urlscan.io logo urlscan.io
SecurityTrails logo

blueteam.news Open in urlscan Pro
143.244.165.121  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://t.co/LSsgjjYLYo?amp=1
Effective URL: https://blueteam.news/apt41-resurfaces-as-earth-baku-with-new-cyberespionage-campaign/?utm_source=dlvr.it&utm_medium=t...
Submission: On August 27 via manual from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 20 IPs in 2 countries across 15 domains to perform 63 HTTP transactions. The main IP is 143.244.165.121, located in North Bergen, United States and belongs to DIGITALOCEAN-ASN, US. The main domain is blueteam.news.
TLS certificate: Issued by R3 on July 11th 2021. Valid for: 3 months.
This is the only time blueteam.news was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

1    104.244.42.197 (United States)

ASN13414 (TWITTER, US)
t.co
1    52.11.199.228 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-11-199-228.us-west-2.compute.amazonaws.com
dlvr.it
30    143.244.165.121 (North Bergen, United States)

ASN14061 (DIGITALOCEAN-ASN, US)
blueteam.news
1    2a00:1450:4001:80f::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.googleapis.com
4    2.18.235.93 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a2-18-235-93.deploy.static.akamaitechnologies.com
contextual.media.net
lg3.media.net
1    2a00:1450:4001:809::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.googletagmanager.com
5    2a00:1450:4001:827::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
pagead2.googlesyndication.com
2    13.224.101.72 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-224-101-72.zrh50.r.cloudfront.net
z-na.amazon-adsystem.com
2    2a00:1450:4001:830::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.gstatic.com
4    2a00:1450:4001:82f::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.gstatic.com
1    2a00:1450:4001:803::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
googleads.g.doubleclick.net
1    2a00:1450:4001:808::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google-analytics.com
1    142.250.184.226 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s12-in-f2.1e100.net
partner.googleadservices.com
1    2a00:1450:4001:80f::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
adservice.google.de
1    2a00:1450:4001:80e::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
adservice.google.com
1    2a00:1450:4001:808::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
googleads.g.doubleclick.net
1    2a00:1450:4001:801::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.googletagservices.com
2    209.54.176.34 (Ashburn, United States)

ASN16509 (AMAZON-02, US)
aax-us-east.amazon-adsystem.com
1    13.224.186.70 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-224-186-70.fra2.r.cloudfront.net
wms-na.amazon-adsystem.com
2    2a00:1450:4001:813::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
tpc.googlesyndication.com
1    2a00:1450:4001:80f::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google.com
Domain Requested by
30 blueteam.news t.co
blueteam.news
6 fonts.gstatic.com fonts.googleapis.com
5 pagead2.googlesyndication.com blueteam.news
pagead2.googlesyndication.com
tpc.googlesyndication.com
3 lg3.media.net blueteam.news
2 tpc.googlesyndication.com pagead2.googlesyndication.com
tpc.googlesyndication.com
2 aax-us-east.amazon-adsystem.com z-na.amazon-adsystem.com
2 googleads.g.doubleclick.net pagead2.googlesyndication.com
2 z-na.amazon-adsystem.com blueteam.news
1 www.google.com tpc.googlesyndication.com
1 wms-na.amazon-adsystem.com blueteam.news
1 www.googletagservices.com pagead2.googlesyndication.com
1 adservice.google.com pagead2.googlesyndication.com
1 adservice.google.de pagead2.googlesyndication.com
1 partner.googleadservices.com pagead2.googlesyndication.com
1 www.google-analytics.com www.googletagmanager.com
1 www.googletagmanager.com blueteam.news
1 contextual.media.net blueteam.news
1 fonts.googleapis.com blueteam.news
1 dlvr.it 1 redirects
1 t.co
63 20

This site contains links to these domains. Also see Links.

Domain
twitter.com
www.facebook.com
reddit.com
www.trendmicro.com
www.amazon.com
Subject Issuer Validity Valid
t.co
DigiCert TLS RSA SHA256 2020 CA1		 2021-02-05 -
2022-02-04		 a year crt.sh
blueteam.news
R3		 2021-07-11 -
2021-10-09		 3 months crt.sh
upload.video.google.com
GTS CA 1O1		 2021-08-16 -
2021-11-08		 3 months crt.sh
*.media.net
DigiCert SHA2 Secure Server CA		 2021-04-12 -
2022-04-20		 a year crt.sh
*.google-analytics.com
GTS CA 1C3		 2021-07-26 -
2021-10-18		 3 months crt.sh
*.g.doubleclick.net
GTS CA 1C3		 2021-07-26 -
2021-10-18		 3 months crt.sh
z-na.amazon-adsystem.com
Amazon		 2020-12-12 -
2022-01-10		 a year crt.sh
*.gstatic.com
GTS CA 1C3		 2021-08-16 -
2021-11-08		 3 months crt.sh
*.googleadservices.com
GTS CA 1C3		 2021-07-26 -
2021-10-18		 3 months crt.sh
*.google.de
GTS CA 1C3		 2021-08-16 -
2021-11-08		 3 months crt.sh
*.google.com
GTS CA 1C3		 2021-07-26 -
2021-10-18		 3 months crt.sh
aax-us-east.amazon-adsystem.com
Amazon		 2021-04-09 -
2022-03-17		 a year crt.sh
wms-na.assoc-amazon.com
Amazon		 2020-12-25 -
2021-12-24		 a year crt.sh
tpc.googlesyndication.com
GTS CA 1C3		 2021-08-16 -
2021-11-08		 3 months crt.sh
www.google.com
GTS CA 1C3		 2021-08-16 -
2021-11-08		 3 months crt.sh

This page contains 5 frames:

Primary Page: https://blueteam.news/apt41-resurfaces-as-earth-baku-with-new-cyberespionage-campaign/?utm_source=dlvr.it&utm_medium=twitter
Frame ID: 73BCF098DBFE50E5D0C41A024D5D805B
Requests: 58 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20210824/r20190131/zrt_lookup.html
Frame ID: 00A5A9C1ECB68250AE72E4C72787EEDE
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2265437101737163&output=html&adk=1812271804&adf=3025194257&lmt=1630079281&plat=8%3A134217728%2C9%3A134250504%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fblueteam.news%2Fapt41-resurfaces-as-earth-baku-with-new-cyberespionage-campaign%2F%3Futm_source%3Ddlvr.it%26utm_medium%3Dtwitter&ea=0&flash=0&pra=5&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1630079281625&bpp=13&bdt=726&idt=203&shv=r20210824&mjsv=m202108240101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=7941980236431&frm=20&pv=2&ga_vid=488418060.1630079282&ga_sid=1630079282&ga_hid=1561959777&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062314%2C31062297&oid=3&pvsid=2747978063985674&ref=https%3A%2F%2Ft.co%2FLSsgjjYLYo%3Famp%3D1&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&dtd=222
Frame ID: 9BE0A3A0A110A7F51862E3FB8DA87CE9
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html
Frame ID: 2234BE2F78D4E8747EC7442DE722C068
Requests: 2 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: E0735A8734B283200D1A0EFF8FA133EE
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

APT41 Resurfaces as Earth Baku With New Cyberespionage Campaign | Blue Team News

Page URL History Show full URLs

  1. https://t.co/LSsgjjYLYo?amp=1 Page URL
  2. http://dlvr.it/S6P9Pv HTTP 301
    https://blueteam.news/apt41-resurfaces-as-earth-baku-with-new-cyberespionage-campaign/?utm_source=... Page URL

Page Statistics

63
Requests

100 %
HTTPS

62 %
IPv6

15
Domains

20
Subdomains

20
IPs

2
Countries

1258 kB
Transfer

2817 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://t.co/LSsgjjYLYo?amp=1 Page URL
  2. http://dlvr.it/S6P9Pv HTTP 301
    https://blueteam.news/apt41-resurfaces-as-earth-baku-with-new-cyberespionage-campaign/?utm_source=dlvr.it&utm_medium=twitter Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

63 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
LSsgjjYLYo
t.co/ 		257 B
562 B 		Document
General
Check archive.org
Download Go to
Full URL
https://t.co/LSsgjjYLYo?amp=1
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.244.42.197 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
3d0b8d49892a80a36ed14c13b4e4b8845e50770c406e4be6302952c77609dcc5
Security Headers
Name Value
Content-Security-Policy referrer always;
Strict-Transport-Security max-age=0
X-Xss-Protection 0

Request headers

:method
GET
:authority
t.co
:scheme
https
:path
/LSsgjjYLYo?amp=1
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Fri, 27 Aug 2021 15:47:58 GMT
vary
Origin
server
tsa_o
expires
Fri, 27 Aug 2021 15:52:59 GMT
set-cookie
muc=13392c2b-000b-424c-99ce-c009ecf4e75d; Max-Age=63072000; Expires=Sun, 27 Aug 2023 15:47:59 GMT; Domain=t.co; Secure; SameSite=None
content-type
text/html; charset=utf-8
cache-control
private,max-age=300
content-length
194
referrer-policy
unsafe-url
content-encoding
gzip
x-xss-protection
0
content-security-policy
referrer always;
strict-transport-security
max-age=0
x-connection-hash
f06d1ce04b5b5c1c190a2946262de28647df85b4e76556412a2cc270d84b9825
Primary Request /
blueteam.news/apt41-resurfaces-as-earth-baku-with-new-cyberespionage-campaign/
Redirect Chain
  • http://dlvr.it/S6P9Pv
  • https://blueteam.news/apt41-resurfaces-as-earth-baku-with-new-cyberespionage-campaign/?utm_source=dlvr.it&utm_medium=twitter
408 KB
55 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://blueteam.news/apt41-resurfaces-as-earth-baku-with-new-cyberespionage-campaign/?utm_source=dlvr.it&utm_medium=twitter
Requested by
Host: t.co
URL: https://t.co/LSsgjjYLYo?amp=1
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
143.244.165.121 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
Apache/2.4.41 (Ubuntu) /
Resource Hash
ebbc09dad62e84debfe43df262084ef1bba596297c48dd9359ccb72423ff52a1

Request headers

Host
blueteam.news
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
document
Referer
https://t.co/LSsgjjYLYo?amp=1
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Referer
https://t.co/LSsgjjYLYo?amp=1

Response headers

Date
Fri, 27 Aug 2021 15:48:00 GMT
Server
Apache/2.4.41 (Ubuntu)
Link
<https://blueteam.news/wp-json/>; rel="https://api.w.org/" <https://blueteam.news/wp-json/wp/v2/posts/2490>; rel="alternate"; type="application/json" <https://blueteam.news/?p=2490>; rel=shortlink
Vary
Accept-Encoding
Content-Encoding
gzip
Content-Length
56066
Keep-Alive
timeout=5, max=100
Connection
Keep-Alive
Content-Type
text/html; charset=UTF-8

Redirect headers

Date
Fri, 27 Aug 2021 15:47:59 GMT
Content-Type
text/html; charset=UTF-8
Transfer-Encoding
chunked
Connection
keep-alive
Server
nginx
Set-Cookie
dlvrId=c054a5ef3f6b28d7b598b68c88fc4a7f; expires=Sun, 26-Sep-2021 15:47:59 GMT; Max-Age=2592000; path=/; domain=.dlvrit.com; secure; SameSite=None
Location
https://blueteam.news/apt41-resurfaces-as-earth-baku-with-new-cyberespionage-campaign/?utm_source=dlvr.it&utm_medium=twitter
Cache-Control
private; max-age=90
X-Backend-Server
web03.web
style.min.css
blueteam.news/wp-includes/css/dist/block-library/ 		53 KB
8 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://blueteam.news/wp-includes/css/dist/block-library/style.min.css?ver=5.5.5
Requested by
Host: blueteam.news
URL: https://blueteam.news/apt41-resurfaces-as-earth-baku-with-new-cyberespionage-campaign/?utm_source=dlvr.it&utm_medium=twitter
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
143.244.165.121 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
Apache/2.4.41 (Ubuntu) /
Resource Hash
8c626f0f9b5c109539b256b73e72c02b300a184f46b4535c2eb86599215c78af

Request headers

Pragma
no-cache
Sec-Fetch-Site
same-origin
Accept-Encoding
gzip, deflate, br
Host
blueteam.news
Accept-Language
en-US
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Sec-Fetch-Mode
no-cors
Accept
text/css,*/*;q=0.1
Cache-Control
no-cache
Sec-Fetch-Dest
style
Referer
https://blueteam.news/apt41-resurfaces-as-earth-baku-with-new-cyberespionage-campaign/?utm_source=dlvr.it&utm_medium=twitter
Connection
keep-alive
Referer
https://blueteam.news/apt41-resurfaces-as-earth-baku-with-new-cyberespionage-campaign/?utm_source=dlvr.it&utm_medium=twitter
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date
Fri, 27 Aug 2021 15:48:01 GMT
Content-Encoding
gzip
Last-Modified
Thu, 27 Aug 2020 18:00:38 GMT
Server
Apache/2.4.41 (Ubuntu)
ETag
"d293-5addfb6b23d80-gzip"
Vary
Accept-Encoding
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
7907
email-subscribers-public.css
blueteam.news/wp-content/plugins/email-subscribers/lite/public/css/ 		2 KB
1007 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://blueteam.news/wp-content/plugins/email-subscribers/lite/public/css/email-subscribers-public.css?ver=4.7.6
Requested by
Host: blueteam.news
URL: https://blueteam.news/apt41-resurfaces-as-earth-baku-with-new-cyberespionage-campaign/?utm_source=dlvr.it&utm_medium=twitter
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
143.244.165.121 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
Apache/2.4.41 (Ubuntu) /
Resource Hash
5803ac00778699dfa69a5f4fed086bf5c29164864bdb5b2f36fe0e3cc98736fb

Request headers

Pragma
no-cache
Sec-Fetch-Site
same-origin
Accept-Encoding
gzip, deflate, br
Host
blueteam.news
Accept-Language
en-US
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Sec-Fetch-Mode
no-cors
Accept
text/css,*/*;q=0.1
Cache-Control
no-cache
Sec-Fetch-Dest
style
Referer
https://blueteam.news/apt41-resurfaces-as-earth-baku-with-new-cyberespionage-campaign/?utm_source=dlvr.it&utm_medium=twitter
Connection
keep-alive
Referer
https://blueteam.news/apt41-resurfaces-as-earth-baku-with-new-cyberespionage-campaign/?utm_source=dlvr.it&utm_medium=twitter
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date
Fri, 27 Aug 2021 15:48:01 GMT
Content-Encoding
gzip
Last-Modified
Sun, 18 Jul 2021 01:58:51 GMT
Server
Apache/2.4.41 (Ubuntu)
ETag
"71e-5c75c29857ea8-gzip"
Vary
Accept-Encoding
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
671
style.css
blueteam.news/wp-content/plugins/td-newsletter/ 		6 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://blueteam.news/wp-content/plugins/td-newsletter/style.css?ver=11
Requested by
Host: blueteam.news
URL: https://blueteam.news/apt41-resurfaces-as-earth-baku-with-new-cyberespionage-campaign/?utm_source=dlvr.it&utm_medium=twitter
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
143.244.165.121 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
Apache/2.4.41 (Ubuntu) /
Resource Hash
4f9568d3aef0133feef6736a0be7a2bad332429d685a584e1c5b85e5a7fd60c9

Request headers

Pragma
no-cache
Sec-Fetch-Site
same-origin
Accept-Encoding
gzip, deflate, br
Host
blueteam.news
Accept-Language
en-US
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Sec-Fetch-Mode
no-cors
Accept
text/css,*/*;q=0.1
Cache-Control
no-cache
Sec-Fetch-Dest
style
Referer
https://blueteam.news/apt41-resurfaces-as-earth-baku-with-new-cyberespionage-campaign/?utm_source=dlvr.it&utm_medium=twitter
Connection
keep-alive
Referer
https://blueteam.news/apt41-resurfaces-as-earth-baku-with-new-cyberespionage-campaign/?utm_source=dlvr.it&utm_medium=twitter
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date
Fri, 27 Aug 2021 15:48:01 GMT
Content-Encoding
gzip
Last-Modified
Sun, 11 Jul 2021 02:49:36 GMT
Server
Apache/2.4.41 (Ubuntu)
ETag
"16c7-5c6d00e221714-gzip"
Vary
Accept-Encoding
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
1476
style.css
blueteam.news/wp-content/plugins/td-composer/td-multi-purpose/ 		36 KB
5 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://blueteam.news/wp-content/plugins/td-composer/td-multi-purpose/style.css?ver=978887166a39c57c36d5cf4a5ec10289
Requested by
Host: blueteam.news
URL: https://blueteam.news/apt41-resurfaces-as-earth-baku-with-new-cyberespionage-campaign/?utm_source=dlvr.it&utm_medium=twitter
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
143.244.165.121 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
Apache/2.4.41 (Ubuntu) /
Resource Hash
d227e31ec93027f2b903fe5011b6ef0d67fd1fd8e0105843a2f56626e74f4322

Request headers

Pragma
no-cache
Sec-Fetch-Site
same-origin
Accept-Encoding
gzip, deflate, br
Host
blueteam.news
Accept-Language
en-US
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Sec-Fetch-Mode
no-cors
Accept
text/css,*/*;q=0.1
Cache-Control
no-cache
Sec-Fetch-Dest
style
Referer
https://blueteam.news/apt41-resurfaces-as-earth-baku-with-new-cyberespionage-campaign/?utm_source=dlvr.it&utm_medium=twitter
Connection
keep-alive
Referer
https://blueteam.news/apt41-resurfaces-as-earth-baku-with-new-cyberespionage-campaign/?utm_source=dlvr.it&utm_medium=twitter
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date
Fri, 27 Aug 2021 15:48:01 GMT
Content-Encoding
gzip
Last-Modified
Sun, 11 Jul 2021 02:42:38 GMT
Server
Apache/2.4.41 (Ubuntu)
ETag
"91a4-5c6cff53884e3-gzip"
Vary
Accept-Encoding
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
4797
css
fonts.googleapis.com/ 		17 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Roboto%3A400%2C500%2C700%7COpen+Sans%3A400%2C600%2C700%7CRoboto%3A400%2C900%2C500%2C700%2C300&display=swap&ver=11
Requested by
Host: blueteam.news
URL: https://blueteam.news/apt41-resurfaces-as-earth-baku-with-new-cyberespionage-campaign/?utm_source=dlvr.it&utm_medium=twitter
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
1a46233ca1af9caf624bb7d62119ac1cd6197ffc21c25926f917a1bc5bfe8912
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://blueteam.news/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Fri, 27 Aug 2021 15:47:34 GMT
server
ESF
date
Fri, 27 Aug 2021 15:48:00 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Fri, 27 Aug 2021 15:48:00 GMT
td-multipurpose.css
blueteam.news/wp-content/plugins/td-composer/assets/fonts/td-multipurpose/ 		12 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://blueteam.news/wp-content/plugins/td-composer/assets/fonts/td-multipurpose/td-multipurpose.css?ver=978887166a39c57c36d5cf4a5ec10289
Requested by
Host: blueteam.news
URL: https://blueteam.news/apt41-resurfaces-as-earth-baku-with-new-cyberespionage-campaign/?utm_source=dlvr.it&utm_medium=twitter
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
143.244.165.121 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
Apache/2.4.41 (Ubuntu) /
Resource Hash
485301e24ee204cd089ec16df7e66702b3a3dc906f5ea5ffcc414c303d647e1e

Request headers

Pragma
no-cache
Sec-Fetch-Site
same-origin
Accept-Encoding
gzip, deflate, br
Host
blueteam.news
Accept-Language
en-US
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Sec-Fetch-Mode
no-cors
Accept
text/css,*/*;q=0.1
Cache-Control
no-cache
Sec-Fetch-Dest
style
Referer
https://blueteam.news/apt41-resurfaces-as-earth-baku-with-new-cyberespionage-campaign/?utm_source=dlvr.it&utm_medium=twitter
Connection
keep-alive
Referer
https://blueteam.news/apt41-resurfaces-as-earth-baku-with-new-cyberespionage-campaign/?utm_source=dlvr.it&utm_medium=twitter
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date
Fri, 27 Aug 2021 15:48:01 GMT
Content-Encoding
gzip
Last-Modified
Sun, 11 Jul 2021 02:42:38 GMT
Server
Apache/2.4.41 (Ubuntu)
ETag
"2ee1-5c6cff539cd02-gzip"
Vary
Accept-Encoding
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
2042
style.css
blueteam.news/wp-content/themes/Newspaper/ 		146 KB
25 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://blueteam.news/wp-content/themes/Newspaper/style.css?ver=11
Requested by
Host: blueteam.news
URL: https://blueteam.news/apt41-resurfaces-as-earth-baku-with-new-cyberespionage-campaign/?utm_source=dlvr.it&utm_medium=twitter
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
143.244.165.121 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
Apache/2.4.41 (Ubuntu) /
Resource Hash
312460f32193ff9910d720cc337941abd9c749e9f3c7c0e3bf707d90a51ca897

Request headers

Pragma
no-cache
Sec-Fetch-Site
same-origin
Accept-Encoding
gzip, deflate, br
Host
blueteam.news
Accept-Language
en-US
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Sec-Fetch-Mode
no-cors
Accept
text/css,*/*;q=0.1
Cache-Control
no-cache
Sec-Fetch-Dest
style
Referer
https://blueteam.news/apt41-resurfaces-as-earth-baku-with-new-cyberespionage-campaign/?utm_source=dlvr.it&utm_medium=twitter
Connection
keep-alive
Referer
https://blueteam.news/apt41-resurfaces-as-earth-baku-with-new-cyberespionage-campaign/?utm_source=dlvr.it&utm_medium=twitter
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date
Fri, 27 Aug 2021 15:48:01 GMT
Content-Encoding
gzip
Last-Modified
Sun, 11 Jul 2021 02:42:11 GMT
Server
Apache/2.4.41 (Ubuntu)
ETag
"24641-5c6cff39cc78c-gzip"
Vary
Accept-Encoding
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
24864
td_legacy_main.css
blueteam.news/wp-content/plugins/td-composer/legacy/Newspaper/assets/css/ 		155 KB
23 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://blueteam.news/wp-content/plugins/td-composer/legacy/Newspaper/assets/css/td_legacy_main.css?ver=978887166a39c57c36d5cf4a5ec10289
Requested by
Host: blueteam.news
URL: https://blueteam.news/apt41-resurfaces-as-earth-baku-with-new-cyberespionage-campaign/?utm_source=dlvr.it&utm_medium=twitter
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
143.244.165.121 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
Apache/2.4.41 (Ubuntu) /
Resource Hash
b689f2267305a97c30f5bda1a0e18993c4bed294007df78eafd6829a4408cb1e

Request headers

Pragma
no-cache
Sec-Fetch-Site
same-origin
Accept-Encoding
gzip, deflate, br
Host
blueteam.news
Accept-Language
en-US
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Sec-Fetch-Mode
no-cors
Accept
text/css,*/*;q=0.1
Cache-Control
no-cache
Sec-Fetch-Dest
style
Referer
https://blueteam.news/apt41-resurfaces-as-earth-baku-with-new-cyberespionage-campaign/?utm_source=dlvr.it&utm_medium=twitter
Connection
keep-alive
Referer
https://blueteam.news/apt41-resurfaces-as-earth-baku-with-new-cyberespionage-campaign/?utm_source=dlvr.it&utm_medium=twitter
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date
Fri, 27 Aug 2021 15:48:01 GMT
Content-Encoding
gzip
Last-Modified
Sun, 11 Jul 2021 02:42:38 GMT
Server
Apache/2.4.41 (Ubuntu)
ETag
"26c08-5c6cff5381783-gzip"
Vary
Accept-Encoding
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=98
Content-Length
23389
jquery.js
blueteam.news/wp-includes/js/jquery/ 		95 KB
33 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://blueteam.news/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp
Requested by
Host: blueteam.news
URL: https://blueteam.news/apt41-resurfaces-as-earth-baku-with-new-cyberespionage-campaign/?utm_source=dlvr.it&utm_medium=twitter
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
143.244.165.121 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
Apache/2.4.41 (Ubuntu) /
Resource Hash
1db21d816296e6939ba1f42962496e4134ae2b0081e26970864c40c6d02bb1df

Request headers

Pragma
no-cache
Sec-Fetch-Site
same-origin
Accept-Encoding
gzip, deflate, br
Host
blueteam.news
Accept-Language
en-US
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Sec-Fetch-Mode
no-cors
Accept
*/*
Cache-Control
no-cache
Sec-Fetch-Dest
script
Referer
https://blueteam.news/apt41-resurfaces-as-earth-baku-with-new-cyberespionage-campaign/?utm_source=dlvr.it&utm_medium=twitter
Connection
keep-alive
Referer
https://blueteam.news/apt41-resurfaces-as-earth-baku-with-new-cyberespionage-campaign/?utm_source=dlvr.it&utm_medium=twitter
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date
Fri, 27 Aug 2021 15:48:01 GMT
Content-Encoding
gzip
Last-Modified
Fri, 17 May 2019 04:25:54 GMT
Server
Apache/2.4.41 (Ubuntu)
ETag
"17a69-5890dc7401880-gzip"
Vary
Accept-Encoding
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
33776
email-subscribers-public.js
blueteam.news/wp-content/plugins/email-subscribers/lite/public/js/ 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://blueteam.news/wp-content/plugins/email-subscribers/lite/public/js/email-subscribers-public.js?ver=4.7.6
Requested by
Host: blueteam.news
URL: https://blueteam.news/apt41-resurfaces-as-earth-baku-with-new-cyberespionage-campaign/?utm_source=dlvr.it&utm_medium=twitter
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
143.244.165.121 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
Apache/2.4.41 (Ubuntu) /
Resource Hash
12f7b276d0357e226f9440732a4151cc26daade05efc15b0255d542625c9eefe

Request headers

Pragma
no-cache
Sec-Fetch-Site
same-origin
Accept-Encoding
gzip, deflate, br
Host
blueteam.news
Accept-Language
en-US
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Sec-Fetch-Mode
no-cors
Accept
*/*
Cache-Control
no-cache
Sec-Fetch-Dest
script
Referer
https://blueteam.news/apt41-resurfaces-as-earth-baku-with-new-cyberespionage-campaign/?utm_source=dlvr.it&utm_medium=twitter
Connection
keep-alive
Referer
https://blueteam.news/apt41-resurfaces-as-earth-baku-with-new-cyberespionage-campaign/?utm_source=dlvr.it&utm_medium=twitter
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date
Fri, 27 Aug 2021 15:48:01 GMT
Content-Encoding
gzip
Last-Modified
Sun, 18 Jul 2021 01:58:51 GMT
Server
Apache/2.4.41 (Ubuntu)
ETag
"e46-5c75c29857ea8-gzip"
Vary
Accept-Encoding
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
1512
medianetAdInjector.js
blueteam.news/wp-content/plugins/media-net-ads-manager/js/ 		562 B
668 B 		Script
General
Check archive.org
Download Go to
Full URL
https://blueteam.news/wp-content/plugins/media-net-ads-manager/js/medianetAdInjector.js?ver=2.10.13
Requested by
Host: blueteam.news
URL: https://blueteam.news/apt41-resurfaces-as-earth-baku-with-new-cyberespionage-campaign/?utm_source=dlvr.it&utm_medium=twitter
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
143.244.165.121 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
Apache/2.4.41 (Ubuntu) /
Resource Hash
37d925559381e9d5388c4a096fe1383570546b7b11548d7d6a7e560adcc24e5d

Request headers

Pragma
no-cache
Sec-Fetch-Site
same-origin
Accept-Encoding
gzip, deflate, br
Host
blueteam.news
Accept-Language
en-US
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Sec-Fetch-Mode
no-cors
Accept
*/*
Cache-Control
no-cache
Sec-Fetch-Dest
script
Referer
https://blueteam.news/apt41-resurfaces-as-earth-baku-with-new-cyberespionage-campaign/?utm_source=dlvr.it&utm_medium=twitter
Connection
keep-alive
Referer
https://blueteam.news/apt41-resurfaces-as-earth-baku-with-new-cyberespionage-campaign/?utm_source=dlvr.it&utm_medium=twitter
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date
Fri, 27 Aug 2021 15:48:01 GMT
Content-Encoding
gzip
Last-Modified
Mon, 23 Aug 2021 20:07:08 GMT
Server
Apache/2.4.41 (Ubuntu)
ETag
"232-5ca3f8fd2e149-gzip"
Vary
Accept-Encoding
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
319
dmedianet.js
contextual.media.net/ 		136 KB
46 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://contextual.media.net/dmedianet.js?cid=8CUNJ75ON
Requested by
Host: blueteam.news
URL: https://blueteam.news/apt41-resurfaces-as-earth-baku-with-new-cyberespionage-campaign/?utm_source=dlvr.it&utm_medium=twitter
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.18.235.93 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-235-93.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
65df1311d734b8d259ce544c85b503bc9e41196452c0514145d01838eaea0f55
Security Headers
Name Value
Strict-Transport-Security max-age=604800

Request headers

Referer
https://blueteam.news/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

x-mnt-h
8-32
content-encoding
gzip
server
Apache
p3p
CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
etag
"259da7cc06509747e1520e6d7bcf1041"
vary
Accept-Encoding
content-type
text/javascript; charset=utf-8
cache-control
max-age=300
date
Fri, 27 Aug 2021 15:48:01 GMT
strict-transport-security
max-age=604800
x-mnt-w
8-19
expires
Fri, 27 Aug 2021 15:53:01 GMT
wp-emoji-release.min.js
blueteam.news/wp-includes/js/ 		14 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://blueteam.news/wp-includes/js/wp-emoji-release.min.js?ver=5.5.5
Requested by
Host: blueteam.news
URL: https://blueteam.news/apt41-resurfaces-as-earth-baku-with-new-cyberespionage-campaign/?utm_source=dlvr.it&utm_medium=twitter
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
143.244.165.121 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
Apache/2.4.41 (Ubuntu) /
Resource Hash
07e4203b9f313b587b1d53f896e63771ec85f9b0d4c2ac5fa64089457784d847

Request headers

Pragma
no-cache
Sec-Fetch-Site
same-origin
Accept-Encoding
gzip, deflate, br
Host
blueteam.news
Accept-Language
en-US
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Sec-Fetch-Mode
no-cors
Accept
*/*
Cache-Control
no-cache
Sec-Fetch-Dest
script
Referer
https://blueteam.news/apt41-resurfaces-as-earth-baku-with-new-cyberespionage-campaign/?utm_source=dlvr.it&utm_medium=twitter
Connection
keep-alive
Referer
https://blueteam.news/apt41-resurfaces-as-earth-baku-with-new-cyberespionage-campaign/?utm_source=dlvr.it&utm_medium=twitter
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date
Fri, 27 Aug 2021 15:48:01 GMT
Content-Encoding
gzip
Last-Modified
Sun, 11 Jul 2021 02:24:45 GMT
Server
Apache/2.4.41 (Ubuntu)
ETag
"3795-5c6cfb54c8e44-gzip"
Vary
Accept-Encoding
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=96
Content-Length
4662
js
www.googletagmanager.com/gtag/ 		128 KB
51 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=G-BX7H8ZCEPW
Requested by
Host: blueteam.news
URL: https://blueteam.news/apt41-resurfaces-as-earth-baku-with-new-cyberespionage-campaign/?utm_source=dlvr.it&utm_medium=twitter
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:809::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
4bc1e32c9183254cd3bf50d981d9f0ba21f3512f8868d571c4e1f3fd8331226e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Referer
https://blueteam.news/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Fri, 27 Aug 2021 15:48:01 GMT
content-encoding
br
server
Google Tag Manager
access-control-allow-headers
Cache-Control
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
strict-transport-security
max-age=31536000; includeSubDomains
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
51718
x-xss-protection
0
expires
Fri, 27 Aug 2021 15:48:01 GMT
adsbygoogle.js
pagead2.googlesyndication.com/pagead/js/ 		139 KB
49 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-2265437101737163
Requested by
Host: blueteam.news
URL: https://blueteam.news/apt41-resurfaces-as-earth-baku-with-new-cyberespionage-campaign/?utm_source=dlvr.it&utm_medium=twitter
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
221489efba5eb3e4c59612e9e563bf967c8f399e2afcef2eaa1be6e48ca9c1c7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://blueteam.news
Referer
https://blueteam.news/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Fri, 27 Aug 2021 15:48:01 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
49998
x-xss-protection
0
server
cafe
etag
6335602564762238188
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=3600
timing-allow-origin
*
expires
Fri, 27 Aug 2021 15:48:01 GMT
sample-62.jpg
blueteam.news/wp-content/uploads/2021/08/ 		53 KB
53 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blueteam.news/wp-content/uploads/2021/08/sample-62.jpg
Requested by
Host: blueteam.news
URL: https://blueteam.news/apt41-resurfaces-as-earth-baku-with-new-cyberespionage-campaign/?utm_source=dlvr.it&utm_medium=twitter
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
143.244.165.121 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
Apache/2.4.41 (Ubuntu) /
Resource Hash
292a8774ea688b6f103fc5182f24e9074de6a6b6af1516b952ddee8d6607b95e

Request headers

Pragma
no-cache
Sec-Fetch-Site
same-origin
Accept-Encoding
gzip, deflate, br
Host
blueteam.news
Accept-Language
en-US
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Sec-Fetch-Mode
no-cors
Accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Cache-Control
no-cache
Sec-Fetch-Dest
image
Referer
https://blueteam.news/apt41-resurfaces-as-earth-baku-with-new-cyberespionage-campaign/?utm_source=dlvr.it&utm_medium=twitter
Connection
keep-alive
Referer
https://blueteam.news/apt41-resurfaces-as-earth-baku-with-new-cyberespionage-campaign/?utm_source=dlvr.it&utm_medium=twitter
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date
Fri, 27 Aug 2021 15:48:01 GMT
Last-Modified
Wed, 25 Aug 2021 01:04:26 GMT
Server
Apache/2.4.41 (Ubuntu)
ETag
"d3ce-5ca57d4e132f7"
Content-Type
image/jpeg
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=97
Content-Length
54222
onejs
z-na.amazon-adsystem.com/widgets/ 		25 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://z-na.amazon-adsystem.com/widgets/onejs?MarketPlace=US&adInstanceId=57a61967-78de-4451-8e48-1a7d1e6df6af
Requested by
Host: blueteam.news
URL: https://blueteam.news/apt41-resurfaces-as-earth-baku-with-new-cyberespionage-campaign/?utm_source=dlvr.it&utm_medium=twitter
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.224.101.72 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-224-101-72.zrh50.r.cloudfront.net
Software
Server /
Resource Hash
019c5b598cd955b04265d45cdc72dcd2c3dbb0f0d4fe30a4431c395a8b3cdbb1

Request headers

Referer
https://blueteam.news/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma
Public
date
Fri, 27 Aug 2021 15:48:01 GMT
content-encoding
gzip
server
Server
x-amz-cf-pop
ZRH50-C1
x-cache
Miss from cloudfront
content-type
application/javascript;charset=UTF-8
access-control-allow-origin
*
charset
UTF-8
cache-control
public,max-age=300,s-maxage=300,no-transform
x-amz-cf-id
mZUUcGomEgoJgfmmjYc7YawmrmiYTOshO9n6-9hufrA654-KLtarsQ==
via
1.1 a70d280cd058ea89c08954ea0ad67199.cloudfront.net (CloudFront)
expires
Fri, 27 Aug 2021 15:53:01 GMT
spinner.gif
blueteam.news/wp-content/plugins/email-subscribers/lite/public/images/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blueteam.news/wp-content/plugins/email-subscribers/lite/public/images/spinner.gif
Requested by
Host: blueteam.news
URL: https://blueteam.news/apt41-resurfaces-as-earth-baku-with-new-cyberespionage-campaign/?utm_source=dlvr.it&utm_medium=twitter
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
143.244.165.121 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
Apache/2.4.41 (Ubuntu) /
Resource Hash
7837e876f1eef549b3250b78380ec2df00ad6da4da6c27667424b1636854df3c

Request headers

Pragma
no-cache
Sec-Fetch-Site
same-origin
Accept-Encoding
gzip, deflate, br
Host
blueteam.news
Accept-Language
en-US
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Sec-Fetch-Mode
no-cors
Accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Cache-Control
no-cache
Sec-Fetch-Dest
image
Referer
https://blueteam.news/apt41-resurfaces-as-earth-baku-with-new-cyberespionage-campaign/?utm_source=dlvr.it&utm_medium=twitter
Connection
keep-alive
Referer
https://blueteam.news/apt41-resurfaces-as-earth-baku-with-new-cyberespionage-campaign/?utm_source=dlvr.it&utm_medium=twitter
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date
Fri, 27 Aug 2021 15:48:01 GMT
Last-Modified
Sun, 18 Jul 2021 01:58:51 GMT
Server
Apache/2.4.41 (Ubuntu)
ETag
"c88-5c75c29856f08"
Content-Type
image/gif
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=98
Content-Length
3208
onejs
z-na.amazon-adsystem.com/widgets/ 		24 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://z-na.amazon-adsystem.com/widgets/onejs?MarketPlace=US
Requested by
Host: blueteam.news
URL: https://blueteam.news/apt41-resurfaces-as-earth-baku-with-new-cyberespionage-campaign/?utm_source=dlvr.it&utm_medium=twitter
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.224.101.72 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-224-101-72.zrh50.r.cloudfront.net
Software
Server /
Resource Hash
eb117fa46ad7744ecc1ba59f1e267b82c00582cfda5fcae2706ea3caf6a98d14

Request headers

Referer
https://blueteam.news/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma
Public
date
Fri, 27 Aug 2021 04:39:09 GMT
content-encoding
gzip
server
Server
age
40132
x-cache
Hit from cloudfront
content-type
application/javascript;charset=UTF-8
access-control-allow-origin
*
charset
UTF-8
cache-control
public,max-age=86400,s-maxage=86400,no-transform
x-amz-cf-pop
ZRH50-C1
content-length
7945
via
1.1 a70d280cd058ea89c08954ea0ad67199.cloudfront.net (CloudFront)
x-amz-cf-id
wDNByJni4VPiW5s28DtALyY9Uk0TXhovcVb71VwV6YNVGTR9hHvjMQ==
expires
Sat, 28 Aug 2021 04:39:09 GMT
underscore.min.js
blueteam.news/wp-includes/js/ 		16 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://blueteam.news/wp-includes/js/underscore.min.js?ver=1.8.3
Requested by
Host: blueteam.news
URL: https://blueteam.news/apt41-resurfaces-as-earth-baku-with-new-cyberespionage-campaign/?utm_source=dlvr.it&utm_medium=twitter
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
143.244.165.121 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
Apache/2.4.41 (Ubuntu) /
Resource Hash
6cd0d6897b3d4779f7d88ce72531f22fbf75851b195fb14e6f3f23d051b3d1e9

Request headers

Pragma
no-cache
Sec-Fetch-Site
same-origin
Accept-Encoding
gzip, deflate, br
Host
blueteam.news
Accept-Language
en-US
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Sec-Fetch-Mode
no-cors
Accept
*/*
Cache-Control
no-cache
Sec-Fetch-Dest
script
Referer
https://blueteam.news/apt41-resurfaces-as-earth-baku-with-new-cyberespionage-campaign/?utm_source=dlvr.it&utm_medium=twitter
Connection
keep-alive
Referer
https://blueteam.news/apt41-resurfaces-as-earth-baku-with-new-cyberespionage-campaign/?utm_source=dlvr.it&utm_medium=twitter
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date
Fri, 27 Aug 2021 15:48:01 GMT
Content-Encoding
gzip
Last-Modified
Sun, 11 Jul 2021 02:24:45 GMT
Server
Apache/2.4.41 (Ubuntu)
ETag
"3ead-5c6cfb54c4024-gzip"
Vary
Accept-Encoding
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=98
Content-Length
5663
js_posts_autoload.min.js
blueteam.news/wp-content/plugins/td-cloud-library/assets/js/ 		5 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://blueteam.news/wp-content/plugins/td-cloud-library/assets/js/js_posts_autoload.min.js?ver=45456ad3a6d583e9cee0a9fe2cdd86cb
Requested by
Host: blueteam.news
URL: https://blueteam.news/apt41-resurfaces-as-earth-baku-with-new-cyberespionage-campaign/?utm_source=dlvr.it&utm_medium=twitter
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
143.244.165.121 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
Apache/2.4.41 (Ubuntu) /
Resource Hash
0dd95d9bfc689b8862a9dd8ae8166ca21df149fb24f3d0830423b66ae00d426e

Request headers

Pragma
no-cache
Sec-Fetch-Site
same-origin
Accept-Encoding
gzip, deflate, br
Host
blueteam.news
Accept-Language
en-US
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Sec-Fetch-Mode
no-cors
Accept
*/*
Cache-Control
no-cache
Sec-Fetch-Dest
script
Referer
https://blueteam.news/apt41-resurfaces-as-earth-baku-with-new-cyberespionage-campaign/?utm_source=dlvr.it&utm_medium=twitter
Connection
keep-alive
Referer
https://blueteam.news/apt41-resurfaces-as-earth-baku-with-new-cyberespionage-campaign/?utm_source=dlvr.it&utm_medium=twitter
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date
Fri, 27 Aug 2021 15:48:01 GMT
Content-Encoding
gzip
Last-Modified
Sun, 11 Jul 2021 02:42:41 GMT
Server
Apache/2.4.41 (Ubuntu)
ETag
"1428-5c6cff56476ca-gzip"
Vary
Accept-Encoding
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=98
Content-Length
1981
tagdiv_theme.min.js
blueteam.news/wp-content/plugins/td-composer/legacy/Newspaper/js/ 		257 KB
60 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://blueteam.news/wp-content/plugins/td-composer/legacy/Newspaper/js/tagdiv_theme.min.js?ver=11
Requested by
Host: blueteam.news
URL: https://blueteam.news/apt41-resurfaces-as-earth-baku-with-new-cyberespionage-campaign/?utm_source=dlvr.it&utm_medium=twitter
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
143.244.165.121 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
Apache/2.4.41 (Ubuntu) /
Resource Hash
2d036346b18bf4c27bc91f0416f8b59427e32bfc6c2724a27e6fe2e5a7b58574

Request headers

Pragma
no-cache
Sec-Fetch-Site
same-origin
Accept-Encoding
gzip, deflate, br
Host
blueteam.news
Accept-Language
en-US
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Sec-Fetch-Mode
no-cors
Accept
*/*
Cache-Control
no-cache
Sec-Fetch-Dest
script
Referer
https://blueteam.news/apt41-resurfaces-as-earth-baku-with-new-cyberespionage-campaign/?utm_source=dlvr.it&utm_medium=twitter
Connection
keep-alive
Referer
https://blueteam.news/apt41-resurfaces-as-earth-baku-with-new-cyberespionage-campaign/?utm_source=dlvr.it&utm_medium=twitter
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date
Fri, 27 Aug 2021 15:48:01 GMT
Content-Encoding
gzip
Last-Modified
Sun, 11 Jul 2021 02:42:37 GMT
Server
Apache/2.4.41 (Ubuntu)
ETag
"4029c-5c6cff531fd07-gzip"
Vary
Accept-Encoding
Content-Type
application/javascript
Transfer-Encoding
chunked
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
comment-reply.min.js
blueteam.news/wp-includes/js/ 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://blueteam.news/wp-includes/js/comment-reply.min.js?ver=5.5.5
Requested by
Host: blueteam.news
URL: https://blueteam.news/apt41-resurfaces-as-earth-baku-with-new-cyberespionage-campaign/?utm_source=dlvr.it&utm_medium=twitter
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
143.244.165.121 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
Apache/2.4.41 (Ubuntu) /
Resource Hash
143ce443c390db3b8598f951de20bd04623859a581a15b8cde43ebfa1f8ec103

Request headers

Pragma
no-cache
Sec-Fetch-Site
same-origin
Accept-Encoding
gzip, deflate, br
Host
blueteam.news
Accept-Language
en-US
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Sec-Fetch-Mode
no-cors
Accept
*/*
Cache-Control
no-cache
Sec-Fetch-Dest
script
Referer
https://blueteam.news/apt41-resurfaces-as-earth-baku-with-new-cyberespionage-campaign/?utm_source=dlvr.it&utm_medium=twitter
Connection
keep-alive
Referer
https://blueteam.news/apt41-resurfaces-as-earth-baku-with-new-cyberespionage-campaign/?utm_source=dlvr.it&utm_medium=twitter
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date
Fri, 27 Aug 2021 15:48:01 GMT
Content-Encoding
gzip
Last-Modified
Sun, 11 Jul 2021 02:24:45 GMT
Server
Apache/2.4.41 (Ubuntu)
ETag
"ba8-5c6cfb54c8e44-gzip"
Vary
Accept-Encoding
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=98
Content-Length
1346
js_files_for_front.min.js
blueteam.news/wp-content/plugins/td-cloud-library/assets/js/ 		36 KB
9 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://blueteam.news/wp-content/plugins/td-cloud-library/assets/js/js_files_for_front.min.js?ver=45456ad3a6d583e9cee0a9fe2cdd86cb
Requested by
Host: blueteam.news
URL: https://blueteam.news/apt41-resurfaces-as-earth-baku-with-new-cyberespionage-campaign/?utm_source=dlvr.it&utm_medium=twitter
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
143.244.165.121 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
Apache/2.4.41 (Ubuntu) /
Resource Hash
15c510fe49c3ec5fd57ac7ead341655699156a63fe10195347dfeae1dc53f909

Request headers

Pragma
no-cache
Sec-Fetch-Site
same-origin
Accept-Encoding
gzip, deflate, br
Host
blueteam.news
Accept-Language
en-US
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Sec-Fetch-Mode
no-cors
Accept
*/*
Cache-Control
no-cache
Sec-Fetch-Dest
script
Referer
https://blueteam.news/apt41-resurfaces-as-earth-baku-with-new-cyberespionage-campaign/?utm_source=dlvr.it&utm_medium=twitter
Connection
keep-alive
Referer
https://blueteam.news/apt41-resurfaces-as-earth-baku-with-new-cyberespionage-campaign/?utm_source=dlvr.it&utm_medium=twitter
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date
Fri, 27 Aug 2021 15:48:01 GMT
Content-Encoding
gzip
Last-Modified
Sun, 11 Jul 2021 02:42:41 GMT
Server
Apache/2.4.41 (Ubuntu)
ETag
"9176-5c6cff56476ca-gzip"
Vary
Accept-Encoding
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=97
Content-Length
8430
wp-embed.min.js
blueteam.news/wp-includes/js/ 		1 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://blueteam.news/wp-includes/js/wp-embed.min.js?ver=5.5.5
Requested by
Host: blueteam.news
URL: https://blueteam.news/apt41-resurfaces-as-earth-baku-with-new-cyberespionage-campaign/?utm_source=dlvr.it&utm_medium=twitter
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
143.244.165.121 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
Apache/2.4.41 (Ubuntu) /
Resource Hash
5be614bce53f767993a5f5f14a6badd6aae6bf3af7cbdbf4d31520de49e27991

Request headers

Pragma
no-cache
Sec-Fetch-Site
same-origin
Accept-Encoding
gzip, deflate, br
Host
blueteam.news
Accept-Language
en-US
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Sec-Fetch-Mode
no-cors
Accept
*/*
Cache-Control
no-cache
Sec-Fetch-Dest
script
Referer
https://blueteam.news/apt41-resurfaces-as-earth-baku-with-new-cyberespionage-campaign/?utm_source=dlvr.it&utm_medium=twitter
Connection
keep-alive
Referer
https://blueteam.news/apt41-resurfaces-as-earth-baku-with-new-cyberespionage-campaign/?utm_source=dlvr.it&utm_medium=twitter
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date
Fri, 27 Aug 2021 15:48:01 GMT
Content-Encoding
gzip
Last-Modified
Sun, 11 Jul 2021 02:24:45 GMT
Server
Apache/2.4.41 (Ubuntu)
ETag
"592-5c6cfb54c9de4-gzip"
Vary
Accept-Encoding
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
765
newspaper.woff
blueteam.news/wp-content/themes/Newspaper/images/icons/ 		24 KB
25 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://blueteam.news/wp-content/themes/Newspaper/images/icons/newspaper.woff?19
Requested by
Host: blueteam.news
URL: https://blueteam.news/wp-content/themes/Newspaper/style.css?ver=11
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
143.244.165.121 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
Apache/2.4.41 (Ubuntu) /
Resource Hash
ea9ad8f6ace011a694d664482cc6ca0acc2dd86a8d6b684154327ec84c0c95fd

Request headers

Pragma
no-cache
Sec-Fetch-Site
same-origin
Origin
https://blueteam.news
Accept-Encoding
gzip, deflate, br
Host
blueteam.news
Accept-Language
en-US
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Sec-Fetch-Mode
cors
Accept
*/*
Cache-Control
no-cache
Sec-Fetch-Dest
font
Referer
https://blueteam.news/wp-content/themes/Newspaper/style.css?ver=11
Connection
keep-alive
Origin
https://blueteam.news
Referer
https://blueteam.news/wp-content/themes/Newspaper/style.css?ver=11
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date
Fri, 27 Aug 2021 15:48:01 GMT
Last-Modified
Sun, 11 Jul 2021 02:42:11 GMT
Server
Apache/2.4.41 (Ubuntu)
ETag
"6120-5c6cff39cc78c"
Content-Type
font/woff
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=97
Content-Length
24864
KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v27/ 		15 KB
16 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v27/KFOlCnqEu92Fr1MmWUlfBBc4.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A400%2C500%2C700%7COpen+Sans%3A400%2C600%2C700%7CRoboto%3A400%2C900%2C500%2C700%2C300&display=swap&ver=11
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
0eaeadb58e6995ba85eccb6198aaef77eeb1d4b66699e4e1f3fc10eb6adfcdb9
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://blueteam.news
Referer
https://fonts.googleapis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Fri, 27 Aug 2021 07:18:45 GMT
x-content-type-options
nosniff
age
30556
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
15828
x-xss-protection
0
last-modified
Mon, 05 Apr 2021 21:10:46 GMT
server
sffe
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sat, 27 Aug 2022 07:18:45 GMT
KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v27/ 		15 KB
15 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v27/KFOmCnqEu92Fr1Mu4mxK.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A400%2C500%2C700%7COpen+Sans%3A400%2C600%2C700%7CRoboto%3A400%2C900%2C500%2C700%2C300&display=swap&ver=11
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://blueteam.news
Referer
https://fonts.googleapis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Tue, 24 Aug 2021 06:52:18 GMT
x-content-type-options
nosniff
age
291343
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
15688
x-xss-protection
0
last-modified
Mon, 05 Apr 2021 21:10:35 GMT
server
sffe
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 24 Aug 2022 06:52:18 GMT
KFOlCnqEu92Fr1MmYUtfBBc4.woff2
fonts.gstatic.com/s/roboto/v27/ 		15 KB
15 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v27/KFOlCnqEu92Fr1MmYUtfBBc4.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A400%2C500%2C700%7COpen+Sans%3A400%2C600%2C700%7CRoboto%3A400%2C900%2C500%2C700%2C300&display=swap&ver=11
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
0e868ca932480407e63d27e8e868cb1514581142928b9be15ec9039bf5fe348f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://blueteam.news
Referer
https://fonts.googleapis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Thu, 26 Aug 2021 18:46:38 GMT
x-content-type-options
nosniff
age
75683
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
15724
x-xss-protection
0
last-modified
Mon, 05 Apr 2021 21:10:50 GMT
server
sffe
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 26 Aug 2022 18:46:38 GMT
KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v27/ 		16 KB
16 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v27/KFOlCnqEu92Fr1MmEU9fBBc4.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A400%2C500%2C700%7COpen+Sans%3A400%2C600%2C700%7CRoboto%3A400%2C900%2C500%2C700%2C300&display=swap&ver=11
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
bb46ed079c3dd3c39af5051b4ada48f29f49151dad4fa218117bad2fdb5e616f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://blueteam.news
Referer
https://fonts.googleapis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Tue, 24 Aug 2021 17:17:27 GMT
x-content-type-options
nosniff
age
253834
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
15920
x-xss-protection
0
last-modified
Mon, 05 Apr 2021 21:10:39 GMT
server
sffe
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 24 Aug 2022 17:17:27 GMT
td-multipurpose.ttf
blueteam.news/wp-content/plugins/td-composer/assets/fonts/td-multipurpose/ 		127 KB
127 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://blueteam.news/wp-content/plugins/td-composer/assets/fonts/td-multipurpose/td-multipurpose.ttf
Requested by
Host: blueteam.news
URL: https://blueteam.news/wp-content/plugins/td-composer/assets/fonts/td-multipurpose/td-multipurpose.css?ver=978887166a39c57c36d5cf4a5ec10289
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
143.244.165.121 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
Apache/2.4.41 (Ubuntu) /
Resource Hash
95c06a3e6c28a512b08155b23f867f4699ce33d79ef8ef7a229ee6a33a6c83f6

Request headers

Pragma
no-cache
Sec-Fetch-Site
same-origin
Origin
https://blueteam.news
Accept-Encoding
gzip, deflate, br
Host
blueteam.news
Accept-Language
en-US
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Sec-Fetch-Mode
cors
Accept
*/*
Cache-Control
no-cache
Sec-Fetch-Dest
font
Referer
https://blueteam.news/wp-content/plugins/td-composer/assets/fonts/td-multipurpose/td-multipurpose.css?ver=978887166a39c57c36d5cf4a5ec10289
Connection
keep-alive
Origin
https://blueteam.news
Referer
https://blueteam.news/wp-content/plugins/td-composer/assets/fonts/td-multipurpose/td-multipurpose.css?ver=978887166a39c57c36d5cf4a5ec10289
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date
Fri, 27 Aug 2021 15:48:01 GMT
Last-Modified
Sun, 11 Jul 2021 02:42:38 GMT
Server
Apache/2.4.41 (Ubuntu)
ETag
"1fa3c-5c6cff539cd02"
Content-Type
font/ttf
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=97
Content-Length
129596
mem8YaGs126MiZpBA-UFVZ0b.woff2
fonts.gstatic.com/s/opensans/v23/ 		14 KB
14 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/opensans/v23/mem8YaGs126MiZpBA-UFVZ0b.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A400%2C500%2C700%7COpen+Sans%3A400%2C600%2C700%7CRoboto%3A400%2C900%2C500%2C700%2C300&display=swap&ver=11
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
a42f2ec73409f2753ef17d737714c86303fa45fc3a3d484a9b0c8ed28ef0fd6b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://blueteam.news
Referer
https://fonts.googleapis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Thu, 26 Aug 2021 01:46:58 GMT
x-content-type-options
nosniff
age
136863
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
14440
x-xss-protection
0
last-modified
Tue, 10 Aug 2021 00:23:25 GMT
server
sffe
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 26 Aug 2022 01:46:58 GMT
mem5YaGs126MiZpBA-UN7rgOUuhp.woff2
fonts.gstatic.com/s/opensans/v23/ 		15 KB
15 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/opensans/v23/mem5YaGs126MiZpBA-UN7rgOUuhp.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A400%2C500%2C700%7COpen+Sans%3A400%2C600%2C700%7CRoboto%3A400%2C900%2C500%2C700%2C300&display=swap&ver=11
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
c73575543a5c99018f842960f9882edaa0918965ea856e91de9717a0d58d3f1c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://blueteam.news
Referer
https://fonts.googleapis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Thu, 26 Aug 2021 06:13:50 GMT
x-content-type-options
nosniff
age
120851
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
15112
x-xss-protection
0
last-modified
Tue, 10 Aug 2021 00:23:34 GMT
server
sffe
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 26 Aug 2022 06:13:50 GMT
show_ads_impl_with_ama_fy2019.js
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202108240101/ 		252 KB
93 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202108240101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-2265437101737163&plah=blueteam.news
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-2265437101737163
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
7089f6cbc081f79ba297f48c9c720869f325f9eedbe422279da1a4bee732bc4b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://blueteam.news/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Fri, 27 Aug 2021 15:48:01 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
95600
x-xss-protection
0
server
cafe
etag
9779198409284284208
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin
*
expires
Fri, 27 Aug 2021 15:48:01 GMT
zrt_lookup.html
googleads.g.doubleclick.net/pagead/html/r20210824/r20190131/ Frame 00A5 		10 KB
5 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/html/r20210824/r20190131/zrt_lookup.html
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-2265437101737163
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
bf5230ffb8745d28c11ae8b743868364f9be8379300bd59d235f402a53ea96ee
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
googleads.g.doubleclick.net
:scheme
https
:path
/pagead/html/r20210824/r20190131/zrt_lookup.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://blueteam.news/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Referer
https://blueteam.news/

Response headers

p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
vary
Accept-Encoding
date
Thu, 26 Aug 2021 23:06:59 GMT
expires
Thu, 09 Sep 2021 23:06:59 GMT
content-type
text/html; charset=UTF-8
etag
13836150016441684253
x-content-type-options
nosniff
content-encoding
gzip
server
cafe
content-length
4591
x-xss-protection
0
age
60062
cache-control
public, max-age=1209600
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
collect
www.google-analytics.com/g/ 		0
70 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/g/collect?v=2&tid=G-BX7H8ZCEPW&gtm=2oe8p0&_p=1561959777&sr=1600x1200&ul=en-us&cid=488418060.1630079282&_s=1&dl=https%3A%2F%2Fblueteam.news%2Fapt41-resurfaces-as-earth-baku-with-new-cyberespionage-campaign%2F%3Futm_source%3Ddlvr.it%26utm_medium%3Dtwitter&dr=https%3A%2F%2Ft.co%2FLSsgjjYLYo%3Famp%3D1&dt=APT41%20Resurfaces%20as%20Earth%20Baku%20With%20New%20Cyberespionage%20Campaign%20%7C%20Blue%20Team%20News&sid=1630079281&sct=1&seg=0&en=page_view&_fv=1&_nsi=1&_ss=1
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-BX7H8ZCEPW
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://blueteam.news/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

pragma
no-cache
date
Fri, 27 Aug 2021 15:48:01 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://blueteam.news
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
flping.php
lg3.media.net/ 		35 B
189 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://lg3.media.net/flping.php?pid=8PO1F6ZLJ&prid=8PRHGG6T9&gdpr=1&action=16&reason=9&cid=8CUNJ75ON&crid=770215448&cc=CZ&ugd=4&requrl=https%253A%252F%252Fblueteam.news%252Fapt41-resurfaces-as-earth-baku-with-new-cyberespionage-campaign%252F%253Futm_source%253Ddlvr.it&domain=blueteam.news&refurl=https%253A%252F%252Ft.co&refdomain=t.co&vi=1630079281423952194&hvsid=00001630079281783035634641921528&gdpr=1&vgd_end=1
Requested by
Host: blueteam.news
URL: https://blueteam.news/apt41-resurfaces-as-earth-baku-with-new-cyberespionage-campaign/?utm_source=dlvr.it&utm_medium=twitter
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.18.235.93 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-235-93.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
0915fad60bc9b61b6dcd82d05da7ec4bc0232a647e75b8507c3cba6d4d6602f9
Security Headers
Name Value
Strict-Transport-Security max-age=21600

Request headers

Referer
https://blueteam.news/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma
no-cache
strict-transport-security
max-age=21600
server
Apache
date
Fri, 27 Aug 2021 15:48:01 GMT
content-type
image/gif
cache-control
max-age=0, no-cache, no-store
content-length
35
expires
Fri, 27 Aug 2021 15:48:01 GMT
flping.php
lg3.media.net/ 		35 B
189 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://lg3.media.net/flping.php?pid=8PO1F6ZLJ&prid=8PRHGG6T9&gdpr=1&action=16&reason=9&cid=8CUNJ75ON&crid=770215448&cc=CZ&ugd=4&requrl=https%253A%252F%252Fblueteam.news%252Fapt41-resurfaces-as-earth-baku-with-new-cyberespionage-campaign%252F%253Futm_source%253Ddlvr.it&domain=blueteam.news&refurl=https%253A%252F%252Ft.co&refdomain=t.co&vi=1630079281123049249&hvsid=00001630079281783035634641921528&gdpr=1&vgd_end=1
Requested by
Host: blueteam.news
URL: https://blueteam.news/apt41-resurfaces-as-earth-baku-with-new-cyberespionage-campaign/?utm_source=dlvr.it&utm_medium=twitter
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.18.235.93 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-235-93.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
0915fad60bc9b61b6dcd82d05da7ec4bc0232a647e75b8507c3cba6d4d6602f9
Security Headers
Name Value
Strict-Transport-Security max-age=21600

Request headers

Referer
https://blueteam.news/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma
no-cache
strict-transport-security
max-age=21600
server
Apache
date
Fri, 27 Aug 2021 15:48:01 GMT
content-type
image/gif
cache-control
max-age=0, no-cache, no-store
content-length
35
expires
Fri, 27 Aug 2021 15:48:01 GMT
cookie.js
partner.googleadservices.com/gampad/ 		203 B
263 B 		Script
General
Check archive.org
Download Go to
Full URL
https://partner.googleadservices.com/gampad/cookie.js?domain=blueteam.news&callback=_gfp_s_&client=ca-pub-2265437101737163
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202108240101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-2265437101737163&plah=blueteam.news
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.184.226 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s12-in-f2.1e100.net
Software
cafe /
Resource Hash
a0f1488c6d4ff18ce56758004bf93f27d279b80b038dff72863286373b4d3b59
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://blueteam.news/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Fri, 27 Aug 2021 15:48:01 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type
text/javascript; charset=UTF-8
cache-control
private
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
194
x-xss-protection
0
integrator.js
adservice.google.de/adsid/ 		107 B
165 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adservice.google.de/adsid/integrator.js?domain=blueteam.news
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202108240101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-2265437101737163&plah=blueteam.news
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://blueteam.news/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

timing-allow-origin
*
date
Fri, 27 Aug 2021 15:48:01 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control
private, no-cache, no-store
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
100
x-xss-protection
0
integrator.js
adservice.google.com/adsid/ 		107 B
165 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adservice.google.com/adsid/integrator.js?domain=blueteam.news
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202108240101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-2265437101737163&plah=blueteam.news
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://blueteam.news/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

timing-allow-origin
*
date
Fri, 27 Aug 2021 15:48:01 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control
private, no-cache, no-store
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
100
x-xss-protection
0
ads
googleads.g.doubleclick.net/pagead/ Frame 9BE0 		603 B
68 B 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2265437101737163&output=html&adk=1812271804&adf=3025194257&lmt=1630079281&plat=8%3A134217728%2C9%3A134250504%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fblueteam.news%2Fapt41-resurfaces-as-earth-baku-with-new-cyberespionage-campaign%2F%3Futm_source%3Ddlvr.it%26utm_medium%3Dtwitter&ea=0&flash=0&pra=5&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1630079281625&bpp=13&bdt=726&idt=203&shv=r20210824&mjsv=m202108240101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=7941980236431&frm=20&pv=2&ga_vid=488418060.1630079282&ga_sid=1630079282&ga_hid=1561959777&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062314%2C31062297&oid=3&pvsid=2747978063985674&ref=https%3A%2F%2Ft.co%2FLSsgjjYLYo%3Famp%3D1&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&dtd=222
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202108240101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-2265437101737163&plah=blueteam.news
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
00daef3b4a945d15f73efa05e0ce2ca51f2f8252e1da8fae5c2efb0f6dddacce
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
googleads.g.doubleclick.net
:scheme
https
:path
/pagead/ads?client=ca-pub-2265437101737163&output=html&adk=1812271804&adf=3025194257&lmt=1630079281&plat=8%3A134217728%2C9%3A134250504%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fblueteam.news%2Fapt41-resurfaces-as-earth-baku-with-new-cyberespionage-campaign%2F%3Futm_source%3Ddlvr.it%26utm_medium%3Dtwitter&ea=0&flash=0&pra=5&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1630079281625&bpp=13&bdt=726&idt=203&shv=r20210824&mjsv=m202108240101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=7941980236431&frm=20&pv=2&ga_vid=488418060.1630079282&ga_sid=1630079282&ga_hid=1561959777&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062314%2C31062297&oid=3&pvsid=2747978063985674&ref=https%3A%2F%2Ft.co%2FLSsgjjYLYo%3Famp%3D1&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&dtd=222
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://blueteam.news/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Referer
https://blueteam.news/

Response headers

p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
br
date
Fri, 27 Aug 2021 15:48:01 GMT
server
cafe
content-length
46
x-xss-protection
0
set-cookie
test_cookie=CheckForPermission; expires=Fri, 27-Aug-2021 16:03:01 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires
Fri, 27 Aug 2021 15:48:01 GMT
cache-control
private
osd.js
www.googletagservices.com/activeview/js/current/ 		72 KB
27 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/osd.js
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202108240101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-2265437101737163&plah=blueteam.news
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
a52935114e24e8f2d5c6d33f048a4690635181cde1e030731351f91e80b4c884
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://blueteam.news/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Fri, 27 Aug 2021 15:48:01 GMT
content-encoding
gzip
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server
sffe
etag
"1629890992072652"
vary
Accept-Encoding
content-type
text/javascript
cache-control
private, max-age=3000
x-content-type-options
nosniff
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
27633
x-xss-protection
0
expires
Fri, 27 Aug 2021 15:48:01 GMT
getad
aax-us-east.amazon-adsystem.com/x/ 		138 KB
138 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://aax-us-east.amazon-adsystem.com/x/getad?src=330&c=100&sz=1x1&apiVersion=2.0&pj=%7B%22placement%22%3A%22adunit0%22%2C%22search_bar%22%3A%22true%22%2C%22tracking_id%22%3A%22blueteamnew0e-20%22%2C%22search_bar_position%22%3A%22bottom%22%2C%22ad_mode%22%3A%22search%22%2C%22ad_type%22%3A%22smart%22%2C%22marketplace%22%3A%22amazon%22%2C%22region%22%3A%22US%22%2C%22title%22%3A%22%22%2C%22default_search_phrase%22%3A%22blue%20team%22%2C%22default_category%22%3A%22All%22%2C%22viewerCountry%22%3A%22CZ%22%2C%22textlinks%22%3A%22%22%2C%22debug%22%3A%22false%22%2C%22acap_publisherId%22%3A%22blueteamnew0e-20%22%2C%22slotNum%22%3A0%2C%22ead%22%3A4%7D&u=https%3A%2F%2Fblueteam.news%2Fapt41-resurfaces-as-earth-baku-with-new-cyberespionage-campaign%2F%3Futm_source%3Ddlvr.it%26utm_medium%3Dtwitter&jscb=amzn_assoc_jsonp_callback_adunit0_0
Requested by
Host: z-na.amazon-adsystem.com
URL: https://z-na.amazon-adsystem.com/widgets/onejs?MarketPlace=US
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
209.54.176.34 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
876a453a8782d19fbb67217abd9627037f2c25958d17b68828d3d9dd3d7d8875
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

Referer
https://blueteam.news/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date
Fri, 27 Aug 2021 15:48:02 GMT
Server
Server
x-amz-rid
S3TCRBG9DRV1JDGWX19V
Vary
Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Content-Type
text/javascript;charset=UTF-8
Connection
keep-alive
Permissions-Policy
interest-cohort=()
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Content-Length
140947
getad
aax-us-east.amazon-adsystem.com/x/ 		134 KB
134 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://aax-us-east.amazon-adsystem.com/x/getad?src=308&c=100&sz=1x1&apiVersion=2.0&pj=%7B%22placement%22%3A%22adunit0%22%2C%22enable_interest_ads%22%3A%22true%22%2C%22div_name%22%3A%22amzn-assoc-ad-57a61967-78de-4451-8e48-1a7d1e6df6af%22%2C%22tracking_id%22%3A%22blueteamnew0e-20%22%2C%22fallback_mode%22%3A%7B%22type%22%3A%22search%22%2C%22value%22%3A%22cybersecurity%22%7D%2C%22ad_mode%22%3A%22auto%22%2C%22ad_type%22%3A%22smart%22%2C%22emphasize_categories%22%3A%22283155%2C5088769011%2C979455011%22%2C%22marketplace%22%3A%22amazon%22%2C%22region%22%3A%22US%22%2C%22linkid%22%3A%22119828143e5e92323dc8ec11aaf7dedd%22%2C%22default_category%22%3A%22All%22%2C%22viewerCountry%22%3A%22CZ%22%2C%22textlinks%22%3A%22%22%2C%22debug%22%3A%22false%22%2C%22acap_publisherId%22%3A%22blueteamnew0e-20%22%2C%22acap_categoryConstraints%22%3A%5B%7B%22category%22%3A%22283155%22%2C%22emphasis%22%3A%22Strong%22%2C%22type%22%3A%22AmazonBrowse%22%7D%2C%7B%22category%22%3A%225088769011%22%2C%22emphasis%22%3A%22Strong%22%2C%22type%22%3A%22AmazonBrowse%22%7D%2C%7B%22category%22%3A%22979455011%22%2C%22emphasis%22%3A%22Strong%22%2C%22type%22%3A%22AmazonBrowse%22%7D%5D%2C%22slotNum%22%3A1%2C%22ead%22%3A8%7D&u=https%3A%2F%2Fblueteam.news%2Fapt41-resurfaces-as-earth-baku-with-new-cyberespionage-campaign%2F%3Futm_source%3Ddlvr.it%26utm_medium%3Dtwitter&jscb=amzn_assoc_jsonp_callback_adunit0_1
Requested by
Host: z-na.amazon-adsystem.com
URL: https://z-na.amazon-adsystem.com/widgets/onejs?MarketPlace=US&adInstanceId=57a61967-78de-4451-8e48-1a7d1e6df6af
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
209.54.176.34 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
736d9c6935e1ad55ef04581c3758db28aebf93ca381c621377e37add3074a982
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

Referer
https://blueteam.news/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date
Fri, 27 Aug 2021 15:48:02 GMT
Server
Server
x-amz-rid
P6DJ55YTAMYK6EDGTM0M
Vary
Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Content-Type
text/javascript;charset=UTF-8
Connection
keep-alive
Permissions-Policy
interest-cohort=()
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Content-Length
136958
amzn-nsa-sprite-2x.png
wms-na.amazon-adsystem.com/panda/20070822/US/img/ 		4 KB
5 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://wms-na.amazon-adsystem.com/panda/20070822/US/img/amzn-nsa-sprite-2x.png
Requested by
Host: blueteam.news
URL: https://blueteam.news/apt41-resurfaces-as-earth-baku-with-new-cyberespionage-campaign/?utm_source=dlvr.it&utm_medium=twitter
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.224.186.70 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-224-186-70.fra2.r.cloudfront.net
Software
Server /
Resource Hash
3d363721e733cd455560f59c74cffdb28148623c7c716a23403bd6b85696b4fa

Request headers

Referer
https://blueteam.news/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Wed, 18 Aug 2021 22:30:44 GMT
via
1.1 34f50889bc574f1edeb41dd758962a5b.cloudfront.net (CloudFront)
last-modified
Wed, 21 Apr 2021 09:07:34 GMT
server
Server
age
753439
etag
"10ef-5c077e4b6afc7"
x-cache
Hit from cloudfront
content-type
image/png
charset
UTF-8
cache-control
max-age=2592000
x-amz-cf-pop
FRA2-C1
accept-ranges
bytes
content-length
4335
x-amz-cf-id
EyzWEMrsvPVv0GcayvoljOFj3u66QORz2LKvzeH3bImfZ2aunHOuTg==
expires
Wed, 25 Aug 2021 22:30:44 GMT
log
lg3.media.net/ 		35 B
206 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://lg3.media.net/log?&logid=kfk&evtid=adPrvLog&otherprov=0&cid=8CUNJ75ON&crid=770215448&cc=CZ&ugd=4&timeTaken=0&vi=1630079281123049249&r=1630079283249
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.18.235.93 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-235-93.deploy.static.akamaitechnologies.com
Software
Jetty(9.4.35.v20201120) /
Resource Hash
796c46ec10bc9105545f6f90d51593921b69956bd9087eb72bee83f40ad86f90
Security Headers
Name Value
Strict-Transport-Security max-age=21600

Request headers

Referer
https://blueteam.news/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 27 Aug 2021 15:48:03 GMT
server
Jetty(9.4.35.v20201120)
strict-transport-security
max-age=21600
content-type
image/gif
access-control-allow-origin
*
cache-control
max-age=0, no-cache, no-store
content-length
35
expires
Fri, 27 Aug 2021 15:48:03 GMT
sodar
pagead2.googlesyndication.com/getconfig/ 		11 KB
8 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20210824&st=env
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202108240101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-2265437101737163&plah=blueteam.news
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
96bf1e1a3ea77e2a77e5eca5f37741e3ced96d3b6821488bb4705591790ea502
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://blueteam.news/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

timing-allow-origin
*
date
Fri, 27 Aug 2021 15:48:03 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/json; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
8526
x-xss-protection
0
sodar2.js
tpc.googlesyndication.com/sodar/ 		17 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/sodar2.js
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202108240101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-2265437101737163&plah=blueteam.news
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
a5ead9037af4a0e749e217f63b25a25493a7705e17d98f04b336ab1370a353db
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://blueteam.news/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Fri, 27 Aug 2021 15:48:03 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1624308425655142"
vary
Accept-Encoding
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
6467
x-xss-protection
0
expires
Fri, 27 Aug 2021 15:48:03 GMT
sample-94-485x360.jpg
blueteam.news/wp-content/uploads/2021/08/ 		30 KB
30 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blueteam.news/wp-content/uploads/2021/08/sample-94-485x360.jpg
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
143.244.165.121 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
Apache/2.4.41 (Ubuntu) /
Resource Hash
a78df631a3daaaa4d329654ec2432c93f18c10828fce75122a0dcf43d7693623

Request headers

Pragma
no-cache
Sec-Fetch-Site
same-origin
Accept-Encoding
gzip, deflate, br
Host
blueteam.news
Accept-Language
en-US
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Sec-Fetch-Mode
no-cors
Accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Cache-Control
no-cache
Sec-Fetch-Dest
image
Referer
https://blueteam.news/apt41-resurfaces-as-earth-baku-with-new-cyberespionage-campaign/?utm_source=dlvr.it&utm_medium=twitter
Connection
keep-alive
Referer
https://blueteam.news/apt41-resurfaces-as-earth-baku-with-new-cyberespionage-campaign/?utm_source=dlvr.it&utm_medium=twitter
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date
Fri, 27 Aug 2021 15:48:03 GMT
Last-Modified
Thu, 26 Aug 2021 20:36:31 GMT
Server
Apache/2.4.41 (Ubuntu)
ETag
"78ba-5ca7c526cccfa"
Content-Type
image/jpeg
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=96
Content-Length
30906
runner.html
tpc.googlesyndication.com/sodar/sodar2/224/ Frame 2234 		12 KB
5 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
4fa0156d693856f79289525c8e4db988a188d55ce0283351c96d811c7ce3e2c3
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
tpc.googlesyndication.com
:scheme
https
:path
/sodar/sodar2/224/runner.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://blueteam.news/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Referer
https://blueteam.news/

Response headers

accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
content-type
text/html
cross-origin-resource-policy
cross-origin
content-length
5029
date
Fri, 27 Aug 2021 13:30:43 GMT
expires
Sat, 27 Aug 2022 13:30:43 GMT
last-modified
Wed, 02 Jun 2021 17:09:45 GMT
x-content-type-options
nosniff
server
sffe
x-xss-protection
0
cache-control
public, max-age=31536000
age
8240
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
aframe
www.google.com/recaptcha/api2/ Frame E073 		783 B
772 B 		Document
General
Check archive.org
Download Go to
Full URL
https://www.google.com/recaptcha/api2/aframe
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
ca787d602ccc9be761345b24a3167d13e46d83a2c7ae940b8276c86f8a8e35b8
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-2MQ3Qw+xPWPLwHBeJj0Y8Q' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:method
GET
:authority
www.google.com
:scheme
https
:path
/recaptcha/api2/aframe
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://blueteam.news/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Referer
https://blueteam.news/

Response headers

expires
Fri, 27 Aug 2021 15:48:03 GMT
date
Fri, 27 Aug 2021 15:48:03 GMT
cache-control
private, max-age=300
content-type
text/html; charset=utf-8
content-security-policy
script-src 'report-sample' 'nonce-2MQ3Qw+xPWPLwHBeJj0Y8Q' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding
gzip
x-content-type-options
nosniff
x-xss-protection
1; mode=block
content-length
515
server
GSE
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
sample-90-218x150.jpg
blueteam.news/wp-content/uploads/2021/08/ 		6 KB
6 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blueteam.news/wp-content/uploads/2021/08/sample-90-218x150.jpg
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
143.244.165.121 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
Apache/2.4.41 (Ubuntu) /
Resource Hash
bafcfd50576d5e911122657e38ab409b30710ecf14b2a276cabee70a3bcbe7ce

Request headers

Pragma
no-cache
Sec-Fetch-Site
same-origin
Accept-Encoding
gzip, deflate, br
Host
blueteam.news
Accept-Language
en-US
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Sec-Fetch-Mode
no-cors
Accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Cache-Control
no-cache
Sec-Fetch-Dest
image
Referer
https://blueteam.news/apt41-resurfaces-as-earth-baku-with-new-cyberespionage-campaign/?utm_source=dlvr.it&utm_medium=twitter
Connection
keep-alive
Referer
https://blueteam.news/apt41-resurfaces-as-earth-baku-with-new-cyberespionage-campaign/?utm_source=dlvr.it&utm_medium=twitter
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date
Fri, 27 Aug 2021 15:48:03 GMT
Last-Modified
Thu, 26 Aug 2021 20:36:03 GMT
Server
Apache/2.4.41 (Ubuntu)
ETag
"16a6-5ca7c50c9dcca"
Content-Type
image/jpeg
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=96
Content-Length
5798
JSi02Q6GJynUs5OPQnU6ClbAiSGuMk75N6kjZ1kLosw.js
pagead2.googlesyndication.com/bg/ Frame 2234 		35 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/bg/JSi02Q6GJynUs5OPQnU6ClbAiSGuMk75N6kjZ1kLosw.js
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
2528b4d90e862729d4b3938f42753a0a56c08921ae324ef937a92367590ba2cc
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://tpc.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Fri, 27 Aug 2021 13:23:30 GMT
content-encoding
br
x-content-type-options
nosniff
age
8673
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
13290
x-xss-protection
0
last-modified
Mon, 23 Aug 2021 08:38:00 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Sat, 27 Aug 2022 13:23:30 GMT
sample-86-218x150.jpg
blueteam.news/wp-content/uploads/2021/08/ 		17 KB
17 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blueteam.news/wp-content/uploads/2021/08/sample-86-218x150.jpg
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
143.244.165.121 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
Apache/2.4.41 (Ubuntu) /
Resource Hash
0fbdcd4f517e88673615c97576cdb896bfb9f81a0ff341f7234a4e69af27d0cf

Request headers

Pragma
no-cache
Sec-Fetch-Site
same-origin
Accept-Encoding
gzip, deflate, br
Host
blueteam.news
Accept-Language
en-US
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Sec-Fetch-Mode
no-cors
Accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Cache-Control
no-cache
Sec-Fetch-Dest
image
Referer
https://blueteam.news/apt41-resurfaces-as-earth-baku-with-new-cyberespionage-campaign/?utm_source=dlvr.it&utm_medium=twitter
Connection
keep-alive
Referer
https://blueteam.news/apt41-resurfaces-as-earth-baku-with-new-cyberespionage-campaign/?utm_source=dlvr.it&utm_medium=twitter
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date
Fri, 27 Aug 2021 15:48:03 GMT
Last-Modified
Thu, 26 Aug 2021 20:35:39 GMT
Server
Apache/2.4.41 (Ubuntu)
ETag
"4377-5ca7c4f57d005"
Content-Type
image/jpeg
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=97
Content-Length
17271
sample-81-218x150.jpg
blueteam.news/wp-content/uploads/2021/08/ 		5 KB
5 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blueteam.news/wp-content/uploads/2021/08/sample-81-218x150.jpg
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
143.244.165.121 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
Apache/2.4.41 (Ubuntu) /
Resource Hash
2f17a3d7ccce1c2fac47013a080c98870a6c93809050c2054b62152d6329df36

Request headers

Pragma
no-cache
Sec-Fetch-Site
same-origin
Accept-Encoding
gzip, deflate, br
Host
blueteam.news
Accept-Language
en-US
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Sec-Fetch-Mode
no-cors
Accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Cache-Control
no-cache
Sec-Fetch-Dest
image
Referer
https://blueteam.news/apt41-resurfaces-as-earth-baku-with-new-cyberespionage-campaign/?utm_source=dlvr.it&utm_medium=twitter
Connection
keep-alive
Referer
https://blueteam.news/apt41-resurfaces-as-earth-baku-with-new-cyberespionage-campaign/?utm_source=dlvr.it&utm_medium=twitter
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date
Fri, 27 Aug 2021 15:48:03 GMT
Last-Modified
Thu, 26 Aug 2021 20:35:08 GMT
Server
Apache/2.4.41 (Ubuntu)
ETag
"13fe-5ca7c4d7c5b54"
Content-Type
image/jpeg
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=98
Content-Length
5118
sodar
pagead2.googlesyndication.com/pagead/ 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=224&t=2&li=gda_r20210824&jk=2747978063985674&bg=!bG-lbyvNAAZOkH6FTpA7ACkAdvg8WorjdrWjgFHuRN60J2LtEwA6yCjQuKfrx6kTaIdk9jIbWnJHUwIAAABxUgAAAAtoAQcKALCM9Ld8gFlNyEUxiH8EMbNari9xQKWhdSlX6IH29bVVdFNODoDqS6kTcjUojfj7MH-l7_whpYeQtRAgERLqpiZt0n9AQgfB9FKbtnBgMhSycQFVdJ4KF_V1xpBgJvtT6tdZ3ZVVSCBYoFBauhgR1SmkKfhc0uGgbQs-vO3P2AsbztJ11At75RCfyalBu4wCHeEUeS8PeCZRcd9okSa3zK14H5wTKHjSCWvDgyiIZ2iVnZkCdxhFuzD8O8od5r_Wr9KjXmp9a6vdRQFFyBwDc-MwvB3Z71zf7VgXsDPSdRBXcqWiICwXjcm-A1Zm3K6KScIuApDbxxHddOCjnWe-d6_AI6xxvFFa2t3W3pKyuqpHx44tCG104ncNouNctyhyanPqL4g85Lk4iKoJsFAE5vki9OMPTghiUwgEEu8t5JcMIZkgVIw3CLsLXV5Pl5uVCqL1z3LZS2levE68c3RqWFtZ821wIaWPKvAO5tFRaOcl-h5SgW8zLNCWFe-nGWftl5VZXQLyddgCVcc38kATAdQ4sbcvAoSE7q6lKIEm4w4gZb5661FJ8VJZ4m4MbITDzCzq0xuzaDi_BwQkQYezp947NWm1acrblSSwnTgufRPtR4nHVWl1pCvVGwSPZobi9HqPhxze1dLNBtKFq57vVF1WfjDRRv9QVvqTNlmq5Aq0xV2ubw1rCVRls2cj8AmLoR_IYU1H39eYi4KVG4lyYC4KpIJiEXSc2V5NDSLFOV_BWBLPk3EBZQ1ZfdNojVoX5TGdxassxarSt83xVGLG7YNgM4H-pWyb0_y9_czV50QTI1kiw6OUq24C2iyC1mRinhmCVJ8oCCsm_cjOgQKeHn51jj3uqbw3d8Us4f68KGdq5GUJlDutRHvYhw5KYoctyFeC4xzz66GVg6YJx_QNkVoAA8laNtxE4UrMReqtkp95c4Lh8tp4qFVCN4jU-lKalVmwaf2Kp0ScYZaKc7NFYWyDuGzNunC7ioxuOzWSkQYVsTL_ewH1dEErYNDxUTIUOmiyXwPwAi3cY-wA_Rs4dzhbcVswRND0k2k_e_gtaYAd-5_1aKD_lxE3t2Q
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://blueteam.news/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers
sample-94-485x360.jpg
blueteam.news/wp-content/uploads/2021/08/ 		30 KB
30 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blueteam.news/wp-content/uploads/2021/08/sample-94-485x360.jpg
Requested by
Host: blueteam.news
URL: https://blueteam.news/apt41-resurfaces-as-earth-baku-with-new-cyberespionage-campaign/?utm_source=dlvr.it&utm_medium=twitter
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
143.244.165.121 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
Apache/2.4.41 (Ubuntu) /
Resource Hash
a78df631a3daaaa4d329654ec2432c93f18c10828fce75122a0dcf43d7693623

Request headers

Pragma
no-cache
Sec-Fetch-Site
same-origin
Accept-Encoding
gzip, deflate, br
Host
blueteam.news
Accept-Language
en-US
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Sec-Fetch-Mode
no-cors
Accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Cache-Control
no-cache
Sec-Fetch-Dest
image
Referer
https://blueteam.news/apt41-resurfaces-as-earth-baku-with-new-cyberespionage-campaign/?utm_source=dlvr.it&utm_medium=twitter
Connection
keep-alive
Referer
https://blueteam.news/apt41-resurfaces-as-earth-baku-with-new-cyberespionage-campaign/?utm_source=dlvr.it&utm_medium=twitter
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date
Fri, 27 Aug 2021 15:48:03 GMT
Last-Modified
Thu, 26 Aug 2021 20:36:31 GMT
Server
Apache/2.4.41 (Ubuntu)
ETag
"78ba-5ca7c526cccfa"
Content-Type
image/jpeg
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=95
Content-Length
30906
sample-90-218x150.jpg
blueteam.news/wp-content/uploads/2021/08/ 		6 KB
6 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blueteam.news/wp-content/uploads/2021/08/sample-90-218x150.jpg
Requested by
Host: blueteam.news
URL: https://blueteam.news/apt41-resurfaces-as-earth-baku-with-new-cyberespionage-campaign/?utm_source=dlvr.it&utm_medium=twitter
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
143.244.165.121 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
Apache/2.4.41 (Ubuntu) /
Resource Hash
bafcfd50576d5e911122657e38ab409b30710ecf14b2a276cabee70a3bcbe7ce

Request headers

Pragma
no-cache
Sec-Fetch-Site
same-origin
Accept-Encoding
gzip, deflate, br
Host
blueteam.news
Accept-Language
en-US
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Sec-Fetch-Mode
no-cors
Accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Cache-Control
no-cache
Sec-Fetch-Dest
image
Referer
https://blueteam.news/apt41-resurfaces-as-earth-baku-with-new-cyberespionage-campaign/?utm_source=dlvr.it&utm_medium=twitter
Connection
keep-alive
Referer
https://blueteam.news/apt41-resurfaces-as-earth-baku-with-new-cyberespionage-campaign/?utm_source=dlvr.it&utm_medium=twitter
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date
Fri, 27 Aug 2021 15:48:03 GMT
Last-Modified
Thu, 26 Aug 2021 20:36:03 GMT
Server
Apache/2.4.41 (Ubuntu)
ETag
"16a6-5ca7c50c9dcca"
Content-Type
image/jpeg
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=97
Content-Length
5798
sample-81-218x150.jpg
blueteam.news/wp-content/uploads/2021/08/ 		5 KB
5 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blueteam.news/wp-content/uploads/2021/08/sample-81-218x150.jpg
Requested by
Host: blueteam.news
URL: https://blueteam.news/apt41-resurfaces-as-earth-baku-with-new-cyberespionage-campaign/?utm_source=dlvr.it&utm_medium=twitter
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
143.244.165.121 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
Apache/2.4.41 (Ubuntu) /
Resource Hash
2f17a3d7ccce1c2fac47013a080c98870a6c93809050c2054b62152d6329df36

Request headers

Pragma
no-cache
Sec-Fetch-Site
same-origin
Accept-Encoding
gzip, deflate, br
Host
blueteam.news
Accept-Language
en-US
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Sec-Fetch-Mode
no-cors
Accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Cache-Control
no-cache
Sec-Fetch-Dest
image
Referer
https://blueteam.news/apt41-resurfaces-as-earth-baku-with-new-cyberespionage-campaign/?utm_source=dlvr.it&utm_medium=twitter
Connection
keep-alive
Referer
https://blueteam.news/apt41-resurfaces-as-earth-baku-with-new-cyberespionage-campaign/?utm_source=dlvr.it&utm_medium=twitter
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date
Fri, 27 Aug 2021 15:48:03 GMT
Last-Modified
Thu, 26 Aug 2021 20:35:08 GMT
Server
Apache/2.4.41 (Ubuntu)
ETag
"13fe-5ca7c4d7c5b54"
Content-Type
image/jpeg
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=96
Content-Length
5118
sample-86-218x150.jpg
blueteam.news/wp-content/uploads/2021/08/ 		17 KB
17 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blueteam.news/wp-content/uploads/2021/08/sample-86-218x150.jpg
Requested by
Host: blueteam.news
URL: https://blueteam.news/apt41-resurfaces-as-earth-baku-with-new-cyberespionage-campaign/?utm_source=dlvr.it&utm_medium=twitter
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
143.244.165.121 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
Apache/2.4.41 (Ubuntu) /
Resource Hash
0fbdcd4f517e88673615c97576cdb896bfb9f81a0ff341f7234a4e69af27d0cf

Request headers

Pragma
no-cache
Sec-Fetch-Site
same-origin
Accept-Encoding
gzip, deflate, br
Host
blueteam.news
Accept-Language
en-US
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Sec-Fetch-Mode
no-cors
Accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Cache-Control
no-cache
Sec-Fetch-Dest
image
Referer
https://blueteam.news/apt41-resurfaces-as-earth-baku-with-new-cyberespionage-campaign/?utm_source=dlvr.it&utm_medium=twitter
Connection
keep-alive
Referer
https://blueteam.news/apt41-resurfaces-as-earth-baku-with-new-cyberespionage-campaign/?utm_source=dlvr.it&utm_medium=twitter
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date
Fri, 27 Aug 2021 15:48:03 GMT
Last-Modified
Thu, 26 Aug 2021 20:35:39 GMT
Server
Apache/2.4.41 (Ubuntu)
ETag
"4377-5ca7c4f57d005"
Content-Type
image/jpeg
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=96
Content-Length
17271

Verdicts & Comments Add Verdict or Comment

236 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 object| 3 object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated object| _wpemojiSettings undefined| $ function| jQuery object| es_data object| jQuery1124040317840285340245 object| mnetCustomerData function| injectMnetScript object| _mNHandle string| medianet_versionId object| tdb_globals object| tdwGlobal object| tdaGlobal object| tdBlocksArray function| tdBlock object| tdLocalCache object| td_viewport_interval_list string| td_animation_stack_effect boolean| tds_animation_stack string| td_animation_stack_specific_selectors string| td_animation_stack_general_selectors string| tds_general_modal_image string| tdc_is_installed string| td_ajax_url string| td_get_template_directory_uri string| tds_snap_menu string| tds_logo_on_sticky string| tds_header_style string| td_please_wait string| td_email_user_pass_incorrect string| td_email_user_incorrect string| td_email_incorrect string| tds_more_articles_on_post_enable string| tds_more_articles_on_post_time_to_wait number| tds_more_articles_on_post_pages_distance_from_top string| tds_theme_color_site_wide string| tds_smart_sidebar string| tdThemeName string| td_magnific_popup_translation_tPrev string| td_magnific_popup_translation_tNext string| td_magnific_popup_translation_tCounter string| td_magnific_popup_translation_ajax_tError string| td_magnific_popup_translation_image_tError string| tdBlockNonce object| tdDateNamesI18n string| td_ad_background_click_link string| td_ad_background_click_target function| gtag object| dataLayer string| tdb_login_sing_in_shortcode object| block_tdi_45 object| google_js_reporting_queue number| google_srt object| google_logging_queue object| google_ad_modifications object| ggeac boolean| google_measure_js_timing object| google_reactive_ads_global_state object| adsbygoogle boolean| _gfp_a_ object| google_sa_queue object| google_sl_win function| google_process_slots object| google_persistent_state_async function| google_spfd number| google_unique_id object| google_sv_map object| google_tag_manager object| block_tdi_102 object| block_tdi_103 string| google_user_agent_client_hint object| google_tag_data object| gaGlobal object| block_tdi_128 object| _mN object| _mNSrv function| setup string| _mN_Idf undefined| _mN_ctr string| _mN_ctrM object| mnjs object| _mNDetails function| _cmL1Require function| _cmL1Define undefined| _mNE object| _mNadPrvLog object| twemoji object| wp object| block_tdi_132 function| Goog_AdSense_getAdAdapterInstance function| Goog_AdSense_OsdAdapter function| google_sa_impl object| __google_ad_urls number| google_global_correlator number| __google_ad_urls_id object| googleToken object| googleIMState boolean| _gfp_p_ function| processGoogleToken object| google_prev_clients object| google_jobrunner object| ampInaboxIframes object| ampInaboxPendingMessages boolean| google_osd_loaded boolean| google_onload_fired function| amazon_assoc_ir_f_call_associates_ads function| amazon_assoc_ir_f_call function| amzn_assoc_ad_spec_type object| amzn_assoc_ad_spec object| amzn_assoc_ad_async_spec object| adUnitDeliveryNetwork object| slotCounter function| cmManager object| amzn_assoc_cm boolean| amzn_assoc_enable_abs object| amzn_assoc_internal_params function| assocUtilsMaker object| amzn_assoc_utils object| nativeAdLayoutComputer object| amzn_assoc_ad object| blockedMarketPlacesJson object| blockedViewerCountriesJson function| amzn_assoc_jsonp_callback_adunit0_0 function| amzn_assoc_client_cb_0 function| _ object| tdbAutoload object| tdAnalytics object| tdDetect object| tdViewport object| tdMenu object| tdUtil object| tdAffix function| td_smart_list_dropdown object| td_more_articles_box number| td_resize_timer_id function| td_done_resizing function| td_resize_videos function| td_mobile_menu function| td_mobile_menu_toogle function| td_retina function| td_read_site_cookie function| td_set_cookies_life boolean| tdIsScrollingAnimation boolean| td_mouse_wheel_or_touch_moved boolean| td_scroll_to_top_is_visible function| td_events_scroll_scroll_to_top function| td_post_template_6_title function| td_smart_lists_magnific_popup function| td_get_document_width function| td_get_document_height function| td_comments_form_validation object| tdLoadingBox object| tdAjaxSearch string| tdModalImageLastEl object| tdBlocks object| tdLogin object| tdLoginMob object| tdDemoMenu object| tdTrendingNow object| td_history object| tdSmartSidebar object| tdStickyRow object| tdScrollToClass object| tdInfiniteLoader function| Froogaloop object| tdCustomEvents object| tdEvents object| tdHeader object| tdAjaxCount object| tdYoutubePlayers object| tdVimeoPlayers function| td_resize_smartlist_slides function| td_resize_smartlist_sliders_and_update function| td_resize_normal_slide function| td_resize_normal_slide_and_update object| tdPullDown object| td_fps object| tdAnimationScroll object| tdHomepageFull object| tdBackstr object| tdShowVideo object| tdAnimationStack function| td_compute_parallax_background function| td_compute_backstretch_item object| td_backstretch_items object| tdAjaxLoop object| tdWeather object| tdAnimationSprite function| td_date_i18n object| tdSocialSharing function| tdModalImage object| tdAjaxVideoModal object| tdfAjaxFlickr object| tdConfirm function| $f function| onYouTubeIframeAPIReady object| addComment undefined| eventHub object| tdbMenu object| tdbMenuItemPullDown object| tdbSearch object| tdcPostSettings function| tdbGetMobileTemplates function| amzn_assoc_jsonp_callback_adunit0_1 function| amzn_assoc_client_cb_1 function| Goog_Osd_UnloadAdBlock function| Goog_Osd_UpdateElementToMeasure function| google_osd_amcb object| amznAssocFallbackMode_1 object| amznAssocEstimatedPerformance_1 object| callbacks function| nativeAdFeedback object| amznassoccsm function| asinHandler function| trackingUtils function| nativeAdLoader function| nativeAd object| amznAssocFallbackMode_0 object| amznAssocEstimatedPerformance_0 function| nativeAdSearchBar object| GoogleGcLKhOms object| google_image_requests

0 Cookies

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy referrer always;
Strict-Transport-Security max-age=0
X-Xss-Protection 0

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

aax-us-east.amazon-adsystem.com
adservice.google.com
adservice.google.de
blueteam.news
contextual.media.net
dlvr.it
fonts.googleapis.com
fonts.gstatic.com
googleads.g.doubleclick.net
lg3.media.net
pagead2.googlesyndication.com
partner.googleadservices.com
t.co
tpc.googlesyndication.com
wms-na.amazon-adsystem.com
www.google-analytics.com
www.google.com
www.googletagmanager.com
www.googletagservices.com
z-na.amazon-adsystem.com
104.244.42.197
13.224.101.72
13.224.186.70
142.250.184.226
143.244.165.121
2.18.235.93
209.54.176.34
2a00:1450:4001:801::2002
2a00:1450:4001:803::2002
2a00:1450:4001:808::2002
2a00:1450:4001:808::200e
2a00:1450:4001:809::2008
2a00:1450:4001:80e::2002
2a00:1450:4001:80f::2002
2a00:1450:4001:80f::2004
2a00:1450:4001:80f::200a
2a00:1450:4001:813::2001
2a00:1450:4001:827::2002
2a00:1450:4001:82f::2003
2a00:1450:4001:830::2003
52.11.199.228
00daef3b4a945d15f73efa05e0ce2ca51f2f8252e1da8fae5c2efb0f6dddacce
019c5b598cd955b04265d45cdc72dcd2c3dbb0f0d4fe30a4431c395a8b3cdbb1
07e4203b9f313b587b1d53f896e63771ec85f9b0d4c2ac5fa64089457784d847
0915fad60bc9b61b6dcd82d05da7ec4bc0232a647e75b8507c3cba6d4d6602f9
0dd95d9bfc689b8862a9dd8ae8166ca21df149fb24f3d0830423b66ae00d426e
0e868ca932480407e63d27e8e868cb1514581142928b9be15ec9039bf5fe348f
0eaeadb58e6995ba85eccb6198aaef77eeb1d4b66699e4e1f3fc10eb6adfcdb9
0fbdcd4f517e88673615c97576cdb896bfb9f81a0ff341f7234a4e69af27d0cf
12f7b276d0357e226f9440732a4151cc26daade05efc15b0255d542625c9eefe
143ce443c390db3b8598f951de20bd04623859a581a15b8cde43ebfa1f8ec103
15c510fe49c3ec5fd57ac7ead341655699156a63fe10195347dfeae1dc53f909
1a46233ca1af9caf624bb7d62119ac1cd6197ffc21c25926f917a1bc5bfe8912
1db21d816296e6939ba1f42962496e4134ae2b0081e26970864c40c6d02bb1df
221489efba5eb3e4c59612e9e563bf967c8f399e2afcef2eaa1be6e48ca9c1c7
2528b4d90e862729d4b3938f42753a0a56c08921ae324ef937a92367590ba2cc
292a8774ea688b6f103fc5182f24e9074de6a6b6af1516b952ddee8d6607b95e
2d036346b18bf4c27bc91f0416f8b59427e32bfc6c2724a27e6fe2e5a7b58574
2f17a3d7ccce1c2fac47013a080c98870a6c93809050c2054b62152d6329df36
312460f32193ff9910d720cc337941abd9c749e9f3c7c0e3bf707d90a51ca897
37d925559381e9d5388c4a096fe1383570546b7b11548d7d6a7e560adcc24e5d
3d0b8d49892a80a36ed14c13b4e4b8845e50770c406e4be6302952c77609dcc5
3d363721e733cd455560f59c74cffdb28148623c7c716a23403bd6b85696b4fa
485301e24ee204cd089ec16df7e66702b3a3dc906f5ea5ffcc414c303d647e1e
4bc1e32c9183254cd3bf50d981d9f0ba21f3512f8868d571c4e1f3fd8331226e
4f9568d3aef0133feef6736a0be7a2bad332429d685a584e1c5b85e5a7fd60c9
4fa0156d693856f79289525c8e4db988a188d55ce0283351c96d811c7ce3e2c3
5803ac00778699dfa69a5f4fed086bf5c29164864bdb5b2f36fe0e3cc98736fb
5be614bce53f767993a5f5f14a6badd6aae6bf3af7cbdbf4d31520de49e27991
65df1311d734b8d259ce544c85b503bc9e41196452c0514145d01838eaea0f55
6cd0d6897b3d4779f7d88ce72531f22fbf75851b195fb14e6f3f23d051b3d1e9
7089f6cbc081f79ba297f48c9c720869f325f9eedbe422279da1a4bee732bc4b
736d9c6935e1ad55ef04581c3758db28aebf93ca381c621377e37add3074a982
7837e876f1eef549b3250b78380ec2df00ad6da4da6c27667424b1636854df3c
796c46ec10bc9105545f6f90d51593921b69956bd9087eb72bee83f40ad86f90
876a453a8782d19fbb67217abd9627037f2c25958d17b68828d3d9dd3d7d8875
8c626f0f9b5c109539b256b73e72c02b300a184f46b4535c2eb86599215c78af
95c06a3e6c28a512b08155b23f867f4699ce33d79ef8ef7a229ee6a33a6c83f6
96bf1e1a3ea77e2a77e5eca5f37741e3ced96d3b6821488bb4705591790ea502
a0f1488c6d4ff18ce56758004bf93f27d279b80b038dff72863286373b4d3b59
a42f2ec73409f2753ef17d737714c86303fa45fc3a3d484a9b0c8ed28ef0fd6b
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
a52935114e24e8f2d5c6d33f048a4690635181cde1e030731351f91e80b4c884
a5ead9037af4a0e749e217f63b25a25493a7705e17d98f04b336ab1370a353db
a78df631a3daaaa4d329654ec2432c93f18c10828fce75122a0dcf43d7693623
b689f2267305a97c30f5bda1a0e18993c4bed294007df78eafd6829a4408cb1e
bafcfd50576d5e911122657e38ab409b30710ecf14b2a276cabee70a3bcbe7ce
bb46ed079c3dd3c39af5051b4ada48f29f49151dad4fa218117bad2fdb5e616f
bf5230ffb8745d28c11ae8b743868364f9be8379300bd59d235f402a53ea96ee
c73575543a5c99018f842960f9882edaa0918965ea856e91de9717a0d58d3f1c
ca787d602ccc9be761345b24a3167d13e46d83a2c7ae940b8276c86f8a8e35b8
cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca
d227e31ec93027f2b903fe5011b6ef0d67fd1fd8e0105843a2f56626e74f4322
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ea9ad8f6ace011a694d664482cc6ca0acc2dd86a8d6b684154327ec84c0c95fd
eb117fa46ad7744ecc1ba59f1e267b82c00582cfda5fcae2706ea3caf6a98d14
ebbc09dad62e84debfe43df262084ef1bba596297c48dd9359ccb72423ff52a1