982798c3ab58ec9ca4b0fc8ea76f491e1b81d7dc557a3f640df68975283b636e

Request headers

Referer
http://www.cyberforum.ru/viruses/thread1083273.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Date
Fri, 22 Nov 2019 11:39:30 GMT
Last-Modified
Fri, 07 Apr 2017 17:50:16 GMT
Server
nginx
ETag
"58e7d158-2aec"
Content-Type
image/png
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
10988
rating_5.gif
cyberstatic.net/images/rating/ 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://cyberstatic.net/images/rating/rating_5.gif
Requested by
Host: www.cyberforum.ru
URL: http://www.cyberforum.ru/viruses/thread1083273.html
Protocol
HTTP/1.1
Server
93.171.221.121 , Russian Federation, ASN49189 (RUWEB, RU),
Reverse DNS
mensa.deserv.net
Software
nginx /
Resource Hash
c3c0674e370e514dd2d0984506c3f3b0890e673d05dc489deabd0b43b7496eb3

Request headers

Referer
http://www.cyberforum.ru/viruses/thread1083273.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Date
Fri, 22 Nov 2019 11:39:30 GMT
Last-Modified
Fri, 07 Apr 2017 17:50:33 GMT
Server
nginx
ETag
"58e7d169-500"
Content-Type
image/gif
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
1280
11x11progress.gif
cyberstatic.net/images/misc/ 		537 B
768 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://cyberstatic.net/images/misc/11x11progress.gif
Requested by
Host: www.cyberforum.ru
URL: http://www.cyberforum.ru/viruses/thread1083273.html
Protocol
HTTP/1.1
Server
93.171.221.121 , Russian Federation, ASN49189 (RUWEB, RU),
Reverse DNS
mensa.deserv.net
Software
nginx /
Resource Hash
54da8bd4301cd4bec5fd0bb75f9639a65882c6bcc0566528c6e74b14edda59af

Request headers

Referer
http://www.cyberforum.ru/viruses/thread1083273.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Date
Fri, 22 Nov 2019 11:39:30 GMT
Last-Modified
Fri, 07 Apr 2017 17:50:23 GMT
Server
nginx
ETag
"58e7d15f-219"
Content-Type
image/gif
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
537
cyberforumru
aliadvert.ru/ 		86 KB
21 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://aliadvert.ru/cyberforumru
Requested by
Host: www.cyberforum.ru
URL: http://www.cyberforum.ru/viruses/thread1083273.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:e2::ac40:8c25 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare / Express
Resource Hash
cd447507b1404c62358b237e19e39b0ce8f93f5298aa7f16e911d7a674c099c8

Request headers

Referer
http://www.cyberforum.ru/viruses/thread1083273.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 11:39:30 GMT
content-encoding
br
etag
W/"156ad-aQk1iMfOVQL3lRNtdZFRu+Tx+Pw"
cf-cache-status
DYNAMIC
server
cloudflare
access-control-allow-origin
http://www.cyberforum.ru
x-powered-by
Express
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
content-type
text/javascript; charset=utf-8
status
200
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cf-ray
539a9f8aca42dfef-FRA
reply.png
cyberstatic.net/images/buttons/ 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://cyberstatic.net/images/buttons/reply.png
Requested by
Host: www.cyberforum.ru
URL: http://www.cyberforum.ru/viruses/thread1083273.html
Protocol
HTTP/1.1
Server
93.171.221.121 , Russian Federation, ASN49189 (RUWEB, RU),
Reverse DNS
mensa.deserv.net
Software
nginx /
Resource Hash
984ed07cfb706ce8375665769acf5e06d3d4f60002b296b3662c8bc6be959c89

Request headers

Referer
http://www.cyberforum.ru/viruses/thread1083273.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Date
Fri, 22 Nov 2019 11:39:30 GMT
Last-Modified
Fri, 07 Apr 2017 17:50:15 GMT
Server
nginx
ETag
"58e7d157-472"
Content-Type
image/png
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
1138
newthread.png
cyberstatic.net/images/buttons/ 		1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://cyberstatic.net/images/buttons/newthread.png
Requested by
Host: www.cyberforum.ru
URL: http://www.cyberforum.ru/viruses/thread1083273.html
Protocol
HTTP/1.1
Server
93.171.221.121 , Russian Federation, ASN49189 (RUWEB, RU),
Reverse DNS
mensa.deserv.net
Software
nginx /
Resource Hash
6e038a09ccaa009545c02a7eb859d7a05cf83bd162a2907daab499d652cb7ccf

Request headers

Referer
http://www.cyberforum.ru/viruses/thread1083273.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Date
Fri, 22 Nov 2019 11:39:30 GMT
Last-Modified
Fri, 07 Apr 2017 17:50:15 GMT
Server
nginx
ETag
"58e7d157-5d5"
Content-Type
image/png
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
1493
vbulletin_lightbox.js
cyberstatic.net/clientscript/ 		21 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://cyberstatic.net/clientscript/vbulletin_lightbox.js?v=389
Requested by
Host: www.cyberforum.ru
URL: http://www.cyberforum.ru/viruses/thread1083273.html
Protocol
HTTP/1.1
Server
93.171.221.121 , Russian Federation, ASN49189 (RUWEB, RU),
Reverse DNS
mensa.deserv.net
Software
nginx /
Resource Hash
473989572be7cf8d9ffef442f7113355e38cc1af23571c534a7d41007c545ba7

Request headers

Referer
http://www.cyberforum.ru/viruses/thread1083273.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Date
Fri, 22 Nov 2019 11:39:30 GMT
Content-Encoding
gzip
Last-Modified
Sat, 21 Oct 2017 17:55:37 GMT
Server
nginx
ETag
W/"59eb8a19-558c"
Vary
Accept-Encoding
Content-Type
application/javascript
Transfer-Encoding
chunked
Connection
keep-alive
exe.php
nohope.ru/reklama/2019/cyberforumru/banner/80000k/
Redirect Chain
  • https://nohope.ru/a
  • https://nohope.ru/reklama/2019/cyberforumru/banner/80000k/exe.php?size=970x250&dp=cforum
21 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://nohope.ru/reklama/2019/cyberforumru/banner/80000k/exe.php?size=970x250&dp=cforum
Requested by
Host: www.cyberforum.ru
URL: http://www.cyberforum.ru/viruses/thread1083273.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:30::681c:1eba , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare / PHP/7.3.11
Resource Hash
8dcfdfa2bc3c4820ca8fbf409288ff772fe8bf047d1f22b20ab6bb1c6850981e

Request headers

Referer
http://www.cyberforum.ru/viruses/thread1083273.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 11:39:30 GMT
content-encoding
br
cf-cache-status
DYNAMIC
server
cloudflare
x-powered-by
PHP/7.3.11
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
content-type
application/javascript; charset=utf-8
status
200
cf-ray
539a9f8af9cfcbc4-VIE

Redirect headers

date
Fri, 22 Nov 2019 11:39:30 GMT
cf-cache-status
DYNAMIC
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
location
https://nohope.ru/reklama/2019/cyberforumru/banner/80000k/exe.php?size=970x250&dp=cforum
content-type
text/html; charset=iso-8859-1
status
302
cf-ray
539a9f8aa918cbc4-VIE
inflym.js
video.market-place.su/v1/build/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
http://video.market-place.su/v1/build/inflym.js
Requested by
Host: www.cyberforum.ru
URL: http://www.cyberforum.ru/viruses/thread1083273.html
Protocol
HTTP/1.1
Server
176.32.179.2 St Petersburg, Russian Federation, ASN24739 (SEVEREN-TELECOM St.Petersburg, Russia, RU),
Reverse DNS
Software
/
Resource Hash

Request headers

Referer
http://www.cyberforum.ru/viruses/thread1083273.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers
fly.js
s.frolvid.ru/static/dist/
Redirect Chain
  • http://s.frolvid.ru/static/dist/fly.js
  • https://s.frolvid.ru/static/dist/fly.js
51 KB
52 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s.frolvid.ru/static/dist/fly.js
Requested by
Host: www.cyberforum.ru
URL: http://www.cyberforum.ru/viruses/thread1083273.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
176.9.32.236 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.236.32.9.176.clients.your-server.de
Software
nginx/1.14.0 /
Resource Hash
6f12714b7e8b3eef8a3b519ea4c8f8c7c30bdbd66e52c171c0614dd7b21b07f8

Request headers

Referer
http://www.cyberforum.ru/viruses/thread1083273.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Date
Fri, 22 Nov 2019 11:39:30 GMT
Last-Modified
Wed, 26 Jun 2019 15:46:52 GMT
Server
nginx/1.14.0
ETag
"5d13936c-cd83"
Content-Type
application/javascript; charset=utf-8
Cache-Control
no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
52611

Redirect headers

Location
https://s.frolvid.ru/static/dist/fly.js
Date
Fri, 22 Nov 2019 11:39:30 GMT
Server
nginx/1.14.0
Connection
keep-alive
Content-Length
185
Content-Type
text/html
vbulletin_autosave.js
cyberstatic.net/clientscript/ 		5 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://cyberstatic.net/clientscript/vbulletin_autosave.js
Requested by
Host: www.cyberforum.ru
URL: http://www.cyberforum.ru/viruses/thread1083273.html
Protocol
HTTP/1.1
Server
93.171.221.121 , Russian Federation, ASN49189 (RUWEB, RU),
Reverse DNS
mensa.deserv.net
Software
nginx /
Resource Hash
e49621b25309592564baae61844a761a674d07b48292ec57ac6bfe27afa4eb49

Request headers

Referer
http://www.cyberforum.ru/viruses/thread1083273.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Date
Fri, 22 Nov 2019 11:39:30 GMT
Content-Encoding
gzip
Last-Modified
Sat, 21 Oct 2017 17:55:36 GMT
Server
nginx
ETag
W/"59eb8a18-1335"
Vary
Accept-Encoding
Content-Type
application/javascript
Transfer-Encoding
chunked
Connection
keep-alive
CtrlPagenav.js
cyberstatic.net/clientscript/custom/ 		2 KB
1009 B 		Script
General
Check archive.org
Download Go to
Full URL
http://cyberstatic.net/clientscript/custom/CtrlPagenav.js
Requested by
Host: www.cyberforum.ru
URL: http://www.cyberforum.ru/viruses/thread1083273.html
Protocol
HTTP/1.1
Server
93.171.221.121 , Russian Federation, ASN49189 (RUWEB, RU),
Reverse DNS
mensa.deserv.net
Software
nginx /
Resource Hash
2e91fefb7391b9e6e5e1c9cdf691630ae6f51a0006fb5a8f5b887dc896f8db5a

Request headers

Referer
http://www.cyberforum.ru/viruses/thread1083273.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Date
Fri, 22 Nov 2019 11:39:30 GMT
Content-Encoding
gzip
Last-Modified
Tue, 05 Nov 2019 11:53:02 GMT
Server
nginx
ETag
W/"5dc1629e-658"
Vary
Accept-Encoding
Content-Type
application/javascript
Transfer-Encoding
chunked
Connection
keep-alive
spoiler.js
cyberstatic.net/clientscript/custom/ 		365 B
503 B 		Script
General
Check archive.org
Download Go to
Full URL
http://cyberstatic.net/clientscript/custom/spoiler.js
Requested by
Host: www.cyberforum.ru
URL: http://www.cyberforum.ru/viruses/thread1083273.html
Protocol
HTTP/1.1
Server
93.171.221.121 , Russian Federation, ASN49189 (RUWEB, RU),
Reverse DNS
mensa.deserv.net
Software
nginx /
Resource Hash
187a7f45f8a6233d976c52fbb67c680381efbf6d81e06b4cab4115d1e5f4b064

Request headers

Referer
http://www.cyberforum.ru/viruses/thread1083273.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Date
Fri, 22 Nov 2019 11:39:30 GMT
Content-Encoding
gzip
Last-Modified
Tue, 05 Nov 2019 11:53:40 GMT
Server
nginx
ETag
W/"5dc162c4-16d"
Vary
Accept-Encoding
Content-Type
application/javascript
Transfer-Encoding
chunked
Connection
keep-alive
topbutton.js
cyberstatic.net/clientscript/custom/ 		1 KB
998 B 		Script
General
Check archive.org
Download Go to
Full URL
http://cyberstatic.net/clientscript/custom/topbutton.js
Requested by
Host: www.cyberforum.ru
URL: http://www.cyberforum.ru/viruses/thread1083273.html
Protocol
HTTP/1.1
Server
93.171.221.121 , Russian Federation, ASN49189 (RUWEB, RU),
Reverse DNS
mensa.deserv.net
Software
nginx /
Resource Hash
7ffd852e45f9eafb24080a731d4e8c9ffdfffd23498266f8be0e0433df747ba3

Request headers

Referer
http://www.cyberforum.ru/viruses/thread1083273.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Date
Fri, 22 Nov 2019 11:39:30 GMT
Content-Encoding
gzip
Last-Modified
Sat, 21 Oct 2017 17:55:39 GMT
Server
nginx
ETag
W/"59eb8a1b-5cd"
Vary
Accept-Encoding
Content-Type
application/javascript
Transfer-Encoding
chunked
Connection
keep-alive
selectcode.js
cyberstatic.net/clientscript/custom/ 		850 B
732 B 		Script
General
Check archive.org
Download Go to
Full URL
http://cyberstatic.net/clientscript/custom/selectcode.js
Requested by
Host: www.cyberforum.ru
URL: http://www.cyberforum.ru/viruses/thread1083273.html
Protocol
HTTP/1.1
Server
93.171.221.121 , Russian Federation, ASN49189 (RUWEB, RU),
Reverse DNS
mensa.deserv.net
Software
nginx /
Resource Hash
625d1dc24589bda4f57d17b192318070dbbb5825deeef5b6514d55cedaa783fc

Request headers

Referer
http://www.cyberforum.ru/viruses/thread1083273.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Date
Fri, 22 Nov 2019 11:39:30 GMT
Content-Encoding
gzip
Last-Modified
Sat, 02 Nov 2019 09:20:01 GMT
Server
nginx
ETag
W/"5dbd4a41-352"
Vary
Accept-Encoding
Content-Type
application/javascript
Transfer-Encoding
chunked
Connection
keep-alive
js
www.googletagmanager.com/gtag/ 		73 KB
27 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=UA-595018-2
Requested by
Host: www.cyberforum.ru
URL: http://www.cyberforum.ru/viruses/thread1083273.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
7a07eb16357f9a2a531b8a8ab8596b570c853d9931c79bfc0ce0b9d4ff5fa40b
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
http://www.cyberforum.ru/viruses/thread1083273.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 11:39:30 GMT
content-encoding
br
last-modified
Fri, 22 Nov 2019 09:00:00 GMT
server
Google Tag Manager
access-control-allow-origin
http://www.googletagmanager.com
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
content-length
27663
x-xss-protection
0
expires
Fri, 22 Nov 2019 11:39:30 GMT
es5-shims.min.js
yastatic.net/es5-shims/0.0.2/ 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://yastatic.net/es5-shims/0.0.2/es5-shims.min.js
Requested by
Host: www.cyberforum.ru
URL: http://www.cyberforum.ru/viruses/thread1083273.html
Protocol
HTTP/1.1
Server
2a02:6b8:20::215 , Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
nginx/1.17.6 /
Resource Hash
40f09dcdb226fb60428bfe107e02f6c50db1561694264b0144e0155f9f3e4140
Security Headers
Name Value
Strict-Transport-Security max-age=43200000; includeSubDomains;

Request headers

Referer
http://www.cyberforum.ru/viruses/thread1083273.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Date
Fri, 22 Nov 2019 11:39:30 GMT
Content-Encoding
gzip
X-Nginx-Request-Id
be73ae8554db5e05
Transfer-Encoding
chunked
Connection
keep-alive
Last-Modified
Thu, 25 Oct 2018 11:27:00 GMT
Server
nginx/1.17.6
Etag
W/"32e3b4f3a8f6048da9934fec1ca08cea"
Vary
Accept-Encoding
Strict-Transport-Security
max-age=43200000; includeSubDomains;
Content-Type
application/x-javascript
Access-Control-Allow-Origin
*
Cache-Control
max-age=315360000, public
Timing-Allow-Origin
*
Keep-Alive
timeout=5
Expires
Thu, 31 Dec 2037 23:55:55 GMT
share.js
yastatic.net/share2/ 		79 KB
26 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://yastatic.net/share2/share.js
Requested by
Host: www.cyberforum.ru
URL: http://www.cyberforum.ru/viruses/thread1083273.html
Protocol
HTTP/1.1
Server
2a02:6b8:20::215 , Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
nginx/1.17.6 /
Resource Hash
64b77871affe1f7eebcf4059ee5472ded7a4c8e9e97007c6009a630292c39e09

Request headers

Referer
http://www.cyberforum.ru/viruses/thread1083273.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Date
Fri, 22 Nov 2019 11:39:30 GMT
Content-Encoding
gzip
Last-Modified
Tue, 24 Sep 2019 14:43:31 GMT
Server
nginx/1.17.6
Etag
W/"3078d7e2a7035017beffbfd531431429"
Vary
Accept-Encoding
Content-Type
application/javascript
Access-Control-Allow-Origin
*
Expires
Mon, 25 Nov 2019 11:36:48 GMT
Cache-Control
max-age=259200, public
Transfer-Encoding
chunked
Connection
keep-alive
Timing-Allow-Origin
*
Keep-Alive
timeout=5
X-Nginx-Request-Id
4500c95c5e74f3f9
menu_open.gif
cyberstatic.net/images/misc/ 		279 B
510 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://cyberstatic.net/images/misc/menu_open.gif
Requested by
Host: www.cyberforum.ru
URL: http://www.cyberforum.ru/viruses/thread1083273.html
Protocol
HTTP/1.1
Server
93.171.221.121 , Russian Federation, ASN49189 (RUWEB, RU),
Reverse DNS
mensa.deserv.net
Software
nginx /
Resource Hash
5ae986db0dcbb3131602f6be4d222a521aac9363a25666666df3ab72d61df51f

Request headers

Referer
http://www.cyberforum.ru/viruses/thread1083273.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Date
Fri, 22 Nov 2019 11:39:30 GMT
Last-Modified
Fri, 07 Apr 2017 17:50:28 GMT
Server
nginx
ETag
"58e7d164-117"
Content-Type
image/gif
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
279
context.js
an.yandex.ru/system/ 		56 KB
20 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://an.yandex.ru/system/context.js
Requested by
Host: www.cyberforum.ru
URL: http://www.cyberforum.ru/viruses/thread1083273.html
Protocol
HTTP/1.1
Server
2a02:6b8::90 Moscow, Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
nginx/1.12.2 /
Resource Hash
18c13a380d38b2e8fd1a9976e55fd86780e1ce80204cbacb1f59add2048de25d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Xss-Protection 1; mode=block

Request headers

Referer
http://www.cyberforum.ru/viruses/thread1083273.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Date
Fri, 22 Nov 2019 11:39:30 GMT
Content-Encoding
gzip
Last-Modified
Fri, 22 Nov 2019 10:29:57 GMT
Server
nginx/1.12.2
ETag
W/"E01B-5DD7B8A5"
Vary
Accept-Encoding
Connection
keep-alive
Content-Type
application/javascript
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=3600
Transfer-Encoding
chunked
Strict-Transport-Security
max-age=31536000
Timing-Allow-Origin
*
X-XSS-Protection
1; mode=block
Expires
Fri, 22 Nov 2019 12:39:30 GMT
cse.js
cse.google.com/ 		10 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cse.google.com/cse.js?cx=partner-pub-6796001588681838:1260530199
Requested by
Host: www.cyberforum.ru
URL: http://www.cyberforum.ru/viruses/thread1083273.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:814::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
gws /
Resource Hash
3bfa92df8adecd240afa230d054081c4afd48da27ea12c6dca24302edaa78312
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
http://www.cyberforum.ru/viruses/thread1083273.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 11:39:30 GMT
content-encoding
br
server
gws
x-frame-options
SAMEORIGIN
p3p
CP="This is not a P3P policy! See g.co/p3phelp for more info."
status
200
cache-control
private
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
3453
x-xss-protection
0
expires
Fri, 22 Nov 2019 11:39:30 GMT
all.js
site.yandex.net/v2.0/js/ 		73 KB
19 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://site.yandex.net/v2.0/js/all.js
Requested by
Host: www.cyberforum.ru
URL: http://www.cyberforum.ru/viruses/thread1083273.html
Protocol
HTTP/1.1
Server
2a02:6b8:20::215 , Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
nginx/1.17.6 /
Resource Hash
40ec3a7a0f09f8cff97773ac797bf65d34dcc63a2cd942ca22ff1c6405b915ff

Request headers

Referer
http://www.cyberforum.ru/viruses/thread1083273.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Date
Fri, 22 Nov 2019 11:39:30 GMT
Content-Encoding
gzip
Last-Modified
Fri, 21 Jun 2019 10:13:03 GMT
Server
nginx/1.17.6
Etag
W/"18fbc64cfd02bc2d69dc49219fff8fe8"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Access-Control-Allow-Origin
*
Expires
Fri, 22 Nov 2019 17:39:00 GMT
Cache-Control
max-age=21600
Transfer-Encoding
chunked
Connection
keep-alive
Keep-Alive
timeout=5
X-Nginx-Request-Id
824bf44fe5c8e12b
croll2.js
cdn.jsdelivr.net/npm/cdn4script@1.1.210/dist/codes/
Redirect Chain
  • https://cdn.4736.in/js/contentroll.js
  • https://cdn.jsdelivr.net/npm/cdn4script@1.1.210/dist/codes/croll2.js
399 KB
116 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.jsdelivr.net/npm/cdn4script@1.1.210/dist/codes/croll2.js
Requested by
Host: www.cyberforum.ru
URL: http://www.cyberforum.ru/viruses/thread1083273.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::621 , Ascension Island, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
/
Resource Hash
997592debba221629c00740f26b81896b1f8188514f945a85ab6f83938615861
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
http://www.cyberforum.ru/viruses/thread1083273.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
x-cache
HIT, HIT
status
200
date
Fri, 22 Nov 2019 11:39:30 GMT
content-length
118810
x-served-by
cache-ams21024-AMS, cache-fra19145-FRA
etag
W/"63bef-BnpRObhm/5MFYxjwRQ4sgl19Lho"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=31536000, s-maxage=31536000, immutable
accept-ranges
bytes
timing-allow-origin
*

Redirect headers

Date
Fri, 22 Nov 2019 11:39:30 GMT
Server
nginx
Location
https://cdn.jsdelivr.net/npm/cdn4script@1.1.210/dist/codes/croll2.js
Content-Type
text/html; charset=utf-8
Access-Control-Allow-Origin
Cache-Control
private, max-age=0, no-cache
Access-Control-Allow-Credentials
true
Connection
keep-alive
Access-Control-Allow-Headers
Content-Length
91
Access-Control-Allow-Method
GET,POST,OPTIONS
icon_plus.gif
cyberstatic.net/images/misc/ 		191 B
421 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://cyberstatic.net/images/misc/icon_plus.gif
Requested by
Host: www.cyberforum.ru
URL: http://www.cyberforum.ru/viruses/thread1083273.html
Protocol
HTTP/1.1
Server
93.171.221.121 , Russian Federation, ASN49189 (RUWEB, RU),
Reverse DNS
mensa.deserv.net
Software
nginx /
Resource Hash
12511c9756a8556182399c6721b442b7a9182622746a6435032e0eb5179f8641

Request headers

Referer
http://cyberstatic.net/clientscript/vbulletin_css/spoiler.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Date
Fri, 22 Nov 2019 11:39:30 GMT
Last-Modified
Fri, 07 Apr 2017 17:50:26 GMT
Server
nginx
ETag
"58e7d162-bf"
Content-Type
image/gif
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
191
cse_element__ru.js
www.google.com/cse/static/element/8b2252448421acb3/ 		260 KB
85 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google.com/cse/static/element/8b2252448421acb3/cse_element__ru.js?usqp=CAI%3D
Requested by
Host: cse.google.com
URL: https://cse.google.com/cse.js?cx=partner-pub-6796001588681838:1260530199
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:818::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
aff5487cde973dc7754e0e69595228a261d3712756ccc194574a361ccc98aa42
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
http://www.cyberforum.ru/viruses/thread1083273.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Thu, 21 Nov 2019 06:48:58 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 31 Oct 2019 16:49:36 GMT
server
sffe
age
103832
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=31536000
accept-ranges
bytes
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
87327
x-xss-protection
0
expires
Fri, 20 Nov 2020 06:48:58 GMT
default+ru.css
www.google.com/cse/static/element/8b2252448421acb3/ 		40 KB
9 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.google.com/cse/static/element/8b2252448421acb3/default+ru.css
Requested by
Host: cse.google.com
URL: https://cse.google.com/cse.js?cx=partner-pub-6796001588681838:1260530199
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:818::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
40a20291f9b526cba58796a4bbd0256d5663313e02c9d5ab5a842476562b3108
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
http://www.cyberforum.ru/viruses/thread1083273.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Thu, 21 Nov 2019 17:58:59 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 31 Oct 2019 16:49:36 GMT
server
sffe
age
63631
vary
Accept-Encoding
content-type
text/css
status
200
cache-control
public, max-age=31536000
accept-ranges
bytes
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
9042
x-xss-protection
0
expires
Fri, 20 Nov 2020 17:58:59 GMT
default.css
www.google.com/cse/static/style/look/v3/ 		11 KB
3 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.google.com/cse/static/style/look/v3/default.css
Requested by
Host: cse.google.com
URL: https://cse.google.com/cse.js?cx=partner-pub-6796001588681838:1260530199
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:818::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
9ceaa25ec7654a66294c16e28989fbf1ecb9cebc9debe96ec597529465c7cd50
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
http://www.cyberforum.ru/viruses/thread1083273.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 11:12:48 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 21 Nov 2019 23:30:00 GMT
server
sffe
age
1602
vary
Accept-Encoding
content-type
text/css
status
200
cache-control
public, max-age=3000
accept-ranges
bytes
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
2719
x-xss-protection
0
expires
Fri, 22 Nov 2019 12:02:48 GMT
/
ru.aliexpress.com/ Frame 6D08
Redirect Chain
  • https://s.click.aliexpress.com/e/Cvg22nO0?dp=ru_cforum
  • https://ru.aliexpress.com/?dp=ru_cforum&aff_platform=link-c-tool&cpt=1574422770657&sk=Cvg22nO0&aff_trace_key=720095bda6af42a5a880f2a707be66d6-1574422770657-01119-Cvg22nO0&terminal_id=33cd002f02b843...
0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://ru.aliexpress.com/?dp=ru_cforum&aff_platform=link-c-tool&cpt=1574422770657&sk=Cvg22nO0&aff_trace_key=720095bda6af42a5a880f2a707be66d6-1574422770657-01119-Cvg22nO0&terminal_id=33cd002f02b843b6976af3ff12ac7cde
Requested by
Host: www.cyberforum.ru
URL: http://www.cyberforum.ru/viruses/thread1083273.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.45.102.209 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a23-45-102-209.deploy.static.akamaitechnologies.com
Software
Tengine/Aserver /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000 ; includeSubDomains max-age=0
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

:method
GET
:authority
ru.aliexpress.com
:scheme
https
:path
/?dp=ru_cforum&aff_platform=link-c-tool&cpt=1574422770657&sk=Cvg22nO0&aff_trace_key=720095bda6af42a5a880f2a707be66d6-1574422770657-01119-Cvg22nO0&terminal_id=33cd002f02b843b6976af3ff12ac7cde
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
cross-site
sec-fetch-mode
nested-navigate
referer
http://www.cyberforum.ru/viruses/thread1083273.html
accept-encoding
gzip, deflate, br
cookie
ali_apache_id=10.181.15.98.1574422770654.468121.0; xman_us_f=x_l=0&x_as_i=%7B%22aeuCID%22%3A%22720095bda6af42a5a880f2a707be66d6-1574422770657-01119-Cvg22nO0%22%2C%22affiliateKey%22%3A%22Cvg22nO0%22%2C%22channel%22%3A%22AFFILIATE%22%2C%22cv%22%3A%221%22%2C%22ms%22%3A%221%22%2C%22pid%22%3A%222197227320%22%2C%22src%22%3A%22link-c-tool%22%2C%22tagtime%22%3A1574422770657%7D&acs_rt=33cd002f02b843b6976af3ff12ac7cde; acs_usuc_t=x_csrf=eqh916qkn3si&acs_rt=33cd002f02b843b6976af3ff12ac7cde; aeu_cid=720095bda6af42a5a880f2a707be66d6-1574422770657-01119-Cvg22nO0; xman_t=6OtD4wMD0bOystjWV0sHFWwelRA85ybMy3F/WZJDIt9haJdDUrtI9r7OAI5s5ptl; xman_f=vGlOXGIC4/HK55NptHE+Xii2NRWK88eprS+rc10mZIzFRDkNhIoNvkClEL6Fa92S3Sv6fPNrRr+GSJzZ93nqdgqFwHuKLtSvmesSmo/BGVmYU8Yok4IJaQ==
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Referer
http://www.cyberforum.ru/viruses/thread1083273.html

Response headers

status
200
content-type
text/html;charset=UTF-8
vary
Accept-Encoding
p3p
CP="CAO PSA OUR"
x-application-context
ae-buyer-homepage-f:prod:7001
x-content-type-options
nosniff
x-xss-protection
1; mode=block
pragma
no-cache
x-frame-options
DENY
strict-transport-security
max-age=31536000 ; includeSubDomains max-age=0
content-language
ru-RU
content-encoding
gzip
access-control-allow-origin
http://hz.ru.aliexpress.com
server
Tengine/Aserver
eagleeye-traceid
0b0a187b15744227708736278e2903
timing-allow-origin
*
x-akamai-transformed
9 - 0 pmb=mRUM,3
cache-control
must-revalidate, max-age=60
expires
Fri, 22 Nov 2019 11:40:30 GMT
date
Fri, 22 Nov 2019 11:39:30 GMT
set-cookie
xman_us_f=x_locale=ru_RU&x_l=0&x_as_i=%7B%22aeuCID%22%3A%22720095bda6af42a5a880f2a707be66d6-1574422770657-01119-Cvg22nO0%22%2C%22affiliateKey%22%3A%22Cvg22nO0%22%2C%22channel%22%3A%22AFFILIATE%22%2C%22cv%22%3A%221%22%2C%22ms%22%3A%221%22%2C%22pid%22%3A%222197227320%22%2C%22src%22%3A%22link-c-tool%22%2C%22tagtime%22%3A1574422770657%7D&acs_rt=33cd002f02b843b6976af3ff12ac7cde; Domain=.aliexpress.com; Expires=Wed, 10-Dec-2087 14:53:37 GMT; Path=/ intl_locale=ru_RU; Domain=.aliexpress.com; Path=/ aep_usuc_f=site=rus&c_tp=RUB&region=NL&b_locale=ru_RU; Domain=.aliexpress.com; Expires=Wed, 10-Dec-2087 14:53:37 GMT; Path=/ intl_common_forever=3Z9RThKF1SinDgtI+nJAMKoLyooITKcpo32PaJiWlUrLry/S9R86Qw==; Domain=.aliexpress.com; Expires=Wed, 10-Dec-2087 14:53:37 GMT; Path=/; HttpOnly JSESSIONID=678397CEB17097233171857282372019; Path=/; HttpOnly
server-timing
edge; dur=28 origin; dur=54 cdn-cache; desc=MISS
x-akamai-fwd-auth-sha
95D0910ACB15C4B4FD4B28BB908F6FEFFDF54B3DCB3609126863D8C5EC7441FF
x-akamai-fwd-auth-data
430893309, 2.16.181.23, 1574422770, 89.38.96.189
x-akamai-fwd-auth-sign
SbO8AWXqTAsbjfztxQiUdA+8k3fjWzUz8el3jLPC+vrCoLHBoiaDzTQp21g57RcNBUCiZQs0do7ZAROduwEhS8+Lz9Kn+lFAFLUpiLD+PA4=

Redirect headers

status
302
content-length
0
x-application-context
affiliateclick:prod,us:7001
p3p
CP="CAO PSA OUR"
x-content-type-options
nosniff
x-xss-protection
1; mode=block
cache-control
no-cache, no-store, max-age=0, must-revalidate
pragma
no-cache
expires
0
x-frame-options
DENY
strict-transport-security
max-age=31536000 ; includeSubDomains max-age=0
location
https://ru.aliexpress.com/?dp=ru_cforum&aff_platform=link-c-tool&cpt=1574422770657&sk=Cvg22nO0&aff_trace_key=720095bda6af42a5a880f2a707be66d6-1574422770657-01119-Cvg22nO0&terminal_id=33cd002f02b843b6976af3ff12ac7cde
content-language
en-US
server
Tengine/Aserver
eagleeye-traceid
0ab50f6215744227706543713ed510
timing-allow-origin
*
date
Fri, 22 Nov 2019 11:39:30 GMT
set-cookie
ali_apache_id=10.181.15.98.1574422770654.468121.0; path=/; domain=.aliexpress.com; expires=Wed, 30-Nov-2084 01:01:01 GMT xman_us_f=x_l=0&x_as_i=%7B%22aeuCID%22%3A%22720095bda6af42a5a880f2a707be66d6-1574422770657-01119-Cvg22nO0%22%2C%22affiliateKey%22%3A%22Cvg22nO0%22%2C%22channel%22%3A%22AFFILIATE%22%2C%22cv%22%3A%221%22%2C%22ms%22%3A%221%22%2C%22pid%22%3A%222197227320%22%2C%22src%22%3A%22link-c-tool%22%2C%22tagtime%22%3A1574422770657%7D&acs_rt=33cd002f02b843b6976af3ff12ac7cde; Domain=.aliexpress.com; Expires=Wed, 10-Dec-2087 14:53:37 GMT; Path=/ acs_usuc_t=x_csrf=eqh916qkn3si&acs_rt=33cd002f02b843b6976af3ff12ac7cde; Domain=.aliexpress.com; Path=/ aeu_cid=720095bda6af42a5a880f2a707be66d6-1574422770657-01119-Cvg22nO0; Domain=.aliexpress.com; Expires=Wed, 10-Dec-2087 14:53:37 GMT; Path=/ xman_t=6OtD4wMD0bOystjWV0sHFWwelRA85ybMy3F/WZJDIt9haJdDUrtI9r7OAI5s5ptl; Domain=.aliexpress.com; Path=/; HttpOnly xman_f=vGlOXGIC4/HK55NptHE+Xii2NRWK88eprS+rc10mZIzFRDkNhIoNvkClEL6Fa92S3Sv6fPNrRr+GSJzZ93nqdgqFwHuKLtSvmesSmo/BGVmYU8Yok4IJaQ==; Domain=.aliexpress.com; Expires=Wed, 10-Dec-2087 14:53:37 GMT; Path=/; HttpOnly
jquery.min.js
yastatic.net/jquery/1.6.2/ 		89 KB
28 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://yastatic.net/jquery/1.6.2/jquery.min.js
Requested by
Host: site.yandex.net
URL: http://site.yandex.net/v2.0/js/all.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6b8:20::215 , Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
nginx/1.17.6 /
Resource Hash
d16d07a0353405fcec95f7efc50a2621bc7425f9a5e8895078396fb0dc460c4f
Security Headers
Name Value
Strict-Transport-Security max-age=43200000; includeSubDomains;

Request headers

Referer
http://www.cyberforum.ru/viruses/thread1083273.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 11:39:30 GMT
content-encoding
br
x-nginx-request-id
bf0a45e638a503b1
status
200
strict-transport-security
max-age=43200000; includeSubDomains;
content-length
28368
last-modified
Mon, 12 Nov 2018 13:13:42 GMT
server
nginx/1.17.6
etag
"57f5e4ce99f95e1eb0f18d52b65b6769"
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
*
cache-control
max-age=315360000, public
accept-ranges
bytes
timing-allow-origin
*
expires
Thu, 31 Dec 2037 23:55:55 GMT
context_static.js
an.yandex.ru/partner-code-bundles/9830/ 		1 MB
178 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://an.yandex.ru/partner-code-bundles/9830/context_static.js
Requested by
Host: an.yandex.ru
URL: http://an.yandex.ru/system/context.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a02:6b8::90 Moscow, Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
nginx/1.12.2 /
Resource Hash
2d798eabd1fb8f6f9a22386660fba363f7320c6d550819e25693af5be90f0fb0
Security Headers
Name Value
Strict-Transport-Security max-age=43200000; includeSubDomains;, max-age=31536000

Request headers

Referer
http://www.cyberforum.ru/viruses/thread1083273.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 11:39:30 GMT
content-encoding
br
status
200
strict-transport-security
max-age=43200000; includeSubDomains;, max-age=31536000
content-length
181769
last-modified
Thu, 21 Nov 2019 16:15:57 GMT
server
nginx/1.12.2
etag
"83e54781fa94e97c3ebff902ac3a36f7"
x-robots-tag
noindex, noarchive, nofollow
vary
Accept-Encoding
content-type
text/javascript
access-control-allow-origin
*
cache-control
max-age=315360000, public
accept-ranges
bytes
timing-allow-origin
*
expires
Thu, 31 Dec 2037 23:55:55 GMT
015bc845f24402d542b2.js
an.yandex.ru/partner-code-bundles/9832/ 		61 KB
16 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://an.yandex.ru/partner-code-bundles/9832/015bc845f24402d542b2.js
Requested by
Host: an.yandex.ru
URL: http://an.yandex.ru/system/context.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a02:6b8::90 Moscow, Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
nginx/1.12.2 /
Resource Hash
60b73b412aa96b4a6060b5c4e459f79caf0da75c34dba2ea4b8b2fa1f9efcac7
Security Headers
Name Value
Strict-Transport-Security max-age=43200000; includeSubDomains;, max-age=31536000

Request headers

Referer
http://www.cyberforum.ru/viruses/thread1083273.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 11:39:30 GMT
content-encoding
br
status
200
strict-transport-security
max-age=43200000; includeSubDomains;, max-age=31536000
content-length
16244
last-modified
Fri, 22 Nov 2019 08:08:23 GMT
server
nginx/1.12.2
etag
"3e4d54be28db457919d99877020951ac"
x-robots-tag
noindex, noarchive, nofollow
vary
Accept-Encoding
content-type
text/javascript
access-control-allow-origin
*
cache-control
max-age=315360000, public
accept-ranges
bytes
timing-allow-origin
*
expires
Thu, 31 Dec 2037 23:55:55 GMT
hit
counter.yadro.ru/
Redirect Chain
  • http://counter.yadro.ru/hit?t12.2;r;s1600*1200*24;uhttp%3A//www.cyberforum.ru/viruses/thread1083273.html;h%u043F%u043E%u0434%u043E%u0437%u0440%u0435%u043D%u0438%u0435%20%u043D%u0430%20Trojan%20%2C%...
  • http://counter.yadro.ru/hit?q;t12.2;r;s1600*1200*24;uhttp%3A//www.cyberforum.ru/viruses/thread1083273.html;h%u043F%u043E%u0434%u043E%u0437%u0440%u0435%u043D%u0438%u0435%20%u043D%u0430%20Trojan%20%2...
643 B
1012 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://counter.yadro.ru/hit?q;t12.2;r;s1600*1200*24;uhttp%3A//www.cyberforum.ru/viruses/thread1083273.html;h%u043F%u043E%u0434%u043E%u0437%u0440%u0435%u043D%u0438%u0435%20%u043D%u0430%20Trojan%20%2C%u043F%u043E%u0434%u043E%u0437%u0440%u0435%u043D%u0438%u0435%20%u043D%u0430%20Exploit.Win32.IH_Infector.12%20%u0438%20%u041C%u0430%u0441%u043A%u0438%u0440%u043E%u0432%u043A%u0430%20%u043F%u0440;0.5818091402964503
Requested by
Host: www.cyberforum.ru
URL: http://www.cyberforum.ru/viruses/thread1083273.html
Protocol
HTTP/1.1
Server
88.212.201.216 , Russian Federation, ASN39134 (UNITEDNET, RU),
Reverse DNS
host216.rax.ru
Software
0W/0.8c /
Resource Hash
006fc5aa90b103de5c6c0d418aca9250699d5195a4379fe1d0e4425338b1c1b8

Request headers

Referer
http://www.cyberforum.ru/viruses/thread1083273.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 22 Nov 2019 11:39:30 GMT
Server
0W/0.8c
P3P
policyref="/w3c/p3p.xml", CP="UNI"
Cache-control
no-cache
Connection
Close
Content-Type
image/gif
Content-Length
643
Expires
Wed, 21 Nov 2018 21:00:00 GMT

Redirect headers

Pragma
no-cache
Date
Fri, 22 Nov 2019 11:39:30 GMT
Server
0W/0.8c
P3P
policyref="/w3c/p3p.xml", CP="UNI"
Location
http://counter.yadro.ru/hit?q;t12.2;r;s1600*1200*24;uhttp%3A//www.cyberforum.ru/viruses/thread1083273.html;h%u043F%u043E%u0434%u043E%u0437%u0440%u0435%u043D%u0438%u0435%20%u043D%u0430%20Trojan%20%2C%u043F%u043E%u0434%u043E%u0437%u0440%u0435%u043D%u0438%u0435%20%u043D%u0430%20Exploit.Win32.IH_Infector.12%20%u0438%20%u041C%u0430%u0441%u043A%u0438%u0440%u043E%u0432%u043A%u0430%20%u043F%u0440;0.5818091402964503
Cache-control
no-cache
Content-Type
text/html
Content-Length
32
Expires
Wed, 21 Nov 2018 21:00:00 GMT
tag.js
mc.yandex.ru/metrika/ 		357 KB
92 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://mc.yandex.ru/metrika/tag.js
Requested by
Host: www.cyberforum.ru
URL: http://www.cyberforum.ru/viruses/thread1083273.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a02:6b8::1:119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
nginx/1.14.2 /
Resource Hash
40f7f245850cf16c62c5067a36c644b5572e99181b0c9f0e8362184ee8d3f356
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Referer
http://www.cyberforum.ru/viruses/thread1083273.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Date
Fri, 22 Nov 2019 11:39:30 GMT
Content-Encoding
br
Last-Modified
Thu, 07 Nov 2019 13:09:02 GMT
Server
nginx/1.14.2
ETag
"5dc4176e-16cc4"
Strict-Transport-Security
max-age=31536000
Content-Type
application/javascript
Access-Control-Allow-Origin
*
Cache-Control
max-age=3600
Connection
keep-alive
Content-Length
93380
Expires
Fri, 22 Nov 2019 12:39:30 GMT
4.jpg
nohope.ru/picture/ 		95 KB
95 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://nohope.ru/picture/4.jpg
Requested by
Host: www.cyberforum.ru
URL: http://www.cyberforum.ru/viruses/thread1083273.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:30::681c:1eba , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
01ae2758002a42764dcf0a2c9ee34209fd6055eac3725990b4295a4975b5919b

Request headers

Referer
http://www.cyberforum.ru/viruses/thread1083273.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 11:39:30 GMT
cf-cache-status
HIT
last-modified
Fri, 08 Nov 2019 09:53:29 GMT
server
cloudflare
age
4292
etag
"17b31-596d2c1023840"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/jpeg
status
200
cache-control
max-age=18000
accept-ranges
bytes
cf-ray
539a9f8c2c6fcbc4-VIE
content-length
97073
watch.js
mc.yandex.ru/metrika/ 		134 KB
40 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://mc.yandex.ru/metrika/watch.js
Requested by
Host: yastatic.net
URL: http://yastatic.net/share2/share.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a02:6b8::1:119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
nginx/1.14.2 /
Resource Hash
0b7d112c2ae6b83cc1bdc7a9ca03a2c1ed3711dbb13cebc0341ae7af1aead2a0
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Referer
http://www.cyberforum.ru/viruses/thread1083273.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Date
Fri, 22 Nov 2019 11:39:30 GMT
Content-Encoding
br
Last-Modified
Thu, 07 Nov 2019 13:09:02 GMT
Server
nginx/1.14.2
ETag
"5dc4176e-9dc1"
Strict-Transport-Security
max-age=31536000
Content-Type
application/javascript
Access-Control-Allow-Origin
*
Cache-Control
max-age=3600
Connection
keep-alive
Content-Length
40385
Expires
Fri, 22 Nov 2019 12:39:30 GMT
async-ads.js
cse.google.com/adsense/search/ 		164 KB
57 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://cse.google.com/adsense/search/async-ads.js
Requested by
Host: www.google.com
URL: https://www.google.com/cse/static/element/8b2252448421acb3/cse_element__ru.js?usqp=CAI%3D
Protocol
HTTP/1.1
Server
2a00:1450:4001:814::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
ea930be37c682fe48ca6ed96c4fd88393680751f96de939cd41afd3e473b8589
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
http://www.cyberforum.ru/viruses/thread1083273.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Date
Fri, 22 Nov 2019 11:39:30 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Server
sffe
ETag
"3070570587936549570"
Vary
Accept-Encoding
Content-Type
text/javascript; charset=UTF-8
Cache-Control
private, max-age=3600
Transfer-Encoding
chunked
Accept-Ranges
bytes
X-XSS-Protection
0
Expires
Fri, 22 Nov 2019 11:39:30 GMT
truncated
/ 		966 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
2d6b8ecb2f70ad50610c2956c63e8b068d64b18b39ab2d3736fa5a81c8a2cac9

Request headers

Referer
http://www.cyberforum.ru/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		287 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
f64f60b60f581caadfa1cf9b012ca732c4f4a24c8475027e7b7a225f20ce4278

Request headers

Referer
http://www.cyberforum.ru/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		623 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
2462686d344ef1fd4018b47593f655e60e8f0e31c9c6d75e78d2197c3c1f08b7

Request headers

Referer
http://www.cyberforum.ru/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		541 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
0cc98d8e92a98749ce2cc2ecfd5cba57cdffa8e04048f66785646ddd3a2d6f75

Request headers

Referer
http://www.cyberforum.ru/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Content-Type
image/svg+xml
googlelogo_grey_46x15dp.png
www.google.com/cse/static/images/1x/ 		919 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/cse/static/images/1x/googlelogo_grey_46x15dp.png
Requested by
Host: www.cyberforum.ru
URL: http://www.cyberforum.ru/viruses/thread1083273.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:818::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
a844cdc48c7591822e45128a138f1dbba5753a3ca9992bd71c36758d51d0b68e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
http://www.cyberforum.ru/viruses/thread1083273.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Tue, 19 Nov 2019 01:11:47 GMT
x-content-type-options
nosniff
last-modified
Tue, 13 Dec 2016 15:00:00 GMT
server
sffe
age
296863
content-type
image/png
status
200
cache-control
public, max-age=31536000
accept-ranges
bytes
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
919
x-xss-protection
0
expires
Wed, 18 Nov 2020 01:11:47 GMT
generate_204
clients1.google.com/ 		0
83 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://clients1.google.com/generate_204
Requested by
Host: www.cyberforum.ru
URL: http://www.cyberforum.ru/viruses/thread1083273.html
Protocol
HTTP/1.1
Server
2a00:1450:4001:814::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
http://www.cyberforum.ru/viruses/thread1083273.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Date
Fri, 22 Nov 2019 11:39:30 GMT
Content-Length
0
analytics.js
www.google-analytics.com/ 		43 KB
17 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: cdn.jsdelivr.net
URL: https://cdn.jsdelivr.net/npm/cdn4script@1.1.210/dist/codes/croll2.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
dbb67c620eaabf6679a314db18d3ae43037aef71ab27422e6feec08ee987cc0a
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
http://www.cyberforum.ru/viruses/thread1083273.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Mon, 19 Aug 2019 17:22:41 GMT
server
Golfe2
age
3953
date
Fri, 22 Nov 2019 10:33:37 GMT
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=7200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
17803
expires
Fri, 22 Nov 2019 12:33:37 GMT
/
4736.in/sync-iframe/ Frame CAB6 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://4736.in/sync-iframe/
Requested by
Host: cdn.jsdelivr.net
URL: https://cdn.jsdelivr.net/npm/cdn4script@1.1.210/dist/codes/croll2.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
195.201.130.19 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.19.130.201.195.clients.your-server.de
Software
nginx /
Resource Hash

Request headers

Host
4736.in
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
nested-navigate
Referer
http://www.cyberforum.ru/viruses/thread1083273.html
Accept-Encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Referer
http://www.cyberforum.ru/viruses/thread1083273.html

Response headers

Server
nginx
Date
Fri, 22 Nov 2019 11:39:30 GMT
Content-Type
text/html
Transfer-Encoding
chunked
Connection
keep-alive
Access-Control-Allow-Credentials
true
Access-Control-Allow-Headers
Access-Control-Allow-Method
GET,POST,OPTIONS
Access-Control-Allow-Origin
Cache-Control
private, max-age=0, no-cache
Content-Encoding
gzip
collect
stats.g.doubleclick.net/r/
Redirect Chain
  • https://www.google-analytics.com/r/collect?v=1&_v=j79&a=1811489031&t=pageview&_s=1&dl=http%3A%2F%2Fwww.cyberforum.ru%2Fviruses%2Fthread1083273.html&ul=en-us&de=UTF-8&dt=%D0%BF%D0%BE%D0%B4%D0%BE%D0%...
  • https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-109426955-32&cid=1743422902.1574422771&jid=1283257664&_gid=264877262.1574422771&gjid=1471484640&_v=j79&z=1611292114
35 B
102 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-109426955-32&cid=1743422902.1574422771&jid=1283257664&_gid=264877262.1574422771&gjid=1471484640&_v=j79&z=1611292114
Requested by
Host: www.cyberforum.ru
URL: http://www.cyberforum.ru/viruses/thread1083273.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400c:c08::9b Brussels, Belgium, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
http://www.cyberforum.ru/viruses/thread1083273.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

pragma
no-cache
strict-transport-security
max-age=10886400; includeSubDomains; preload
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
access-control-allow-origin
*
date
Fri, 22 Nov 2019 11:39:30 GMT
content-type
image/gif
status
200
cache-control
no-cache, no-store, must-revalidate
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
35
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Fri, 22 Nov 2019 11:39:30 GMT
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
access-control-allow-origin
*
location
https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-109426955-32&cid=1743422902.1574422771&jid=1283257664&_gid=264877262.1574422771&gjid=1471484640&_v=j79&z=1611292114
content-type
text/html; charset=UTF-8
status
302
cache-control
no-cache, no-store, must-revalidate
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
421
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.de/ads/
Redirect Chain
  • https://www.google-analytics.com/r/collect?v=1&_v=j79&a=1811489031&t=pageview&_s=1&dl=http%3A%2F%2Fwww.cyberforum.ru%2Fviruses%2Fthread1083273.html&ul=en-us&de=UTF-8&dt=%D0%BF%D0%BE%D0%B4%D0%BE%D0%...
  • https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-595018-2&cid=1743422902.1574422771&jid=416891654&_gid=264877262.1574422771&gjid=220206980&_v=j79&z=1342028841
  • https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-595018-2&cid=1743422902.1574422771&jid=416891654&_v=j79&z=1342028841
  • https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-595018-2&cid=1743422902.1574422771&jid=416891654&_v=j79&z=1342028841&slf_rd=1&random=2052656658
42 B
109 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-595018-2&cid=1743422902.1574422771&jid=416891654&_v=j79&z=1342028841&slf_rd=1&random=2052656658
Requested by
Host: www.cyberforum.ru
URL: http://www.cyberforum.ru/viruses/thread1083273.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
http://www.cyberforum.ru/viruses/thread1083273.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 22 Nov 2019 11:39:30 GMT
x-content-type-options
nosniff
content-type
image/gif
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
no-cache, no-store, must-revalidate
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Fri, 22 Nov 2019 11:39:30 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
location
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-595018-2&cid=1743422902.1574422771&jid=416891654&_v=j79&z=1342028841&slf_rd=1&random=2052656658
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
302
cache-control
no-cache, no-store, must-revalidate
content-type
text/html; charset=UTF-8
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
suggest.js
site.yandex.net/v2.0/js/ 		9 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://site.yandex.net/v2.0/js/suggest.js
Requested by
Host: site.yandex.net
URL: http://site.yandex.net/v2.0/js/all.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6b8:20::215 , Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
nginx/1.17.6 /
Resource Hash
7768ed4ae55bae0566763dcedb03a2b686e9680ea3d0f89e2d0b4090c67515c7

Request headers

Referer
http://www.cyberforum.ru/viruses/thread1083273.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 11:39:30 GMT
content-encoding
br
last-modified
Fri, 21 Jun 2019 10:13:03 GMT
server
nginx/1.17.6
access-control-allow-origin
*
etag
W/"fa418164e4ad6b885cd81ae25bdbbb69"
vary
Accept-Encoding
content-type
application/x-javascript
status
200
cache-control
max-age=21600
x-nginx-request-id
351539158a3ee463
expires
Fri, 22 Nov 2019 17:39:22 GMT
opensearch.js
site.yandex.net/v2.0/js/ 		36 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://site.yandex.net/v2.0/js/opensearch.js
Requested by
Host: site.yandex.net
URL: http://site.yandex.net/v2.0/js/all.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6b8:20::215 , Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
nginx/1.17.6 /
Resource Hash
bab9fac841ecb978dd2ad6c8946d088be9dba8aedb275ac15bbdb6f07a30d67f

Request headers

Referer
http://www.cyberforum.ru/viruses/thread1083273.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 11:39:30 GMT
content-encoding
br
last-modified
Fri, 21 Jun 2019 10:13:03 GMT
server
nginx/1.17.6
access-control-allow-origin
*
etag
W/"db09bd85396d8ad5cec24d4909fe523d"
vary
Accept-Encoding
content-type
application/x-javascript
status
200
cache-control
max-age=21600
x-nginx-request-id
0767e6f27cc9414b
expires
Fri, 22 Nov 2019 17:36:55 GMT
yandex-hint-rb.png
site.yandex.net/v2.0/i/ 		425 B
667 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://site.yandex.net/v2.0/i/yandex-hint-rb.png
Requested by
Host: www.cyberforum.ru
URL: http://www.cyberforum.ru/viruses/thread1083273.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6b8:20::215 , Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
nginx/1.17.6 /
Resource Hash
3db7135d424b421c0c412fd4504afd0f744698be1df3f009027159627de5ff8f
Security Headers
Name Value
Strict-Transport-Security max-age=43200000; includeSubDomains;

Request headers

Referer
http://www.cyberforum.ru/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 11:39:30 GMT
last-modified
Fri, 21 Jun 2019 10:13:03 GMT
server
nginx/1.17.6
etag
"fbe624b4939c4538e386beffac5861f6"
vary
Accept-Encoding
content-type
image/png
status
200
strict-transport-security
max-age=43200000; includeSubDomains;
accept-ranges
bytes
content-length
425
x-nginx-request-id
148710433a17a2ef
punycode.js
site.yandex.net/v2.0/js/ 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://site.yandex.net/v2.0/js/punycode.js
Requested by
Host: site.yandex.net
URL: http://site.yandex.net/v2.0/js/all.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6b8:20::215 , Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
nginx/1.17.6 /
Resource Hash
d5f57ef3e0959d2bb2dc683c08a006db9907409c87ccf4ca110a4ea141ab05eb
Security Headers
Name Value
Strict-Transport-Security max-age=43200000; includeSubDomains;

Request headers

Referer
http://www.cyberforum.ru/viruses/thread1083273.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 11:39:30 GMT
content-encoding
br
last-modified
Fri, 21 Jun 2019 10:13:03 GMT
server
nginx/1.17.6
etag
W/"6535e52bf844a80361fc74e3a878794c"
vary
Accept-Encoding
content-type
application/x-javascript
status
200
strict-transport-security
max-age=43200000; includeSubDomains;
x-nginx-request-id
d7b8467f74e65194
17
aliadvert.ru/t/cyberforumru/View/ 		0
487 B 		XHR
General
Check archive.org
Download Go to
Full URL
http://aliadvert.ru/t/cyberforumru/View/17
Requested by
Host: aliadvert.ru
URL: https://aliadvert.ru/cyberforumru
Protocol
HTTP/1.1
Server
2606:4700:e2::ac40:8c25 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare / Express
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Referer
http://www.cyberforum.ru/viruses/thread1083273.html
Origin
http://www.cyberforum.ru

Response headers

Date
Fri, 22 Nov 2019 11:39:30 GMT
CF-Cache-Status
DYNAMIC
Server
cloudflare
X-Powered-By
Express
Transfer-Encoding
chunked
Access-Control-Allow-Origin
http://www.cyberforum.ru
Access-Control-Allow-Credentials
true
Connection
keep-alive
CF-RAY
539a9f8d0f71c2e5-FRA
truncated
/ 		10 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
4b76d229fffd06e56152502366fdefa175937e53c22b00325ffe23443eb73e03

Request headers

Referer
http://www.cyberforum.ru/viruses/thread1083273.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Content-Type
image/jpeg
2
aliadvert.ru/t/cyberforumru/Stuffing/ 		0
495 B 		XHR
General
Check archive.org
Download Go to
Full URL
http://aliadvert.ru/t/cyberforumru/Stuffing/2
Requested by
Host: aliadvert.ru
URL: https://aliadvert.ru/cyberforumru
Protocol
HTTP/1.1
Server
2606:4700:e2::ac40:8c25 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare / Express
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Referer
http://www.cyberforum.ru/viruses/thread1083273.html
Origin
http://www.cyberforum.ru

Response headers

Date
Fri, 22 Nov 2019 11:39:30 GMT
CF-Cache-Status
DYNAMIC
Server
cloudflare
X-Powered-By
Express
Transfer-Encoding
chunked
Access-Control-Allow-Origin
http://www.cyberforum.ru
Access-Control-Allow-Credentials
true
Connection
keep-alive
CF-RAY
539a9f8d1e4e64f1-FRA
Cookie set /
epnclick.ru/redirect/cpa/o/psmm3rf4havca49b2h5036s1vs0olsny/ Frame 6674 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://epnclick.ru/redirect/cpa/o/psmm3rf4havca49b2h5036s1vs0olsny/?sub=cyberforumru&sub1=cyberforumru&af_sub=245&click_id=658867&sub2=28
Requested by
Host: aliadvert.ru
URL: https://aliadvert.ru/cyberforumru
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
195.24.73.119 , Luxembourg, ASN5577 (ROOT, LU),
Reverse DNS
ip-static-195-24-73-119.server.lu
Software
nginx /
Resource Hash

Request headers

Host
epnclick.ru
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
nested-navigate
Referer
http://www.cyberforum.ru/viruses/thread1083273.html
Accept-Encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Referer
http://www.cyberforum.ru/viruses/thread1083273.html

Response headers

Server
nginx
Date
Fri, 22 Nov 2019 11:39:30 GMT
Content-Type
text/html; charset=UTF-8
Transfer-Encoding
chunked
Connection
keep-alive
Set-Cookie
cpa=5dd7c8f2ca7d5; expires=Sat, 23-Nov-2019 11:39:30 GMT; Max-Age=86400; path=/ cpa_607=5dd7c8f2ca7e8; expires=Sat, 23-Nov-2019 11:39:30 GMT; Max-Age=86400; path=/ cl1=5dd7c8f2ca7f0; expires=Mon, 25-Nov-2019 11:39:30 GMT; Max-Age=259200; path=/ clidd=607; expires=Fri, 22-Nov-2019 12:39:30 GMT; Max-Age=3600; path=/ clids[1574422770]=43q1dcdu4x93vpfuteur6srxx28gkhce; expires=Sat, 21-Nov-2020 11:39:30 GMT; Max-Age=31536000; path=/ uuid=43q1dcdu4x93vpfuteur6srxx28gkhce; expires=Mon, 19-Nov-2029 11:39:30 GMT; Max-Age=315360000; path=/
Request-ID
20022e381871eafaf7002e216e450487
Content-Encoding
gzip
28
aliadvert.ru/t/cyberforumru/Stuffing/ 		0
495 B 		XHR
General
Check archive.org
Download Go to
Full URL
http://aliadvert.ru/t/cyberforumru/Stuffing/28
Requested by
Host: aliadvert.ru
URL: https://aliadvert.ru/cyberforumru
Protocol
HTTP/1.1
Server
2606:4700:e2::ac40:8c25 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare / Express
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Referer
http://www.cyberforum.ru/viruses/thread1083273.html
Origin
http://www.cyberforum.ru

Response headers

Date
Fri, 22 Nov 2019 11:39:30 GMT
CF-Cache-Status
DYNAMIC
Server
cloudflare
X-Powered-By
Express
Transfer-Encoding
chunked
Access-Control-Allow-Origin
http://www.cyberforum.ru
Access-Control-Allow-Credentials
true
Connection
keep-alive
CF-RAY
539a9f8d1d1963b9-FRA
aff_new_user.htm
sale.aliexpress.com/__pc/
Redirect Chain
  • https://s.click.aliexpress.com/e/DziQooLW?dp=cyberforumru
  • https://sale.aliexpress.com/aff_new_user.htm?lan=en&tmLog=best_to_affi_new_v2_4860&dp=cyberforumru&aff_platform=link-c-tool&cpt=1574422770820&sk=DziQooLW&aff_trace_key=cf4a9ce4b0b2497a912ffa4645878...
  • https://sale.aliexpress.com/__pc/aff_new_user.htm?lan=en&tmLog=best_to_affi_new_v2_4860&dp=cyberforumru&aff_platform=link-c-tool&cpt=1574422770820&sk=DziQooLW&aff_trace_key=cf4a9ce4b0b2497a912ffa46...
0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sale.aliexpress.com/__pc/aff_new_user.htm?lan=en&tmLog=best_to_affi_new_v2_4860&dp=cyberforumru&aff_platform=link-c-tool&cpt=1574422770820&sk=DziQooLW&aff_trace_key=cf4a9ce4b0b2497a912ffa46458787f0-1574422770820-04791-DziQooLW&terminal_id=740406f87d5d4ed1841b3d829353104e
Requested by
Host: www.cyberforum.ru
URL: http://www.cyberforum.ru/viruses/thread1083273.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.45.236.130 , United States, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a23-45-236-130.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
http://www.cyberforum.ru/viruses/thread1083273.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Redirect headers

strict-transport-security
max-age=31536000 ; includeSubDomains, max-age=31536000
x-content-type-options
nosniff
server
Tengine/Aserver
date
Fri, 22 Nov 2019 11:39:31 GMT
location
https://sale.aliexpress.com/__pc/aff_new_user.htm?lan=en&tmLog=best_to_affi_new_v2_4860&dp=cyberforumru&aff_platform=link-c-tool&cpt=1574422770820&sk=DziQooLW&aff_trace_key=cf4a9ce4b0b2497a912ffa46458787f0-1574422770820-04791-DziQooLW&terminal_id=740406f87d5d4ed1841b3d829353104e
p3p
CP="CAO PSA OUR"
status
302
cache-control
public, no-transform, max-age=0, s-maxage=0
eagleeye-traceid
0ab6f82315744227711544034e473f
timing-allow-origin
*
content-length
0
x-xss-protection
1; mode=block
expires
Fri, 22 Nov 2019 11:39:31 GMT
/
4736.in/code-block/ 		0
334 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://4736.in/code-block/?pid6=1346&ref=www.cyberforum.ru&msg=cross-coding
Requested by
Host: www.cyberforum.ru
URL: http://www.cyberforum.ru/viruses/thread1083273.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
195.201.130.19 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.19.130.201.195.clients.your-server.de
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
http://www.cyberforum.ru/viruses/thread1083273.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Date
Fri, 22 Nov 2019 11:39:30 GMT
Server
nginx
Content-Type
image/gif
Access-Control-Allow-Origin
Cache-Control
private, max-age=0, no-cache
Access-Control-Allow-Credentials
true
Connection
keep-alive
Access-Control-Allow-Headers
Content-Length
0
Access-Control-Allow-Method
GET,POST,OPTIONS
29317
an.yandex.ru/meta/
Redirect Chain
  • https://an.yandex.ru/meta/29317?grab=dNC_0L7QtNC-0LfRgNC10L3QuNC1INC90LAgVHJvamFuICzQv9C-0LTQvtC30YDQtdC90LjQtSDQvdCwIEV4cGxvaXQuV2luMzIuSUhfSW5mZWN0b3IuMTIg0Lgg0JzQsNGB0LrQuNGA0L7QstC60LAg0L_RgNC-...
  • https://an.yandex.ru/meta/29317?redir-setuniq=1&grab=dNC_0L7QtNC-0LfRgNC10L3QuNC1INC90LAgVHJvamFuICzQv9C-0LTQvtC30YDQtdC90LjQtSDQvdCwIEV4cGxvaXQuV2luMzIuSUhfSW5mZWN0b3IuMTIg0Lgg0JzQsNGB0LrQuNGA0L7Q...
0
-1 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://an.yandex.ru/meta/29317?redir-setuniq=1&grab=dNC_0L7QtNC-0LfRgNC10L3QuNC1INC90LAgVHJvamFuICzQv9C-0LTQvtC30YDQtdC90LjQtSDQvdCwIEV4cGxvaXQuV2luMzIuSUhfSW5mZWN0b3IuMTIg0Lgg0JzQsNGB0LrQuNGA0L7QstC60LAg0L_RgNC-0YbQtdGB0YHQsCAtINCj0LTQsNC70LXQvdC40LUg0LLQuNGA0YPRgdC-0LIgLSDQmtC40LHQtdGA0YTQvtGA0YPQvAox0L_QvtC00L7Qt9GA0LXQvdC40LUg0L3QsCBUcm9qYW4gLNC_0L7QtNC-0LfRgNC10L3QuNC1INC90LAgRXhwbG9pdC5XaW4zMi5JSF9JbmZlY3Rvci4xMiDQuCDQnNCw0YHQutC40YDQvtCy0LrQsCDQv9GA0L7RhtC10YHRgdCwIAo%3D&target-ref=http%3A%2F%2Fwww.cyberforum.ru%2Fviruses%2Fthread1083273.html&charset=utf-8&imp-id=1&enable-flat-highlight=1&test-tag=337550069727234&ad-session-id=3386441574422770509&target-id=17181348&pcode-version=9830&flash-ver=0&layout-config=%7B%22win_width%22%3A1600%2C%22win_height%22%3A1200%2C%22width%22%3A0%2C%22height%22%3A0%2C%22left%22%3A793%2C%22top%22%3A122%2C%22visible%22%3A1%2C%22ad_no%22%3A0%2C%22req_no%22%3A0%7D&callback=Ya%5B2755144854384%5D
Requested by
Host: www.cyberforum.ru
URL: http://www.cyberforum.ru/viruses/thread1083273.html
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a02:6b8::90 Moscow, Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
nginx/1.12.2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 1; mode=block

Request headers

Referer
http://www.cyberforum.ru/viruses/thread1083273.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 22 Nov 2019 11:39:30 GMT
last-modified
Fri, 22 Nov 2019 11:39:30 GMT
server
nginx/1.12.2
access-control-allow-origin
http://www.cyberforum.ru
location
https://an.yandex.ru/meta/29317?redir-setuniq=1&grab=dNC_0L7QtNC-0LfRgNC10L3QuNC1INC90LAgVHJvamFuICzQv9C-0LTQvtC30YDQtdC90LjQtSDQvdCwIEV4cGxvaXQuV2luMzIuSUhfSW5mZWN0b3IuMTIg0Lgg0JzQsNGB0LrQuNGA0L7QstC60LAg0L_RgNC-0YbQtdGB0YHQsCAtINCj0LTQsNC70LXQvdC40LUg0LLQuNGA0YPRgdC-0LIgLSDQmtC40LHQtdGA0YTQvtGA0YPQvAox0L_QvtC00L7Qt9GA0LXQvdC40LUg0L3QsCBUcm9qYW4gLNC_0L7QtNC-0LfRgNC10L3QuNC1INC90LAgRXhwbG9pdC5XaW4zMi5JSF9JbmZlY3Rvci4xMiDQuCDQnNCw0YHQutC40YDQvtCy0LrQsCDQv9GA0L7RhtC10YHRgdCwIAo%3D&target-ref=http%3A%2F%2Fwww.cyberforum.ru%2Fviruses%2Fthread1083273.html&charset=utf-8&imp-id=1&enable-flat-highlight=1&test-tag=337550069727234&ad-session-id=3386441574422770509&target-id=17181348&pcode-version=9830&flash-ver=0&layout-config=%7B%22win_width%22%3A1600%2C%22win_height%22%3A1200%2C%22width%22%3A0%2C%22height%22%3A0%2C%22left%22%3A793%2C%22top%22%3A122%2C%22visible%22%3A1%2C%22ad_no%22%3A0%2C%22req_no%22%3A0%7D&callback=Ya%5B2755144854384%5D
p3p
CP="NOI DEVa TAIa OUR BUS UNI STA"
status
302
cache-control
private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials
true
timing-allow-origin
*
content-length
0
x-xss-protection
1; mode=block
expires
Fri, 22 Nov 2019 11:39:30 GMT

Redirect headers

pragma
no-cache
date
Fri, 22 Nov 2019 11:39:30 GMT
last-modified
Fri, 22 Nov 2019 11:39:30 GMT
server
nginx/1.12.2
status
302
location
https://an.yandex.ru/meta/29317?redir-setuniq=1&grab=dNC_0L7QtNC-0LfRgNC10L3QuNC1INC90LAgVHJvamFuICzQv9C-0LTQvtC30YDQtdC90LjQtSDQvdCwIEV4cGxvaXQuV2luMzIuSUhfSW5mZWN0b3IuMTIg0Lgg0JzQsNGB0LrQuNGA0L7QstC60LAg0L_RgNC-0YbQtdGB0YHQsCAtINCj0LTQsNC70LXQvdC40LUg0LLQuNGA0YPRgdC-0LIgLSDQmtC40LHQtdGA0YTQvtGA0YPQvAox0L_QvtC00L7Qt9GA0LXQvdC40LUg0L3QsCBUcm9qYW4gLNC_0L7QtNC-0LfRgNC10L3QuNC1INC90LAgRXhwbG9pdC5XaW4zMi5JSF9JbmZlY3Rvci4xMiDQuCDQnNCw0YHQutC40YDQvtCy0LrQsCDQv9GA0L7RhtC10YHRgdCwIAo%3D&target-ref=http%3A%2F%2Fwww.cyberforum.ru%2Fviruses%2Fthread1083273.html&charset=utf-8&imp-id=1&enable-flat-highlight=1&test-tag=337550069727234&ad-session-id=3386441574422770509&target-id=17181348&pcode-version=9830&flash-ver=0&layout-config=%7B%22win_width%22%3A1600%2C%22win_height%22%3A1200%2C%22width%22%3A0%2C%22height%22%3A0%2C%22left%22%3A793%2C%22top%22%3A122%2C%22visible%22%3A1%2C%22ad_no%22%3A0%2C%22req_no%22%3A0%7D&callback=Ya%5B2755144854384%5D
p3p
CP="NOI DEVa TAIa OUR BUS UNI STA"
access-control-allow-origin
http://www.cyberforum.ru
cache-control
private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials
true
timing-allow-origin
*
content-length
0
x-xss-protection
1; mode=block
expires
Fri, 22 Nov 2019 11:39:30 GMT
1
mc.yandex.ru/watch/26812653/
Redirect Chain
  • https://mc.yandex.ru/watch/26812653?wmode=7&page-url=http%3A%2F%2Fwww.cyberforum.ru%2Fviruses%2Fthread1083273.html&charset=utf-8&site-info=%7B%22jquery%22%3Atrue%2C%22version%22%3A%222.2.4%22%2C%22...
  • https://mc.yandex.ru/watch/26812653/1?wmode=7&page-url=http%3A%2F%2Fwww.cyberforum.ru%2Fviruses%2Fthread1083273.html&charset=utf-8&site-info=%7B%22jquery%22%3Atrue%2C%22version%22%3A%222.2.4%22%2C%...
0
-1 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://mc.yandex.ru/watch/26812653/1?wmode=7&page-url=http%3A%2F%2Fwww.cyberforum.ru%2Fviruses%2Fthread1083273.html&charset=utf-8&site-info=%7B%22jquery%22%3Atrue%2C%22version%22%3A%222.2.4%22%2C%22shareVersion%22%3A2%7D&browser-info=ti%3A10%3Ans%3A1574422769473%3As%3A1600x1200x24%3Ask%3A1%3Ahdl%3A1%3Afpr%3A216613626101%3Acn%3A1%3Aw%3A1585x1200%3Az%3A60%3Ai%3A20191122123930%3Aet%3A1574422771%3Aen%3Autf-8%3Ac%3A1%3Ala%3Aen-us%3Apv%3A1%3Arn%3A470496104%3Ahid%3A125359108%3Ads%3A1%2C18%2C513%2C47%2C1%2C0%2C0%2C560%2C22%2C%2C%2C%2C1100%3Afp%3A834%3Agdpr%3A14%3Av%3A1744%3Ast%3A1574422771%3Au%3A1574422771233816621%3At%3A%D0%BF%D0%BE%D0%B4%D0%BE%D0%B7%D1%80%D0%B5%D0%BD%D0%B8%D0%B5%20%D0%BD%D0%B0%20Trojan%20%2C%D0%BF%D0%BE%D0%B4%D0%BE%D0%B7%D1%80%D0%B5%D0%BD%D0%B8%D0%B5%20%D0%BD%D0%B0%20Exploit.Win32.IH_Infector.12%20%D0%B8%20%D0%9C%D0%B0%D1%81%D0%BA%D0%B8%D1%80%D0%BE%D0%B2%D0%BA%D0%B0%20%D0%BF%D1%80%D0%BE%D1%86%D0%B5%D1%81%D1%81%D0%B0%20-%20%D0%A3%D0%B4%D0%B0%D0%BB%D0%B5%D0%BD%D0%B8%D0%B5%20%D0%B2%D0%B8%D1%80%D1%83%D1%81%D0%BE%D0%B2%20-%20%D0%9A%D0%B8%D0%B1%D0%B5%D1%80%D1%84%D0%BE%D1%80%D1%83%D0%BC
Requested by
Host: www.cyberforum.ru
URL: http://www.cyberforum.ru/viruses/thread1083273.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a02:6b8::1:119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
nginx/1.14.2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Xss-Protection 1; mode=block

Request headers

Referer
http://www.cyberforum.ru/viruses/thread1083273.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 22 Nov 2019 11:39:30 GMT
Last-Modified
Fri, 22-Nov-2019 11:39:30 GMT
Server
nginx/1.14.2
Location
/watch/26812653/1?wmode=7&page-url=http%3A%2F%2Fwww.cyberforum.ru%2Fviruses%2Fthread1083273.html&charset=utf-8&site-info=%7B%22jquery%22%3Atrue%2C%22version%22%3A%222.2.4%22%2C%22shareVersion%22%3A2%7D&browser-info=ti%3A10%3Ans%3A1574422769473%3As%3A1600x1200x24%3Ask%3A1%3Ahdl%3A1%3Afpr%3A216613626101%3Acn%3A1%3Aw%3A1585x1200%3Az%3A60%3Ai%3A20191122123930%3Aet%3A1574422771%3Aen%3Autf-8%3Ac%3A1%3Ala%3Aen-us%3Apv%3A1%3Arn%3A470496104%3Ahid%3A125359108%3Ads%3A1%2C18%2C513%2C47%2C1%2C0%2C0%2C560%2C22%2C%2C%2C%2C1100%3Afp%3A834%3Agdpr%3A14%3Av%3A1744%3Ast%3A1574422771%3Au%3A1574422771233816621%3At%3A%D0%BF%D0%BE%D0%B4%D0%BE%D0%B7%D1%80%D0%B5%D0%BD%D0%B8%D0%B5%20%D0%BD%D0%B0%20Trojan%20%2C%D0%BF%D0%BE%D0%B4%D0%BE%D0%B7%D1%80%D0%B5%D0%BD%D0%B8%D0%B5%20%D0%BD%D0%B0%20Exploit.Win32.IH_Infector.12%20%D0%B8%20%D0%9C%D0%B0%D1%81%D0%BA%D0%B8%D1%80%D0%BE%D0%B2%D0%BA%D0%B0%20%D0%BF%D1%80%D0%BE%D1%86%D0%B5%D1%81%D1%81%D0%B0%20-%20%D0%A3%D0%B4%D0%B0%D0%BB%D0%B5%D0%BD%D0%B8%D0%B5%20%D0%B2%D0%B8%D1%80%D1%83%D1%81%D0%BE%D0%B2%20-%20%D0%9A%D0%B8%D0%B1%D0%B5%D1%80%D1%84%D0%BE%D1%80%D1%83%D0%BC
Strict-Transport-Security
max-age=31536000
Access-Control-Allow-Origin
http://www.cyberforum.ru
Cache-Control
private, no-cache, no-store, must-revalidate, max-age=0
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
0
X-XSS-Protection
1; mode=block
Expires
Fri, 22-Nov-2019 11:39:30 GMT

Redirect headers

Pragma
no-cache
Date
Fri, 22 Nov 2019 11:39:30 GMT
Last-Modified
Fri, 22-Nov-2019 11:39:30 GMT
Server
nginx/1.14.2
Access-Control-Allow-Origin
http://www.cyberforum.ru
Strict-Transport-Security
max-age=31536000
Location
/watch/26812653/1?wmode=7&page-url=http%3A%2F%2Fwww.cyberforum.ru%2Fviruses%2Fthread1083273.html&charset=utf-8&site-info=%7B%22jquery%22%3Atrue%2C%22version%22%3A%222.2.4%22%2C%22shareVersion%22%3A2%7D&browser-info=ti%3A10%3Ans%3A1574422769473%3As%3A1600x1200x24%3Ask%3A1%3Ahdl%3A1%3Afpr%3A216613626101%3Acn%3A1%3Aw%3A1585x1200%3Az%3A60%3Ai%3A20191122123930%3Aet%3A1574422771%3Aen%3Autf-8%3Ac%3A1%3Ala%3Aen-us%3Apv%3A1%3Arn%3A470496104%3Ahid%3A125359108%3Ads%3A1%2C18%2C513%2C47%2C1%2C0%2C0%2C560%2C22%2C%2C%2C%2C1100%3Afp%3A834%3Agdpr%3A14%3Av%3A1744%3Ast%3A1574422771%3Au%3A1574422771233816621%3At%3A%D0%BF%D0%BE%D0%B4%D0%BE%D0%B7%D1%80%D0%B5%D0%BD%D0%B8%D0%B5%20%D0%BD%D0%B0%20Trojan%20%2C%D0%BF%D0%BE%D0%B4%D0%BE%D0%B7%D1%80%D0%B5%D0%BD%D0%B8%D0%B5%20%D0%BD%D0%B0%20Exploit.Win32.IH_Infector.12%20%D0%B8%20%D0%9C%D0%B0%D1%81%D0%BA%D0%B8%D1%80%D0%BE%D0%B2%D0%BA%D0%B0%20%D0%BF%D1%80%D0%BE%D1%86%D0%B5%D1%81%D1%81%D0%B0%20-%20%D0%A3%D0%B4%D0%B0%D0%BB%D0%B5%D0%BD%D0%B8%D0%B5%20%D0%B2%D0%B8%D1%80%D1%83%D1%81%D0%BE%D0%B2%20-%20%D0%9A%D0%B8%D0%B1%D0%B5%D1%80%D1%84%D0%BE%D1%80%D1%83%D0%BC
Cache-Control
private, no-cache, no-store, must-revalidate, max-age=0
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
0
X-XSS-Protection
1; mode=block
Expires
Fri, 22-Nov-2019 11:39:30 GMT
29317
an.yandex.ru/meta/ 		1 KB
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://an.yandex.ru/meta/29317?redir-setuniq=1&grab=dNC_0L7QtNC-0LfRgNC10L3QuNC1INC90LAgVHJvamFuICzQv9C-0LTQvtC30YDQtdC90LjQtSDQvdCwIEV4cGxvaXQuV2luMzIuSUhfSW5mZWN0b3IuMTIg0Lgg0JzQsNGB0LrQuNGA0L7QstC60LAg0L_RgNC-0YbQtdGB0YHQsCAtINCj0LTQsNC70LXQvdC40LUg0LLQuNGA0YPRgdC-0LIgLSDQmtC40LHQtdGA0YTQvtGA0YPQvAox0L_QvtC00L7Qt9GA0LXQvdC40LUg0L3QsCBUcm9qYW4gLNC_0L7QtNC-0LfRgNC10L3QuNC1INC90LAgRXhwbG9pdC5XaW4zMi5JSF9JbmZlY3Rvci4xMiDQuCDQnNCw0YHQutC40YDQvtCy0LrQsCDQv9GA0L7RhtC10YHRgdCwIAo%3D&target-ref=http%3A%2F%2Fwww.cyberforum.ru%2Fviruses%2Fthread1083273.html&charset=utf-8&imp-id=1&enable-flat-highlight=1&test-tag=337550069727234&ad-session-id=3386441574422770509&target-id=17181348&pcode-version=9830&flash-ver=0&layout-config=%7B%22win_width%22%3A1600%2C%22win_height%22%3A1200%2C%22width%22%3A0%2C%22height%22%3A0%2C%22left%22%3A793%2C%22top%22%3A122%2C%22visible%22%3A1%2C%22ad_no%22%3A0%2C%22req_no%22%3A0%7D&callback=Ya%5B2755144854384%5D
Requested by
Host: www.cyberforum.ru
URL: http://www.cyberforum.ru/viruses/thread1083273.html
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a02:6b8::90 Moscow, Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
nginx/1.12.2 /
Resource Hash
f986b7d7773b9fa859b1c01edc18e86004f3978468c9bd363f418476f8d3980f
Security Headers
Name Value
X-Xss-Protection 1; mode=block

Request headers

Referer
http://www.cyberforum.ru/viruses/thread1083273.html
Origin
http://www.cyberforum.ru
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

pragma
no-cache
date
Fri, 22 Nov 2019 11:39:31 GMT
content-encoding
gzip
last-modified
Fri, 22 Nov 2019 11:39:31 GMT
server
nginx/1.12.2
timing-allow-origin
*
status
200
p3p
CP="NOI DEVa TAIa OUR BUS UNI STA"
access-control-allow-origin
http://www.cyberforum.ru
cache-control
private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials
true
content-type
application/x-javascript; charset=utf-8
x-xss-protection
1; mode=block
expires
Fri, 22 Nov 2019 11:39:31 GMT
advert.gif
mc.yandex.ru/metrika/ 		43 B
445 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://mc.yandex.ru/metrika/advert.gif
Requested by
Host: www.cyberforum.ru
URL: http://www.cyberforum.ru/viruses/thread1083273.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a02:6b8::1:119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
nginx/1.14.2 /
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Referer
http://www.cyberforum.ru/viruses/thread1083273.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Date
Fri, 22 Nov 2019 11:39:30 GMT
Content-Encoding
gzip
Last-Modified
Mon, 12 Oct 2015 13:09:09 GMT
Server
nginx/1.14.2
ETag
"561bb0f5-3d"
Strict-Transport-Security
max-age=31536000
Content-Type
image/gif
Access-Control-Allow-Origin
*
Cache-Control
max-age=3600
Connection
keep-alive
Content-Length
61
Expires
Fri, 22 Nov 2019 12:39:30 GMT
1
mc.yandex.ru/watch/26812653/ 		133 B
685 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://mc.yandex.ru/watch/26812653/1?wmode=7&page-url=http%3A%2F%2Fwww.cyberforum.ru%2Fviruses%2Fthread1083273.html&charset=utf-8&site-info=%7B%22jquery%22%3Atrue%2C%22version%22%3A%222.2.4%22%2C%22shareVersion%22%3A2%7D&browser-info=ti%3A10%3Ans%3A1574422769473%3As%3A1600x1200x24%3Ask%3A1%3Ahdl%3A1%3Afpr%3A216613626101%3Acn%3A1%3Aw%3A1585x1200%3Az%3A60%3Ai%3A20191122123930%3Aet%3A1574422771%3Aen%3Autf-8%3Ac%3A1%3Ala%3Aen-us%3Apv%3A1%3Arn%3A470496104%3Ahid%3A125359108%3Ads%3A1%2C18%2C513%2C47%2C1%2C0%2C0%2C560%2C22%2C%2C%2C%2C1100%3Afp%3A834%3Agdpr%3A14%3Av%3A1744%3Ast%3A1574422771%3Au%3A1574422771233816621%3At%3A%D0%BF%D0%BE%D0%B4%D0%BE%D0%B7%D1%80%D0%B5%D0%BD%D0%B8%D0%B5%20%D0%BD%D0%B0%20Trojan%20%2C%D0%BF%D0%BE%D0%B4%D0%BE%D0%B7%D1%80%D0%B5%D0%BD%D0%B8%D0%B5%20%D0%BD%D0%B0%20Exploit.Win32.IH_Infector.12%20%D0%B8%20%D0%9C%D0%B0%D1%81%D0%BA%D0%B8%D1%80%D0%BE%D0%B2%D0%BA%D0%B0%20%D0%BF%D1%80%D0%BE%D1%86%D0%B5%D1%81%D1%81%D0%B0%20-%20%D0%A3%D0%B4%D0%B0%D0%BB%D0%B5%D0%BD%D0%B8%D0%B5%20%D0%B2%D0%B8%D1%80%D1%83%D1%81%D0%BE%D0%B2%20-%20%D0%9A%D0%B8%D0%B1%D0%B5%D1%80%D1%84%D0%BE%D1%80%D1%83%D0%BC
Requested by
Host: www.cyberforum.ru
URL: http://www.cyberforum.ru/viruses/thread1083273.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a02:6b8::1:119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
nginx/1.14.2 /
Resource Hash
dcc27bc3d3ec380b240a8a3b3ababdd92d3afe8da85bde0b495b67917ef5a5ea
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
http://www.cyberforum.ru/viruses/thread1083273.html
Origin
http://www.cyberforum.ru
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

Pragma
no-cache
Date
Fri, 22 Nov 2019 11:39:30 GMT
X-Content-Type-Options
nosniff
Last-Modified
Fri, 22-Nov-2019 11:39:30 GMT
Server
nginx/1.14.2
Strict-Transport-Security
max-age=31536000
Content-Type
application/json; charset=utf-8
Access-Control-Allow-Origin
http://www.cyberforum.ru
Cache-Control
private, no-cache, no-store, must-revalidate, max-age=0
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
133
X-XSS-Protection
1; mode=block
Expires
Fri, 22-Nov-2019 11:39:30 GMT
1
mc.yandex.ru/watch/26812653/ 		43 B
539 B 		Other
General
Check archive.org
Download Go to
Full URL
https://mc.yandex.ru/watch/26812653/1?page-url=http%3A%2F%2Fwww.cyberforum.ru%2Fviruses%2Fthread1083273.html&charset=utf-8&force-urlencoded=1&browser-info=ti%3A1%3Ans%3A1574422769473%3As%3A1600x1200x24%3Ask%3A1%3Ahdl%3A1%3Afpr%3A216613626101%3Acn%3A1%3Az%3A60%3Ai%3A20191122123930%3Aet%3A1574422771%3Aen%3Autf-8%3Ac%3A1%3Ala%3Aen-us%3Aar%3A1%3Apa%3A1%3Arn%3A182024113%3Ahid%3A125359108%3Ads%3A%2C%2C%2C%2C%2C%2C%2C%2C%2C%2C%2C%2C%3Agdpr%3A14%3Av%3A1744%3Ast%3A1574422771%3Au%3A1574422771233816621%3App%3A3629563401
Requested by
Host: mc.yandex.ru
URL: https://mc.yandex.ru/metrika/watch.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a02:6b8::1:119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
nginx/1.14.2 /
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Xss-Protection 1; mode=block

Request headers

Referer
http://www.cyberforum.ru/viruses/thread1083273.html
Origin
http://www.cyberforum.ru
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

Pragma
no-cache
Date
Fri, 22 Nov 2019 11:39:31 GMT
Last-Modified
Fri, 22-Nov-2019 11:39:31 GMT
Server
nginx/1.14.2
Strict-Transport-Security
max-age=31536000
Content-Type
image/gif
Access-Control-Allow-Origin
http://www.cyberforum.ru
Cache-Control
private, no-cache, no-store, must-revalidate, max-age=0
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
43
X-XSS-Protection
1; mode=block
Expires
Fri, 22-Nov-2019 11:39:31 GMT
1
mc.yandex.ru/watch/26812653/ 		43 B
539 B 		Other
General
Check archive.org
Download Go to
Full URL
https://mc.yandex.ru/watch/26812653/1?page-url=http%3A%2F%2Fwww.cyberforum.ru%2Fviruses%2Fthread1083273.html&charset=utf-8&force-urlencoded=1&browser-info=ti%3A1%3Adp%3A1%3Ans%3A1574422769473%3As%3A1600x1200x24%3Ask%3A1%3Ahdl%3A1%3Afpr%3A216613626101%3Acn%3A1%3Az%3A60%3Ai%3A20191122123930%3Aet%3A1574422771%3Aen%3Autf-8%3Ac%3A1%3Ala%3Aen-us%3Aar%3A1%3Apa%3A1%3Arn%3A605803957%3Ahid%3A125359108%3Ads%3A%2C%2C%2C%2C%2C%2C%2C%2C%2C%2C%2C%2C%3Agdpr%3A14%3Av%3A1744%3Ast%3A1574422771%3Au%3A1574422771233816621%3App%3A3629563401
Requested by
Host: mc.yandex.ru
URL: https://mc.yandex.ru/metrika/watch.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a02:6b8::1:119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
nginx/1.14.2 /
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Xss-Protection 1; mode=block

Request headers

Referer
http://www.cyberforum.ru/viruses/thread1083273.html
Origin
http://www.cyberforum.ru
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

Pragma
no-cache
Date
Fri, 22 Nov 2019 11:39:37 GMT
Last-Modified
Fri, 22-Nov-2019 11:39:37 GMT
Server
nginx/1.14.2
Strict-Transport-Security
max-age=31536000
Content-Type
image/gif
Access-Control-Allow-Origin
http://www.cyberforum.ru
Cache-Control
private, no-cache, no-store, must-revalidate, max-age=0
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
43
X-XSS-Protection
1; mode=block
Expires
Fri, 22-Nov-2019 11:39:37 GMT
50312308
mc.yandex.ru/watch/ 		152 B
704 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://mc.yandex.ru/watch/50312308?wmode=7&page-url=http%3A%2F%2Fwww.cyberforum.ru%2Fviruses%2Fthread1083273.html&charset=utf-8&browser-info=ti%3A10%3Adp%3A1%3Ans%3A1574422769473%3As%3A1600x1200x24%3Ask%3A1%3Ahdl%3A1%3Afpr%3A216613626101%3Acn%3A2%3Aw%3A1585x1200%3Az%3A60%3Ai%3A20191122123930%3Aet%3A1574422771%3Aen%3Autf-8%3Ac%3A1%3Ala%3Aen-us%3Apv%3A1%3Arn%3A1035739264%3Ahid%3A125359108%3Ads%3A1%2C18%2C513%2C47%2C1%2C0%2C0%2C560%2C22%2C%2C%2C%2C1100%3Afp%3A834%3Agdpr%3A14%3Av%3A1747%3Awv%3A2%3Ast%3A1574422771%3Au%3A1574422771233816621%3App%3A3629563401%3At%3A%D0%BF%D0%BE%D0%B4%D0%BE%D0%B7%D1%80%D0%B5%D0%BD%D0%B8%D0%B5%20%D0%BD%D0%B0%20Trojan%20%2C%D0%BF%D0%BE%D0%B4%D0%BE%D0%B7%D1%80%D0%B5%D0%BD%D0%B8%D0%B5%20%D0%BD%D0%B0%20Exploit.Win32.IH_Infector.12%20%D0%B8%20%D0%9C%D0%B0%D1%81%D0%BA%D0%B8%D1%80%D0%BE%D0%B2%D0%BA%D0%B0%20%D0%BF%D1%80%D0%BE%D1%86%D0%B5%D1%81%D1%81%D0%B0%20-%20%D0%A3%D0%B4%D0%B0%D0%BB%D0%B5%D0%BD%D0%B8%D0%B5%20%D0%B2%D0%B8%D1%80%D1%83%D1%81%D0%BE%D0%B2%20-%20%D0%9A%D0%B8%D0%B1%D0%B5%D1%80%D1%84%D0%BE%D1%80%D1%83%D0%BC
Requested by
Host: mc.yandex.ru
URL: https://mc.yandex.ru/metrika/tag.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a02:6b8::1:119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
nginx/1.14.2 /
Resource Hash
7837c22bccb68b6c153c92b5e407e4ec7daf4804d9ae4bea6c09d0165cd4ed93
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
http://www.cyberforum.ru/viruses/thread1083273.html
Origin
http://www.cyberforum.ru
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

Pragma
no-cache
Date
Fri, 22 Nov 2019 11:39:31 GMT
X-Content-Type-Options
nosniff
Last-Modified
Fri, 22-Nov-2019 11:39:31 GMT
Server
nginx/1.14.2
Strict-Transport-Security
max-age=31536000
Content-Type
application/json; charset=utf-8
Access-Control-Allow-Origin
http://www.cyberforum.ru
Cache-Control
private, no-cache, no-store, must-revalidate, max-age=0
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
152
X-XSS-Protection
1; mode=block
Expires
Fri, 22-Nov-2019 11:39:31 GMT
1
mc.yandex.ru/watch/50312308/ 		43 B
539 B 		Other
General
Check archive.org
Download Go to
Full URL
https://mc.yandex.ru/watch/50312308/1?page-url=http%3A%2F%2Fwww.cyberforum.ru%2Fviruses%2Fthread1083273.html&charset=utf-8&force-urlencoded=1&browser-info=ti%3A1%3Adp%3A1%3Ans%3A1574422769473%3As%3A1600x1200x24%3Ask%3A1%3Ahdl%3A1%3Afpr%3A216613626101%3Acn%3A2%3Az%3A60%3Ai%3A20191122123930%3Aet%3A1574422771%3Aen%3Autf-8%3Ac%3A1%3Ala%3Aen-us%3Aar%3A1%3Apa%3A1%3Arn%3A583110349%3Ahid%3A125359108%3Ads%3A%2C%2C%2C%2C%2C%2C%2C%2C%2C%2C%2C%2C%3Agdpr%3A14%3Av%3A1747%3Awv%3A2%3Ast%3A1574422771%3Au%3A1574422771233816621%3App%3A3629563401
Requested by
Host: mc.yandex.ru
URL: https://mc.yandex.ru/metrika/tag.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a02:6b8::1:119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
nginx/1.14.2 /
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Xss-Protection 1; mode=block

Request headers

Referer
http://www.cyberforum.ru/viruses/thread1083273.html
Origin
http://www.cyberforum.ru
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

Pragma
no-cache
Date
Fri, 22 Nov 2019 11:39:31 GMT
Last-Modified
Fri, 22-Nov-2019 11:39:31 GMT
Server
nginx/1.14.2
Strict-Transport-Security
max-age=31536000
Content-Type
image/gif
Access-Control-Allow-Origin
http://www.cyberforum.ru
Cache-Control
private, no-cache, no-store, must-revalidate, max-age=0
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
43
X-XSS-Protection
1; mode=block
Expires
Fri, 22-Nov-2019 11:39:31 GMT
29317
mc.yandex.ru/watch/ 		35 B
586 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://mc.yandex.ru/watch/29317?wmode=7&cnt-class=1&nohit=1&page-url=http%3A%2F%2Fwww.cyberforum.ru%2Fviruses%2Fthread1083273.html&charset=utf-8&browser-info=ti%3A10%3Adp%3A1%3Ans%3A1574422769473%3As%3A1600x1200x24%3Ask%3A1%3Ahdl%3A1%3Aadb%3A2%3Afpr%3A216613626101%3Acn%3A3%3Aw%3A1585x1200%3Az%3A60%3Ai%3A20191122123930%3Aet%3A1574422771%3Aen%3Autf-8%3Ac%3A1%3Ala%3Aen-us%3Aad%3A1%3Apv%3A1%3Arn%3A519200135%3Ahid%3A125359108%3Agdpr%3A14%3Av%3A1744%3Ast%3A1574422771%3Au%3A1574422771233816621%3App%3A3629563401%3At%3A%D0%BF%D0%BE%D0%B4%D0%BE%D0%B7%D1%80%D0%B5%D0%BD%D0%B8%D0%B5%20%D0%BD%D0%B0%20Trojan%20%2C%D0%BF%D0%BE%D0%B4%D0%BE%D0%B7%D1%80%D0%B5%D0%BD%D0%B8%D0%B5%20%D0%BD%D0%B0%20Exploit.Win32.IH_Infector.12%20%D0%B8%20%D0%9C%D0%B0%D1%81%D0%BA%D0%B8%D1%80%D0%BE%D0%B2%D0%BA%D0%B0%20%D0%BF%D1%80%D0%BE%D1%86%D0%B5%D1%81%D1%81%D0%B0%20-%20%D0%A3%D0%B4%D0%B0%D0%BB%D0%B5%D0%BD%D0%B8%D0%B5%20%D0%B2%D0%B8%D1%80%D1%83%D1%81%D0%BE%D0%B2%20-%20%D0%9A%D0%B8%D0%B1%D0%B5%D1%80%D1%84%D0%BE%D1%80%D1%83%D0%BC
Requested by
Host: mc.yandex.ru
URL: https://mc.yandex.ru/metrika/watch.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a02:6b8::1:119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
nginx/1.14.2 /
Resource Hash
d9443ef74dadcd4d4c3d09b0e96b6f27bff47789258e3984fc774e2c81f07f37
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
http://www.cyberforum.ru/viruses/thread1083273.html
Origin
http://www.cyberforum.ru
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

Pragma
no-cache
Date
Fri, 22 Nov 2019 11:39:31 GMT
X-Content-Type-Options
nosniff
Last-Modified
Fri, 22-Nov-2019 11:39:31 GMT
Server
nginx/1.14.2
Strict-Transport-Security
max-age=31536000
Content-Type
application/json; charset=utf-8
Access-Control-Allow-Origin
http://www.cyberforum.ru
Cache-Control
private, no-cache, no-store, must-revalidate, max-age=0
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
35
X-XSS-Protection
1; mode=block
Expires
Fri, 22-Nov-2019 11:39:31 GMT
1
mc.yandex.ru/watch/29317/ 		43 B
539 B 		Other
General
Check archive.org
Download Go to
Full URL
https://mc.yandex.ru/watch/29317/1?cnt-class=1&page-url=http%3A%2F%2Fwww.cyberforum.ru%2Fviruses%2Fthread1083273.html&charset=utf-8&force-urlencoded=1&browser-info=ti%3A1%3Adp%3A1%3Ans%3A1574422769473%3As%3A1600x1200x24%3Ask%3A1%3Ahdl%3A1%3Aadb%3A2%3Afpr%3A216613626101%3Acn%3A3%3Az%3A60%3Ai%3A20191122123931%3Aet%3A1574422771%3Aen%3Autf-8%3Ac%3A1%3Ala%3Aen-us%3Aar%3A1%3Apa%3A1%3Arn%3A565292422%3Ahid%3A125359108%3Ads%3A1%2C18%2C513%2C47%2C1%2C0%2C0%2C560%2C22%2C%2C%2C%2C1100%3Afp%3A834%3Agdpr%3A14%3Av%3A1744%3Ast%3A1574422771%3Au%3A1574422771233816621%3App%3A3629563401
Requested by
Host: mc.yandex.ru
URL: https://mc.yandex.ru/metrika/watch.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a02:6b8::1:119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
nginx/1.14.2 /
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Xss-Protection 1; mode=block

Request headers

Referer
http://www.cyberforum.ru/viruses/thread1083273.html
Origin
http://www.cyberforum.ru
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

Pragma
no-cache
Date
Fri, 22 Nov 2019 11:39:31 GMT
Last-Modified
Fri, 22-Nov-2019 11:39:31 GMT
Server
nginx/1.14.2
Strict-Transport-Security
max-age=31536000
Content-Type
image/gif
Access-Control-Allow-Origin
http://www.cyberforum.ru
Cache-Control
private, no-cache, no-store, must-revalidate, max-age=0
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
43
X-XSS-Protection
1; mode=block
Expires
Fri, 22-Nov-2019 11:39:31 GMT
29317
mc.yandex.ru/watch/ 		43 B
539 B 		Other
General
Check archive.org
Download Go to
Full URL
https://mc.yandex.ru/watch/29317?cnt-class=1&page-url=http%3A%2F%2Fwww.cyberforum.ru%2Fviruses%2Fthread1083273.html&charset=utf-8&force-urlencoded=1&browser-info=ti%3A1%3Adp%3A1%3Ans%3A1574422769473%3As%3A1600x1200x24%3Ask%3A1%3Ahdl%3A1%3Aadb%3A2%3Afpr%3A216613626101%3Acn%3A3%3Aw%3A1585x1200%3Az%3A60%3Ai%3A20191122123931%3Aet%3A1574422771%3Aen%3Autf-8%3Ac%3A1%3Ala%3Aen-us%3Aar%3A1%3Apv%3A1%3Arn%3A286357189%3Ahid%3A125359108%3Ads%3A%2C%2C%2C%2C%2C%2C%2C%2C%2C%2C%2C%2C%3Agdpr%3A14%3Av%3A1744%3Ast%3A1574422771%3Au%3A1574422771233816621%3App%3A3629563401%3At%3A%D0%BF%D0%BE%D0%B4%D0%BE%D0%B7%D1%80%D0%B5%D0%BD%D0%B8%D0%B5%20%D0%BD%D0%B0%20Trojan%20%2C%D0%BF%D0%BE%D0%B4%D0%BE%D0%B7%D1%80%D0%B5%D0%BD%D0%B8%D0%B5%20%D0%BD%D0%B0%20Exploit.Win32.IH_Infector.12%20%D0%B8%20%D0%9C%D0%B0%D1%81%D0%BA%D0%B8%D1%80%D0%BE%D0%B2%D0%BA%D0%B0%20%D0%BF%D1%80%D0%BE%D1%86%D0%B5%D1%81%D1%81%D0%B0%20-%20%D0%A3%D0%B4%D0%B0%D0%BB%D0%B5%D0%BD%D0%B8%D0%B5%20%D0%B2%D0%B8%D1%80%D1%83%D1%81%D0%BE%D0%B2%20-%20%D0%9A%D0%B8%D0%B1%D0%B5%D1%80%D1%84%D0%BE%D1%80%D1%83%D0%BC
Requested by
Host: mc.yandex.ru
URL: https://mc.yandex.ru/metrika/watch.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a02:6b8::1:119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
nginx/1.14.2 /
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Xss-Protection 1; mode=block

Request headers

Referer
http://www.cyberforum.ru/viruses/thread1083273.html
Origin
http://www.cyberforum.ru
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

Pragma
no-cache
Date
Fri, 22 Nov 2019 11:39:31 GMT
Last-Modified
Fri, 22-Nov-2019 11:39:31 GMT
Server
nginx/1.14.2
Strict-Transport-Security
max-age=31536000
Content-Type
image/gif
Access-Control-Allow-Origin
http://www.cyberforum.ru
Cache-Control
private, no-cache, no-store, must-revalidate, max-age=0
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
43
X-XSS-Protection
1; mode=block
Expires
Fri, 22-Nov-2019 11:39:31 GMT
29317
an.yandex.ru/meta/ 		1 KB
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://an.yandex.ru/meta/29317?grab=dNC_0L7QtNC-0LfRgNC10L3QuNC1INC90LAgVHJvamFuICzQv9C-0LTQvtC30YDQtdC90LjQtSDQvdCwIEV4cGxvaXQuV2luMzIuSUhfSW5mZWN0b3IuMTIg0Lgg0JzQsNGB0LrQuNGA0L7QstC60LAg0L_RgNC-0YbQtdGB0YHQsCAtINCj0LTQsNC70LXQvdC40LUg0LLQuNGA0YPRgdC-0LIgLSDQmtC40LHQtdGA0YTQvtGA0YPQvAox0L_QvtC00L7Qt9GA0LXQvdC40LUg0L3QsCBUcm9qYW4gLNC_0L7QtNC-0LfRgNC10L3QuNC1INC90LAgRXhwbG9pdC5XaW4zMi5JSF9JbmZlY3Rvci4xMiDQuCDQnNCw0YHQutC40YDQvtCy0LrQsCDQv9GA0L7RhtC10YHRgdCwIAo%3D&target-ref=http%3A%2F%2Fwww.cyberforum.ru%2Fviruses%2Fthread1083273.html&charset=utf-8&duid=MTU3NDQyMjc3MTIzMzgxNjYyMQ%3D%3D&imp-id=17&enable-flat-highlight=1&test-tag=337550069727234&ad-session-id=3386441574422770509&target-id=29049460&pcode-version=9830&flash-ver=0&layout-config=%7B%22win_width%22%3A1600%2C%22win_height%22%3A1200%2C%22width%22%3A0%2C%22height%22%3A0%2C%22left%22%3A218%2C%22top%22%3A771%2C%22visible%22%3A1%2C%22ad_no%22%3A0%2C%22req_no%22%3A1%7D&callback=Ya%5B9797964166442%5D
Requested by
Host: an.yandex.ru
URL: http://an.yandex.ru/system/context.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a02:6b8::90 Moscow, Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
nginx/1.12.2 /
Resource Hash
6d7cc332d2caf38b718130ed69bcc87ca84d3b4d0d61534fa574ecd59685df98
Security Headers
Name Value
X-Xss-Protection 1; mode=block

Request headers

Referer
http://www.cyberforum.ru/viruses/thread1083273.html
Origin
http://www.cyberforum.ru
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

pragma
no-cache
date
Fri, 22 Nov 2019 11:39:31 GMT
content-encoding
gzip
last-modified
Fri, 22 Nov 2019 11:39:31 GMT
server
nginx/1.12.2
timing-allow-origin
*
status
200
p3p
CP="NOI DEVa TAIa OUR BUS UNI STA"
access-control-allow-origin
http://www.cyberforum.ru
cache-control
private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials
true
content-type
application/x-javascript; charset=utf-8
x-xss-protection
1; mode=block
expires
Fri, 22 Nov 2019 11:39:31 GMT
host.js
yastatic.net/safeframe-bundles/0.69/ 		29 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://yastatic.net/safeframe-bundles/0.69/host.js
Requested by
Host: an.yandex.ru
URL: https://an.yandex.ru/partner-code-bundles/9830/context_static.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6b8:20::215 , Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
nginx/1.17.6 /
Resource Hash
9fa8c2bb49f0e9e391d87f70459663c0e3898f32d4506c81239151b9c0b870d6
Security Headers
Name Value
Strict-Transport-Security max-age=43200000; includeSubDomains;

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Referer
http://www.cyberforum.ru/viruses/thread1083273.html
Origin
http://www.cyberforum.ru

Response headers

date
Fri, 22 Nov 2019 11:39:31 GMT
content-encoding
br
status
200
strict-transport-security
max-age=43200000; includeSubDomains;
content-length
8104
last-modified
Tue, 20 Aug 2019 11:55:41 GMT
server
nginx/1.17.6
etag
"901e860c36afb614c88b40352db2214f"
x-robots-tag
noindex, noarchive, nofollow
vary
Accept-Encoding
content-type
text/javascript
access-control-allow-origin
*
cache-control
max-age=315360000, public
accept-ranges
bytes
timing-allow-origin
*
expires
Thu, 31 Dec 2037 23:55:55 GMT
render.html
yastatic.net/safeframe-bundles/0.69/1-1-0/ Frame 8F57 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://yastatic.net/safeframe-bundles/0.69/1-1-0/render.html
Requested by
Host: yastatic.net
URL: https://yastatic.net/safeframe-bundles/0.69/host.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6b8:20::215 , Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
nginx/1.17.6 /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=43200000; includeSubDomains;

Request headers

:method
GET
:authority
yastatic.net
:scheme
https
:path
/safeframe-bundles/0.69/1-1-0/render.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
cross-site
sec-fetch-mode
nested-navigate
referer
http://www.cyberforum.ru/viruses/thread1083273.html
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Referer
http://www.cyberforum.ru/viruses/thread1083273.html

Response headers

status
200
server
nginx/1.17.6
date
Fri, 22 Nov 2019 11:39:31 GMT
content-type
text/html
content-length
6026
etag
"f883bd7781c332870c9968db60e89349"
last-modified
Tue, 20 Aug 2019 11:55:41 GMT
x-robots-tag
noindex, noarchive, nofollow
expires
Thu, 31 Dec 2037 23:55:55 GMT
cache-control
max-age=315360000 public
access-control-allow-origin
*
strict-transport-security
max-age=43200000; includeSubDomains;
timing-allow-origin
*
vary
Accept-Encoding
content-encoding
br
accept-ranges
bytes
render.html
yastatic.net/safeframe-bundles/0.69/1-1-0/ Frame D8CF 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://yastatic.net/safeframe-bundles/0.69/1-1-0/render.html
Requested by
Host: yastatic.net
URL: https://yastatic.net/safeframe-bundles/0.69/host.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6b8:20::215 , Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
nginx/1.17.6 /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=43200000; includeSubDomains;

Request headers

:method
GET
:authority
yastatic.net
:scheme
https
:path
/safeframe-bundles/0.69/1-1-0/render.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
cross-site
sec-fetch-mode
nested-navigate
referer
http://www.cyberforum.ru/viruses/thread1083273.html
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Referer
http://www.cyberforum.ru/viruses/thread1083273.html

Response headers

status
200
server
nginx/1.17.6
date
Fri, 22 Nov 2019 11:39:31 GMT
content-type
text/html
content-length
6026
etag
"f883bd7781c332870c9968db60e89349"
last-modified
Tue, 20 Aug 2019 11:55:41 GMT
x-robots-tag
noindex, noarchive, nofollow
expires
Thu, 31 Dec 2037 23:55:55 GMT
cache-control
max-age=315360000 public
access-control-allow-origin
*
strict-transport-security
max-age=43200000; includeSubDomains;
timing-allow-origin
*
vary
Accept-Encoding
content-encoding
br
accept-ranges
bytes
29317
an.yandex.ru/meta/ 		1 KB
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://an.yandex.ru/meta/29317?grab=dNC_0L7QtNC-0LfRgNC10L3QuNC1INC90LAgVHJvamFuICzQv9C-0LTQvtC30YDQtdC90LjQtSDQvdCwIEV4cGxvaXQuV2luMzIuSUhfSW5mZWN0b3IuMTIg0Lgg0JzQsNGB0LrQuNGA0L7QstC60LAg0L_RgNC-0YbQtdGB0YHQsCAtINCj0LTQsNC70LXQvdC40LUg0LLQuNGA0YPRgdC-0LIgLSDQmtC40LHQtdGA0YTQvtGA0YPQvAox0L_QvtC00L7Qt9GA0LXQvdC40LUg0L3QsCBUcm9qYW4gLNC_0L7QtNC-0LfRgNC10L3QuNC1INC90LAgRXhwbG9pdC5XaW4zMi5JSF9JbmZlY3Rvci4xMiDQuCDQnNCw0YHQutC40YDQvtCy0LrQsCDQv9GA0L7RhtC10YHRgdCwIAo%3D&target-ref=http%3A%2F%2Fwww.cyberforum.ru%2Fviruses%2Fthread1083273.html&charset=utf-8&duid=MTU3NDQyMjc3MTIzMzgxNjYyMQ%3D%3D&imp-id=2&enable-flat-highlight=1&test-tag=337550069727234&ad-session-id=3386441574422770509&target-id=68041868&pcode-version=9830&flash-ver=0&layout-config=%7B%22win_width%22%3A1600%2C%22win_height%22%3A1200%2C%22width%22%3A0%2C%22height%22%3A0%2C%22left%22%3A218%2C%22top%22%3A1078%2C%22visible%22%3A1%2C%22ad_no%22%3A0%2C%22req_no%22%3A2%7D&callback=Ya%5B5045905534637%5D
Requested by
Host: an.yandex.ru
URL: http://an.yandex.ru/system/context.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a02:6b8::90 Moscow, Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
nginx/1.12.2 /
Resource Hash
e2a23e07c9fe601e16c9a3386544fc873ca602498a9859c92cee02c478931b21
Security Headers
Name Value
X-Xss-Protection 1; mode=block

Request headers

Referer
http://www.cyberforum.ru/viruses/thread1083273.html
Origin
http://www.cyberforum.ru
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

pragma
no-cache
date
Fri, 22 Nov 2019 11:39:31 GMT
content-encoding
gzip
last-modified
Fri, 22 Nov 2019 11:39:31 GMT
server
nginx/1.12.2
timing-allow-origin
*
status
200
p3p
CP="NOI DEVa TAIa OUR BUS UNI STA"
access-control-allow-origin
http://www.cyberforum.ru
cache-control
private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials
true
content-type
application/x-javascript; charset=utf-8
x-xss-protection
1; mode=block
expires
Fri, 22 Nov 2019 11:39:31 GMT
render.html
yastatic.net/safeframe-bundles/0.69/1-1-0/ Frame 9FAB 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://yastatic.net/safeframe-bundles/0.69/1-1-0/render.html
Requested by
Host: yastatic.net
URL: https://yastatic.net/safeframe-bundles/0.69/host.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6b8:20::215 , Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
nginx/1.17.6 /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=43200000; includeSubDomains;

Request headers

:method
GET
:authority
yastatic.net
:scheme
https
:path
/safeframe-bundles/0.69/1-1-0/render.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
cross-site
sec-fetch-mode
nested-navigate
referer
http://www.cyberforum.ru/viruses/thread1083273.html
accept-encoding
gzip, deflate, br
cookie
pcs3=1
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Referer
http://www.cyberforum.ru/viruses/thread1083273.html

Response headers

status
200
server
nginx/1.17.6
date
Fri, 22 Nov 2019 11:39:31 GMT
content-type
text/html
content-length
6026
etag
"f883bd7781c332870c9968db60e89349"
last-modified
Tue, 20 Aug 2019 11:55:41 GMT
x-robots-tag
noindex, noarchive, nofollow
expires
Thu, 31 Dec 2037 23:55:55 GMT
cache-control
max-age=315360000 public
access-control-allow-origin
*
strict-transport-security
max-age=43200000; includeSubDomains;
timing-allow-origin
*
vary
Accept-Encoding
content-encoding
br
accept-ranges
bytes
render.html
yastatic.net/safeframe-bundles/0.69/1-1-0/ Frame 2EB4 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://yastatic.net/safeframe-bundles/0.69/1-1-0/render.html
Requested by
Host: yastatic.net
URL: https://yastatic.net/safeframe-bundles/0.69/host.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6b8:20::215 , Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
nginx/1.17.6 /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=43200000; includeSubDomains;

Request headers

:method
GET
:authority
yastatic.net
:scheme
https
:path
/safeframe-bundles/0.69/1-1-0/render.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
cross-site
sec-fetch-mode
nested-navigate
referer
http://www.cyberforum.ru/viruses/thread1083273.html
accept-encoding
gzip, deflate, br
cookie
pcs3=1
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Referer
http://www.cyberforum.ru/viruses/thread1083273.html

Response headers

status
200
server
nginx/1.17.6
date
Fri, 22 Nov 2019 11:39:31 GMT
content-type
text/html
content-length
6026
etag
"f883bd7781c332870c9968db60e89349"
last-modified
Tue, 20 Aug 2019 11:55:41 GMT
x-robots-tag
noindex, noarchive, nofollow
expires
Thu, 31 Dec 2037 23:55:55 GMT
cache-control
max-age=315360000 public
access-control-allow-origin
*
strict-transport-security
max-age=43200000; includeSubDomains;
timing-allow-origin
*
vary
Accept-Encoding
content-encoding
br
accept-ranges
bytes
render.html
yastatic.net/safeframe-bundles/0.69/1-1-0/ Frame 4526 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://yastatic.net/safeframe-bundles/0.69/1-1-0/render.html
Requested by
Host: yastatic.net
URL: https://yastatic.net/safeframe-bundles/0.69/host.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6b8:20::215 , Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
nginx/1.17.6 /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=43200000; includeSubDomains;

Request headers

:method
GET
:authority
yastatic.net
:scheme
https
:path
/safeframe-bundles/0.69/1-1-0/render.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
cross-site
sec-fetch-mode
nested-navigate
referer
http://www.cyberforum.ru/viruses/thread1083273.html
accept-encoding
gzip, deflate, br
cookie
pcs3=1
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Referer
http://www.cyberforum.ru/viruses/thread1083273.html

Response headers

status
200
server
nginx/1.17.6
date
Fri, 22 Nov 2019 11:39:31 GMT
content-type
text/html
content-length
6026
etag
"f883bd7781c332870c9968db60e89349"
last-modified
Tue, 20 Aug 2019 11:55:41 GMT
x-robots-tag
noindex, noarchive, nofollow
expires
Thu, 31 Dec 2037 23:55:55 GMT
cache-control
max-age=315360000 public
access-control-allow-origin
*
strict-transport-security
max-age=43200000; includeSubDomains;
timing-allow-origin
*
vary
Accept-Encoding
content-encoding
br
accept-ranges
bytes
render.html
yastatic.net/safeframe-bundles/0.69/1-1-0/ Frame D8CA 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://yastatic.net/safeframe-bundles/0.69/1-1-0/render.html
Requested by
Host: yastatic.net
URL: https://yastatic.net/safeframe-bundles/0.69/host.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6b8:20::215 , Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
nginx/1.17.6 /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=43200000; includeSubDomains;

Request headers

:method
GET
:authority
yastatic.net
:scheme
https
:path
/safeframe-bundles/0.69/1-1-0/render.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
cross-site
sec-fetch-mode
nested-navigate
referer
http://www.cyberforum.ru/viruses/thread1083273.html
accept-encoding
gzip, deflate, br
cookie
pcs3=1
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Referer
http://www.cyberforum.ru/viruses/thread1083273.html

Response headers

status
200
server
nginx/1.17.6
date
Fri, 22 Nov 2019 11:39:31 GMT
content-type
text/html
content-length
6026
etag
"f883bd7781c332870c9968db60e89349"
last-modified
Tue, 20 Aug 2019 11:55:41 GMT
x-robots-tag
noindex, noarchive, nofollow
expires
Thu, 31 Dec 2037 23:55:55 GMT
cache-control
max-age=315360000 public
access-control-allow-origin
*
strict-transport-security
max-age=43200000; includeSubDomains;
timing-allow-origin
*
vary
Accept-Encoding
content-encoding
br
accept-ranges
bytes
cyberforum.ru_-_-_ROQOFutpFkRluCHuSb1i0rB5iDqaD5rB.json
frolvid.ru/settings/ 		32 KB
32 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://frolvid.ru/settings/cyberforum.ru_-_-_ROQOFutpFkRluCHuSb1i0rB5iDqaD5rB.json?1=1
Requested by
Host: s.frolvid.ru
URL: https://s.frolvid.ru/static/dist/fly.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
176.9.32.236 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.236.32.9.176.clients.your-server.de
Software
nginx/1.14.0 /
Resource Hash
6e8891cab29e4ad3b1cd5cc3caf69a8546d2a6a3392c7a17fbdfb8b74d65f59c

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Referer
http://www.cyberforum.ru/viruses/thread1083273.html
Origin
http://www.cyberforum.ru

Response headers

Date
Fri, 22 Nov 2019 11:39:32 GMT
Last-Modified
Fri, 22 Nov 2019 09:50:39 GMT
Server
nginx/1.14.0
ETag
"5dd7af6f-8000"
Content-Type
application/json
Access-Control-Allow-Origin
http://www.cyberforum.ru
Cache-Control
no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
Access-Control-Allow-Credentials
true
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
32768
ima3.js
imasdk.googleapis.com/js/sdkloader/ 		273 KB
93 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://imasdk.googleapis.com/js/sdkloader/ima3.js
Requested by
Host: s.frolvid.ru
URL: https://s.frolvid.ru/static/dist/fly.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:816::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
5fa6833aaa4245a425c0bf047e200f7be29f46246239529a6e4ac8085736671d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
http://www.cyberforum.ru/viruses/thread1083273.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 11:39:32 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=900, stale-while-revalidate=3600
accept-ranges
bytes
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
94888
x-xss-protection
0
expires
Fri, 22 Nov 2019 11:39:32 GMT
styleAds.css
s.frolvid.ru/static/player/css/ 		178 B
459 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://s.frolvid.ru/static/player/css/styleAds.css
Requested by
Host: s.frolvid.ru
URL: https://s.frolvid.ru/static/dist/fly.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
176.9.32.236 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.236.32.9.176.clients.your-server.de
Software
nginx/1.14.0 /
Resource Hash
970d1441b7e386f2dbde319d5ddceb4110611d359c245c7cabd35cf380a15826
Security Headers
Name Value
Strict-Transport-Security max-age=15768000

Request headers

Referer
http://www.cyberforum.ru/viruses/thread1083273.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Date
Fri, 22 Nov 2019 11:39:32 GMT
Last-Modified
Tue, 19 Mar 2019 13:42:51 GMT
Server
nginx/1.14.0
ETag
"5c90f1db-b2"
Strict-Transport-Security
max-age=15768000
Content-Type
text/css
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
178
black_list.json
frolvid.ru/black/ 		592 B
1013 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://frolvid.ru/black/black_list.json?v=0.29630175531697556
Requested by
Host: s.frolvid.ru
URL: https://s.frolvid.ru/static/dist/fly.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
176.9.32.236 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.236.32.9.176.clients.your-server.de
Software
nginx/1.14.0 /
Resource Hash
394f459fc88c78b0b75976647afcf14de909a51923b9097172031ac07c0c55e5

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Referer
http://www.cyberforum.ru/viruses/thread1083273.html
Origin
http://www.cyberforum.ru

Response headers

Date
Fri, 22 Nov 2019 11:39:32 GMT
Last-Modified
Wed, 09 Oct 2019 14:43:46 GMT
Server
nginx/1.14.0
ETag
"5d9df222-250"
Content-Type
application/json
Access-Control-Allow-Origin
http://www.cyberforum.ru
Cache-Control
no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
Access-Control-Allow-Credentials
true
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
592
preloader.gif
s.frolvid.ru/static/player/images/ 		16 KB
16 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.frolvid.ru/static/player/images/preloader.gif
Requested by
Host: s.frolvid.ru
URL: https://s.frolvid.ru/static/dist/fly.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
176.9.32.236 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.236.32.9.176.clients.your-server.de
Software
nginx/1.14.0 /
Resource Hash
648821f1ce49562855c2f8679bdbb84efb98b0ec60d931dae4ef4599389e76df
Security Headers
Name Value
Strict-Transport-Security max-age=15768000

Request headers

Referer
http://www.cyberforum.ru/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Date
Fri, 22 Nov 2019 11:39:32 GMT
Last-Modified
Fri, 09 Nov 2018 06:16:43 GMT
Server
nginx/1.14.0
ETag
"5be5264b-3eca"
Strict-Transport-Security
max-age=15768000
Content-Type
image/gif
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
16074
/
s.frolvid.ru/log/ 		35 B
316 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.frolvid.ru/log/?p=0.4869826709721867&data=%7B%22page_key%22%3A%2299db3a00-a4f3-45fa-bbcf-c04e79c8ce27%22%2C%22wid_id%22%3A%2229%22%2C%22src_id%22%3A0%2C%22event%22%3A%22widRequest%22%2C%22control%22%3A%220%22%2C%22block_id%22%3A%2224%22%2C%22wid_type%22%3A%222%22%2C%22device%22%3A%22desktop%22%2C%22os%22%3A%22macOS%2010.14.6%22%2C%22browser%22%3A%22Chrome%2078.0%22%2C%22referrer%22%3A0%2C%22origins%22%3A%5B%5D%2C%22cookie%22%3A1%7D
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
176.9.32.236 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.236.32.9.176.clients.your-server.de
Software
nginx/1.14.0 /
Resource Hash
6a842ea462daca2a0b5a0f5f25bcfc8e0059ac811ca6c6a1bc54e4d9119621c3
Security Headers
Name Value
Strict-Transport-Security max-age=15768000

Request headers

Referer
http://www.cyberforum.ru/viruses/thread1083273.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Date
Fri, 22 Nov 2019 11:39:32 GMT
Last-Modified
Thu, 08 Nov 2018 20:36:35 GMT
Server
nginx/1.14.0
ETag
"5be49e53-23"
Strict-Transport-Security
max-age=15768000
Content-Type
image/gif
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
35
bridge3.353.0_en.html
imasdk.googleapis.com/js/core/ Frame 63BA 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
http://imasdk.googleapis.com/js/core/bridge3.353.0_en.html
Requested by
Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js
Protocol
HTTP/1.1
Server
2a00:1450:4001:816::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Host
imasdk.googleapis.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Referer
http://www.cyberforum.ru/viruses/thread1083273.html
Accept-Encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Referer
http://www.cyberforum.ru/viruses/thread1083273.html

Response headers

Accept-Ranges
bytes
Vary
Accept-Encoding
Content-Encoding
gzip
Content-Type
text/html
Content-Length
196419
Date
Fri, 22 Nov 2019 11:17:33 GMT
Expires
Sat, 21 Nov 2020 11:17:33 GMT
Last-Modified
Wed, 20 Nov 2019 19:30:13 GMT
X-Content-Type-Options
nosniff
Server
sffe
X-XSS-Protection
0
Cache-Control
public, max-age=31536000
Age
1320
client.js
s0.2mdn.net/instream/video/ 		26 KB
11 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s0.2mdn.net/instream/video/client.js
Requested by
Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:800::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
62f2eeec7851ae0d5e322062cf40092478236d4a4fc5a2cfd87b257739104147
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
http://www.cyberforum.ru/viruses/thread1083273.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 11:39:33 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=900
accept-ranges
bytes
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
10523
x-xss-protection
0
expires
Fri, 22 Nov 2019 11:39:33 GMT
integrator.js
adservice.google.com/adsid/ 		109 B
171 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adservice.google.com/adsid/integrator.js?domain=www.cyberforum.ru
Requested by
Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81d::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
http://www.cyberforum.ru/viruses/thread1083273.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Fri, 22 Nov 2019 11:39:33 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-type
application/javascript; charset=UTF-8
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
104
x-xss-protection
0
/
s.frolvid.ru/log/ 		35 B
316 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.frolvid.ru/log/?p=0.34649692107938&data=%7B%22page_key%22%3A%2299db3a00-a4f3-45fa-bbcf-c04e79c8ce27%22%2C%22wid_id%22%3A%2229%22%2C%22src_id%22%3A4%2C%22event%22%3A%22AdRequested%22%2C%22control%22%3A%220%22%2C%22block_id%22%3A%2224%22%2C%22wid_type%22%3A%222%22%2C%22device%22%3A%22desktop%22%2C%22os%22%3A%22macOS%2010.14.6%22%2C%22browser%22%3A%22Chrome%2078.0%22%2C%22referrer%22%3A0%2C%22origins%22%3A%5B%5D%2C%22cookie%22%3A1%7D
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
176.9.32.236 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.236.32.9.176.clients.your-server.de
Software
nginx/1.14.0 /
Resource Hash
6a842ea462daca2a0b5a0f5f25bcfc8e0059ac811ca6c6a1bc54e4d9119621c3
Security Headers
Name Value
Strict-Transport-Security max-age=15768000

Request headers

Referer
http://www.cyberforum.ru/viruses/thread1083273.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Date
Fri, 22 Nov 2019 11:39:33 GMT
Last-Modified
Thu, 08 Nov 2018 20:36:35 GMT
Server
nginx/1.14.0
ETag
"5be49e53-23"
Strict-Transport-Security
max-age=15768000
Content-Type
image/gif
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
35
captain_marvel_0.mp4
s.frolvid.ru/static/player/trailers/ 		108 KB
108 KB 		Media
General
Check archive.org
Download Go to
Full URL
https://s.frolvid.ru/static/player/trailers/captain_marvel_0.mp4
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
176.9.32.236 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.236.32.9.176.clients.your-server.de
Software
nginx/1.14.0 /
Resource Hash
a4041e1cbe30a71bfce4f5ca2fe12beb71d096e47a05e32ffdd3f62fefcca6af
Security Headers
Name Value
Strict-Transport-Security max-age=15768000

Request headers

Referer
http://www.cyberforum.ru/viruses/thread1083273.html
Accept-Encoding
identity;q=1, *;q=0
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Range
bytes=0-

Response headers

Date
Fri, 22 Nov 2019 11:39:33 GMT
Last-Modified
Fri, 15 Mar 2019 07:57:02 GMT
Server
nginx/1.14.0
ETag
"5c8b5ace-1af6a"
Strict-Transport-Security
max-age=15768000
Content-Type
video/mp4
Content-Range
bytes 0-110441/110442
Connection
keep-alive
Content-Length
110442
/
s.frolvid.ru/log/ 		35 B
316 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.frolvid.ru/log/?p=0.9055126148807289&data=%7B%22page_key%22%3A%2299db3a00-a4f3-45fa-bbcf-c04e79c8ce27%22%2C%22wid_id%22%3A%2229%22%2C%22src_id%22%3A4%2C%22event%22%3A%22AdLoaded%22%2C%22control%22%3A%220%22%2C%22block_id%22%3A%2224%22%2C%22wid_type%22%3A%222%22%2C%22device%22%3A%22desktop%22%2C%22os%22%3A%22macOS%2010.14.6%22%2C%22browser%22%3A%22Chrome%2078.0%22%2C%22referrer%22%3A0%2C%22origins%22%3A%5B%5D%2C%22cookie%22%3A1%7D
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
176.9.32.236 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.236.32.9.176.clients.your-server.de
Software
nginx/1.14.0 /
Resource Hash
6a842ea462daca2a0b5a0f5f25bcfc8e0059ac811ca6c6a1bc54e4d9119621c3
Security Headers
Name Value
Strict-Transport-Security max-age=15768000

Request headers

Referer
http://www.cyberforum.ru/viruses/thread1083273.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Date
Fri, 22 Nov 2019 11:39:33 GMT
Last-Modified
Thu, 08 Nov 2018 20:36:35 GMT
Server
nginx/1.14.0
ETag
"5be49e53-23"
Strict-Transport-Security
max-age=15768000
Content-Type
image/gif
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
35
1JiCQatD0FK000000000U9nJ_AGo-p7Nh8nIGz7ad4dfHq8JB3-Tk1xB00IXsTzP_69RYnWOKbc1t596855x5KYqCeB8eunSGF8g8qZuBYE320F3N2Oc87ifqmjc1eQrJ1L0zaQcJpikH743ZJ_Bz1y8NZ49B4_PV40qcO7XJlAVks-dipAqCeCCxsKM099pcK46h...
an.yandex.ru/rtbcount/ 		43 B
318 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://an.yandex.ru/rtbcount/1JiCQatD0FK000000000U9nJ_AGo-p7Nh8nIGz7ad4dfHq8JB3-Tk1xB00IXsTzP_69RYnWOKbc1t596855x5KYqCeB8eunSGF8g8qZuBYE320F3N2Oc87ifqmjc1eQrJ1L0zaQcJpikH743ZJ_Bz1y8NZ49B4_PV40qcO7XJlAVks-dipAqCeCCxsKM099pcK46h0II2Y07C6nazYqMhLZDzr_lAZFO6Z3vazd1YHyilu7bFmmmxa1Y7q1YtsG1AsNuOFyGpW80vrvLC000?confirmTime=2100000&confirmRatio=1000000&test-tag=337550069727234&rnd=6051426779899&renderWidth=1000&renderHeight=120
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a02:6b8::90 Moscow, Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
nginx/1.12.2 /
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
Security Headers
Name Value
X-Xss-Protection 1; mode=block

Request headers

Referer
http://www.cyberforum.ru/viruses/thread1083273.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 22 Nov 2019 11:39:33 GMT
last-modified
Fri, 22 Nov 2019 11:39:33 GMT
server
nginx/1.12.2
p3p
CP="NOI DEVa TAIa OUR BUS UNI STA"
content-type
image/gif
status
200
cache-control
private, no-cache, no-store, must-revalidate, max-age=0
timing-allow-origin
*
content-length
43
x-xss-protection
1; mode=block
expires
Fri, 22 Nov 2019 11:39:33 GMT
1MfsJhxZ010100000000U9nJ_AGo-p7Nh8nIGz7a6vEBZuGcM7u-SJsM0GX2HUIKgc9RYnWOKbc1t591855x5KYqCeB8gOmC30eCHncvWEohZ40Emrr61X46XhbCJ43sKgO0eD1Q9WaWkP7fquuBKTn0Iyuo_GU2Lqm2B2kU_H5DPc0GIVb_z-rqLePMPf0LlSm2G...
an.yandex.ru/rtbcount/ 		43 B
318 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://an.yandex.ru/rtbcount/1MfsJhxZ010100000000U9nJ_AGo-p7Nh8nIGz7a6vEBZuGcM7u-SJsM0GX2HUIKgc9RYnWOKbc1t591855x5KYqCeB8gOmC30eCHncvWEohZ40Emrr61X46XhbCJ43sKgO0eD1Q9WaWkP7fquuBKTn0Iyuo_GU2Lqm2B2kU_H5DPc0GIVb_z-rqLePMPf0LlSm2G78kCyY0bK1I0UGCXetCliMY5Qlv_kkTP8QvzYeps48m-PFPmOaVh783otyOODo1n3w0nBx0ihPXszhDI--z4Rt90jR5yC7-8Pm505yBNra0?confirmTime=2100000&confirmRatio=1000000&test-tag=337550069727234&rnd=9127416256748&renderWidth=336&renderHeight=280
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a02:6b8::90 Moscow, Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
nginx/1.12.2 /
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
Security Headers
Name Value
X-Xss-Protection 1; mode=block

Request headers

Referer
http://www.cyberforum.ru/viruses/thread1083273.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 22 Nov 2019 11:39:33 GMT
last-modified
Fri, 22 Nov 2019 11:39:33 GMT
server
nginx/1.12.2
p3p
CP="NOI DEVa TAIa OUR BUS UNI STA"
content-type
image/gif
status
200
cache-control
private, no-cache, no-store, must-revalidate, max-age=0
timing-allow-origin
*
content-length
43
x-xss-protection
1; mode=block
expires
Fri, 22 Nov 2019 11:39:33 GMT
bridge3.353.0_en.html
imasdk.googleapis.com/js/core/ Frame 4366 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
http://imasdk.googleapis.com/js/core/bridge3.353.0_en.html
Requested by
Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js
Protocol
HTTP/1.1
Server
2a00:1450:4001:816::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Host
imasdk.googleapis.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Referer
http://www.cyberforum.ru/viruses/thread1083273.html
Accept-Encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Referer
http://www.cyberforum.ru/viruses/thread1083273.html

Response headers

Accept-Ranges
bytes
Vary
Accept-Encoding
Content-Encoding
gzip
Content-Type
text/html
Content-Length
196419
Date
Fri, 22 Nov 2019 11:17:33 GMT
Expires
Sat, 21 Nov 2020 11:17:33 GMT
Last-Modified
Wed, 20 Nov 2019 19:30:13 GMT
X-Content-Type-Options
nosniff
Server
sffe
X-XSS-Protection
0
Cache-Control
public, max-age=31536000
Age
1320
/
s.frolvid.ru/log/ 		35 B
316 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.frolvid.ru/log/?p=0.3708050187993748&data=%7B%22page_key%22%3A%2299db3a00-a4f3-45fa-bbcf-c04e79c8ce27%22%2C%22wid_id%22%3A%2229%22%2C%22src_id%22%3A24%2C%22event%22%3A%22AdRequested%22%2C%22control%22%3A%220%22%2C%22block_id%22%3A%2224%22%2C%22wid_type%22%3A%222%22%2C%22device%22%3A%22desktop%22%2C%22os%22%3A%22macOS%2010.14.6%22%2C%22browser%22%3A%22Chrome%2078.0%22%2C%22referrer%22%3A0%2C%22origins%22%3A%5B%5D%2C%22cookie%22%3A1%7D
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
176.9.32.236 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.236.32.9.176.clients.your-server.de
Software
nginx/1.14.0 /
Resource Hash
6a842ea462daca2a0b5a0f5f25bcfc8e0059ac811ca6c6a1bc54e4d9119621c3
Security Headers
Name Value
Strict-Transport-Security max-age=15768000

Request headers

Referer
http://www.cyberforum.ru/viruses/thread1083273.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Date
Fri, 22 Nov 2019 11:39:33 GMT
Last-Modified
Thu, 08 Nov 2018 20:36:35 GMT
Server
nginx/1.14.0
ETag
"5be49e53-23"
Strict-Transport-Security
max-age=15768000
Content-Type
image/gif
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
35
bridge3.353.0_en.html
imasdk.googleapis.com/js/core/ Frame 63F6 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
http://imasdk.googleapis.com/js/core/bridge3.353.0_en.html
Requested by
Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js
Protocol
HTTP/1.1
Server
2a00:1450:4001:816::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Host
imasdk.googleapis.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Referer
http://www.cyberforum.ru/viruses/thread1083273.html
Accept-Encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Referer
http://www.cyberforum.ru/viruses/thread1083273.html

Response headers

Accept-Ranges
bytes
Vary
Accept-Encoding
Content-Encoding
gzip
Content-Type
text/html
Content-Length
196419
Date
Fri, 22 Nov 2019 11:17:33 GMT
Expires
Sat, 21 Nov 2020 11:17:33 GMT
Last-Modified
Wed, 20 Nov 2019 19:30:13 GMT
X-Content-Type-Options
nosniff
Server
sffe
X-XSS-Protection
0
Cache-Control
public, max-age=31536000
Age
1321
/
s.frolvid.ru/log/ 		35 B
316 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.frolvid.ru/log/?p=0.8973922661885247&data=%7B%22page_key%22%3A%2299db3a00-a4f3-45fa-bbcf-c04e79c8ce27%22%2C%22wid_id%22%3A%2229%22%2C%22src_id%22%3A16%2C%22event%22%3A%22AdRequested%22%2C%22control%22%3A%220%22%2C%22block_id%22%3A%2224%22%2C%22wid_type%22%3A%222%22%2C%22device%22%3A%22desktop%22%2C%22os%22%3A%22macOS%2010.14.6%22%2C%22browser%22%3A%22Chrome%2078.0%22%2C%22referrer%22%3A0%2C%22origins%22%3A%5B%5D%2C%22cookie%22%3A1%7D
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
176.9.32.236 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.236.32.9.176.clients.your-server.de
Software
nginx/1.14.0 /
Resource Hash
6a842ea462daca2a0b5a0f5f25bcfc8e0059ac811ca6c6a1bc54e4d9119621c3
Security Headers
Name Value
Strict-Transport-Security max-age=15768000

Request headers

Referer
http://www.cyberforum.ru/viruses/thread1083273.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Date
Fri, 22 Nov 2019 11:39:34 GMT
Last-Modified
Thu, 08 Nov 2018 20:36:35 GMT
Server
nginx/1.14.0
ETag
"5be49e53-23"
Strict-Transport-Security
max-age=15768000
Content-Type
image/gif
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
35
/
s.frolvid.ru/log/ 		35 B
316 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.frolvid.ru/log/?p=0.15258957380176574&data=%7B%22page_key%22%3A%2299db3a00-a4f3-45fa-bbcf-c04e79c8ce27%22%2C%22wid_id%22%3A%2229%22%2C%22src_id%22%3A16%2C%22event%22%3A%22AdLoaded%22%2C%22control%22%3A%220%22%2C%22block_id%22%3A%2224%22%2C%22wid_type%22%3A%222%22%2C%22device%22%3A%22desktop%22%2C%22os%22%3A%22macOS%2010.14.6%22%2C%22browser%22%3A%22Chrome%2078.0%22%2C%22referrer%22%3A0%2C%22origins%22%3A%5B%5D%2C%22cookie%22%3A1%7D
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
176.9.32.236 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.236.32.9.176.clients.your-server.de
Software
nginx/1.14.0 /
Resource Hash
6a842ea462daca2a0b5a0f5f25bcfc8e0059ac811ca6c6a1bc54e4d9119621c3
Security Headers
Name Value
Strict-Transport-Security max-age=15768000

Request headers

Referer
http://www.cyberforum.ru/viruses/thread1083273.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Date
Fri, 22 Nov 2019 11:39:34 GMT
Last-Modified
Thu, 08 Nov 2018 20:36:35 GMT
Server
nginx/1.14.0
ETag
"5be49e53-23"
Strict-Transport-Security
max-age=15768000
Content-Type
image/gif
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
35
truncated
/ 		2 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
9d02d662da8a47fb5fb610b545007507b6017028043dbb63cd09ec897d3b9627

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ 		715 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
5a3f1dd74233f605e511f1b5b244bedf85ac88ba264caf4d6401bc7ec2017dcd

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Content-Type
image/png
/
s.frolvid.ru/log/ 		35 B
316 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.frolvid.ru/log/?p=0.048721549507529716&data=%7B%22page_key%22%3A%2299db3a00-a4f3-45fa-bbcf-c04e79c8ce27%22%2C%22wid_id%22%3A%2229%22%2C%22src_id%22%3A16%2C%22event%22%3A%22AdLoaded%22%2C%22control%22%3A%220%22%2C%22block_id%22%3A%2224%22%2C%22wid_type%22%3A%222%22%2C%22device%22%3A%22desktop%22%2C%22os%22%3A%22macOS%2010.14.6%22%2C%22browser%22%3A%22Chrome%2078.0%22%2C%22referrer%22%3A0%2C%22origins%22%3A%5B%5D%2C%22cookie%22%3A1%7D
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
176.9.32.236 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.236.32.9.176.clients.your-server.de
Software
nginx/1.14.0 /
Resource Hash
6a842ea462daca2a0b5a0f5f25bcfc8e0059ac811ca6c6a1bc54e4d9119621c3
Security Headers
Name Value
Strict-Transport-Security max-age=15768000

Request headers

Referer
http://www.cyberforum.ru/viruses/thread1083273.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Date
Fri, 22 Nov 2019 11:39:35 GMT
Last-Modified
Thu, 08 Nov 2018 20:36:35 GMT
Server
nginx/1.14.0
ETag
"5be49e53-23"
Strict-Transport-Security
max-age=15768000
Content-Type
image/gif
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
35
/
s.frolvid.ru/log/ 		35 B
316 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.frolvid.ru/log/?p=0.9055751579085762&data=%7B%22page_key%22%3A%2299db3a00-a4f3-45fa-bbcf-c04e79c8ce27%22%2C%22wid_id%22%3A%2229%22%2C%22src_id%22%3A16%2C%22event%22%3A%22AdLoaded%22%2C%22control%22%3A%220%22%2C%22block_id%22%3A%2224%22%2C%22wid_type%22%3A%222%22%2C%22device%22%3A%22desktop%22%2C%22os%22%3A%22macOS%2010.14.6%22%2C%22browser%22%3A%22Chrome%2078.0%22%2C%22referrer%22%3A0%2C%22origins%22%3A%5B%5D%2C%22cookie%22%3A1%7D
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
176.9.32.236 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.236.32.9.176.clients.your-server.de
Software
nginx/1.14.0 /
Resource Hash
6a842ea462daca2a0b5a0f5f25bcfc8e0059ac811ca6c6a1bc54e4d9119621c3
Security Headers
Name Value
Strict-Transport-Security max-age=15768000

Request headers

Referer
http://www.cyberforum.ru/viruses/thread1083273.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Date
Fri, 22 Nov 2019 11:39:36 GMT
Last-Modified
Thu, 08 Nov 2018 20:36:35 GMT
Server
nginx/1.14.0
ETag
"5be49e53-23"
Strict-Transport-Security
max-age=15768000
Content-Type
image/gif
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
35
/
s.frolvid.ru/log/ 		35 B
316 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.frolvid.ru/log/?p=0.8102158205345589&data=%7B%22page_key%22%3A%2299db3a00-a4f3-45fa-bbcf-c04e79c8ce27%22%2C%22wid_id%22%3A%2229%22%2C%22src_id%22%3A16%2C%22event%22%3A%22AdLoaded%22%2C%22control%22%3A%220%22%2C%22block_id%22%3A%2224%22%2C%22wid_type%22%3A%222%22%2C%22device%22%3A%22desktop%22%2C%22os%22%3A%22macOS%2010.14.6%22%2C%22browser%22%3A%22Chrome%2078.0%22%2C%22referrer%22%3A0%2C%22origins%22%3A%5B%5D%2C%22cookie%22%3A1%7D
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
176.9.32.236 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.236.32.9.176.clients.your-server.de
Software
nginx/1.14.0 /
Resource Hash
6a842ea462daca2a0b5a0f5f25bcfc8e0059ac811ca6c6a1bc54e4d9119621c3
Security Headers
Name Value
Strict-Transport-Security max-age=15768000

Request headers

Referer
http://www.cyberforum.ru/viruses/thread1083273.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Date
Fri, 22 Nov 2019 11:39:36 GMT
Last-Modified
Thu, 08 Nov 2018 20:36:35 GMT
Server
nginx/1.14.0
ETag
"5be49e53-23"
Strict-Transport-Security
max-age=15768000
Content-Type
image/gif
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
35
/
s.frolvid.ru/log/ 		35 B
316 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.frolvid.ru/log/?p=0.34767825897921534&data=%7B%22page_key%22%3A%2299db3a00-a4f3-45fa-bbcf-c04e79c8ce27%22%2C%22wid_id%22%3A%2229%22%2C%22src_id%22%3A16%2C%22event%22%3A%22AdLoaded%22%2C%22control%22%3A%220%22%2C%22block_id%22%3A%2224%22%2C%22wid_type%22%3A%222%22%2C%22device%22%3A%22desktop%22%2C%22os%22%3A%22macOS%2010.14.6%22%2C%22browser%22%3A%22Chrome%2078.0%22%2C%22referrer%22%3A0%2C%22origins%22%3A%5B%5D%2C%22cookie%22%3A1%7D
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
176.9.32.236 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.236.32.9.176.clients.your-server.de
Software
nginx/1.14.0 /
Resource Hash
6a842ea462daca2a0b5a0f5f25bcfc8e0059ac811ca6c6a1bc54e4d9119621c3
Security Headers
Name Value
Strict-Transport-Security max-age=15768000

Request headers

Referer
http://www.cyberforum.ru/viruses/thread1083273.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Date
Fri, 22 Nov 2019 11:39:36 GMT
Last-Modified
Thu, 08 Nov 2018 20:36:35 GMT
Server
nginx/1.14.0
ETag
"5be49e53-23"
Strict-Transport-Security
max-age=15768000
Content-Type
image/gif
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
35
/
ru.aliexpress.com/ Frame 0B41
Redirect Chain
  • https://s.click.aliexpress.com/e/Cvg22nO0?dp=ru_cforum
  • https://ru.aliexpress.com/?dp=ru_cforum&aff_platform=link-c-tool&cpt=1574422782140&sk=Cvg22nO0&aff_trace_key=b717ce2a51bf4c19b207d76f9fd7c535-1574422782140-00022-Cvg22nO0&terminal_id=9aaf87f7803b48...
0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://ru.aliexpress.com/?dp=ru_cforum&aff_platform=link-c-tool&cpt=1574422782140&sk=Cvg22nO0&aff_trace_key=b717ce2a51bf4c19b207d76f9fd7c535-1574422782140-00022-Cvg22nO0&terminal_id=9aaf87f7803b48619390b9ea1d91562e
Requested by
Host: www.cyberforum.ru
URL: http://www.cyberforum.ru/viruses/thread1083273.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.45.102.209 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a23-45-102-209.deploy.static.akamaitechnologies.com
Software
Tengine/Aserver /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000 ; includeSubDomains max-age=0
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

:method
GET
:authority
ru.aliexpress.com
:scheme
https
:path
/?dp=ru_cforum&aff_platform=link-c-tool&cpt=1574422782140&sk=Cvg22nO0&aff_trace_key=b717ce2a51bf4c19b207d76f9fd7c535-1574422782140-00022-Cvg22nO0&terminal_id=9aaf87f7803b48619390b9ea1d91562e
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
cross-site
sec-fetch-mode
nested-navigate
referer
http://www.cyberforum.ru/viruses/thread1083273.html
accept-encoding
gzip, deflate, br
cookie
ali_apache_id=10.182.213.149.1574422782136.434279.9; xman_us_f=x_l=0&x_as_i=%7B%22aeuCID%22%3A%22b717ce2a51bf4c19b207d76f9fd7c535-1574422782140-00022-Cvg22nO0%22%2C%22affiliateKey%22%3A%22Cvg22nO0%22%2C%22channel%22%3A%22AFFILIATE%22%2C%22cv%22%3A%221%22%2C%22ms%22%3A%221%22%2C%22pid%22%3A%222197227320%22%2C%22src%22%3A%22link-c-tool%22%2C%22tagtime%22%3A1574422782140%7D&acs_rt=9aaf87f7803b48619390b9ea1d91562e; acs_usuc_t=x_csrf=w59te1kh0irm&acs_rt=9aaf87f7803b48619390b9ea1d91562e; aeu_cid=b717ce2a51bf4c19b207d76f9fd7c535-1574422782140-00022-Cvg22nO0; xman_t=7XAwjHebC45ZVosWPi9WbZi0XA/zeuEdxSPX5p+ohjMtGZObJi9IojCcPtbf6RAQ; xman_f=fHFQLqH/fPlOpShzYFoagYw3ODLzygGLnMQ2CYtYC5UaqYq6UUWsleOjIBYNs3u/S41XiZ5CjkC/wRMR+RSa9btWFWqPE+kUPf+4ftgmw9F192T6xk+CWQ==
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Referer
http://www.cyberforum.ru/viruses/thread1083273.html

Response headers

status
200
content-type
text/html;charset=UTF-8
vary
Accept-Encoding
p3p
CP="CAO PSA OUR"
x-application-context
ae-buyer-homepage-f:prod:7001
x-content-type-options
nosniff
x-xss-protection
1; mode=block
pragma
no-cache
x-frame-options
DENY
strict-transport-security
max-age=31536000 ; includeSubDomains max-age=0
content-language
ru-RU
content-encoding
gzip
access-control-allow-origin
http://hz.ru.aliexpress.com
server
Tengine/Aserver
eagleeye-traceid
0b0a187915744227824625903e189d
timing-allow-origin
*
x-akamai-transformed
9 - 0 pmb=mRUM,3
cache-control
must-revalidate, max-age=60
expires
Fri, 22 Nov 2019 11:40:42 GMT
date
Fri, 22 Nov 2019 11:39:42 GMT
set-cookie
xman_us_f=x_locale=ru_RU&x_l=0&x_as_i=%7B%22aeuCID%22%3A%22b717ce2a51bf4c19b207d76f9fd7c535-1574422782140-00022-Cvg22nO0%22%2C%22affiliateKey%22%3A%22Cvg22nO0%22%2C%22channel%22%3A%22AFFILIATE%22%2C%22cv%22%3A%221%22%2C%22ms%22%3A%221%22%2C%22pid%22%3A%222197227320%22%2C%22src%22%3A%22link-c-tool%22%2C%22tagtime%22%3A1574422782140%7D&acs_rt=9aaf87f7803b48619390b9ea1d91562e; Domain=.aliexpress.com; Expires=Wed, 10-Dec-2087 14:53:49 GMT; Path=/ intl_locale=ru_RU; Domain=.aliexpress.com; Path=/ aep_usuc_f=site=rus&c_tp=RUB&region=NL&b_locale=ru_RU; Domain=.aliexpress.com; Expires=Wed, 10-Dec-2087 14:53:49 GMT; Path=/ intl_common_forever=xb+WI+pKWlmvZFF8NjmYacopsxdwC9gH9yKcJ+Xbx7NtGQEj42VCsA==; Domain=.aliexpress.com; Expires=Wed, 10-Dec-2087 14:53:49 GMT; Path=/; HttpOnly JSESSIONID=BED6ADAAF5A386EEED15E3A76796260F; Path=/; HttpOnly
server-timing
edge; dur=41 origin; dur=48 cdn-cache; desc=MISS
x-akamai-fwd-auth-sha
E33E7883F33E4097C850FF9B991839415B4FE3FA1FE52AE1D654F3BB41856FB9
x-akamai-fwd-auth-data
1545246440, 2.16.181.23, 1574422782, 89.38.96.189
x-akamai-fwd-auth-sign
+gh6rs+3T+LzfLJDKcLZsp62DilxonKhAt0q7RdCA0SdnGQ1jRoe7koUiHYTWyd0EWFyjWQ25p60mC4wbyHGfZ9ssxcjmQ8UNAWNIFZR6ks=

Redirect headers

status
302
content-length
0
x-application-context
affiliateclick:prod,us:7001
p3p
CP="CAO PSA OUR"
x-content-type-options
nosniff
x-xss-protection
1; mode=block
cache-control
no-cache, no-store, max-age=0, must-revalidate
pragma
no-cache
expires
0
x-frame-options
DENY
strict-transport-security
max-age=31536000 ; includeSubDomains max-age=0
location
https://ru.aliexpress.com/?dp=ru_cforum&aff_platform=link-c-tool&cpt=1574422782140&sk=Cvg22nO0&aff_trace_key=b717ce2a51bf4c19b207d76f9fd7c535-1574422782140-00022-Cvg22nO0&terminal_id=9aaf87f7803b48619390b9ea1d91562e
content-language
en-US
server
Tengine/Aserver
eagleeye-traceid
0ab6d59515744227821363527e5235
timing-allow-origin
*
date
Fri, 22 Nov 2019 11:39:42 GMT
set-cookie
ali_apache_id=10.182.213.149.1574422782136.434279.9; path=/; domain=.aliexpress.com; expires=Wed, 30-Nov-2084 01:01:01 GMT xman_us_f=x_l=0&x_as_i=%7B%22aeuCID%22%3A%22b717ce2a51bf4c19b207d76f9fd7c535-1574422782140-00022-Cvg22nO0%22%2C%22affiliateKey%22%3A%22Cvg22nO0%22%2C%22channel%22%3A%22AFFILIATE%22%2C%22cv%22%3A%221%22%2C%22ms%22%3A%221%22%2C%22pid%22%3A%222197227320%22%2C%22src%22%3A%22link-c-tool%22%2C%22tagtime%22%3A1574422782140%7D&acs_rt=9aaf87f7803b48619390b9ea1d91562e; Domain=.aliexpress.com; Expires=Wed, 10-Dec-2087 14:53:49 GMT; Path=/ acs_usuc_t=x_csrf=w59te1kh0irm&acs_rt=9aaf87f7803b48619390b9ea1d91562e; Domain=.aliexpress.com; Path=/ aeu_cid=b717ce2a51bf4c19b207d76f9fd7c535-1574422782140-00022-Cvg22nO0; Domain=.aliexpress.com; Expires=Wed, 10-Dec-2087 14:53:49 GMT; Path=/ xman_t=7XAwjHebC45ZVosWPi9WbZi0XA/zeuEdxSPX5p+ohjMtGZObJi9IojCcPtbf6RAQ; Domain=.aliexpress.com; Path=/; HttpOnly xman_f=fHFQLqH/fPlOpShzYFoagYw3ODLzygGLnMQ2CYtYC5UaqYq6UUWsleOjIBYNs3u/S41XiZ5CjkC/wRMR+RSa9btWFWqPE+kUPf+4ftgmw9F192T6xk+CWQ==; Domain=.aliexpress.com; Expires=Wed, 10-Dec-2087 14:53:49 GMT; Path=/; HttpOnly

Verdicts & Comments Add Verdict or Comment

275 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate string| SESSIONURL string| SECURITYTOKEN string| IMGDIR_MISC number| vb_disable_ajax object| YAHOO function| $ function| jQuery function| fetch_object function| fetch_tags function| fetch_tag_count function| do_an_e function| e_by_gum function| validatemessage function| stripcode function| vB_PHP_Emulator function| vB_AJAX_Handler function| is_ajax_compatible function| vBulletin_AJAX_Error_Handler function| vB_Hidden_Form function| vB_Select_Overlay_Handler function| openWindow function| js_open_help function| attachments function| who function| imwindow function| SendMSNMessage function| AddMSNContact function| detect_caps_lock function| log_out function| set_cookie function| delete_cookie function| fetch_cookie function| js_toggle_all function| js_select_all function| js_check_all function| js_check_all_option function| checkall function| checkall_option function| resize_textarea function| region_intersects function| fetch_viewport_info function| clear_viewport_info function| center_element function| fetch_all_stylesheets function| highlight_login_box function| toggle_collapse function| save_collapsed function| vBpagenav function| vbmenu_register function| string_to_node function| set_unselectable function| fetch_sessionhash function| construct_phrase function| switch_id function| child_img_alt_2_title function| img_alt_2_title function| do_securitytoken_replacement function| handle_securitytoken_response function| handle_securitytoken_error function| replace_securitytoken function| Comment_Init function| PostBit_Init function| vBulletin_init function| vBulletin_Framework function| handle_dismiss_notice_error function| handle_dismiss_notice_ajax function| dismiss_notice undefined| names object| vbphrase object| vB_Editor boolean| ignorequotechars number| pagenavcounter boolean| is_regexp boolean| AJAX_Compatible object| viewport_info number| vB_Default_Timeout string| userAgent boolean| is_opera boolean| is_saf boolean| is_webtv boolean| is_ie boolean| is_ie4 boolean| is_ie7 boolean| is_ps3 boolean| is_moz boolean| is_kon boolean| is_ns boolean| is_ns4 boolean| is_mac string| pointer_cursor number| securitytoken_timeout number| securitytoken_errors object| PHP object| vBulletin function| vB_Popup_Handler object| vBmenu function| vbmenu_hide function| vB_Popup_Menu function| vB_Popup_Events function| toggleimg number| vbpost_getting function| vbpost_get function| display_post object| vB_PostLoader function| vB_AJAX_PostLoader number| hexcase string| b64pad number| chrsz function| hex_md5 function| b64_md5 function| str_md5 function| hex_hmac_md5 function| b64_hmac_md5 function| str_hmac_md5 function| core_md5 function| md5_cmn function| md5_ff function| md5_gg function| md5_hh function| md5_ii function| core_hmac_md5 function| safe_add function| bit_rol function| str2binl function| binl2str function| binl2hex function| binl2b64 function| str_to_ent function| trim function| md5hash string| IMGDIR_BUTTON undefined| SORT_COLUMN_INDEX function| sortables_init function| ts_makeSortable function| ts_getInnerText function| ts_resortTable function| getParent function| ts_sort_date function| ts_sort_currency function| ts_sort_numeric function| ts_sort_caseinsensitive function| ts_sort_default function| addEvent object| krtsts object| addfield_ajax object| deleteanswer_ajax object| saveedit_ajax object| switchfields_ajax object| preview_ajax function| krtsts_showhide_selects function| krtsts_grayOut function| krtsts_load_jscssfile function| krtsts_ctrl object| postanswer_ajax object| deletefield_ajax object| finishtest_ajax object| showresult_ajax object| postcert_ajax function| AJAX_KRBA object| krba_options object| KRBA object| krthumbs object| add_thumb object| remove_thumb object| view_thumbs object| delete_thumb object| user_rate object| show_form function| krthumbs_grayOut function| krthumbs_showhide_selects function| krthumbs_close_window function| krthumbs_show_window function| krthumbs_add_comment function| krthumbs_add function| krthumbs_remove function| krthumbs_view function| krthumbs_delete function| krthumbs_user_rate undefined| yandexContextAsyncCallbacks object| yandex_site_callbacks object| ZCCroll object| Lightboxes object| Lightbox_overlay object| Lightbox_overlay_select_handler number| Lightbox_event_default object| Lightbox_current object| Lightbox_map function| vB_Lightbox function| is_lightbox_element function| init_postbit_lightbox function| vB_Lightbox_Container object| __gcse object| google object| closure_lm_913337 object| Ya function| pcodeLoaderJsonp9832 undefined| yandex_context_callbacks object| FrolvidFlyRoll undefined| storage undefined| urllen undefined| dl undefined| storageKey undefined| editorObject undefined| formObject undefined| buttons undefined| isEmpty undefined| newEvent undefined| writeToTextarea undefined| writeToEditor undefined| clearStorage undefined| setStorage undefined| getData undefined| insertData object| CtrlPagenav function| initSpoilers function| selectCode object| heads undefined| link function| gtag object| dataLayer function| orig_onload function| _googCsa number| nextSearchboxId object| google_tag_manager object| __core-js_shared__ function| FuckAdBlock object| fuckAdBlock string| GoogleAnalyticsObject function| ga function| u7522328651963484 object| core boolean| 053fa154c69038d2e0fd4a86f0f41de7 object| google_tag_data object| gaplugins object| gaGlobal object| gaData number| googleNDT_ number| _googCsaAlwaysHttps number| _googCsaFetchExpIds string| _googCsaExpIds number| googleAltLoader object| a number| b object| EventType object| punycode object| yaCounter26812653 object| yaCounter50312308 undefined| script function| pcodeStaticJsonp9830 object| yaSafeFrameCallbacksStorage object| yaCounter29317 boolean| isLoadingSafeframeStarted object| yaSafeFrameAsyncCallbacks object| $sf object| tbls number| ti object| thisTbl object| google_js_reporting_queue number| google_srt object| _google_rum_ns_ object| google_persistent_state_async number| google_global_correlator function| mb function| Goog_AdSense_Lidar_sendVastEvent function| Goog_AdSense_Lidar_getViewability function| Goog_AdSense_Lidar_getUrlSignalsArray function| Goog_AdSense_Lidar_getUrlSignalsList object| ima object| closure_lm_492019 function| processGoogleToken object| googleToken object| googleIMState object| closure_lm_174437

32 Cookies

Domain/Path Name / Value
.doubleclick.net/ Name: DSID
Value: NO_DATA
.doubleclick.net/ Name: test_cookie
Value: CheckForPermission
yastatic.net/safeframe-bundles/0.69/1-1-0 Name: pcs3
Value: 1
.alibaba.com/ Name: t
Value: 6ae21073a5e5666176b02f2068e2695e
.alibaba.com/ Name: ali_apache_track
Value: ""
offer.alibaba.com/ Name: XSRF-TOKEN
Value: 51634af6-bbc0-4fbc-83b7-429f391f9d4a
www.cyberforum.ru/ Name: cflastvisit
Value: 1574422769
.aliexpress.com/ Name: aeu_cid
Value: cf4a9ce4b0b2497a912ffa46458787f0-1574422770820-04791-DziQooLW
.aliexpress.com/ Name: xman_us_f
Value: x_l=0&x_as_i=%7B%22aeuCID%22%3A%22cf4a9ce4b0b2497a912ffa46458787f0-1574422770820-04791-DziQooLW%22%2C%22affiliateKey%22%3A%22DziQooLW%22%2C%22channel%22%3A%22AFFILIATE%22%2C%22cv%22%3A%221%22%2C%22ms%22%3A%221%22%2C%22pid%22%3A%22814724145%22%2C%22src%22%3A%22link-c-tool%22%2C%22tagtime%22%3A1574422770820%7D&acs_rt=740406f87d5d4ed1841b3d829353104e
.cyberforum.ru/ Name: _gat_gtag_UA_595018_2
Value: 1
ru.aliexpress.com/ Name: JSESSIONID
Value: 678397CEB17097233171857282372019
.aliexpress.com/ Name: intl_common_forever
Value: 3Z9RThKF1SinDgtI+nJAMKoLyooITKcpo32PaJiWlUrLry/S9R86Qw==
.alibaba.com/ Name: ali_apache_id
Value: 11.227.118.126.1574422771729.167501.5
.cyberforum.ru/ Name: _ga
Value: GA1.2.1743422902.1574422771
.aliexpress.com/ Name: xman_f
Value: C6GZQcjKlg7iofhIJdkAP+vA+7IqvVEA8o5g5NhzIV1+9IivGZ7EpIGUfSdjNwkBDexFbXQjI9EbK9I9q1OEA09Fq644ncHl8mzLrNLS+AqWdciq/kvEOg==
.aliexpress.com/ Name: acs_usuc_t
Value: x_csrf=1dspbg8f1ytmr&acs_rt=740406f87d5d4ed1841b3d829353104e
.aliexpress.com/ Name: ali_apache_id
Value: 10.182.250.123.1574422770816.462057.9
.aliexpress.com/ Name: intl_locale
Value: ru_RU
.alibaba.com/ Name: cookie2
Value: u95421bd0115be88d29405562d9ef1b6
.aliexpress.com/ Name: aep_usuc_f
Value: site=rus&c_tp=RUB&region=NL&b_locale=ru_RU
.cyberforum.ru/ Name: _ym_uid
Value: 1574422771233816621
.cyberforum.ru/ Name: _gat_GA_11070349163922444
Value: 1
.cyberforum.ru/ Name: __ddg1
Value: E7200A639E3249414C009773E75157D3B629AEA4
.aliexpress.com/ Name: xman_t
Value: 4fPbLAxF5biE81S9XtfqELdjsl4XM8TpufqyL6ee7AD/42ESIV3TYqnERwa9ri+L
.cyberforum.ru/ Name: _ym_d
Value: 1574422771
.cyberforum.ru/ Name: _gid
Value: GA1.2.264877262.1574422771
www.cyberforum.ru/ Name: cflastactivity
Value: 0
.cyberforum.ru/ Name: _ym_visorc_50312308
Value: b
.cyberforum.ru/ Name: _ym_isad
Value: 2
.alibaba.com/ Name: _tb_token_
Value: e83775f6e9d11
.alibaba.com/ Name: ali_apache_tracktmp
Value: ""
www.cyberforum.ru/ Name: cfsessionhash
Value: 19002155852f83ced42bcb271f888aaf

7 Console Messages

Source Level URL
Text
console-api info URL: http://cyberstatic.net/clientscript/vbulletin_global.js?v=389(Line 1)
Message:
This browser is%s AJAX compatible
console-api info URL: http://cyberstatic.net/clientscript/vbulletin_global.js?v=389(Line 1)
Message:
Creating array vBulletin.elements["%s"] vB_Lightbox_Container
console-api log URL: http://cyberstatic.net/clientscript/vbulletin_global.js?v=389(Line 1)
Message:
vBulletin.elements["%s"][%d] = %s vB_Lightbox_Container 0 posts, 1
console-api log URL: http://cyberstatic.net/clientscript/vbulletin_menu.js?v=389(Line 64)
Message:
vBmenu :: System Activated
console-api info URL: http://cyberstatic.net/clientscript/vbulletin_global.js?v=389(Line 1)
Message:
Firing System Init
console-api log (Line 1)
Message:
%c
console-api log URL: http://www.cyberforum.ru/viruses/thread1083273.html(Line 913)
Message:
ended

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
X-Frame-Options SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

4736.in
adservice.google.com
ajax.googleapis.com
aliadvert.ru
an.yandex.ru
cdn.4736.in
cdn.jsdelivr.net
clients1.google.com
counter.yadro.ru
cse.google.com
cyberstatic.net
epnclick.ru
frolvid.ru
imasdk.googleapis.com
mc.yandex.ru
nohope.ru
ru.aliexpress.com
s.click.aliexpress.com
s.frolvid.ru
s0.2mdn.net
sale.aliexpress.com
site.yandex.net
stats.g.doubleclick.net
video.market-place.su
www.cyberforum.ru
www.google-analytics.com
www.google.com
www.google.de
www.googletagmanager.com
yastatic.net
104.111.214.74
176.32.179.2
176.9.32.236
185.112.80.14
195.201.130.19
195.24.73.119
23.45.102.209
23.45.236.130
2606:4700:30::681c:1eba
2606:4700:e2::ac40:8c25
2a00:1450:4001:800::2006
2a00:1450:4001:806::2003
2a00:1450:4001:808::2008
2a00:1450:4001:814::200e
2a00:1450:4001:816::200a
2a00:1450:4001:818::2004
2a00:1450:4001:81b::200a
2a00:1450:4001:81b::200e
2a00:1450:4001:81d::2002
2a00:1450:400c:c08::9b
2a02:6b8:20::215
2a02:6b8::1:119
2a02:6b8::90
2a04:4e42:3::621
88.212.201.216
93.171.221.121
006fc5aa90b103de5c6c0d418aca9250699d5195a4379fe1d0e4425338b1c1b8
01ae2758002a42764dcf0a2c9ee34209fd6055eac3725990b4295a4975b5919b
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
0b7d112c2ae6b83cc1bdc7a9ca03a2c1ed3711dbb13cebc0341ae7af1aead2a0
0cc98d8e92a98749ce2cc2ecfd5cba57cdffa8e04048f66785646ddd3a2d6f75
12511c9756a8556182399c6721b442b7a9182622746a6435032e0eb5179f8641
187a7f45f8a6233d976c52fbb67c680381efbf6d81e06b4cab4115d1e5f4b064
18c13a380d38b2e8fd1a9976e55fd86780e1ce80204cbacb1f59add2048de25d
1b2113191e228a2c56eb76957a87c565f375f0fdaa5fd606a03b7723054d98cf
1b82b243f5e7f2c56730773716844b1a275f10bbc8b66d4285aad996f675bf9d
2462686d344ef1fd4018b47593f655e60e8f0e31c9c6d75e78d2197c3c1f08b7
27f28f040d744fd271be425ee09bf36026eeec1cdca6d6889b672f0050b8c988
2d6b8ecb2f70ad50610c2956c63e8b068d64b18b39ab2d3736fa5a81c8a2cac9
2d798eabd1fb8f6f9a22386660fba363f7320c6d550819e25693af5be90f0fb0
2e91fefb7391b9e6e5e1c9cdf691630ae6f51a0006fb5a8f5b887dc896f8db5a
34e4be92ec5b080fa8861ec31ab78bf63baad3b2242b5975a38de8d2807857aa
394f459fc88c78b0b75976647afcf14de909a51923b9097172031ac07c0c55e5
3bfa92df8adecd240afa230d054081c4afd48da27ea12c6dca24302edaa78312
3db7135d424b421c0c412fd4504afd0f744698be1df3f009027159627de5ff8f
3df5aac1c3aa2796cc74184a49609bb0b7a4fd8c5b585db9cde197e9abe004cc
40a20291f9b526cba58796a4bbd0256d5663313e02c9d5ab5a842476562b3108
40ec3a7a0f09f8cff97773ac797bf65d34dcc63a2cd942ca22ff1c6405b915ff
40f09dcdb226fb60428bfe107e02f6c50db1561694264b0144e0155f9f3e4140
40f7f245850cf16c62c5067a36c644b5572e99181b0c9f0e8362184ee8d3f356
43f67cee90d69b2ceb8944ab3d3106abda2e40a33a324ab4ce1ef828ec2ae4a3
45a81fb6dc99a3b2e0e03ed11f1661f189f705ced277866f1a8b02916f27e172
466b7bee0f1befc421af448d6adb079163536ea2d4b9d9e514425fad899b2251
473989572be7cf8d9ffef442f7113355e38cc1af23571c534a7d41007c545ba7
4b76d229fffd06e56152502366fdefa175937e53c22b00325ffe23443eb73e03
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
54da8bd4301cd4bec5fd0bb75f9639a65882c6bcc0566528c6e74b14edda59af
5a3f1dd74233f605e511f1b5b244bedf85ac88ba264caf4d6401bc7ec2017dcd
5ae986db0dcbb3131602f6be4d222a521aac9363a25666666df3ab72d61df51f
5fa6833aaa4245a425c0bf047e200f7be29f46246239529a6e4ac8085736671d
60b73b412aa96b4a6060b5c4e459f79caf0da75c34dba2ea4b8b2fa1f9efcac7
625d1dc24589bda4f57d17b192318070dbbb5825deeef5b6514d55cedaa783fc
62f2eeec7851ae0d5e322062cf40092478236d4a4fc5a2cfd87b257739104147
648821f1ce49562855c2f8679bdbb84efb98b0ec60d931dae4ef4599389e76df
64b77871affe1f7eebcf4059ee5472ded7a4c8e9e97007c6009a630292c39e09
6a842ea462daca2a0b5a0f5f25bcfc8e0059ac811ca6c6a1bc54e4d9119621c3
6d7cc332d2caf38b718130ed69bcc87ca84d3b4d0d61534fa574ecd59685df98
6e038a09ccaa009545c02a7eb859d7a05cf83bd162a2907daab499d652cb7ccf
6e8891cab29e4ad3b1cd5cc3caf69a8546d2a6a3392c7a17fbdfb8b74d65f59c
6f12714b7e8b3eef8a3b519ea4c8f8c7c30bdbd66e52c171c0614dd7b21b07f8
7768ed4ae55bae0566763dcedb03a2b686e9680ea3d0f89e2d0b4090c67515c7
7837c22bccb68b6c153c92b5e407e4ec7daf4804d9ae4bea6c09d0165cd4ed93
7a07eb16357f9a2a531b8a8ab8596b570c853d9931c79bfc0ce0b9d4ff5fa40b
7ffd852e45f9eafb24080a731d4e8c9ffdfffd23498266f8be0e0433df747ba3
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
872d751d8312e0c745053ce5ef4f60a8e4c91475147341adca71f48d17d6d7b9
8dcfdfa2bc3c4820ca8fbf409288ff772fe8bf047d1f22b20ab6bb1c6850981e
970d1441b7e386f2dbde319d5ddceb4110611d359c245c7cabd35cf380a15826
982798c3ab58ec9ca4b0fc8ea76f491e1b81d7dc557a3f640df68975283b636e
984ed07cfb706ce8375665769acf5e06d3d4f60002b296b3662c8bc6be959c89
997592debba221629c00740f26b81896b1f8188514f945a85ab6f83938615861
9ceaa25ec7654a66294c16e28989fbf1ecb9cebc9debe96ec597529465c7cd50
9d02d662da8a47fb5fb610b545007507b6017028043dbb63cd09ec897d3b9627
9fa8c2bb49f0e9e391d87f70459663c0e3898f32d4506c81239151b9c0b870d6
a4041e1cbe30a71bfce4f5ca2fe12beb71d096e47a05e32ffdd3f62fefcca6af
a844cdc48c7591822e45128a138f1dbba5753a3ca9992bd71c36758d51d0b68e
aff5487cde973dc7754e0e69595228a261d3712756ccc194574a361ccc98aa42
b271a70ce1ba380a80c924c6435b3e77c03408cd4d4a7389928970f7658d962a
b27f8c0281546dbd8050053a7d6971ab660d7aeb0c93f00ac2b06c9a48bfa601
b4e9ccfcb7d5ca026a1262a7075b7e6e6f30446fb8fc35205fe6edfa6f5a9b5a
bab9fac841ecb978dd2ad6c8946d088be9dba8aedb275ac15bbdb6f07a30d67f
c1287adfc1c6761dcb4221e342113981bfcf6067e0f65adbf417674f5e83da4d
c25f3f18658ceca1cc19c38d7e1ce8db3a148d2b69c65c2dbda0062ce4b93d03
c3c0674e370e514dd2d0984506c3f3b0890e673d05dc489deabd0b43b7496eb3
c602a1d1e40c7d55e25c97d867e6dc6d6dff1be6b6bb0607100158848e7f77c0
c7e70d434e17a158fe1bf1ff44515243cb0eb2cda8d6b72ee956a17a31505607
cc61c44a97e0a7d64a8a1f791a518903f1f9f075fa802590e46b13175f51ae8d
cd447507b1404c62358b237e19e39b0ce8f93f5298aa7f16e911d7a674c099c8
d16d07a0353405fcec95f7efc50a2621bc7425f9a5e8895078396fb0dc460c4f
d5f57ef3e0959d2bb2dc683c08a006db9907409c87ccf4ca110a4ea141ab05eb
d9443ef74dadcd4d4c3d09b0e96b6f27bff47789258e3984fc774e2c81f07f37
dbb67c620eaabf6679a314db18d3ae43037aef71ab27422e6feec08ee987cc0a
dcc27bc3d3ec380b240a8a3b3ababdd92d3afe8da85bde0b495b67917ef5a5ea
e2a23e07c9fe601e16c9a3386544fc873ca602498a9859c92cee02c478931b21
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e49621b25309592564baae61844a761a674d07b48292ec57ac6bfe27afa4eb49
ea930be37c682fe48ca6ed96c4fd88393680751f96de939cd41afd3e473b8589
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f4ad7c81a625a0702dcdd837b046d8c5950d51ccad59e12b6d729ba758b2e1a5
f64f60b60f581caadfa1cf9b012ca732c4f4a24c8475027e7b7a225f20ce4278
f986b7d7773b9fa859b1c01edc18e86004f3978468c9bd363f418476f8d3980f