urlscan.io logo urlscan.io
SecurityTrails logo

www.hendryadrian.com Open in urlscan Pro
103.229.73.62  Public Scan

Go To Rescan Add Verdict Report
URL: https://www.hendryadrian.com/modular-java-backdoor-dropped-in-cleo-exploitation-campaign/
Submission: On December 30 via api from IN — Scanned from PT
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 9 IPs in 2 countries across 9 domains to perform 62 HTTP transactions. The main IP is 103.229.73.62, located in Indonesia and belongs to EXBCOID-AS-AP PT. EXABYTES NETWORK INDONESIA, ID. The main domain is www.hendryadrian.com.
TLS certificate: Issued by R10 on December 18th 2024. Valid for: 3 months.
This is the only time www.hendryadrian.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
41 103.229.73.62 136170 (EXBCOID-A...)
2 142.250.185.202 15169 (GOOGLE)
1 142.250.185.232 15169 (GOOGLE)
2 216.58.206.34 15169 (GOOGLE)
5 13.32.121.83 16509 (AMAZON-02)
4 142.250.185.131 15169 (GOOGLE)
1 216.239.32.36 15169 (GOOGLE)
4 142.250.185.238 15169 (GOOGLE)
62 9
41    103.229.73.62 (Indonesia)

ASN136170 (EXBCOID-AS-AP PT. EXABYTES NETWORK INDONESIA, ID)
PTR: sp132.idcloudhosting.cloud
www.hendryadrian.com
2    142.250.185.202 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s52-in-f10.1e100.net
fonts.googleapis.com
1    142.250.185.232 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s53-in-f8.1e100.net
www.googletagmanager.com
2    216.58.206.34 (United States)

ASN15169 (GOOGLE, US)
PTR: mil07s07-in-f2.1e100.net
pagead2.googlesyndication.com
5    13.32.121.83 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-32-121-83.fra60.r.cloudfront.net
blog.rapid7.com
4    142.250.185.131 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s50-in-f3.1e100.net
fonts.gstatic.com
1    216.239.32.36 (United States)

ASN15169 (GOOGLE, US)
region1.google-analytics.com
4    142.250.185.238 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s53-in-f14.1e100.net
fundingchoicesmessages.google.com
Apex Domain
Subdomains		 Transfer
41 hendryadrian.com
www.hendryadrian.com
466 KB
5 rapid7.com
blog.rapid7.com — Cisco Umbrella Rank: 643847
3 MB
4 google.com
fundingchoicesmessages.google.com — Cisco Umbrella Rank: 695
127 KB
4 gstatic.com
fonts.gstatic.com
105 KB
2 googlesyndication.com
pagead2.googlesyndication.com — Cisco Umbrella Rank: 110
198 KB
2 googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 29
7 KB
1 google-analytics.com
region1.google-analytics.com — Cisco Umbrella Rank: 3353
1 googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 39
108 KB
0 buymeacoffee.com Failed
cdnjs.buymeacoffee.com Failed
62 9
Domain Requested by
41 www.hendryadrian.com www.hendryadrian.com
5 blog.rapid7.com www.hendryadrian.com
4 fundingchoicesmessages.google.com pagead2.googlesyndication.com
4 fonts.gstatic.com fonts.googleapis.com
www.hendryadrian.com
2 pagead2.googlesyndication.com www.hendryadrian.com
pagead2.googlesyndication.com
2 fonts.googleapis.com www.hendryadrian.com
1 region1.google-analytics.com www.googletagmanager.com
1 www.googletagmanager.com www.hendryadrian.com
0 cdnjs.buymeacoffee.com Failed www.hendryadrian.com
62 9
Subject Issuer Validity Valid
hendryadrian.com
R10		 2024-12-18 -
2025-03-18		 3 months crt.sh
upload.video.google.com
WR2		 2024-12-02 -
2025-02-24		 3 months crt.sh
*.google-analytics.com
WR2		 2024-12-02 -
2025-02-24		 3 months crt.sh
*.g.doubleclick.net
WR2		 2024-12-02 -
2025-02-24		 3 months crt.sh
blog.rapid7.com
Amazon RSA 2048 M02		 2024-04-05 -
2025-05-04		 a year crt.sh
*.gstatic.com
WR2		 2024-12-02 -
2025-02-24		 3 months crt.sh
*.google.com
WR2		 2024-12-02 -
2025-02-24		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://www.hendryadrian.com/modular-java-backdoor-dropped-in-cleo-exploitation-campaign/
Frame ID: CFD5F33504EA29FA7F3F78AE4A920474
Requests: 62 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Modular Java Backdoor Dropped in Cleo Exploitation Campaign – Cyber Security News Aggregator

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link rel=["']stylesheet["'] [^>]+/wp-(?:content|includes)/
  • /wp-(?:content|includes)/
Overall confidence: 100%
Detected patterns
  • (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
Overall confidence: 100%
Detected patterns
  • googlesyndication\.com/
Overall confidence: 100%
Detected patterns
Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com
Overall confidence: 100%
Detected patterns
  • googletagmanager\.com/gtag/js
Overall confidence: 100%
Detected patterns
  • (?:/([\d.]+))?/slick(?:\.min)?\.js
Overall confidence: 100%
Detected patterns
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Overall confidence: 100%
Detected patterns
  • jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?

Page Statistics

62
Requests

97 %
HTTPS

0 %
IPv6

9
Domains

9
Subdomains

9
IPs

2
Countries

4218 kB
Transfer

5975 kB
Size

2
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

62 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
www.hendryadrian.com/modular-java-backdoor-dropped-in-cleo-exploitation-campaign/ 		92 KB
23 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.hendryadrian.com/modular-java-backdoor-dropped-in-cleo-exploitation-campaign/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
103.229.73.62 , Indonesia, ASN136170 (EXBCOID-AS-AP PT. EXABYTES NETWORK INDONESIA, ID),
Reverse DNS
sp132.idcloudhosting.cloud
Software
LiteSpeed / Exabytes PleskLin
Resource Hash
40167250d7f0f57ee425f6d84d9bb9c6a0fef3dba8299c6b86f869c90169e5ae
Security Headers
Name Value
Strict-Transport-Security max-age=15768000; includeSubDomains

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

alt-svc
h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
cache-control
public, max-age=0
content-encoding
br
content-length
23475
content-type
text/html; charset=UTF-8
date
Mon, 30 Dec 2024 11:33:19 GMT
expires
Mon, 30 Dec 2024 11:30:09 GMT
link
<https://www.hendryadrian.com/wp-json/>; rel="https://api.w.org/" <https://www.hendryadrian.com/wp-json/wp/v2/posts/34943>; rel="alternate"; title="JSON"; type="application/json" <https://www.hendryadrian.com/?p=34943>; rel=shortlink
server
LiteSpeed
strict-transport-security
max-age=15768000; includeSubDomains
vary
Accept-Encoding,User-Agent
x-litespeed-cache
hit
x-powered-by
Exabytes PleskLin
33b627c6-4c29-4c44-a977-a6c85df95c25
https://www.hendryadrian.com/ 		0
0
style.min.css
www.hendryadrian.com/wp-includes/css/dist/block-library/ 		112 KB
14 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.hendryadrian.com/wp-includes/css/dist/block-library/style.min.css?ver=6.7.1
Requested by
Host: www.hendryadrian.com
URL: https://www.hendryadrian.com/modular-java-backdoor-dropped-in-cleo-exploitation-campaign/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
103.229.73.62 , Indonesia, ASN136170 (EXBCOID-AS-AP PT. EXABYTES NETWORK INDONESIA, ID),
Reverse DNS
sp132.idcloudhosting.cloud
Software
LiteSpeed / Exabytes, PleskLin
Resource Hash
3bb38d0f302677ff4104564454f60f495133579d6e6dfb722b3de850df596502
Security Headers
Name Value
Strict-Transport-Security max-age=15768000; includeSubDomains

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.hendryadrian.com/modular-java-backdoor-dropped-in-cleo-exploitation-campaign/

Response headers

strict-transport-security
max-age=15768000; includeSubDomains
cache-control
max-age=31536000, public
content-encoding
br
expires
Mon, 27 Jan 2025 11:46:39 GMT
accept-ranges
bytes
content-length
14225
date
Mon, 30 Dec 2024 11:33:19 GMT
content-type
text/css
last-modified
Wed, 13 Nov 2024 01:58:14 GMT
vary
Accept-Encoding,User-Agent,Accept-Encoding,Accept-Encoding
server
LiteSpeed
x-powered-by
Exabytes, PleskLin
inline-spoilers-default.css
www.hendryadrian.com/wp-content/plugins/inline-spoilers/styles/ 		1 KB
704 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.hendryadrian.com/wp-content/plugins/inline-spoilers/styles/inline-spoilers-default.css?ver=1.4.1
Requested by
Host: www.hendryadrian.com
URL: https://www.hendryadrian.com/modular-java-backdoor-dropped-in-cleo-exploitation-campaign/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
103.229.73.62 , Indonesia, ASN136170 (EXBCOID-AS-AP PT. EXABYTES NETWORK INDONESIA, ID),
Reverse DNS
sp132.idcloudhosting.cloud
Software
LiteSpeed / Exabytes, PleskLin
Resource Hash
a346b59724a1aa134f163b9ce5ed5488dccd6777c1382c07a736acaeb6e38ada
Security Headers
Name Value
Strict-Transport-Security max-age=15768000; includeSubDomains

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.hendryadrian.com/modular-java-backdoor-dropped-in-cleo-exploitation-campaign/

Response headers

strict-transport-security
max-age=15768000; includeSubDomains
cache-control
max-age=31536000, public
content-encoding
br
expires
Mon, 27 Jan 2025 11:46:39 GMT
accept-ranges
bytes
content-length
645
date
Mon, 30 Dec 2024 11:33:19 GMT
content-type
text/css
last-modified
Sat, 01 Jun 2024 04:00:27 GMT
vary
Accept-Encoding,User-Agent,Accept-Encoding,Accept-Encoding
server
LiteSpeed
x-powered-by
Exabytes, PleskLin
ivory-search.min.css
www.hendryadrian.com/wp-content/plugins/add-search-to-menu/public/css/ 		6 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.hendryadrian.com/wp-content/plugins/add-search-to-menu/public/css/ivory-search.min.css?ver=5.5.8
Requested by
Host: www.hendryadrian.com
URL: https://www.hendryadrian.com/modular-java-backdoor-dropped-in-cleo-exploitation-campaign/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
103.229.73.62 , Indonesia, ASN136170 (EXBCOID-AS-AP PT. EXABYTES NETWORK INDONESIA, ID),
Reverse DNS
sp132.idcloudhosting.cloud
Software
LiteSpeed / Exabytes, PleskLin
Resource Hash
5e4d82463aa8389e0f15a7824efd4ff16c9c278bf79075a4b0b46fc156f59bec
Security Headers
Name Value
Strict-Transport-Security max-age=15768000; includeSubDomains

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.hendryadrian.com/modular-java-backdoor-dropped-in-cleo-exploitation-campaign/

Response headers

strict-transport-security
max-age=15768000; includeSubDomains
cache-control
max-age=31536000, public
content-encoding
br
expires
Mon, 27 Jan 2025 11:46:39 GMT
accept-ranges
bytes
content-length
1519
date
Mon, 30 Dec 2024 11:33:19 GMT
content-type
text/css
last-modified
Mon, 25 Nov 2024 23:08:28 GMT
vary
Accept-Encoding,User-Agent,Accept-Encoding,Accept-Encoding
server
LiteSpeed
x-powered-by
Exabytes, PleskLin
style.css
www.hendryadrian.com/wp-content/themes/fairy/ 		102 KB
17 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.hendryadrian.com/wp-content/themes/fairy/style.css?ver=6.7.1
Requested by
Host: www.hendryadrian.com
URL: https://www.hendryadrian.com/modular-java-backdoor-dropped-in-cleo-exploitation-campaign/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
103.229.73.62 , Indonesia, ASN136170 (EXBCOID-AS-AP PT. EXABYTES NETWORK INDONESIA, ID),
Reverse DNS
sp132.idcloudhosting.cloud
Software
LiteSpeed / Exabytes, PleskLin
Resource Hash
17aa3f396ffe9cef4e7e86e5aebac31f58e383326c6237381e223b22aa9690b0
Security Headers
Name Value
Strict-Transport-Security max-age=15768000; includeSubDomains

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.hendryadrian.com/modular-java-backdoor-dropped-in-cleo-exploitation-campaign/

Response headers

strict-transport-security
max-age=15768000; includeSubDomains
cache-control
max-age=31536000, public
content-encoding
br
expires
Mon, 27 Jan 2025 11:46:39 GMT
accept-ranges
bytes
content-length
16841
date
Mon, 30 Dec 2024 11:33:19 GMT
content-type
text/css
last-modified
Sat, 10 Aug 2024 23:25:10 GMT
vary
Accept-Encoding,User-Agent,Accept-Encoding,Accept-Encoding
server
LiteSpeed
x-powered-by
Exabytes, PleskLin
style.css
www.hendryadrian.com/wp-content/themes/fairy-dark/ 		5 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.hendryadrian.com/wp-content/themes/fairy-dark/style.css?ver=6.7.1
Requested by
Host: www.hendryadrian.com
URL: https://www.hendryadrian.com/modular-java-backdoor-dropped-in-cleo-exploitation-campaign/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
103.229.73.62 , Indonesia, ASN136170 (EXBCOID-AS-AP PT. EXABYTES NETWORK INDONESIA, ID),
Reverse DNS
sp132.idcloudhosting.cloud
Software
LiteSpeed / Exabytes, PleskLin
Resource Hash
d2402925a6c7959c06055a7c3e4328174cf7eb41e8f687b1ef48c0613b315cf8
Security Headers
Name Value
Strict-Transport-Security max-age=15768000; includeSubDomains

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.hendryadrian.com/modular-java-backdoor-dropped-in-cleo-exploitation-campaign/

Response headers

strict-transport-security
max-age=15768000; includeSubDomains
cache-control
max-age=31536000, public
content-encoding
br
expires
Mon, 27 Jan 2025 11:46:39 GMT
accept-ranges
bytes
content-length
1658
date
Mon, 30 Dec 2024 11:33:19 GMT
content-type
text/css
last-modified
Tue, 06 Feb 2024 03:24:16 GMT
vary
Accept-Encoding,User-Agent,Accept-Encoding,Accept-Encoding
server
LiteSpeed
x-powered-by
Exabytes, PleskLin
css
fonts.googleapis.com/ 		3 KB
994 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Muli%3A400%2C300italic%2C300&ver=6.7.1
Requested by
Host: www.hendryadrian.com
URL: https://www.hendryadrian.com/modular-java-backdoor-dropped-in-cleo-exploitation-campaign/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.185.202 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s52-in-f10.1e100.net
Software
ESF /
Resource Hash
d41b9d79912d8477348877d675c4943c8148fe06d427cfa658d5b6aad2f904e1
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.hendryadrian.com/

Response headers

content-encoding
gzip
x-content-type-options
nosniff
expires
Mon, 30 Dec 2024 11:33:27 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Mon, 30 Dec 2024 11:33:27 GMT
content-type
text/css; charset=utf-8
vary
Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
last-modified
Mon, 30 Dec 2024 11:33:27 GMT
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=31536000
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
cross-origin-opener-policy
same-origin-allow-popups
cross-origin-resource-policy
cross-origin
access-control-allow-origin
*
x-xss-protection
0
server
ESF
font-awesome.min.css
www.hendryadrian.com/wp-content/themes/fairy/candidthemes/assets/framework/Font-Awesome/css/ 		30 KB
7 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.hendryadrian.com/wp-content/themes/fairy/candidthemes/assets/framework/Font-Awesome/css/font-awesome.min.css?ver=1.4.2
Requested by
Host: www.hendryadrian.com
URL: https://www.hendryadrian.com/modular-java-backdoor-dropped-in-cleo-exploitation-campaign/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
103.229.73.62 , Indonesia, ASN136170 (EXBCOID-AS-AP PT. EXABYTES NETWORK INDONESIA, ID),
Reverse DNS
sp132.idcloudhosting.cloud
Software
LiteSpeed / Exabytes, PleskLin
Resource Hash
820e169ce24824066d9973fd4b6561aae9dcd6dbef6435da905d5a1d6482997c
Security Headers
Name Value
Strict-Transport-Security max-age=15768000; includeSubDomains

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.hendryadrian.com/modular-java-backdoor-dropped-in-cleo-exploitation-campaign/

Response headers

strict-transport-security
max-age=15768000; includeSubDomains
cache-control
max-age=31536000, public
content-encoding
br
expires
Mon, 27 Jan 2025 11:46:39 GMT
accept-ranges
bytes
content-length
6662
date
Mon, 30 Dec 2024 11:33:19 GMT
content-type
text/css
last-modified
Sat, 10 Aug 2024 23:25:08 GMT
vary
Accept-Encoding,User-Agent,Accept-Encoding,Accept-Encoding
server
LiteSpeed
x-powered-by
Exabytes, PleskLin
slick.css
www.hendryadrian.com/wp-content/themes/fairy/candidthemes/assets/framework/slick/ 		2 KB
552 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.hendryadrian.com/wp-content/themes/fairy/candidthemes/assets/framework/slick/slick.css?ver=1.4.2
Requested by
Host: www.hendryadrian.com
URL: https://www.hendryadrian.com/modular-java-backdoor-dropped-in-cleo-exploitation-campaign/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
103.229.73.62 , Indonesia, ASN136170 (EXBCOID-AS-AP PT. EXABYTES NETWORK INDONESIA, ID),
Reverse DNS
sp132.idcloudhosting.cloud
Software
LiteSpeed / Exabytes, PleskLin
Resource Hash
f0b722c48c52082cd77261574e22a5251fe37ea4b291b1441134145bab9b2063
Security Headers
Name Value
Strict-Transport-Security max-age=15768000; includeSubDomains

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.hendryadrian.com/modular-java-backdoor-dropped-in-cleo-exploitation-campaign/

Response headers

strict-transport-security
max-age=15768000; includeSubDomains
cache-control
max-age=31536000, public
content-encoding
br
expires
Mon, 27 Jan 2025 11:46:39 GMT
accept-ranges
bytes
content-length
493
date
Mon, 30 Dec 2024 11:33:19 GMT
content-type
text/css
last-modified
Sat, 10 Aug 2024 23:25:09 GMT
vary
Accept-Encoding,User-Agent,Accept-Encoding,Accept-Encoding
server
LiteSpeed
x-powered-by
Exabytes, PleskLin
slick-theme.css
www.hendryadrian.com/wp-content/themes/fairy/candidthemes/assets/framework/slick/ 		3 KB
809 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.hendryadrian.com/wp-content/themes/fairy/candidthemes/assets/framework/slick/slick-theme.css?ver=1.4.2
Requested by
Host: www.hendryadrian.com
URL: https://www.hendryadrian.com/modular-java-backdoor-dropped-in-cleo-exploitation-campaign/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
103.229.73.62 , Indonesia, ASN136170 (EXBCOID-AS-AP PT. EXABYTES NETWORK INDONESIA, ID),
Reverse DNS
sp132.idcloudhosting.cloud
Software
LiteSpeed / Exabytes, PleskLin
Resource Hash
597978bca0f97e5bb3f70452c24f8a0c93db7f7229433c2a54706b85cdd39aa6
Security Headers
Name Value
Strict-Transport-Security max-age=15768000; includeSubDomains

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.hendryadrian.com/modular-java-backdoor-dropped-in-cleo-exploitation-campaign/

Response headers

strict-transport-security
max-age=15768000; includeSubDomains
cache-control
max-age=31536000, public
content-encoding
br
expires
Mon, 27 Jan 2025 11:46:39 GMT
accept-ranges
bytes
content-length
773
date
Mon, 30 Dec 2024 11:33:19 GMT
content-type
text/css
last-modified
Sat, 10 Aug 2024 23:25:09 GMT
vary
Accept-Encoding,User-Agent,Accept-Encoding,Accept-Encoding
server
LiteSpeed
x-powered-by
Exabytes, PleskLin
frontend.css
www.hendryadrian.com/wp-content/plugins/simple-tags/assets/frontend/css/ 		2 KB
505 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.hendryadrian.com/wp-content/plugins/simple-tags/assets/frontend/css/frontend.css?ver=3.28.1
Requested by
Host: www.hendryadrian.com
URL: https://www.hendryadrian.com/modular-java-backdoor-dropped-in-cleo-exploitation-campaign/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
103.229.73.62 , Indonesia, ASN136170 (EXBCOID-AS-AP PT. EXABYTES NETWORK INDONESIA, ID),
Reverse DNS
sp132.idcloudhosting.cloud
Software
LiteSpeed / Exabytes, PleskLin
Resource Hash
a9957bcfdf67975a509656bd8e9c7ce92cb8807b84bc9f2d87b26e3264d45e8f
Security Headers
Name Value
Strict-Transport-Security max-age=15768000; includeSubDomains

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.hendryadrian.com/modular-java-backdoor-dropped-in-cleo-exploitation-campaign/

Response headers

strict-transport-security
max-age=15768000; includeSubDomains
cache-control
max-age=31536000, public
content-encoding
br
expires
Mon, 27 Jan 2025 11:46:39 GMT
accept-ranges
bytes
content-length
446
date
Mon, 30 Dec 2024 11:33:19 GMT
content-type
text/css
last-modified
Wed, 04 Dec 2024 23:14:19 GMT
vary
Accept-Encoding,User-Agent,Accept-Encoding,Accept-Encoding
server
LiteSpeed
x-powered-by
Exabytes, PleskLin
jquery.min.js
www.hendryadrian.com/wp-includes/js/jquery/ 		86 KB
29 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.hendryadrian.com/wp-includes/js/jquery/jquery.min.js?ver=3.7.1
Requested by
Host: www.hendryadrian.com
URL: https://www.hendryadrian.com/modular-java-backdoor-dropped-in-cleo-exploitation-campaign/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
103.229.73.62 , Indonesia, ASN136170 (EXBCOID-AS-AP PT. EXABYTES NETWORK INDONESIA, ID),
Reverse DNS
sp132.idcloudhosting.cloud
Software
LiteSpeed / Exabytes, PleskLin
Resource Hash
cb6f2d32c49d1c2b25e9ffc9aaafa3f83075346c01bcd4ae6eb187392a4292cf
Security Headers
Name Value
Strict-Transport-Security max-age=15768000; includeSubDomains

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.hendryadrian.com/modular-java-backdoor-dropped-in-cleo-exploitation-campaign/

Response headers

strict-transport-security
max-age=15768000; includeSubDomains
cache-control
max-age=31536000, public
content-encoding
br
expires
Mon, 27 Jan 2025 11:46:39 GMT
accept-ranges
bytes
content-length
29744
date
Mon, 30 Dec 2024 11:33:19 GMT
content-type
application/javascript
last-modified
Mon, 28 Aug 2023 17:14:23 GMT
vary
Accept-Encoding,User-Agent,Accept-Encoding,Accept-Encoding
server
LiteSpeed
x-powered-by
Exabytes, PleskLin
jquery-migrate.min.js
www.hendryadrian.com/wp-includes/js/jquery/ 		13 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.hendryadrian.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.1
Requested by
Host: www.hendryadrian.com
URL: https://www.hendryadrian.com/modular-java-backdoor-dropped-in-cleo-exploitation-campaign/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
103.229.73.62 , Indonesia, ASN136170 (EXBCOID-AS-AP PT. EXABYTES NETWORK INDONESIA, ID),
Reverse DNS
sp132.idcloudhosting.cloud
Software
LiteSpeed / Exabytes, PleskLin
Resource Hash
5274f11e6fb32ae0cf2dfb9f8043272865c397a7c4223b4cfa7d50ea52fbde89
Security Headers
Name Value
Strict-Transport-Security max-age=15768000; includeSubDomains

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.hendryadrian.com/modular-java-backdoor-dropped-in-cleo-exploitation-campaign/

Response headers

strict-transport-security
max-age=15768000; includeSubDomains
cache-control
max-age=31536000, public
content-encoding
br
expires
Mon, 27 Jan 2025 11:46:39 GMT
accept-ranges
bytes
content-length
4678
date
Mon, 30 Dec 2024 11:33:19 GMT
content-type
application/javascript
last-modified
Fri, 09 Jun 2023 05:49:24 GMT
vary
Accept-Encoding,User-Agent,Accept-Encoding,Accept-Encoding
server
LiteSpeed
x-powered-by
Exabytes, PleskLin
frontend.js
www.hendryadrian.com/wp-content/plugins/simple-tags/assets/frontend/js/ 		1 KB
319 B 		Script
General
Check archive.org
Download Go to
Full URL
https://www.hendryadrian.com/wp-content/plugins/simple-tags/assets/frontend/js/frontend.js?ver=3.28.1
Requested by
Host: www.hendryadrian.com
URL: https://www.hendryadrian.com/modular-java-backdoor-dropped-in-cleo-exploitation-campaign/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
103.229.73.62 , Indonesia, ASN136170 (EXBCOID-AS-AP PT. EXABYTES NETWORK INDONESIA, ID),
Reverse DNS
sp132.idcloudhosting.cloud
Software
LiteSpeed / Exabytes, PleskLin
Resource Hash
68050132d00103b58e5dfc387574b2e9c379476798384478e32b1cda8cfae705
Security Headers
Name Value
Strict-Transport-Security max-age=15768000; includeSubDomains

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.hendryadrian.com/modular-java-backdoor-dropped-in-cleo-exploitation-campaign/

Response headers

strict-transport-security
max-age=15768000; includeSubDomains
cache-control
max-age=31536000, public
content-encoding
br
expires
Mon, 27 Jan 2025 11:46:39 GMT
accept-ranges
bytes
content-length
283
date
Mon, 30 Dec 2024 11:33:19 GMT
content-type
application/javascript
last-modified
Wed, 04 Dec 2024 23:14:19 GMT
vary
Accept-Encoding,User-Agent,Accept-Encoding,Accept-Encoding
server
LiteSpeed
x-powered-by
Exabytes, PleskLin
js
www.googletagmanager.com/gtag/ 		323 KB
108 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=GT-P85KW66Q
Requested by
Host: www.hendryadrian.com
URL: https://www.hendryadrian.com/modular-java-backdoor-dropped-in-cleo-exploitation-campaign/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.185.232 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s53-in-f8.1e100.net
Software
Google Tag Manager /
Resource Hash
deae44c5e2d8da6b1582900a4416177eb5e49abd300174cbd01d4c6bd81a22d2
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.hendryadrian.com/

Response headers

content-encoding
br
report-to
{"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires
Mon, 30 Dec 2024 11:33:27 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Mon, 30 Dec 2024 11:33:27 GMT
content-type
application/javascript; charset=UTF-8
vary
Accept-Encoding
access-control-allow-headers
Cache-Control
strict-transport-security
max-age=31536000; includeSubDomains
cache-control
private, max-age=900
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
content-security-policy-report-only
script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to=coop_reporting
content-length
109832
x-xss-protection
0
server
Google Tag Manager
adsbygoogle.js
pagead2.googlesyndication.com/pagead/js/ 		163 KB
53 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-7391999098984836&host=ca-host-pub-2644536267352236
Requested by
Host: www.hendryadrian.com
URL: https://www.hendryadrian.com/modular-java-backdoor-dropped-in-cleo-exploitation-campaign/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
216.58.206.34 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
mil07s07-in-f2.1e100.net
Software
cafe /
Resource Hash
21005d768e8a2e6112d3b5b2f05a2cd407021b147b69f94e456bbc4a82f63238
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin
https://www.hendryadrian.com
Referer
https://www.hendryadrian.com/

Response headers

content-encoding
br
etag
15965724664959950383
x-content-type-options
nosniff
expires
Mon, 30 Dec 2024 11:33:27 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date
Mon, 30 Dec 2024 11:33:27 GMT
content-type
text/javascript; charset=UTF-8
vary
Accept-Encoding
content-disposition
attachment; filename="f.txt"
link
<https://googleads.g.doubleclick.net>; rel="preconnect"; crossorigin
cache-control
private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
access-control-allow-origin
*
content-length
54161
x-xss-protection
0
server
cafe
threatresearch.png
www.hendryadrian.com/tweet/image/ 		81 KB
81 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.hendryadrian.com/tweet/image/threatresearch.png
Requested by
Host: www.hendryadrian.com
URL: https://www.hendryadrian.com/modular-java-backdoor-dropped-in-cleo-exploitation-campaign/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
103.229.73.62 , Indonesia, ASN136170 (EXBCOID-AS-AP PT. EXABYTES NETWORK INDONESIA, ID),
Reverse DNS
sp132.idcloudhosting.cloud
Software
LiteSpeed / Exabytes, PleskLin
Resource Hash
9dbb7c43d8ec22b902e8cc4d88a4c976191adf85145fe2dd933360a941b4fafd
Security Headers
Name Value
Strict-Transport-Security max-age=15768000; includeSubDomains

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.hendryadrian.com/modular-java-backdoor-dropped-in-cleo-exploitation-campaign/

Response headers

strict-transport-security
max-age=15768000; includeSubDomains
vary
User-Agent
cache-control
max-age=31536000, public
expires
Mon, 27 Jan 2025 11:46:39 GMT
accept-ranges
bytes
content-length
82488
date
Mon, 30 Dec 2024 11:33:19 GMT
content-type
image/png
last-modified
Tue, 10 Dec 2024 04:32:03 GMT
server
LiteSpeed
x-powered-by
Exabytes, PleskLin
Cleo_FLow_Attack_v1-1.png
blog.rapid7.com/content/images/2024/12/ 		1 MB
1 MB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blog.rapid7.com/content/images/2024/12/Cleo_FLow_Attack_v1-1.png
Requested by
Host: www.hendryadrian.com
URL: https://www.hendryadrian.com/modular-java-backdoor-dropped-in-cleo-exploitation-campaign/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
13.32.121.83 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-32-121-83.fra60.r.cloudfront.net
Software
nginx/1.14.0 (Ubuntu) / Express
Resource Hash
61b2ecb468216007900d30b677955d54b8cbfc7d21e7c62b052e3b107bbeb721
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://www.rapid7.com
X-Frame-Options SAMEORIGIN

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.hendryadrian.com/

Response headers

ETag
W/"10bb8e-193b6ebfd19"
Age
190
X-Cache
Hit from cloudfront
X-Amz-Cf-Id
ZXaLwIElhdDb2NnYzGGsIBwwy8zQRzz865ltChIVDgPAw0DmNvW26g==
Date
Mon, 30 Dec 2024 11:30:17 GMT
Content-Type
image/png
Last-Modified
Wed, 11 Dec 2024 18:12:19 GMT
X-Frame-Options
SAMEORIGIN
Content-Security-Policy
frame-ancestors 'self' https://www.rapid7.com
Cache-Control
public, max-age=31536000
Connection
keep-alive
Via
1.1 a300dbfb49a2eb50edb83038642c9f82.cloudfront.net (CloudFront)
Accept-Ranges
bytes
Content-Length
1096590
X-Amz-Cf-Pop
FRA60-P1
X-Powered-By
Express
Server
nginx/1.14.0 (Ubuntu)
Cleo_FLow_Attack_v1.png
blog.rapid7.com/content/images/2024/12/ 		1 MB
1 MB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blog.rapid7.com/content/images/2024/12/Cleo_FLow_Attack_v1.png
Requested by
Host: www.hendryadrian.com
URL: https://www.hendryadrian.com/modular-java-backdoor-dropped-in-cleo-exploitation-campaign/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
13.32.121.83 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-32-121-83.fra60.r.cloudfront.net
Software
nginx/1.14.0 (Ubuntu) / Express
Resource Hash
61b2ecb468216007900d30b677955d54b8cbfc7d21e7c62b052e3b107bbeb721
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://www.rapid7.com
X-Frame-Options SAMEORIGIN

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.hendryadrian.com/

Response headers

ETag
W/"10bb8e-193b6e38169"
Age
189
X-Cache
Hit from cloudfront
X-Amz-Cf-Id
wv8DwYeGcMDdraKXLlzp7tUgYHcoEbEbar60ljdl6Qv6FtSP9HrWKg==
Date
Mon, 30 Dec 2024 11:30:18 GMT
Content-Type
image/png
Last-Modified
Wed, 11 Dec 2024 18:03:03 GMT
X-Frame-Options
SAMEORIGIN
Content-Security-Policy
frame-ancestors 'self' https://www.rapid7.com
Cache-Control
public, max-age=31536000
Connection
keep-alive
Via
1.1 a300dbfb49a2eb50edb83038642c9f82.cloudfront.net (CloudFront)
Accept-Ranges
bytes
Content-Length
1096590
X-Amz-Cf-Pop
FRA60-P1
X-Powered-By
Express
Server
nginx/1.14.0 (Ubuntu)
cleo-2-inside-the-jar-file.png
blog.rapid7.com/content/images/2024/12/ 		25 KB
25 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blog.rapid7.com/content/images/2024/12/cleo-2-inside-the-jar-file.png
Requested by
Host: www.hendryadrian.com
URL: https://www.hendryadrian.com/modular-java-backdoor-dropped-in-cleo-exploitation-campaign/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
13.32.121.83 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-32-121-83.fra60.r.cloudfront.net
Software
nginx/1.14.0 (Ubuntu) / Express
Resource Hash
a9ddc80140c6de1c738cdc21f1142fa3d787fb873ccb1d679b47a13c7feaaaaf
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://www.rapid7.com
X-Frame-Options SAMEORIGIN

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.hendryadrian.com/

Response headers

ETag
W/"6260-193b6d6bccc"
Age
190
X-Cache
Hit from cloudfront
X-Amz-Cf-Id
z0F5jzY3Yq06NPasrGtGFEx0Q0Jjg9zDMJBcKIDjT3BT7Hox8dZJ6Q==
Date
Mon, 30 Dec 2024 11:30:17 GMT
Content-Type
image/png
Last-Modified
Wed, 11 Dec 2024 17:49:06 GMT
X-Frame-Options
SAMEORIGIN
Content-Security-Policy
frame-ancestors 'self' https://www.rapid7.com
Cache-Control
public, max-age=31536000
Connection
keep-alive
Via
1.1 23e8ec14db0917c91c2c733b45578890.cloudfront.net (CloudFront)
Accept-Ranges
bytes
Content-Length
25184
X-Amz-Cf-Pop
FRA60-P1
X-Powered-By
Express
Server
nginx/1.14.0 (Ubuntu)
JAva_RAT_FLow_v1.png
blog.rapid7.com/content/images/2024/12/ 		1 MB
1 MB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blog.rapid7.com/content/images/2024/12/JAva_RAT_FLow_v1.png
Requested by
Host: www.hendryadrian.com
URL: https://www.hendryadrian.com/modular-java-backdoor-dropped-in-cleo-exploitation-campaign/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
13.32.121.83 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-32-121-83.fra60.r.cloudfront.net
Software
nginx/1.14.0 (Ubuntu) / Express
Resource Hash
1dedf11c8d4edbb4c6a7d3c277c806ac41cdeef6c32b9516e2e70ba29c20acec
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://www.rapid7.com
X-Frame-Options SAMEORIGIN

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.hendryadrian.com/

Response headers

ETag
W/"101dae-193b6e7dca1"
Age
189
X-Cache
Hit from cloudfront
X-Amz-Cf-Id
8feVx3WXeoDjs6N_WbcDz-qGqs1lKgg3iHvHRu7eeXhT6Ois0GtIUw==
Date
Mon, 30 Dec 2024 11:30:17 GMT
Content-Type
image/png
Last-Modified
Wed, 11 Dec 2024 18:07:48 GMT
X-Frame-Options
SAMEORIGIN
Content-Security-Policy
frame-ancestors 'self' https://www.rapid7.com
Cache-Control
public, max-age=31536000
Connection
keep-alive
Via
1.1 36cd2d0f34e25c2dc5099656a60bedac.cloudfront.net (CloudFront)
Accept-Ranges
bytes
Content-Length
1056174
X-Amz-Cf-Pop
FRA60-P1
X-Powered-By
Express
Server
nginx/1.14.0 (Ubuntu)
cleo-4.png
blog.rapid7.com/content/images/2024/12/ 		7 KB
8 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blog.rapid7.com/content/images/2024/12/cleo-4.png
Requested by
Host: www.hendryadrian.com
URL: https://www.hendryadrian.com/modular-java-backdoor-dropped-in-cleo-exploitation-campaign/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
13.32.121.83 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-32-121-83.fra60.r.cloudfront.net
Software
nginx/1.14.0 (Ubuntu) / Express
Resource Hash
e0efa6bf2a1cbe24b5cb8aece4b7b12e0ff4270565c8d14a4b7bf7dd259bc0ad
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://www.rapid7.com
X-Frame-Options SAMEORIGIN

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.hendryadrian.com/

Response headers

ETag
W/"1c94-193b6eb65cd"
Age
190
X-Cache
Hit from cloudfront
X-Amz-Cf-Id
fDbdUyNuJ5vJEfmLcuUZLwfVUkiwJvqxpbN8p0uDbpL8I93SQkdnQw==
Date
Mon, 30 Dec 2024 11:30:17 GMT
Content-Type
image/png
Last-Modified
Wed, 11 Dec 2024 18:11:40 GMT
X-Frame-Options
SAMEORIGIN
Content-Security-Policy
frame-ancestors 'self' https://www.rapid7.com
Cache-Control
public, max-age=31536000
Connection
keep-alive
Via
1.1 23e8ec14db0917c91c2c733b45578890.cloudfront.net (CloudFront)
Accept-Ranges
bytes
Content-Length
7316
X-Amz-Cf-Pop
FRA60-P1
X-Powered-By
Express
Server
nginx/1.14.0 (Ubuntu)
button.prod.min.js
cdnjs.buymeacoffee.com/1.0.0/ 		0
0
ivory-ajax-search.min.css
www.hendryadrian.com/wp-content/plugins/add-search-to-menu/public/css/ 		8 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.hendryadrian.com/wp-content/plugins/add-search-to-menu/public/css/ivory-ajax-search.min.css?ver=5.5.8
Requested by
Host: www.hendryadrian.com
URL: https://www.hendryadrian.com/modular-java-backdoor-dropped-in-cleo-exploitation-campaign/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
103.229.73.62 , Indonesia, ASN136170 (EXBCOID-AS-AP PT. EXABYTES NETWORK INDONESIA, ID),
Reverse DNS
sp132.idcloudhosting.cloud
Software
LiteSpeed / Exabytes, PleskLin
Resource Hash
316868f97d2f29e79b0fa3501b5e72f84f3f4076a47a024936553dcc49e1aeb1
Security Headers
Name Value
Strict-Transport-Security max-age=15768000; includeSubDomains

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.hendryadrian.com/modular-java-backdoor-dropped-in-cleo-exploitation-campaign/

Response headers

strict-transport-security
max-age=15768000; includeSubDomains
cache-control
max-age=31536000, public
content-encoding
br
expires
Mon, 27 Jan 2025 11:46:40 GMT
accept-ranges
bytes
content-length
1928
date
Mon, 30 Dec 2024 11:33:20 GMT
content-type
text/css
last-modified
Mon, 25 Nov 2024 23:08:28 GMT
vary
Accept-Encoding,User-Agent,Accept-Encoding,Accept-Encoding
server
LiteSpeed
x-powered-by
Exabytes, PleskLin
inline-spoilers-scripts.js
www.hendryadrian.com/wp-content/plugins/inline-spoilers/scripts/ 		358 B
205 B 		Script
General
Check archive.org
Download Go to
Full URL
https://www.hendryadrian.com/wp-content/plugins/inline-spoilers/scripts/inline-spoilers-scripts.js?ver=1.4.1
Requested by
Host: www.hendryadrian.com
URL: https://www.hendryadrian.com/modular-java-backdoor-dropped-in-cleo-exploitation-campaign/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
103.229.73.62 , Indonesia, ASN136170 (EXBCOID-AS-AP PT. EXABYTES NETWORK INDONESIA, ID),
Reverse DNS
sp132.idcloudhosting.cloud
Software
LiteSpeed / Exabytes, PleskLin
Resource Hash
d96e147610eb5ecafe7e06313ed0c4b3808b19dee2c5a38d687f3d4ae7f896a5
Security Headers
Name Value
Strict-Transport-Security max-age=15768000; includeSubDomains

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.hendryadrian.com/modular-java-backdoor-dropped-in-cleo-exploitation-campaign/

Response headers

strict-transport-security
max-age=15768000; includeSubDomains
cache-control
max-age=31536000, public
content-encoding
br
expires
Mon, 27 Jan 2025 11:46:40 GMT
accept-ranges
bytes
content-length
169
date
Mon, 30 Dec 2024 11:33:20 GMT
content-type
application/javascript
last-modified
Sat, 01 Jun 2024 04:00:27 GMT
vary
Accept-Encoding,User-Agent,Accept-Encoding,Accept-Encoding
server
LiteSpeed
x-powered-by
Exabytes, PleskLin
navigation.js
www.hendryadrian.com/wp-content/themes/fairy/js/ 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.hendryadrian.com/wp-content/themes/fairy/js/navigation.js?ver=1.4.2
Requested by
Host: www.hendryadrian.com
URL: https://www.hendryadrian.com/modular-java-backdoor-dropped-in-cleo-exploitation-campaign/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
103.229.73.62 , Indonesia, ASN136170 (EXBCOID-AS-AP PT. EXABYTES NETWORK INDONESIA, ID),
Reverse DNS
sp132.idcloudhosting.cloud
Software
LiteSpeed / Exabytes, PleskLin
Resource Hash
01d7c9a6f7c2b8c9290aba44c16c812337398880d14cfcbbb402fd7b153661b1
Security Headers
Name Value
Strict-Transport-Security max-age=15768000; includeSubDomains

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.hendryadrian.com/modular-java-backdoor-dropped-in-cleo-exploitation-campaign/

Response headers

strict-transport-security
max-age=15768000; includeSubDomains
cache-control
max-age=31536000, public
content-encoding
br
expires
Mon, 27 Jan 2025 11:46:40 GMT
accept-ranges
bytes
content-length
988
date
Mon, 30 Dec 2024 11:33:20 GMT
content-type
application/javascript
last-modified
Sat, 10 Aug 2024 23:25:09 GMT
vary
Accept-Encoding,User-Agent,Accept-Encoding,Accept-Encoding
server
LiteSpeed
x-powered-by
Exabytes, PleskLin
theia-sticky-sidebar.js
www.hendryadrian.com/wp-content/themes/fairy/candidthemes/assets/custom/js/ 		16 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.hendryadrian.com/wp-content/themes/fairy/candidthemes/assets/custom/js/theia-sticky-sidebar.js?ver=1.4.2
Requested by
Host: www.hendryadrian.com
URL: https://www.hendryadrian.com/modular-java-backdoor-dropped-in-cleo-exploitation-campaign/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
103.229.73.62 , Indonesia, ASN136170 (EXBCOID-AS-AP PT. EXABYTES NETWORK INDONESIA, ID),
Reverse DNS
sp132.idcloudhosting.cloud
Software
LiteSpeed / Exabytes, PleskLin
Resource Hash
9aa067574acf4c7b8d7cef4f104ea80eeb6bd8af4d1e142015d029779dcdae3e
Security Headers
Name Value
Strict-Transport-Security max-age=15768000; includeSubDomains

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.hendryadrian.com/modular-java-backdoor-dropped-in-cleo-exploitation-campaign/

Response headers

strict-transport-security
max-age=15768000; includeSubDomains
cache-control
max-age=31536000, public
content-encoding
br
expires
Mon, 27 Jan 2025 11:46:40 GMT
accept-ranges
bytes
content-length
3411
date
Mon, 30 Dec 2024 11:33:20 GMT
content-type
application/javascript
last-modified
Sat, 10 Aug 2024 23:25:08 GMT
vary
Accept-Encoding,User-Agent,Accept-Encoding,Accept-Encoding
server
LiteSpeed
x-powered-by
Exabytes, PleskLin
slick.js
www.hendryadrian.com/wp-content/themes/fairy/candidthemes/assets/framework/slick/ 		90 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.hendryadrian.com/wp-content/themes/fairy/candidthemes/assets/framework/slick/slick.js?ver=1.4.2
Requested by
Host: www.hendryadrian.com
URL: https://www.hendryadrian.com/modular-java-backdoor-dropped-in-cleo-exploitation-campaign/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
103.229.73.62 , Indonesia, ASN136170 (EXBCOID-AS-AP PT. EXABYTES NETWORK INDONESIA, ID),
Reverse DNS
sp132.idcloudhosting.cloud
Software
LiteSpeed / Exabytes, PleskLin
Resource Hash
6596a1e2c00a9382621eecdd04431e99c4638499a25fe64389d690a05d838a15
Security Headers
Name Value
Strict-Transport-Security max-age=15768000; includeSubDomains

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.hendryadrian.com/modular-java-backdoor-dropped-in-cleo-exploitation-campaign/

Response headers

strict-transport-security
max-age=15768000; includeSubDomains
cache-control
max-age=31536000, public
content-encoding
br
expires
Mon, 27 Jan 2025 11:46:40 GMT
accept-ranges
bytes
content-length
14940
date
Mon, 30 Dec 2024 11:33:20 GMT
content-type
application/javascript
last-modified
Sat, 10 Aug 2024 23:25:09 GMT
vary
Accept-Encoding,User-Agent,Accept-Encoding,Accept-Encoding
server
LiteSpeed
x-powered-by
Exabytes, PleskLin
imagesloaded.min.js
www.hendryadrian.com/wp-includes/js/ 		5 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.hendryadrian.com/wp-includes/js/imagesloaded.min.js?ver=5.0.0
Requested by
Host: www.hendryadrian.com
URL: https://www.hendryadrian.com/modular-java-backdoor-dropped-in-cleo-exploitation-campaign/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
103.229.73.62 , Indonesia, ASN136170 (EXBCOID-AS-AP PT. EXABYTES NETWORK INDONESIA, ID),
Reverse DNS
sp132.idcloudhosting.cloud
Software
LiteSpeed / Exabytes, PleskLin
Resource Hash
b65b3de1bc923b9355248a0d941a0eaee15dfb9a6b8eadb51323a8df6189dcd1
Security Headers
Name Value
Strict-Transport-Security max-age=15768000; includeSubDomains

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.hendryadrian.com/modular-java-backdoor-dropped-in-cleo-exploitation-campaign/

Response headers

strict-transport-security
max-age=15768000; includeSubDomains
cache-control
max-age=31536000, public
content-encoding
br
expires
Mon, 27 Jan 2025 11:46:40 GMT
accept-ranges
bytes
content-length
1687
date
Mon, 30 Dec 2024 11:33:20 GMT
content-type
application/javascript
last-modified
Fri, 11 Aug 2023 18:18:26 GMT
vary
Accept-Encoding,User-Agent,Accept-Encoding,Accept-Encoding
server
LiteSpeed
x-powered-by
Exabytes, PleskLin
masonry.min.js
www.hendryadrian.com/wp-includes/js/ 		24 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.hendryadrian.com/wp-includes/js/masonry.min.js?ver=4.2.2
Requested by
Host: www.hendryadrian.com
URL: https://www.hendryadrian.com/modular-java-backdoor-dropped-in-cleo-exploitation-campaign/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
103.229.73.62 , Indonesia, ASN136170 (EXBCOID-AS-AP PT. EXABYTES NETWORK INDONESIA, ID),
Reverse DNS
sp132.idcloudhosting.cloud
Software
LiteSpeed / Exabytes, PleskLin
Resource Hash
e00add38134eac2fb8e8e9c09cbfff7bbe57952b210322eb2eecb0a21fc055eb
Security Headers
Name Value
Strict-Transport-Security max-age=15768000; includeSubDomains

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.hendryadrian.com/modular-java-backdoor-dropped-in-cleo-exploitation-campaign/

Response headers

strict-transport-security
max-age=15768000; includeSubDomains
cache-control
max-age=31536000, public
content-encoding
br
expires
Mon, 27 Jan 2025 11:46:40 GMT
accept-ranges
bytes
content-length
7117
date
Mon, 30 Dec 2024 11:33:20 GMT
content-type
application/javascript
last-modified
Sat, 13 Jun 2020 18:53:27 GMT
vary
Accept-Encoding,User-Agent,Accept-Encoding,Accept-Encoding
server
LiteSpeed
x-powered-by
Exabytes, PleskLin
custom.js
www.hendryadrian.com/wp-content/themes/fairy/candidthemes/assets/custom/js/ 		7 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.hendryadrian.com/wp-content/themes/fairy/candidthemes/assets/custom/js/custom.js?ver=1.4.2
Requested by
Host: www.hendryadrian.com
URL: https://www.hendryadrian.com/modular-java-backdoor-dropped-in-cleo-exploitation-campaign/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
103.229.73.62 , Indonesia, ASN136170 (EXBCOID-AS-AP PT. EXABYTES NETWORK INDONESIA, ID),
Reverse DNS
sp132.idcloudhosting.cloud
Software
LiteSpeed / Exabytes, PleskLin
Resource Hash
6b10604397cb4df6fe4c4609ae563859e41fd0977ecdc5819e71f805d7e6cc0e
Security Headers
Name Value
Strict-Transport-Security max-age=15768000; includeSubDomains

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.hendryadrian.com/modular-java-backdoor-dropped-in-cleo-exploitation-campaign/

Response headers

strict-transport-security
max-age=15768000; includeSubDomains
cache-control
max-age=31536000, public
content-encoding
br
expires
Mon, 27 Jan 2025 11:46:40 GMT
accept-ranges
bytes
content-length
1648
date
Mon, 30 Dec 2024 11:33:20 GMT
content-type
application/javascript
last-modified
Sat, 10 Aug 2024 23:25:08 GMT
vary
Accept-Encoding,User-Agent,Accept-Encoding,Accept-Encoding
server
LiteSpeed
x-powered-by
Exabytes, PleskLin
ivory-search.min.js
www.hendryadrian.com/wp-content/plugins/add-search-to-menu/public/js/ 		4 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.hendryadrian.com/wp-content/plugins/add-search-to-menu/public/js/ivory-search.min.js?ver=5.5.8
Requested by
Host: www.hendryadrian.com
URL: https://www.hendryadrian.com/modular-java-backdoor-dropped-in-cleo-exploitation-campaign/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
103.229.73.62 , Indonesia, ASN136170 (EXBCOID-AS-AP PT. EXABYTES NETWORK INDONESIA, ID),
Reverse DNS
sp132.idcloudhosting.cloud
Software
LiteSpeed / Exabytes, PleskLin
Resource Hash
66d0c8cbacc09ad8746e64ad28d887186d1f060f04c388c2f1102ee346120a8c
Security Headers
Name Value
Strict-Transport-Security max-age=15768000; includeSubDomains

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.hendryadrian.com/modular-java-backdoor-dropped-in-cleo-exploitation-campaign/

Response headers

strict-transport-security
max-age=15768000; includeSubDomains
cache-control
max-age=31536000, public
content-encoding
br
expires
Mon, 27 Jan 2025 11:46:40 GMT
accept-ranges
bytes
content-length
1074
date
Mon, 30 Dec 2024 11:33:20 GMT
content-type
application/javascript
last-modified
Mon, 25 Nov 2024 23:08:28 GMT
vary
Accept-Encoding,User-Agent,Accept-Encoding,Accept-Encoding
server
LiteSpeed
x-powered-by
Exabytes, PleskLin
float.js
www.hendryadrian.com/wp-content/plugins/gtranslate/js/ 		22 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.hendryadrian.com/wp-content/plugins/gtranslate/js/float.js?ver=6.7.1
Requested by
Host: www.hendryadrian.com
URL: https://www.hendryadrian.com/modular-java-backdoor-dropped-in-cleo-exploitation-campaign/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
103.229.73.62 , Indonesia, ASN136170 (EXBCOID-AS-AP PT. EXABYTES NETWORK INDONESIA, ID),
Reverse DNS
sp132.idcloudhosting.cloud
Software
LiteSpeed / Exabytes, PleskLin
Resource Hash
e7b82cf334e70a450ecf59d4d92355d1cb408b1a95f028decb50c597ac53e42d
Security Headers
Name Value
Strict-Transport-Security max-age=15768000; includeSubDomains

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.hendryadrian.com/modular-java-backdoor-dropped-in-cleo-exploitation-campaign/

Response headers

strict-transport-security
max-age=15768000; includeSubDomains
cache-control
max-age=31536000, public
content-encoding
br
expires
Mon, 27 Jan 2025 11:46:40 GMT
accept-ranges
bytes
content-length
6287
date
Mon, 30 Dec 2024 11:33:20 GMT
content-type
application/javascript
last-modified
Wed, 18 Sep 2024 23:21:57 GMT
vary
Accept-Encoding,User-Agent,Accept-Encoding,Accept-Encoding
server
LiteSpeed
x-powered-by
Exabytes, PleskLin
ivory-ajax-search.min.js
www.hendryadrian.com/wp-content/plugins/add-search-to-menu/public/js/ 		66 KB
20 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.hendryadrian.com/wp-content/plugins/add-search-to-menu/public/js/ivory-ajax-search.min.js?ver=5.5.8
Requested by
Host: www.hendryadrian.com
URL: https://www.hendryadrian.com/modular-java-backdoor-dropped-in-cleo-exploitation-campaign/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
103.229.73.62 , Indonesia, ASN136170 (EXBCOID-AS-AP PT. EXABYTES NETWORK INDONESIA, ID),
Reverse DNS
sp132.idcloudhosting.cloud
Software
LiteSpeed / Exabytes, PleskLin
Resource Hash
108cd01e5eaa34e9942ca8af9f8fe70271d3a3a5028fa085c628c162c3706d2d
Security Headers
Name Value
Strict-Transport-Security max-age=15768000; includeSubDomains

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.hendryadrian.com/modular-java-backdoor-dropped-in-cleo-exploitation-campaign/

Response headers

strict-transport-security
max-age=15768000; includeSubDomains
cache-control
max-age=31536000, public
content-encoding
br
expires
Mon, 27 Jan 2025 11:46:40 GMT
accept-ranges
bytes
content-length
20124
date
Mon, 30 Dec 2024 11:33:20 GMT
content-type
application/javascript
last-modified
Mon, 25 Nov 2024 23:08:28 GMT
vary
Accept-Encoding,User-Agent,Accept-Encoding,Accept-Encoding
server
LiteSpeed
x-powered-by
Exabytes, PleskLin
7Auwp_0qiz-afTLGLQ.woff2
fonts.gstatic.com/s/muli/v29/ 		32 KB
32 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/muli/v29/7Auwp_0qiz-afTLGLQ.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Muli%3A400%2C300italic%2C300&ver=6.7.1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.185.131 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s50-in-f3.1e100.net
Software
sffe /
Resource Hash
f68d37d474952b1fbe30def1b69e63e79c46a70263433285783b69ac0107b929
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin
https://www.hendryadrian.com
Referer
https://fonts.googleapis.com/

Response headers

age
573711
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options
nosniff
expires
Tue, 23 Dec 2025 20:11:36 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Mon, 23 Dec 2024 20:11:36 GMT
last-modified
Wed, 13 Sep 2023 22:41:22 GMT
content-type
font/woff2
cache-control
public, max-age=31536000
timing-allow-origin
*
cross-origin-opener-policy
same-origin; report-to="apps-themes"
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges
bytes
access-control-allow-origin
*
content-length
32796
x-xss-protection
0
server
sffe
fontawesome-webfont.woff2
www.hendryadrian.com/wp-content/themes/fairy/candidthemes/assets/framework/Font-Awesome/fonts/ 		75 KB
75 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://www.hendryadrian.com/wp-content/themes/fairy/candidthemes/assets/framework/Font-Awesome/fonts/fontawesome-webfont.woff2?v=4.7.0
Requested by
Host: www.hendryadrian.com
URL: https://www.hendryadrian.com/wp-content/themes/fairy/candidthemes/assets/framework/Font-Awesome/css/font-awesome.min.css?ver=1.4.2
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
103.229.73.62 , Indonesia, ASN136170 (EXBCOID-AS-AP PT. EXABYTES NETWORK INDONESIA, ID),
Reverse DNS
sp132.idcloudhosting.cloud
Software
LiteSpeed / Exabytes, PleskLin
Resource Hash
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe
Security Headers
Name Value
Strict-Transport-Security max-age=15768000; includeSubDomains

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin
https://www.hendryadrian.com
Referer
https://www.hendryadrian.com/wp-content/themes/fairy/candidthemes/assets/framework/Font-Awesome/css/font-awesome.min.css?ver=1.4.2

Response headers

strict-transport-security
max-age=15768000; includeSubDomains
vary
User-Agent,Accept-Encoding
cache-control
max-age=31536000, public
expires
Mon, 27 Jan 2025 11:46:40 GMT
accept-ranges
bytes
content-length
77160
date
Mon, 30 Dec 2024 11:33:20 GMT
content-type
font/woff2
last-modified
Sat, 10 Aug 2024 23:25:09 GMT
server
LiteSpeed
x-powered-by
Exabytes, PleskLin
7Aujp_0qiz-afTfcIyoiGtm2P0wG089z4eqVww.woff2
fonts.gstatic.com/s/muli/v29/ 		18 KB
18 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/muli/v29/7Aujp_0qiz-afTfcIyoiGtm2P0wG089z4eqVww.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Muli%3A400%2C300italic%2C300&ver=6.7.1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.185.131 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s50-in-f3.1e100.net
Software
sffe /
Resource Hash
e1457d7a711b5d6ff38cf8d64e74354a212548b489dd59ca083e59599e0d5da0
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin
https://www.hendryadrian.com
Referer
https://fonts.googleapis.com/

Response headers

age
416388
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options
nosniff
expires
Thu, 25 Dec 2025 15:53:39 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Wed, 25 Dec 2024 15:53:39 GMT
last-modified
Wed, 13 Sep 2023 22:53:16 GMT
content-type
font/woff2
cache-control
public, max-age=31536000
timing-allow-origin
*
cross-origin-opener-policy
same-origin; report-to="apps-themes"
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges
bytes
access-control-allow-origin
*
content-length
18736
x-xss-protection
0
server
sffe
logo.png
www.hendryadrian.com/wp-content/uploads/2024/12/ 		134 KB
134 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.hendryadrian.com/wp-content/uploads/2024/12/logo.png
Requested by
Host: www.hendryadrian.com
URL: https://www.hendryadrian.com/modular-java-backdoor-dropped-in-cleo-exploitation-campaign/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
103.229.73.62 , Indonesia, ASN136170 (EXBCOID-AS-AP PT. EXABYTES NETWORK INDONESIA, ID),
Reverse DNS
sp132.idcloudhosting.cloud
Software
LiteSpeed / Exabytes, PleskLin
Resource Hash
2513f76634bfde77d2f0f08cb8f9d04e3c53cc81a76831e1e99b93ee47c3aeba
Security Headers
Name Value
Strict-Transport-Security max-age=15768000; includeSubDomains

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.hendryadrian.com/modular-java-backdoor-dropped-in-cleo-exploitation-campaign/

Response headers

strict-transport-security
max-age=15768000; includeSubDomains
vary
User-Agent
cache-control
max-age=31536000, public
expires
Mon, 27 Jan 2025 11:46:40 GMT
accept-ranges
bytes
content-length
137396
date
Mon, 30 Dec 2024 11:33:20 GMT
content-type
image/png
last-modified
Wed, 11 Dec 2024 12:35:46 GMT
server
LiteSpeed
x-powered-by
Exabytes, PleskLin
hacker-1.png
www.hendryadrian.com/wp-content/uploads/2024/03/ 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.hendryadrian.com/wp-content/uploads/2024/03/hacker-1.png
Requested by
Host: www.hendryadrian.com
URL: https://www.hendryadrian.com/modular-java-backdoor-dropped-in-cleo-exploitation-campaign/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
103.229.73.62 , Indonesia, ASN136170 (EXBCOID-AS-AP PT. EXABYTES NETWORK INDONESIA, ID),
Reverse DNS
sp132.idcloudhosting.cloud
Software
LiteSpeed / Exabytes, PleskLin
Resource Hash
64af813ec7b0f71e2e9f33bfe8d8413dfbc71fb3bc0aa6b3700c8296c4a89952
Security Headers
Name Value
Strict-Transport-Security max-age=15768000; includeSubDomains

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.hendryadrian.com/modular-java-backdoor-dropped-in-cleo-exploitation-campaign/

Response headers

strict-transport-security
max-age=15768000; includeSubDomains
vary
User-Agent
cache-control
max-age=31536000, public
expires
Mon, 27 Jan 2025 11:46:40 GMT
accept-ranges
bytes
content-length
1254
date
Mon, 30 Dec 2024 11:33:20 GMT
content-type
image/png
last-modified
Sun, 19 May 2024 12:05:35 GMT
server
LiteSpeed
x-powered-by
Exabytes, PleskLin
analysis.png
www.hendryadrian.com/wp-content/uploads/2024/03/ 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.hendryadrian.com/wp-content/uploads/2024/03/analysis.png
Requested by
Host: www.hendryadrian.com
URL: https://www.hendryadrian.com/modular-java-backdoor-dropped-in-cleo-exploitation-campaign/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
103.229.73.62 , Indonesia, ASN136170 (EXBCOID-AS-AP PT. EXABYTES NETWORK INDONESIA, ID),
Reverse DNS
sp132.idcloudhosting.cloud
Software
LiteSpeed / Exabytes, PleskLin
Resource Hash
e5a220e6f5b4678463da5b689049a8c47369d039f8b550ddd6e8130de4db84b7
Security Headers
Name Value
Strict-Transport-Security max-age=15768000; includeSubDomains

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.hendryadrian.com/modular-java-backdoor-dropped-in-cleo-exploitation-campaign/

Response headers

strict-transport-security
max-age=15768000; includeSubDomains
vary
User-Agent
cache-control
max-age=31536000, public
expires
Mon, 27 Jan 2025 11:46:40 GMT
accept-ranges
bytes
content-length
1309
date
Mon, 30 Dec 2024 11:33:20 GMT
content-type
image/png
last-modified
Sun, 19 May 2024 12:05:35 GMT
server
LiteSpeed
x-powered-by
Exabytes, PleskLin
cyber-security.png
www.hendryadrian.com/wp-content/uploads/2024/03/ 		968 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.hendryadrian.com/wp-content/uploads/2024/03/cyber-security.png
Requested by
Host: www.hendryadrian.com
URL: https://www.hendryadrian.com/modular-java-backdoor-dropped-in-cleo-exploitation-campaign/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
103.229.73.62 , Indonesia, ASN136170 (EXBCOID-AS-AP PT. EXABYTES NETWORK INDONESIA, ID),
Reverse DNS
sp132.idcloudhosting.cloud
Software
LiteSpeed / Exabytes, PleskLin
Resource Hash
ad73b8c73f8b64b5017fb5cd4808eab8b29c151e93375b4fd99af15fd9b65b6b
Security Headers
Name Value
Strict-Transport-Security max-age=15768000; includeSubDomains

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.hendryadrian.com/modular-java-backdoor-dropped-in-cleo-exploitation-campaign/

Response headers

strict-transport-security
max-age=15768000; includeSubDomains
vary
User-Agent
cache-control
max-age=31536000, public
expires
Mon, 27 Jan 2025 11:46:40 GMT
accept-ranges
bytes
content-length
968
date
Mon, 30 Dec 2024 11:33:20 GMT
content-type
image/png
last-modified
Sun, 19 May 2024 12:05:38 GMT
server
LiteSpeed
x-powered-by
Exabytes, PleskLin
attention_6935729.png
www.hendryadrian.com/wp-content/uploads/2024/03/ 		1006 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.hendryadrian.com/wp-content/uploads/2024/03/attention_6935729.png
Requested by
Host: www.hendryadrian.com
URL: https://www.hendryadrian.com/modular-java-backdoor-dropped-in-cleo-exploitation-campaign/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
103.229.73.62 , Indonesia, ASN136170 (EXBCOID-AS-AP PT. EXABYTES NETWORK INDONESIA, ID),
Reverse DNS
sp132.idcloudhosting.cloud
Software
LiteSpeed / Exabytes, PleskLin
Resource Hash
1099d8bbd3926371812fd2bac05241d4962b3be4e01b2d0977e8c4a7e43f6d8b
Security Headers
Name Value
Strict-Transport-Security max-age=15768000; includeSubDomains

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.hendryadrian.com/modular-java-backdoor-dropped-in-cleo-exploitation-campaign/

Response headers

strict-transport-security
max-age=15768000; includeSubDomains
vary
User-Agent
cache-control
max-age=31536000, public
expires
Mon, 27 Jan 2025 11:46:40 GMT
accept-ranges
bytes
content-length
1006
date
Mon, 30 Dec 2024 11:33:20 GMT
content-type
image/png
last-modified
Sun, 19 May 2024 12:05:27 GMT
server
LiteSpeed
x-powered-by
Exabytes, PleskLin
web-analytics.png
www.hendryadrian.com/wp-content/uploads/2024/03/ 		930 B
966 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.hendryadrian.com/wp-content/uploads/2024/03/web-analytics.png
Requested by
Host: www.hendryadrian.com
URL: https://www.hendryadrian.com/modular-java-backdoor-dropped-in-cleo-exploitation-campaign/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
103.229.73.62 , Indonesia, ASN136170 (EXBCOID-AS-AP PT. EXABYTES NETWORK INDONESIA, ID),
Reverse DNS
sp132.idcloudhosting.cloud
Software
LiteSpeed / Exabytes, PleskLin
Resource Hash
cbce4e75f4f79414d9b3dd00c5559eb5b8ec5c3ef24e494f764abf6cccfe1b3d
Security Headers
Name Value
Strict-Transport-Security max-age=15768000; includeSubDomains

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.hendryadrian.com/modular-java-backdoor-dropped-in-cleo-exploitation-campaign/

Response headers

strict-transport-security
max-age=15768000; includeSubDomains
vary
User-Agent
cache-control
max-age=31536000, public
expires
Mon, 27 Jan 2025 11:46:40 GMT
accept-ranges
bytes
content-length
930
date
Mon, 30 Dec 2024 11:33:20 GMT
content-type
image/png
last-modified
Sun, 19 May 2024 12:05:38 GMT
server
LiteSpeed
x-powered-by
Exabytes, PleskLin
hacked_7921006.png
www.hendryadrian.com/wp-content/uploads/2024/04/ 		867 B
968 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.hendryadrian.com/wp-content/uploads/2024/04/hacked_7921006.png
Requested by
Host: www.hendryadrian.com
URL: https://www.hendryadrian.com/modular-java-backdoor-dropped-in-cleo-exploitation-campaign/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
103.229.73.62 , Indonesia, ASN136170 (EXBCOID-AS-AP PT. EXABYTES NETWORK INDONESIA, ID),
Reverse DNS
sp132.idcloudhosting.cloud
Software
LiteSpeed / Exabytes, PleskLin
Resource Hash
d110145af85007f352735e6a3f54cabbb381b7811d0c1345b04fd4a8637f38e9
Security Headers
Name Value
Strict-Transport-Security max-age=15768000; includeSubDomains

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.hendryadrian.com/modular-java-backdoor-dropped-in-cleo-exploitation-campaign/

Response headers

strict-transport-security
max-age=15768000; includeSubDomains
vary
User-Agent
cache-control
max-age=31536000, public
expires
Mon, 27 Jan 2025 11:46:40 GMT
accept-ranges
bytes
content-length
867
date
Mon, 30 Dec 2024 11:33:20 GMT
content-type
image/png
last-modified
Sun, 19 May 2024 12:01:54 GMT
server
LiteSpeed
x-powered-by
Exabytes, PleskLin
inbox.png
www.hendryadrian.com/wp-content/uploads/2024/03/ 		429 B
488 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.hendryadrian.com/wp-content/uploads/2024/03/inbox.png
Requested by
Host: www.hendryadrian.com
URL: https://www.hendryadrian.com/modular-java-backdoor-dropped-in-cleo-exploitation-campaign/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
103.229.73.62 , Indonesia, ASN136170 (EXBCOID-AS-AP PT. EXABYTES NETWORK INDONESIA, ID),
Reverse DNS
sp132.idcloudhosting.cloud
Software
LiteSpeed / Exabytes, PleskLin
Resource Hash
d2d1ae29b8701898717395a1d5781f06bcffc8ed105bba802be1230597274664
Security Headers
Name Value
Strict-Transport-Security max-age=15768000; includeSubDomains

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.hendryadrian.com/modular-java-backdoor-dropped-in-cleo-exploitation-campaign/

Response headers

strict-transport-security
max-age=15768000; includeSubDomains
vary
User-Agent
cache-control
max-age=31536000, public
expires
Mon, 27 Jan 2025 11:46:40 GMT
accept-ranges
bytes
content-length
429
date
Mon, 30 Dec 2024 11:33:20 GMT
content-type
image/png
last-modified
Sun, 19 May 2024 12:05:36 GMT
server
LiteSpeed
x-powered-by
Exabytes, PleskLin
medium-2.png
www.hendryadrian.com/wp-content/uploads/2024/03/ 		437 B
515 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.hendryadrian.com/wp-content/uploads/2024/03/medium-2.png
Requested by
Host: www.hendryadrian.com
URL: https://www.hendryadrian.com/modular-java-backdoor-dropped-in-cleo-exploitation-campaign/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
103.229.73.62 , Indonesia, ASN136170 (EXBCOID-AS-AP PT. EXABYTES NETWORK INDONESIA, ID),
Reverse DNS
sp132.idcloudhosting.cloud
Software
LiteSpeed / Exabytes, PleskLin
Resource Hash
15f31ae23851f7c5e13317c6d9b6f4459a9b405ca5be4bb57d02ac9a0adad75c
Security Headers
Name Value
Strict-Transport-Security max-age=15768000; includeSubDomains

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.hendryadrian.com/modular-java-backdoor-dropped-in-cleo-exploitation-campaign/

Response headers

strict-transport-security
max-age=15768000; includeSubDomains
vary
User-Agent
cache-control
max-age=31536000, public
expires
Mon, 27 Jan 2025 11:46:40 GMT
accept-ranges
bytes
content-length
437
date
Mon, 30 Dec 2024 11:33:20 GMT
content-type
image/png
last-modified
Sun, 19 May 2024 12:03:40 GMT
server
LiteSpeed
x-powered-by
Exabytes, PleskLin
youtube-1.png
www.hendryadrian.com/wp-content/uploads/2024/03/ 		541 B
604 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.hendryadrian.com/wp-content/uploads/2024/03/youtube-1.png
Requested by
Host: www.hendryadrian.com
URL: https://www.hendryadrian.com/modular-java-backdoor-dropped-in-cleo-exploitation-campaign/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
103.229.73.62 , Indonesia, ASN136170 (EXBCOID-AS-AP PT. EXABYTES NETWORK INDONESIA, ID),
Reverse DNS
sp132.idcloudhosting.cloud
Software
LiteSpeed / Exabytes, PleskLin
Resource Hash
26e4ca182296729a48bb46622024d776370ae0a843a67463e1147a1922ced829
Security Headers
Name Value
Strict-Transport-Security max-age=15768000; includeSubDomains

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.hendryadrian.com/modular-java-backdoor-dropped-in-cleo-exploitation-campaign/

Response headers

strict-transport-security
max-age=15768000; includeSubDomains
vary
User-Agent
cache-control
max-age=31536000, public
expires
Mon, 27 Jan 2025 11:46:40 GMT
accept-ranges
bytes
content-length
541
date
Mon, 30 Dec 2024 11:33:20 GMT
content-type
image/png
last-modified
Sun, 19 May 2024 12:03:42 GMT
server
LiteSpeed
x-powered-by
Exabytes, PleskLin
google.png
www.hendryadrian.com/wp-content/uploads/2024/03/ 		864 B
922 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.hendryadrian.com/wp-content/uploads/2024/03/google.png
Requested by
Host: www.hendryadrian.com
URL: https://www.hendryadrian.com/modular-java-backdoor-dropped-in-cleo-exploitation-campaign/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
103.229.73.62 , Indonesia, ASN136170 (EXBCOID-AS-AP PT. EXABYTES NETWORK INDONESIA, ID),
Reverse DNS
sp132.idcloudhosting.cloud
Software
LiteSpeed / Exabytes, PleskLin
Resource Hash
60ed561088324e111cf4bf61b15b95c7a747eb317cd37bc7ce313a6b1b599f90
Security Headers
Name Value
Strict-Transport-Security max-age=15768000; includeSubDomains

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.hendryadrian.com/modular-java-backdoor-dropped-in-cleo-exploitation-campaign/

Response headers

strict-transport-security
max-age=15768000; includeSubDomains
vary
User-Agent
cache-control
max-age=31536000, public
expires
Mon, 27 Jan 2025 11:46:40 GMT
accept-ranges
bytes
content-length
864
date
Mon, 30 Dec 2024 11:33:20 GMT
content-type
image/png
last-modified
Sun, 19 May 2024 12:05:37 GMT
server
LiteSpeed
x-powered-by
Exabytes, PleskLin
telegram.png
www.hendryadrian.com/wp-content/uploads/2024/03/ 		846 B
881 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.hendryadrian.com/wp-content/uploads/2024/03/telegram.png
Requested by
Host: www.hendryadrian.com
URL: https://www.hendryadrian.com/modular-java-backdoor-dropped-in-cleo-exploitation-campaign/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
103.229.73.62 , Indonesia, ASN136170 (EXBCOID-AS-AP PT. EXABYTES NETWORK INDONESIA, ID),
Reverse DNS
sp132.idcloudhosting.cloud
Software
LiteSpeed / Exabytes, PleskLin
Resource Hash
51df2d7453a3b876ee85045f84afe48791400b424fd98b38db129285ded30b1c
Security Headers
Name Value
Strict-Transport-Security max-age=15768000; includeSubDomains

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.hendryadrian.com/modular-java-backdoor-dropped-in-cleo-exploitation-campaign/

Response headers

strict-transport-security
max-age=15768000; includeSubDomains
vary
User-Agent
cache-control
max-age=31536000, public
expires
Mon, 27 Jan 2025 11:46:40 GMT
accept-ranges
bytes
content-length
846
date
Mon, 30 Dec 2024 11:33:20 GMT
content-type
image/png
last-modified
Sun, 19 May 2024 12:05:36 GMT
server
LiteSpeed
x-powered-by
Exabytes, PleskLin
show_ads_impl_with_ama_fy2021.js
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202412090101/ 		435 KB
145 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202412090101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-7391999098984836&plah=www.hendryadrian.com
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-7391999098984836&host=ca-host-pub-2644536267352236
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
216.58.206.34 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
mil07s07-in-f2.1e100.net
Software
cafe /
Resource Hash
3fc196bba8c6c2880ce6f4a645dadc488bc638aa11e789c32a616709dc7b05a7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.hendryadrian.com/

Response headers

content-encoding
br
etag
16942698977871213599
x-content-type-options
nosniff
expires
Mon, 30 Dec 2024 11:33:27 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date
Mon, 30 Dec 2024 11:33:27 GMT
content-type
text/javascript; charset=UTF-8
vary
Accept-Encoding
content-disposition
attachment; filename="f.txt"
cache-control
private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
content-length
148015
x-xss-protection
0
server
cafe
en-us.svg
www.hendryadrian.com/wp-content/plugins/gtranslate/flags/svg/ 		6 KB
976 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.hendryadrian.com/wp-content/plugins/gtranslate/flags/svg/en-us.svg
Requested by
Host: www.hendryadrian.com
URL: https://www.hendryadrian.com/modular-java-backdoor-dropped-in-cleo-exploitation-campaign/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
103.229.73.62 , Indonesia, ASN136170 (EXBCOID-AS-AP PT. EXABYTES NETWORK INDONESIA, ID),
Reverse DNS
sp132.idcloudhosting.cloud
Software
LiteSpeed / Exabytes, PleskLin
Resource Hash
1c64c14fa68916dba409ddf0e38ca5dc8bd262b959a5814ecb6667096b35efa5
Security Headers
Name Value
Strict-Transport-Security max-age=15768000; includeSubDomains

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.hendryadrian.com/modular-java-backdoor-dropped-in-cleo-exploitation-campaign/

Response headers

strict-transport-security
max-age=15768000; includeSubDomains
cache-control
public, max-age=2420000
content-encoding
br
expires
Mon, 27 Jan 2025 11:46:40 GMT
accept-ranges
bytes
content-length
887
date
Mon, 30 Dec 2024 11:33:20 GMT
content-type
image/svg+xml
last-modified
Wed, 18 Sep 2024 23:21:57 GMT
vary
Accept-Encoding,User-Agent
server
LiteSpeed
x-powered-by
Exabytes, PleskLin
wp-emoji-release.min.js
www.hendryadrian.com/wp-includes/js/ 		18 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.hendryadrian.com/wp-includes/js/wp-emoji-release.min.js?ver=6.7.1
Requested by
Host: www.hendryadrian.com
URL: https://www.hendryadrian.com/modular-java-backdoor-dropped-in-cleo-exploitation-campaign/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
103.229.73.62 , Indonesia, ASN136170 (EXBCOID-AS-AP PT. EXABYTES NETWORK INDONESIA, ID),
Reverse DNS
sp132.idcloudhosting.cloud
Software
LiteSpeed / Exabytes, PleskLin
Resource Hash
4e6ce5444c7f396cef0eb1fa3611034151e485dd06fbe5573a5583e1eebc98c3
Security Headers
Name Value
Strict-Transport-Security max-age=15768000; includeSubDomains

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.hendryadrian.com/modular-java-backdoor-dropped-in-cleo-exploitation-campaign/

Response headers

strict-transport-security
max-age=15768000; includeSubDomains
cache-control
max-age=31536000, public
content-encoding
br
expires
Mon, 27 Jan 2025 11:46:40 GMT
accept-ranges
bytes
content-length
4676
date
Mon, 30 Dec 2024 11:33:20 GMT
content-type
application/javascript
last-modified
Wed, 03 Apr 2024 02:56:06 GMT
vary
Accept-Encoding,User-Agent,Accept-Encoding,Accept-Encoding
server
LiteSpeed
x-powered-by
Exabytes, PleskLin
truncated
/ 		270 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
2f0e74ef11fded5b721296335b5fe6eb516cfee12091deb90bfd4f35fec3f1c1

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

Content-Type
image/svg+xml
collect
region1.google-analytics.com/g/ 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://region1.google-analytics.com/g/collect?v=2&tid=G-4BNSY0J9XG&gtm=45Pe4cc1v9177941614za200&_p=1735558407483&gcd=13l3l3l2l1l1&npa=1&dma_cps=syphamo&dma=1&tag_exp=101925629~102067555~102067808~102081485~102198178&gdid=dZTNiMT&cid=762092154.1735558408&ul=pt-pt&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&sid=1735558407&sct=1&seg=0&dl=https%3A%2F%2Fwww.hendryadrian.com%2Fmodular-java-backdoor-dropped-in-cleo-exploitation-campaign%2F&dt=Modular%20Java%20Backdoor%20Dropped%20in%20Cleo%20Exploitation%20Campaign%20%E2%80%93%20Cyber%20Security%20News%20Aggregator&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&ep.googlesitekit_post_type=post&tfd=2501
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=GT-P85KW66Q
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
216.239.32.36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.hendryadrian.com/

Response headers

cache-control
no-cache, no-store, must-revalidate
pragma
no-cache
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
content-security-policy-report-only
script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:86:0
report-to
{"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:86:0"}],}
expires
Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin
https://www.hendryadrian.com
cross-origin-opener-policy-report-only
same-origin; report-to=coop_reporting
content-length
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Mon, 30 Dec 2024 11:33:28 GMT
content-type
text/plain
server
Golfe2
ca-pub-7391999098984836
fundingchoicesmessages.google.com/i/ 		197 KB
65 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://fundingchoicesmessages.google.com/i/ca-pub-7391999098984836?href=https%3A%2F%2Fwww.hendryadrian.com%2Fmodular-java-backdoor-dropped-in-cleo-exploitation-campaign&ers=2
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202412090101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-7391999098984836&plah=www.hendryadrian.com
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.185.238 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s53-in-f14.1e100.net
Software
ESF /
Resource Hash
fdc06d13647ffa96876ae3bdb52b4e63c7b0286c2f294cf840a8839a9bff8d4a
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-aL1jpwXmBrjtghdmqPNy8Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.hendryadrian.com/

Response headers

content-encoding
gzip
x-content-type-options
nosniff
expires
Mon, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Mon, 30 Dec 2024 11:33:28 GMT
content-type
application/javascript; charset=utf-8
x-frame-options
SAMEORIGIN
reporting-endpoints
default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjKtDikmJw0JBikPj6kkkDiJ3SZ7AGAXHrzXOsU4HYaO15VicgTvp3nrUIiA0VLrE6gnDRJVZPIFbtucRqCsT3111ifQ7EH-ovs_4A4hnnL7MuAOIiiSusTUDM8PUKKwcQC_FwdHSd2s0msGDPm-2MShpJ-YXxyfl5JUWZSaUl-UVpyWmpxalFZalF8UYGRiaGRoZGegaG8QUGAIBgRWg"
content-security-policy
script-src 'report-sample' 'nonce-aL1jpwXmBrjtghdmqPNy8Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
cache-control
no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin
*
cross-origin-opener-policy
same-origin
pragma
no-cache
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy
cross-origin
permissions-policy
ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection
0
server
ESF
AGSKWxVkaHhqRF3JNfaJ-1ZwpMP3okkbL-ch-xUbP1krn9-LhHIOd8eHTtjIhAeV46u3YT1xl4FV2X79lib1YLKPaI_M1eprKbY_L7i-xRkTr9Zh6MYSSB2-Ec30f-IOoLewdMF_zPiYZw==
fundingchoicesmessages.google.com/f/ 		402 KB
62 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://fundingchoicesmessages.google.com/f/AGSKWxVkaHhqRF3JNfaJ-1ZwpMP3okkbL-ch-xUbP1krn9-LhHIOd8eHTtjIhAeV46u3YT1xl4FV2X79lib1YLKPaI_M1eprKbY_L7i-xRkTr9Zh6MYSSB2-Ec30f-IOoLewdMF_zPiYZw==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzM1NTU4NDA4LDU2MzAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzddXSwiaHR0cHM6Ly93d3cuaGVuZHJ5YWRyaWFuLmNvbS9tb2R1bGFyLWphdmEtYmFja2Rvb3ItZHJvcHBlZC1pbi1jbGVvLWV4cGxvaXRhdGlvbi1jYW1wYWlnbi8iLG51bGwsW1s4LCJJTXo1N3ljNWhWdyJdLFs5LCJwdC1QVCJdLFsxOSwiMSJdXV0
Requested by
Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.pt_PT.IMz57yc5hVw.es5.O/am=DAY/d=1/rs=AJlcJMxPkJ8-z0NIHVIV3zOye7kPdDw5wA/m=kernel_loader,loader_js_executable
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.185.238 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s53-in-f14.1e100.net
Software
ESF /
Resource Hash
0f8a6b809107aaeb0b280c57f52350637be712a10ae1234537a3de05e711a3e4
Security Headers
Name Value
Content-Security-Policy require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-0LmKKdH6fN8NKOEOW-zMHA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.hendryadrian.com/

Response headers

content-encoding
gzip
x-content-type-options
nosniff
expires
Mon, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Mon, 30 Dec 2024 11:33:28 GMT
content-type
application/javascript; charset=utf-8
x-frame-options
SAMEORIGIN
reporting-endpoints
default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjKtDikmLw1pBikPj6kkkDiJ3SZ7AGAXHrzXOsU4HYaO15VicgTvp3nrUIiA0VLrE6gnDRJVZPIFbtucRqCsT3111ifQ7EH-ovs_4A4hnnL7MuAOIiiSusTUDM8PUKKwcQC_FwdHSd2s0msODDiu1MShpJ-YXxyfl5JUWZSaUl-UVpyWmpxalFZalF8UYGRiaGRoZGegaG8QUGAIT7RWQ"
content-security-policy
require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-0LmKKdH6fN8NKOEOW-zMHA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
cache-control
no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin
*
cross-origin-opener-policy
same-origin
pragma
no-cache
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy
cross-origin
permissions-policy
ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection
0
server
ESF
css
fonts.googleapis.com/ 		114 KB
6 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Archivo:400,500|Arimo:400,500|Bitter:400,500|EB+Garamond:400,500|Lato|Libre+Baskervill|Libre+Franklin:400,500|Lora:400,500|Google+Sans_old:regular,medium:400,500|Material+Icons|Google+Symbols|Merriweather|Montserrat:400,500|Mukta:400,500|Muli:400,500|Nunito:400,500|Open+Sans:400,500,600|Open+Sans+Condensed:400,600|Oswald:500|Playfair+Display:400,500|Poppins:400,500|Raleway:400,500|Roboto_old:400,500|Roboto+Condensed:400,500|Roboto+Slab:400,500|Slabo+27px|Source+Sans+Pro|Ubuntu:400,500|Volkhov&display=swap
Requested by
Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.pt_PT.IMz57yc5hVw.es5.O/d=1/exm=kernel_loader,loader_js_executable/ed=1/rs=AJlcJMwUG_wIDOABh2cOyOjgXShwjBgs6Q/m=web_iab_tcf_v2_wall_executable
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.185.202 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s52-in-f10.1e100.net
Software
ESF /
Resource Hash
892fdb2e5c44c5f901e7afb124ce07e4522e72ac445492eb8e4570e11aa56457
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.hendryadrian.com/

Response headers

content-encoding
gzip
x-content-type-options
nosniff
expires
Mon, 30 Dec 2024 11:33:28 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Mon, 30 Dec 2024 11:33:28 GMT
content-type
text/css; charset=utf-8
vary
Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
last-modified
Mon, 30 Dec 2024 11:33:28 GMT
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=31536000
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
cross-origin-opener-policy
same-origin-allow-popups
cross-origin-resource-policy
cross-origin
access-control-allow-origin
*
x-xss-protection
0
server
ESF
memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v40/ 		47 KB
47 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
Requested by
Host: www.hendryadrian.com
URL: https://www.hendryadrian.com/modular-java-backdoor-dropped-in-cleo-exploitation-campaign/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.185.131 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s50-in-f3.1e100.net
Software
sffe /
Resource Hash
3c4d6a1421c7ddb7e404521fe8c4cd5be5af446d7689cd880be26612eaad3cfa
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin
https://www.hendryadrian.com
Referer
https://www.hendryadrian.com/

Response headers

age
567245
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options
nosniff
expires
Tue, 23 Dec 2025 21:59:23 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Mon, 23 Dec 2024 21:59:23 GMT
last-modified
Thu, 14 Dec 2023 02:08:40 GMT
content-type
font/woff2
cache-control
public, max-age=31536000
timing-allow-origin
*
cross-origin-opener-policy
same-origin; report-to="apps-themes"
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges
bytes
access-control-allow-origin
*
content-length
48236
x-xss-protection
0
server
sffe
AGSKWxWesFj9qF44BKIBnYf7E4G-o0Q48TUoUxNRsX1ke7LZVAsPcUrJfPAZMfUoM20R-A5zdz5ZIfldKBtDNBxXye9nnNZlrzR7maBxML2VvYJlkQT2xtfh1xc05-sQ5RGDQ_txhBRfKA==
fundingchoicesmessages.google.com/el/ 		0
28 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://fundingchoicesmessages.google.com/el/AGSKWxWesFj9qF44BKIBnYf7E4G-o0Q48TUoUxNRsX1ke7LZVAsPcUrJfPAZMfUoM20R-A5zdz5ZIfldKBtDNBxXye9nnNZlrzR7maBxML2VvYJlkQT2xtfh1xc05-sQ5RGDQ_txhBRfKA==
Requested by
Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.pt_PT.IMz57yc5hVw.es5.O/am=DAY/d=1/rs=AJlcJMxPkJ8-z0NIHVIV3zOye7kPdDw5wA/m=kernel_loader,loader_js_executable
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.185.238 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s53-in-f14.1e100.net
Software
ESF /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-qW07P29R7EWykj2OYbz2kw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type
text/plain
Referer
https://www.hendryadrian.com/

Response headers

access-control-max-age
86400
access-control-allow-methods
POST, GET, OPTIONS
x-content-type-options
nosniff
expires
Mon, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Mon, 30 Dec 2024 11:33:28 GMT
content-type
text/html; charset=utf-8
x-frame-options
SAMEORIGIN
reporting-endpoints
default="/_/ContributorLoggingHttp/web-reports?context=eJzjUtDikmLw15BicEqfwRoCxB_qL7P-AGKGr1dYOYBYiIejo-vUbjaBC6eO7GZWcknKL4xPzs8rSc0r0U1MKdYFsYsyk0pL8otQ2KllIBU5-enpmXnp8UYGRiaGRoZGegZm8QUGAP2mKus"
content-security-policy
script-src 'report-sample' 'nonce-qW07P29R7EWykj2OYbz2kw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
cache-control
no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy
same-origin
pragma
no-cache
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials
true
permissions-policy
ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin
https://www.hendryadrian.com
content-length
0
x-xss-protection
0
server
ESF
AGSKWxWesFj9qF44BKIBnYf7E4G-o0Q48TUoUxNRsX1ke7LZVAsPcUrJfPAZMfUoM20R-A5zdz5ZIfldKBtDNBxXye9nnNZlrzR7maBxML2VvYJlkQT2xtfh1xc05-sQ5RGDQ_txhBRfKA==
fundingchoicesmessages.google.com/el/ 		0
28 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://fundingchoicesmessages.google.com/el/AGSKWxWesFj9qF44BKIBnYf7E4G-o0Q48TUoUxNRsX1ke7LZVAsPcUrJfPAZMfUoM20R-A5zdz5ZIfldKBtDNBxXye9nnNZlrzR7maBxML2VvYJlkQT2xtfh1xc05-sQ5RGDQ_txhBRfKA==
Requested by
Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.pt_PT.IMz57yc5hVw.es5.O/am=DAY/d=1/rs=AJlcJMxPkJ8-z0NIHVIV3zOye7kPdDw5wA/m=kernel_loader,loader_js_executable
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.185.238 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s53-in-f14.1e100.net
Software
ESF /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Content-Security-Policy require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-EK9o-JOjAfu8jmojrQF4qQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type
text/plain
Referer
https://www.hendryadrian.com/

Response headers

access-control-max-age
86400
access-control-allow-methods
POST, GET, OPTIONS
x-content-type-options
nosniff
expires
Mon, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Mon, 30 Dec 2024 11:33:28 GMT
content-type
text/html; charset=utf-8
x-frame-options
SAMEORIGIN
reporting-endpoints
default="/_/ContributorLoggingHttp/web-reports?context=eJzjUtDikmII1pBicEqfwRoCxB_qL7P-AGKGr1dYOYBYiIejo-vUbjaBDx0fjjIruSTlF8Yn5-eVpOaV6CamFOuC2EWZSaUl-UUo7NQykIqc_PT0zLz0eCMDIxNDI0MjPQOz-AIDAAUdKwM"
content-security-policy
require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-EK9o-JOjAfu8jmojrQF4qQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
cache-control
no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy
same-origin
pragma
no-cache
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials
true
permissions-policy
ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin
https://www.hendryadrian.com
content-length
0
x-xss-protection
0
server
ESF
pxiByp8kv8JHgFVrLGT9Z1xlFQ.woff2
fonts.gstatic.com/s/poppins/v22/ 		8 KB
8 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/poppins/v22/pxiByp8kv8JHgFVrLGT9Z1xlFQ.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Archivo:400,500|Arimo:400,500|Bitter:400,500|EB+Garamond:400,500|Lato|Libre+Baskervill|Libre+Franklin:400,500|Lora:400,500|Google+Sans_old:regular,medium:400,500|Material+Icons|Google+Symbols|Merriweather|Montserrat:400,500|Mukta:400,500|Muli:400,500|Nunito:400,500|Open+Sans:400,500,600|Open+Sans+Condensed:400,600|Oswald:500|Playfair+Display:400,500|Poppins:400,500|Raleway:400,500|Roboto_old:400,500|Roboto+Condensed:400,500|Roboto+Slab:400,500|Slabo+27px|Source+Sans+Pro|Ubuntu:400,500|Volkhov&display=swap
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.185.131 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s50-in-f3.1e100.net
Software
sffe /
Resource Hash
cd36de204aca2d5fa263a731f7c20009b5e3d754ba1f1e03c33e93a48f3e7446
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin
https://www.hendryadrian.com
Referer
https://fonts.googleapis.com/

Response headers

age
527696
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options
nosniff
expires
Wed, 24 Dec 2025 08:58:32 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Tue, 24 Dec 2024 08:58:32 GMT
last-modified
Wed, 04 Dec 2024 06:54:05 GMT
content-type
font/woff2
cache-control
public, max-age=31536000
timing-allow-origin
*
cross-origin-opener-policy
same-origin; report-to="apps-themes"
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges
bytes
access-control-allow-origin
*
content-length
7748
x-xss-protection
0
server
sffe
cropped-photo_6264509117943102959_x-32x32.jpg
www.hendryadrian.com/wp-content/uploads/2024/02/ 		764 B
877 B 		Other
General
Check archive.org
Download Go to
Full URL
https://www.hendryadrian.com/wp-content/uploads/2024/02/cropped-photo_6264509117943102959_x-32x32.jpg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
103.229.73.62 , Indonesia, ASN136170 (EXBCOID-AS-AP PT. EXABYTES NETWORK INDONESIA, ID),
Reverse DNS
sp132.idcloudhosting.cloud
Software
LiteSpeed / Exabytes, PleskLin
Resource Hash
495fcd8958236ec0efa7160c0b51303580f949cf53bfcd9eafa642e93210b1ae
Security Headers
Name Value
Strict-Transport-Security max-age=15768000; includeSubDomains

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.hendryadrian.com/modular-java-backdoor-dropped-in-cleo-exploitation-campaign/

Response headers

strict-transport-security
max-age=15768000; includeSubDomains
vary
User-Agent
cache-control
max-age=31536000, public
expires
Mon, 27 Jan 2025 11:46:41 GMT
accept-ranges
bytes
content-length
764
date
Mon, 30 Dec 2024 11:33:21 GMT
content-type
image/jpeg
last-modified
Sun, 19 May 2024 12:05:59 GMT
server
LiteSpeed
x-powered-by
Exabytes, PleskLin

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
www.hendryadrian.com
URL
blob:https://www.hendryadrian.com/33b627c6-4c29-4c44-a977-a6c85df95c25
Domain
cdnjs.buymeacoffee.com
URL
https://cdnjs.buymeacoffee.com/1.0.0/button.prod.min.js

Verdicts & Comments Add Verdict or Comment

76 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 object| 3 object| 4 object| 5 object| _wpemojiSettings function| jQuery function| gtag object| dataLayer object| title object| nav_tag function| EvEmitter function| imagesLoaded function| jQueryBridget function| getSize function| matchesSelector object| fizzyUIUtils function| Outlayer function| Masonry object| IvorySearchVars function| ivory_search_analytics object| gtranslateSettings object| IvoryAjaxVars function| IVS_AJAX_JS_LOAD function| SimpleBar object| google_js_reporting_queue number| google_srt object| google_logging_queue object| google_ad_modifications object| ggeac object| google_persistent_state_async object| google_tag_data object| google_reactive_ads_global_state object| adsbygoogle object| google_sa_queue function| google_process_slots object| google_ama_state function| google_spfd number| google_unique_id object| google_sv_map number| google_rum_task_id_counter string| google_user_agent_client_hint function| doGTranslate function| googleTranslateElementInit2 function| goToTop object| google_tag_manager function| onYouTubeIframeAPIReady object| gaGlobal object| twemoji object| wp function| google_sa_impl object| googlefc boolean| adsbygoogle_ama_fc_has_run object| googPageScrollPreventerInfo boolean| googFloatingToolbarManagerAsyncPositionUpdate object| default_ContributorServingResponseClientJs object| _F_toggles object| __googlefc string| __fcInvoked string| __fcexpdef string| ZTNhMzU3YWFlMWM5NDJhN2xvYWRlcl9qcw== string| ZTNhMzU3YWFlMWM5NDJhN2NhY2hlZF9qcw== object| __fcInternalApiManager boolean| __fcInternalApiPostMessageReady object| __tcfapiEventListeners function| __tcfapi object| __tcfapiManager boolean| __tcfapiPostMessageReady function| __uspapi object| __uspapiManager boolean| __uspapiPostMessageReady object| __gppEventListeners function| __gpp object| __gppManager boolean| __gppPostMessageReady

2 Cookies

Domain/Path Name / Value
.hendryadrian.com/ Name: _ga_4BNSY0J9XG
Value: GS1.1.1735558407.1.0.1735558407.0.0.0
.hendryadrian.com/ Name: _ga
Value: GA1.1.762092154.1735558408

1 Console Messages

Source Level URL
Text
network error URL: https://cdnjs.buymeacoffee.com/1.0.0/button.prod.min.js
Message:
Failed to load resource: net::ERR_BLOCKED_BY_RESPONSE.NotSameOrigin

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=15768000; includeSubDomains

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

blog.rapid7.com
cdnjs.buymeacoffee.com
fonts.googleapis.com
fonts.gstatic.com
fundingchoicesmessages.google.com
pagead2.googlesyndication.com
region1.google-analytics.com
www.googletagmanager.com
www.hendryadrian.com
cdnjs.buymeacoffee.com
www.hendryadrian.com
103.229.73.62
13.32.121.83
142.250.185.131
142.250.185.202
142.250.185.232
142.250.185.238
216.239.32.36
216.58.206.34
01d7c9a6f7c2b8c9290aba44c16c812337398880d14cfcbbb402fd7b153661b1
0f8a6b809107aaeb0b280c57f52350637be712a10ae1234537a3de05e711a3e4
108cd01e5eaa34e9942ca8af9f8fe70271d3a3a5028fa085c628c162c3706d2d
1099d8bbd3926371812fd2bac05241d4962b3be4e01b2d0977e8c4a7e43f6d8b
15f31ae23851f7c5e13317c6d9b6f4459a9b405ca5be4bb57d02ac9a0adad75c
17aa3f396ffe9cef4e7e86e5aebac31f58e383326c6237381e223b22aa9690b0
1c64c14fa68916dba409ddf0e38ca5dc8bd262b959a5814ecb6667096b35efa5
1dedf11c8d4edbb4c6a7d3c277c806ac41cdeef6c32b9516e2e70ba29c20acec
21005d768e8a2e6112d3b5b2f05a2cd407021b147b69f94e456bbc4a82f63238
2513f76634bfde77d2f0f08cb8f9d04e3c53cc81a76831e1e99b93ee47c3aeba
26e4ca182296729a48bb46622024d776370ae0a843a67463e1147a1922ced829
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe
2f0e74ef11fded5b721296335b5fe6eb516cfee12091deb90bfd4f35fec3f1c1
316868f97d2f29e79b0fa3501b5e72f84f3f4076a47a024936553dcc49e1aeb1
3bb38d0f302677ff4104564454f60f495133579d6e6dfb722b3de850df596502
3c4d6a1421c7ddb7e404521fe8c4cd5be5af446d7689cd880be26612eaad3cfa
3fc196bba8c6c2880ce6f4a645dadc488bc638aa11e789c32a616709dc7b05a7
40167250d7f0f57ee425f6d84d9bb9c6a0fef3dba8299c6b86f869c90169e5ae
495fcd8958236ec0efa7160c0b51303580f949cf53bfcd9eafa642e93210b1ae
4e6ce5444c7f396cef0eb1fa3611034151e485dd06fbe5573a5583e1eebc98c3
51df2d7453a3b876ee85045f84afe48791400b424fd98b38db129285ded30b1c
5274f11e6fb32ae0cf2dfb9f8043272865c397a7c4223b4cfa7d50ea52fbde89
597978bca0f97e5bb3f70452c24f8a0c93db7f7229433c2a54706b85cdd39aa6
5e4d82463aa8389e0f15a7824efd4ff16c9c278bf79075a4b0b46fc156f59bec
60ed561088324e111cf4bf61b15b95c7a747eb317cd37bc7ce313a6b1b599f90
61b2ecb468216007900d30b677955d54b8cbfc7d21e7c62b052e3b107bbeb721
64af813ec7b0f71e2e9f33bfe8d8413dfbc71fb3bc0aa6b3700c8296c4a89952
6596a1e2c00a9382621eecdd04431e99c4638499a25fe64389d690a05d838a15
66d0c8cbacc09ad8746e64ad28d887186d1f060f04c388c2f1102ee346120a8c
68050132d00103b58e5dfc387574b2e9c379476798384478e32b1cda8cfae705
6b10604397cb4df6fe4c4609ae563859e41fd0977ecdc5819e71f805d7e6cc0e
820e169ce24824066d9973fd4b6561aae9dcd6dbef6435da905d5a1d6482997c
892fdb2e5c44c5f901e7afb124ce07e4522e72ac445492eb8e4570e11aa56457
9aa067574acf4c7b8d7cef4f104ea80eeb6bd8af4d1e142015d029779dcdae3e
9dbb7c43d8ec22b902e8cc4d88a4c976191adf85145fe2dd933360a941b4fafd
a346b59724a1aa134f163b9ce5ed5488dccd6777c1382c07a736acaeb6e38ada
a9957bcfdf67975a509656bd8e9c7ce92cb8807b84bc9f2d87b26e3264d45e8f
a9ddc80140c6de1c738cdc21f1142fa3d787fb873ccb1d679b47a13c7feaaaaf
ad73b8c73f8b64b5017fb5cd4808eab8b29c151e93375b4fd99af15fd9b65b6b
b65b3de1bc923b9355248a0d941a0eaee15dfb9a6b8eadb51323a8df6189dcd1
cb6f2d32c49d1c2b25e9ffc9aaafa3f83075346c01bcd4ae6eb187392a4292cf
cbce4e75f4f79414d9b3dd00c5559eb5b8ec5c3ef24e494f764abf6cccfe1b3d
cd36de204aca2d5fa263a731f7c20009b5e3d754ba1f1e03c33e93a48f3e7446
d110145af85007f352735e6a3f54cabbb381b7811d0c1345b04fd4a8637f38e9
d2402925a6c7959c06055a7c3e4328174cf7eb41e8f687b1ef48c0613b315cf8
d2d1ae29b8701898717395a1d5781f06bcffc8ed105bba802be1230597274664
d41b9d79912d8477348877d675c4943c8148fe06d427cfa658d5b6aad2f904e1
d96e147610eb5ecafe7e06313ed0c4b3808b19dee2c5a38d687f3d4ae7f896a5
deae44c5e2d8da6b1582900a4416177eb5e49abd300174cbd01d4c6bd81a22d2
e00add38134eac2fb8e8e9c09cbfff7bbe57952b210322eb2eecb0a21fc055eb
e0efa6bf2a1cbe24b5cb8aece4b7b12e0ff4270565c8d14a4b7bf7dd259bc0ad
e1457d7a711b5d6ff38cf8d64e74354a212548b489dd59ca083e59599e0d5da0
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e5a220e6f5b4678463da5b689049a8c47369d039f8b550ddd6e8130de4db84b7
e7b82cf334e70a450ecf59d4d92355d1cb408b1a95f028decb50c597ac53e42d
f0b722c48c52082cd77261574e22a5251fe37ea4b291b1441134145bab9b2063
f68d37d474952b1fbe30def1b69e63e79c46a70263433285783b69ac0107b929
fdc06d13647ffa96876ae3bdb52b4e63c7b0286c2f294cf840a8839a9bff8d4a