www.welivesecurity.com Open in urlscan Pro
2a02:26f0:3500:12::1730:17bf Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.welivesecurity.com/2017/07/04/analysis-of-telebots-cunning-backdoor/
Submission: On December 08 via manual (December 8th 2022, 12:25:40 pm UTC) from FR — Scanned from FR

Summary HTTP 71 Redirects Links 10 Behaviour Indicators

Summary

This website contacted 11 IPs in 2 countries across 8 domains to perform 71 HTTP transactions. The main IP is 2a02:26f0:3500:12::1730:17bf, located in Frankfurt am Main, Germany and belongs to AKAMAI-ASN1, NL. The main domain is www.welivesecurity.com. The Cisco Umbrella rank of the primary domain is 347812.
TLS certificate: Issued by Thawte ECC CA 2018 on October 26th 2022. Valid for: 3 months.

This is the only time www.welivesecurity.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
31	2a02:26f0:350... 2a02:26f0:3500:12::1730:17bf	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	2a00:1450:400... 2a00:1450:4001:810::2008	15169 (GOOGLE) (GOOGLE)
4	2a00:1450:400... 2a00:1450:4001:806::200e	15169 (GOOGLE) (GOOGLE)
1	18.66.97.100 18.66.97.100	16509 (AMAZON-02) (AMAZON-02)
2	199.232.192.134 199.232.192.134	54113 (FASTLY) (FASTLY)
2	2620:1ec:46::44 2620:1ec:46::44	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
2	2001:4860:480... 2001:4860:4802:32::36	15169 (GOOGLE) (GOOGLE)
18	2600:9000:20e... 2600:9000:20eb:d600:6:8656:f5c0:93a1	16509 (AMAZON-02) (AMAZON-02)
5	151.101.128.134 151.101.128.134	54113 (FASTLY) (FASTLY)
1	199.232.196.134 199.232.196.134	54113 (FASTLY) (FASTLY)
71	11

31 2a02:26f0:3500:12::1730:17bf (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

www.welivesecurity.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:810::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:806::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.66.97.100 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-66-97-100.fra56.r.cloudfront.net

cdn1.esetstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 199.232.192.134 (United States)

ASN54113 (FASTLY, US)

welivesecurity.disqus.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2620:1ec:46::44 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

cdn.esetstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2001:4860:4802:32::36 (United States)

ASN15169 (GOOGLE, US)

region1.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

18 2600:9000:20eb:d600:6:8656:f5c0:93a1 (United States)

ASN16509 (AMAZON-02, US)

c.disquscdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 151.101.128.134 (United States)

ASN54113 (FASTLY, US)

disqus.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 199.232.196.134 (United States)

ASN54113 (FASTLY, US)

referrer.disqus.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
31	welivesecurity.com www.welivesecurity.com — Cisco Umbrella Rank: 347812	722 KB
18	disquscdn.com c.disquscdn.com — Cisco Umbrella Rank: 4680	554 KB
8	disqus.com welivesecurity.disqus.com disqus.com — Cisco Umbrella Rank: 1021 referrer.disqus.com — Cisco Umbrella Rank: 6967	74 KB
6	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 26 region1.google-analytics.com — Cisco Umbrella Rank: 2554	21 KB
3	esetstatic.com cdn1.esetstatic.com — Cisco Umbrella Rank: 457819 cdn.esetstatic.com — Cisco Umbrella Rank: 534750	105 KB
2	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 47	162 KB
0	go-mpulse.net Failed s.go-mpulse.net Failed
0	msecnd.net Failed az416426.vo.msecnd.net Failed
71	8

	Domain	Requested by
31	www.welivesecurity.com	www.welivesecurity.com
18	c.disquscdn.com	welivesecurity.disqus.com disqus.com c.disquscdn.com
5	disqus.com	welivesecurity.disqus.com c.disquscdn.com
4	www.google-analytics.com	www.welivesecurity.com www.googletagmanager.com
2	region1.google-analytics.com	www.googletagmanager.com
2	cdn.esetstatic.com	www.googletagmanager.com
2	welivesecurity.disqus.com	www.welivesecurity.com
2	www.googletagmanager.com	www.welivesecurity.com www.googletagmanager.com
1	referrer.disqus.com
1	cdn1.esetstatic.com	www.welivesecurity.com
0	s.go-mpulse.net Failed	www.welivesecurity.com
0	az416426.vo.msecnd.net Failed	www.welivesecurity.com
71	12

This site contains links to these domains. Also see Links.

Domain
www.eset.com
welivesecurity.com
www.facebook.com
twitter.com
www.linkedin.com
www.virusradar.com
uk.wikipedia.org
eset.com

Subject Issuer	Validity	Valid
www.welivesecurity.com Thawte ECC CA 2018	`2022-10-26` - `2023-02-03`	3 months	crt.sh
*.google-analytics.com GTS CA 1C3	`2022-11-02` - `2023-01-25`	3 months	crt.sh
*.esetstatic.com Thawte RSA CA 2018	`2022-09-23` - `2023-10-02`	a year	crt.sh
*.disqus.com Sectigo RSA Domain Validation Secure Server CA	`2022-04-20` - `2023-04-20`	a year	crt.sh
cdn.esetstatic.com Thawte RSA CA 2018	`2022-11-11` - `2023-11-11`	a year	crt.sh
a.disquscdn.com Amazon	`2022-09-30` - `2023-10-29`	a year	crt.sh

This page contains 3 frames:

Primary Page: https://www.welivesecurity.com/2017/07/04/analysis-of-telebots-cunning-backdoor/
Frame ID: 82EFE282216E4F833E482F1AD8FC0F5C
Requests: 50 HTTP requests in this frame

Frame: https://s.go-mpulse.net/boomerang/7R9SM-QGSYF-QDLJK-UETXR-SPM6B
Frame ID: E278C8EE0515033DAAE453324CEBD01B
Requests: 1 HTTP requests in this frame

Frame: https://disqus.com/embed/comments/?base=default&f=welivesecurity&t_i=96464%20https%3A%2F%2Fba-infohub-web01-v.hq.eset.com%2F%3Fp%3D96464&t_u=https%3A%2F%2Fwww.welivesecurity.com%2F2017%2F07%2F04%2Fanalysis-of-telebots-cunning-backdoor%2F&t_e=Analysis%20of%20TeleBots%E2%80%99%20cunning%20backdoor&t_d=Analysis%20of%20TeleBots%E2%80%99%20cunning%20backdoor&t_t=Analysis%20of%20TeleBots%E2%80%99%20cunning%20backdoor&s_o=default&l=en
Frame ID: EBA2FC37990BB90854ACA3561DF07F8D
Requests: 20 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Analysis of TeleBots’ cunning backdoor | WeLiveSecurity

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

/wp-(?:content|includes)/

Yoast SEO (SEO) Expand

Overall confidence: 100%
Detected patterns

<!-- This site is optimized with the Yoast (?:WordPress )?SEO plugin v([\d.]+) -

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/ns\.html[^>]+></iframe>
googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

Page Statistics

71
Requests

96 %
HTTPS

60 %
IPv6

8
Domains

12
Subdomains

11
IPs

2
Countries

1637 kB
Transfer

3284 kB
Size

6
Cookies

10 Outgoing links

These are links going to different origins than the main page.

URL: https://www.eset.com/?utm_source=welivesecurity.com&utm_medium=referral&utm_campaign=autotagging&utm_content=ukraine-crisis-digital-security-resource-center&utm_term=en

Search URL Search Domain Scan URL

URL: http://welivesecurity.com/category/ukraine-crisis-digital-security-resource-center/
Title: Ukraine Crisis – Digital Security Resource Center

Search URL Search Domain Scan URL

URL: https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fwww.welivesecurity.com%2F2017%2F07%2F04%2Fanalysis-of-telebots-cunning-backdoor%2F

Search URL Search Domain Scan URL

URL: https://twitter.com/intent/tweet?&url=https%3A%2F%2Fwww.welivesecurity.com%2F2017%2F07%2F04%2Fanalysis-of-telebots-cunning-backdoor%2F&text=Analysis%20of%20TeleBots%E2%80%99%20cunning%20backdoor%0A&via=welivesecurity

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fwww.welivesecurity.com%2F2017%2F07%2F04%2Fanalysis-of-telebots-cunning-backdoor%2F

Search URL Search Domain Scan URL

URL: http://www.virusradar.com/en/Win32_Diskcoder.C/description
Title: Diskcoder.C

Search URL Search Domain Scan URL

URL: https://www.facebook.com/cyberpoliceua/posts/536947343096100
Title: Facebook account

Search URL Search Domain Scan URL

URL: https://uk.wikipedia.org/wiki/%D0%9A%D0%BE%D0%B4_%D0%84%D0%94%D0%A0%D0%9F%D0%9E%D0%A3
Title: Код ЄДРПОУ

Search URL Search Domain Scan URL

URL: https://eset.com/?utm_source=welivesecurity.com&utm_medium=referral&utm_campaign=autotagging&utm_content=ukraine-crisis-digital-security-resource-center&utm_term=en
Title: ESET

Search URL Search Domain Scan URL

URL: https://twitter.com/intent/tweet?https%3A%2F%2Fwww.welivesecurity.com%2F2017%2F07%2F04%2Fanalysis-of-telebots-cunning-backdoor%2F

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

71 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
www.welivesecurity.com/2017/07/04/analysis-of-telebots-cunning-backdoor/ 60 KB
20 KB 852ms
698ms Document
text/html 2a02:26f0:3500:12::1730:17bf
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.welivesecurity.com/2017/07/04/analysis-of-telebots-cunning-backdoor/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:3500:12::1730:17bf Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

34d8af20588a149e070529713e72323efe5e3bf627dc334f51e12c43a46d0f2f

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; child-src https://disqus.com https://vars.hotjar.com; connect-src 'self' http://ad.doubleclick.net https://.akamaihd.net https://.akstat.io https://.hotjar.com https://adservice.google.com https://captcha.eset.com https://cc.welivesecurity.com https://cdn.linkedin.oribi.io https://in.hotjar.com https://region1.google-analytics.com https://stats.g.doubleclick.net https://surveystats.hotjar.io https://trial-eum-clientnsv4-s.akamaihd.net https://trial-eum-clienttons-s.akamaihd.net https://vc.hotjar.io https://ws22.hotjar.com https://ws32.hotjar.com https://www.facebook.com https://www.google-analytics.com https://www.google.com https://www.googletagmanager.com https://www.opinionstage.com wss://.hotjar.com wss://ws1.hotjar.com; font-src 'self'; frame-src 'self' https://c.disquscdn.com https://disqus.com https://m.facebook.com https://platform.twitter.com https://tpc.googlesyndication.com https://vars.hotjar.com https://www.facebook.com https://www.googletagmanager.com https://www.instagram.com https://www.opinionstage.com https://www.podbean.com https://www.screencast.com https://www.slideshare.net https://www.youtube-nocookie.com https://www.youtube.com; img-src 'self' data: https://*.ads.linkedin.com https://adservice.google.com https://analytics.twitter.com https://c.disquscdn.com https://captcha.eset.com https://cdn1.esetstatic.com https://googleads.g.doubleclick.net https://px.ads.linkedin.com https://referrer.disqus.com https://region1.google-analytics.com https://script.hotjar.com https://secure.eset.com https://syndication.twitter.com https://t.co https://www.facebook.com https://www.google-analytics.com https://www.google.ad https://www.google.ae https://www.google.al https://www.google.at https://www.google.az https://www.google.ba https://www.google.be https://www.google.bf https://www.google.bg https://www.google.bj https://www.google.bs https://www.google.ca https://www.google.cd https://www.google.ch https://www.google.ci https://www.google.cl https://www.google.cm https://www.google.cn https://www.google.co.ao https://www.google.co.cr https://www.google.co.id https://www.google.co.il https://www.google.co.in https://www.google.co.jp https://www.google.co.ke https://www.google.co.kr https://www.google.co.ls https://www.google.co.ma https://www.google.co.mz https://www.google.co.nz https://www.google.co.th https://www.google.co.tz https://www.google.co.ug https://www.google.co.uk https://www.google.co.uz https://www.google.co.ve https://www.google.co.za https://www.google.co.zm https://www.google.com https://www.google.com.ar https://www.google.com.au https://www.google.com.bd https://www.google.com.bh https://www.google.com.bo https://www.google.com.br https://www.google.com.bz https://www.google.com.co https://www.google.com.cu https://www.google.com.cy https://www.google.com.do https://www.google.com.ec https://www.google.com.eg https://www.google.com.et https://www.google.com.gh https://www.google.com.gt https://www.google.com.hk https://www.google.com.jm https://www.google.com.kh https://www.google.com.kw https://www.google.com.lb https://www.google.com.ly https://www.google.com.mt https://www.google.com.mx https://www.google.com.my https://www.google.com.ng https://www.google.com.ni https://www.google.com.np https://www.google.com.om https://www.google.com.pa https://www.google.com.pe https://www.google.com.ph https://www.google.com.pk https://www.google.com.pr https://www.google.com.py https://www.google.com.qa https://www.google.com.sa https://www.google.com.sg https://www.google.com.sl https://www.google.com.sv https://www.google.com.tr https://www.google.com.tw https://www.google.com.ua https://www.google.com.uy https://www.google.com.vn https://www.google.cv https://www.google.cz https://www.google.de https://www.google.dk https://www.google.dz https://www.google.ee https://www.google.es https://www.google.fi https://www.google.fr https://www.google.ge https://www.google.gr https://www.google.gy https://www.google.hn https://www.google.hr https://www.google.hu https://www.google.ie https://www.google.iq https://www.google.is https://www.google.it https://www.google.jo https://www.google.kg https://www.google.kz https://www.google.lk https://www.google.lt https://www.google.lu https://www.google.lv https://www.google.mk https://www.google.mn https://www.google.mv https://www.google.nl https://www.google.no https://www.google.pl https://www.google.pt https://www.google.ro https://www.google.rs https://www.google.ru https://www.google.sc https://www.google.se https://www.google.si https://www.google.sk https://www.google.sn https://www.google.tn https://www.google.tt https://www.google.vg https://www.googletagmanager.com https://www.linkedin.com https://www.youtube.com; manifest-src 'none'; media-src 'self'; object-src 'self' https://content.screencast.com; prefetch-src 'none' https://c.disquscdn.com https://disqus.com; script-src 'self' 'unsafe-eval' 'unsafe-inline' https://assets.esetstatic.com https://cdn.esetstatic.com https://connect.facebook.net https://googleads.g.doubleclick.net https://platform.twitter.com https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tpc.googlesyndication.com https://welivesecurity.disqus.com https://www.google-analytics.com https://www.google.co.kr https://www.google.com https://www.googleadservices.com https://www.googletagmanager.com https://www.instagram.com https://www.opinionstage.com https://www.youtube.com; style-src 'self' 'unsafe-inline' https://assets.esetstatic.com https://c.disquscdn.com https://cdn.esetstatic.com; worker-src 'none'; report-uri https://www-welivesecurity-com.api.cspconsole.com/v1/csp/report; report-to default;
Strict-Transport-Security	max-age=15724800
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36
accept-language: fr-FR,fr;q=0.9

Response headers

access-control-allow-origin: *
cache-control: max-age=3600 public
content-encoding: gzip
content-length: 14417
content-security-policy: default-src 'none'; child-src https://disqus.com https://vars.hotjar.com; connect-src 'self' http://ad.doubleclick.net https://*.akamaihd.net https://*.akstat.io https://*.hotjar.com https://adservice.google.com https://captcha.eset.com https://cc.welivesecurity.com https://cdn.linkedin.oribi.io https://in.hotjar.com https://region1.google-analytics.com https://stats.g.doubleclick.net https://surveystats.hotjar.io https://trial-eum-clientnsv4-s.akamaihd.net https://trial-eum-clienttons-s.akamaihd.net https://vc.hotjar.io https://ws22.hotjar.com https://ws32.hotjar.com https://www.facebook.com https://www.google-analytics.com https://www.google.com https://www.googletagmanager.com https://www.opinionstage.com wss://*.hotjar.com wss://ws1.hotjar.com; font-src 'self'; frame-src 'self' https://c.disquscdn.com https://disqus.com https://m.facebook.com https://platform.twitter.com https://tpc.googlesyndication.com https://vars.hotjar.com https://www.facebook.com https://www.googletagmanager.com https://www.instagram.com https://www.opinionstage.com https://www.podbean.com https://www.screencast.com https://www.slideshare.net https://www.youtube-nocookie.com https://www.youtube.com; img-src 'self' data: https://*.ads.linkedin.com https://adservice.google.com https://analytics.twitter.com https://c.disquscdn.com https://captcha.eset.com https://cdn1.esetstatic.com https://googleads.g.doubleclick.net https://px.ads.linkedin.com https://referrer.disqus.com https://region1.google-analytics.com https://script.hotjar.com https://secure.eset.com https://syndication.twitter.com https://t.co https://www.facebook.com https://www.google-analytics.com https://www.google.ad https://www.google.ae https://www.google.al https://www.google.at https://www.google.az https://www.google.ba https://www.google.be https://www.google.bf https://www.google.bg https://www.google.bj https://www.google.bs https://www.google.ca https://www.google.cd https://www.google.ch https://www.google.ci https://www.google.cl https://www.google.cm https://www.google.cn https://www.google.co.ao https://www.google.co.cr https://www.google.co.id https://www.google.co.il https://www.google.co.in https://www.google.co.jp https://www.google.co.ke https://www.google.co.kr https://www.google.co.ls https://www.google.co.ma https://www.google.co.mz https://www.google.co.nz https://www.google.co.th https://www.google.co.tz https://www.google.co.ug https://www.google.co.uk https://www.google.co.uz https://www.google.co.ve https://www.google.co.za https://www.google.co.zm https://www.google.com https://www.google.com.ar https://www.google.com.au https://www.google.com.bd https://www.google.com.bh https://www.google.com.bo https://www.google.com.br https://www.google.com.bz https://www.google.com.co https://www.google.com.cu https://www.google.com.cy https://www.google.com.do https://www.google.com.ec https://www.google.com.eg https://www.google.com.et https://www.google.com.gh https://www.google.com.gt https://www.google.com.hk https://www.google.com.jm https://www.google.com.kh https://www.google.com.kw https://www.google.com.lb https://www.google.com.ly https://www.google.com.mt https://www.google.com.mx https://www.google.com.my https://www.google.com.ng https://www.google.com.ni https://www.google.com.np https://www.google.com.om https://www.google.com.pa https://www.google.com.pe https://www.google.com.ph https://www.google.com.pk https://www.google.com.pr https://www.google.com.py https://www.google.com.qa https://www.google.com.sa https://www.google.com.sg https://www.google.com.sl https://www.google.com.sv https://www.google.com.tr https://www.google.com.tw https://www.google.com.ua https://www.google.com.uy https://www.google.com.vn https://www.google.cv https://www.google.cz https://www.google.de https://www.google.dk https://www.google.dz https://www.google.ee https://www.google.es https://www.google.fi https://www.google.fr https://www.google.ge https://www.google.gr https://www.google.gy https://www.google.hn https://www.google.hr https://www.google.hu https://www.google.ie https://www.google.iq https://www.google.is https://www.google.it https://www.google.jo https://www.google.kg https://www.google.kz https://www.google.lk https://www.google.lt https://www.google.lu https://www.google.lv https://www.google.mk https://www.google.mn https://www.google.mv https://www.google.nl https://www.google.no https://www.google.pl https://www.google.pt https://www.google.ro https://www.google.rs https://www.google.ru https://www.google.sc https://www.google.se https://www.google.si https://www.google.sk https://www.google.sn https://www.google.tn https://www.google.tt https://www.google.vg https://www.googletagmanager.com https://www.linkedin.com https://www.youtube.com; manifest-src 'none'; media-src 'self'; object-src 'self' https://content.screencast.com; prefetch-src 'none' https://c.disquscdn.com https://disqus.com; script-src 'self' 'unsafe-eval' 'unsafe-inline' https://assets.esetstatic.com https://cdn.esetstatic.com https://connect.facebook.net https://googleads.g.doubleclick.net https://platform.twitter.com https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tpc.googlesyndication.com https://welivesecurity.disqus.com https://www.google-analytics.com https://www.google.co.kr https://www.google.com https://www.googleadservices.com https://www.googletagmanager.com https://www.instagram.com https://www.opinionstage.com https://www.youtube.com; style-src 'self' 'unsafe-inline' https://assets.esetstatic.com https://c.disquscdn.com https://cdn.esetstatic.com; worker-src 'none'; report-uri https://www-welivesecurity-com.api.cspconsole.com/v1/csp/report; report-to default;
content-type: text/html; charset=UTF-8
date: Thu, 08 Dec 2022 12:25:34 GMT
expires: Thu, 08 Dec 2022 13:25:34 GMT
link: <https://www.welivesecurity.com/?p=96464>; rel=shortlink <https://www.welivesecurity.com/wp-content/themes/eset-wls-2018/assets/fonts/Fedra-Sans-Alt-Bold.woff?0050bbd300d61bbb50d2fff0bb6cd926>;rel="preload";as="font";type="font/woff";crossorigin,<https://www.welivesecurity.com/wp-content/themes/eset-wls-2018/assets/fonts/icomoon.ttf?45b4319f2445b74719611d0ab85cf93a>;rel="preload";as="font";type="font/ttf";crossorigin,<https://www.welivesecurity.com/wp-content/themes/eset-wls-2018/assets/fonts/Fedra-Sans-Alt-Book.woff?c156eca4ec460dcfa741dfda69fb16d5>;rel="preload";as="font";type="font/woff";crossorigin <https://www.googletagmanager.com>;rel="preconnect",<https://az416426.vo.msecnd.net>;rel="preconnect",<https://welivesecurity.disqus.com>;rel="preconnect",<https://www.google-analytics.com>;rel="preconnect",<https://cdn.esetstatic.com>;rel="preconnect"
referrer-policy: no-referrer-when-downgrade
report-to: {"group":"default","max_age":31536000,"endpoints":[{"url":"https://www-welivesecurity-com.api.cspconsole.com/v1/csp/report"}],"include_subdomains":false}
server-timing: cdn-cache; desc=REVALIDATE edge; dur=20 origin; dur=649
strict-transport-security: max-age=15724800
vary: Accept-Encoding
x-akamai-transformed: 9 14553 0 pmb=mRUM,2
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H2 200 Fedra-Sans-Alt-Bold.woff
www.welivesecurity.com/wp-content/themes/eset-wls-2018/assets/fonts/ 40 KB
40 KB 73ms
72ms Font
font/woff 2a02:26f0:3500:12::1730:17bf
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.welivesecurity.com/wp-content/themes/eset-wls-2018/assets/fonts/Fedra-Sans-Alt-Bold.woff?0050bbd300d61bbb50d2fff0bb6cd926

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:3500:12::1730:17bf Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

12f37c0a70377ac636345742e2eb0d2acb70d411612020ae1608193330a5b15d

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.welivesecurity.com/2017/07/04/analysis-of-telebots-cunning-backdoor/
Origin: https://www.welivesecurity.com
accept-language: fr-FR,fr;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

strict-transport-security: max-age=15724800
date: Thu, 08 Dec 2022 12:25:34 GMT
referrer-policy: no-referrer-when-downgrade
x-content-type-options: nosniff
last-modified: Mon, 28 Feb 2022 12:04:13 GMT
etag: "621cba3d-9e73"
content-type: font/woff
access-control-allow-origin: *
cache-control: max-age=31536000, public
server-timing: cdn-cache; desc=HIT, edge; dur=21
accept-ranges: bytes
content-length: 40563
x-xss-protection: 1; mode=block
expires: Tue, 28 Feb 2023 15:46:21 GMT

GET
H2 200 icomoon.ttf
www.welivesecurity.com/wp-content/themes/eset-wls-2018/assets/fonts/ 4 KB
7 KB 65ms
64ms Font
text/plain 2a02:26f0:3500:12::1730:17bf
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.welivesecurity.com/wp-content/themes/eset-wls-2018/assets/fonts/icomoon.ttf?45b4319f2445b74719611d0ab85cf93a

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:3500:12::1730:17bf Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

8d8ba4c94f3b33965aa63ce307972277b1263dc40705b292af8f835f4eebd042

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; child-src https://disqus.com https://vars.hotjar.com; connect-src 'self' http://ad.doubleclick.net https://.akamaihd.net https://.akstat.io https://.hotjar.com https://adservice.google.com https://captcha.eset.com https://cc.welivesecurity.com https://cdn.linkedin.oribi.io https://in.hotjar.com https://region1.google-analytics.com https://stats.g.doubleclick.net https://surveystats.hotjar.io https://trial-eum-clientnsv4-s.akamaihd.net https://trial-eum-clienttons-s.akamaihd.net https://vc.hotjar.io https://ws22.hotjar.com https://ws32.hotjar.com https://www.facebook.com https://www.google-analytics.com https://www.google.com https://www.googletagmanager.com https://www.opinionstage.com wss://.hotjar.com wss://ws1.hotjar.com; font-src 'self'; frame-src 'self' https://c.disquscdn.com https://disqus.com https://m.facebook.com https://platform.twitter.com https://tpc.googlesyndication.com https://vars.hotjar.com https://www.facebook.com https://www.googletagmanager.com https://www.instagram.com https://www.opinionstage.com https://www.podbean.com https://www.screencast.com https://www.slideshare.net https://www.youtube-nocookie.com https://www.youtube.com; img-src 'self' data: https://*.ads.linkedin.com https://adservice.google.com https://analytics.twitter.com https://c.disquscdn.com https://captcha.eset.com https://cdn1.esetstatic.com https://googleads.g.doubleclick.net https://px.ads.linkedin.com https://referrer.disqus.com https://region1.google-analytics.com https://script.hotjar.com https://secure.eset.com https://syndication.twitter.com https://t.co https://www.facebook.com https://www.google-analytics.com https://www.google.ad https://www.google.ae https://www.google.al https://www.google.at https://www.google.az https://www.google.ba https://www.google.be https://www.google.bf https://www.google.bg https://www.google.bj https://www.google.bs https://www.google.ca https://www.google.cd https://www.google.ch https://www.google.ci https://www.google.cl https://www.google.cm https://www.google.cn https://www.google.co.ao https://www.google.co.cr https://www.google.co.id https://www.google.co.il https://www.google.co.in https://www.google.co.jp https://www.google.co.ke https://www.google.co.kr https://www.google.co.ls https://www.google.co.ma https://www.google.co.mz https://www.google.co.nz https://www.google.co.th https://www.google.co.tz https://www.google.co.ug https://www.google.co.uk https://www.google.co.uz https://www.google.co.ve https://www.google.co.za https://www.google.co.zm https://www.google.com https://www.google.com.ar https://www.google.com.au https://www.google.com.bd https://www.google.com.bh https://www.google.com.bo https://www.google.com.br https://www.google.com.bz https://www.google.com.co https://www.google.com.cu https://www.google.com.cy https://www.google.com.do https://www.google.com.ec https://www.google.com.eg https://www.google.com.et https://www.google.com.gh https://www.google.com.gt https://www.google.com.hk https://www.google.com.jm https://www.google.com.kh https://www.google.com.kw https://www.google.com.lb https://www.google.com.ly https://www.google.com.mt https://www.google.com.mx https://www.google.com.my https://www.google.com.ng https://www.google.com.ni https://www.google.com.np https://www.google.com.om https://www.google.com.pa https://www.google.com.pe https://www.google.com.ph https://www.google.com.pk https://www.google.com.pr https://www.google.com.py https://www.google.com.qa https://www.google.com.sa https://www.google.com.sg https://www.google.com.sl https://www.google.com.sv https://www.google.com.tr https://www.google.com.tw https://www.google.com.ua https://www.google.com.uy https://www.google.com.vn https://www.google.cv https://www.google.cz https://www.google.de https://www.google.dk https://www.google.dz https://www.google.ee https://www.google.es https://www.google.fi https://www.google.fr https://www.google.ge https://www.google.gr https://www.google.gy https://www.google.hn https://www.google.hr https://www.google.hu https://www.google.ie https://www.google.iq https://www.google.is https://www.google.it https://www.google.jo https://www.google.kg https://www.google.kz https://www.google.lk https://www.google.lt https://www.google.lu https://www.google.lv https://www.google.mk https://www.google.mn https://www.google.mv https://www.google.nl https://www.google.no https://www.google.pl https://www.google.pt https://www.google.ro https://www.google.rs https://www.google.ru https://www.google.sc https://www.google.se https://www.google.si https://www.google.sk https://www.google.sn https://www.google.tn https://www.google.tt https://www.google.vg https://www.googletagmanager.com https://www.linkedin.com https://www.youtube.com; manifest-src 'none'; media-src 'self'; object-src 'self' https://content.screencast.com; prefetch-src 'none' https://c.disquscdn.com https://disqus.com; script-src 'self' 'unsafe-eval' 'unsafe-inline' https://assets.esetstatic.com https://cdn.esetstatic.com https://connect.facebook.net https://googleads.g.doubleclick.net https://platform.twitter.com https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tpc.googlesyndication.com https://welivesecurity.disqus.com https://www.google-analytics.com https://www.google.co.kr https://www.google.com https://www.googleadservices.com https://www.googletagmanager.com https://www.instagram.com https://www.opinionstage.com https://www.youtube.com; style-src 'self' 'unsafe-inline' https://assets.esetstatic.com https://c.disquscdn.com https://cdn.esetstatic.com; worker-src 'none'; report-uri https://www-welivesecurity-com.api.cspconsole.com/v1/csp/report; report-to default;
Strict-Transport-Security	max-age=15724800
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.welivesecurity.com/2017/07/04/analysis-of-telebots-cunning-backdoor/
Origin: https://www.welivesecurity.com
accept-language: fr-FR,fr;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

content-security-policy: default-src 'none'; child-src https://disqus.com https://vars.hotjar.com; connect-src 'self' http://ad.doubleclick.net https://*.akamaihd.net https://*.akstat.io https://*.hotjar.com https://adservice.google.com https://captcha.eset.com https://cc.welivesecurity.com https://cdn.linkedin.oribi.io https://in.hotjar.com https://region1.google-analytics.com https://stats.g.doubleclick.net https://surveystats.hotjar.io https://trial-eum-clientnsv4-s.akamaihd.net https://trial-eum-clienttons-s.akamaihd.net https://vc.hotjar.io https://ws22.hotjar.com https://ws32.hotjar.com https://www.facebook.com https://www.google-analytics.com https://www.google.com https://www.googletagmanager.com https://www.opinionstage.com wss://*.hotjar.com wss://ws1.hotjar.com; font-src 'self'; frame-src 'self' https://c.disquscdn.com https://disqus.com https://m.facebook.com https://platform.twitter.com https://tpc.googlesyndication.com https://vars.hotjar.com https://www.facebook.com https://www.googletagmanager.com https://www.instagram.com https://www.opinionstage.com https://www.podbean.com https://www.screencast.com https://www.slideshare.net https://www.youtube-nocookie.com https://www.youtube.com; img-src 'self' data: https://*.ads.linkedin.com https://adservice.google.com https://analytics.twitter.com https://c.disquscdn.com https://captcha.eset.com https://cdn1.esetstatic.com https://googleads.g.doubleclick.net https://px.ads.linkedin.com https://referrer.disqus.com https://region1.google-analytics.com https://script.hotjar.com https://secure.eset.com https://syndication.twitter.com https://t.co https://www.facebook.com https://www.google-analytics.com https://www.google.ad https://www.google.ae https://www.google.al https://www.google.at https://www.google.az https://www.google.ba https://www.google.be https://www.google.bf https://www.google.bg https://www.google.bj https://www.google.bs https://www.google.ca https://www.google.cd https://www.google.ch https://www.google.ci https://www.google.cl https://www.google.cm https://www.google.cn https://www.google.co.ao https://www.google.co.cr https://www.google.co.id https://www.google.co.il https://www.google.co.in https://www.google.co.jp https://www.google.co.ke https://www.google.co.kr https://www.google.co.ls https://www.google.co.ma https://www.google.co.mz https://www.google.co.nz https://www.google.co.th https://www.google.co.tz https://www.google.co.ug https://www.google.co.uk https://www.google.co.uz https://www.google.co.ve https://www.google.co.za https://www.google.co.zm https://www.google.com https://www.google.com.ar https://www.google.com.au https://www.google.com.bd https://www.google.com.bh https://www.google.com.bo https://www.google.com.br https://www.google.com.bz https://www.google.com.co https://www.google.com.cu https://www.google.com.cy https://www.google.com.do https://www.google.com.ec https://www.google.com.eg https://www.google.com.et https://www.google.com.gh https://www.google.com.gt https://www.google.com.hk https://www.google.com.jm https://www.google.com.kh https://www.google.com.kw https://www.google.com.lb https://www.google.com.ly https://www.google.com.mt https://www.google.com.mx https://www.google.com.my https://www.google.com.ng https://www.google.com.ni https://www.google.com.np https://www.google.com.om https://www.google.com.pa https://www.google.com.pe https://www.google.com.ph https://www.google.com.pk https://www.google.com.pr https://www.google.com.py https://www.google.com.qa https://www.google.com.sa https://www.google.com.sg https://www.google.com.sl https://www.google.com.sv https://www.google.com.tr https://www.google.com.tw https://www.google.com.ua https://www.google.com.uy https://www.google.com.vn https://www.google.cv https://www.google.cz https://www.google.de https://www.google.dk https://www.google.dz https://www.google.ee https://www.google.es https://www.google.fi https://www.google.fr https://www.google.ge https://www.google.gr https://www.google.gy https://www.google.hn https://www.google.hr https://www.google.hu https://www.google.ie https://www.google.iq https://www.google.is https://www.google.it https://www.google.jo https://www.google.kg https://www.google.kz https://www.google.lk https://www.google.lt https://www.google.lu https://www.google.lv https://www.google.mk https://www.google.mn https://www.google.mv https://www.google.nl https://www.google.no https://www.google.pl https://www.google.pt https://www.google.ro https://www.google.rs https://www.google.ru https://www.google.sc https://www.google.se https://www.google.si https://www.google.sk https://www.google.sn https://www.google.tn https://www.google.tt https://www.google.vg https://www.googletagmanager.com https://www.linkedin.com https://www.youtube.com; manifest-src 'none'; media-src 'self'; object-src 'self' https://content.screencast.com; prefetch-src 'none' https://c.disquscdn.com https://disqus.com; script-src 'self' 'unsafe-eval' 'unsafe-inline' https://assets.esetstatic.com https://cdn.esetstatic.com https://connect.facebook.net https://googleads.g.doubleclick.net https://platform.twitter.com https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tpc.googlesyndication.com https://welivesecurity.disqus.com https://www.google-analytics.com https://www.google.co.kr https://www.google.com https://www.googleadservices.com https://www.googletagmanager.com https://www.instagram.com https://www.opinionstage.com https://www.youtube.com; style-src 'self' 'unsafe-inline' https://assets.esetstatic.com https://c.disquscdn.com https://cdn.esetstatic.com; worker-src 'none'; report-uri https://www-welivesecurity-com.api.cspconsole.com/v1/csp/report; report-to default;
strict-transport-security: max-age=15724800
x-content-type-options: nosniff
date: Thu, 08 Dec 2022 12:25:34 GMT
content-encoding: gzip
server-timing: cdn-cache; desc=HIT, edge; dur=1
content-length: 2186
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
last-modified: Wed, 07 Dec 2022 05:52:46 GMT
etag: W/"63902a2e-f94"
vary: Accept-Encoding
report-to: {"group":"default","max_age":31536000,"endpoints":[{"url":"https://www-welivesecurity-com.api.cspconsole.com/v1/csp/report"}],"include_subdomains":false}
content-type: text/plain; charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=86400, public
expires: Thu, 08 Dec 2022 16:27:40 GMT

GET
H2 200 Fedra-Sans-Alt-Book.woff
www.welivesecurity.com/wp-content/themes/eset-wls-2018/assets/fonts/ 40 KB
40 KB 99ms
98ms Font
font/woff 2a02:26f0:3500:12::1730:17bf
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.welivesecurity.com/wp-content/themes/eset-wls-2018/assets/fonts/Fedra-Sans-Alt-Book.woff?c156eca4ec460dcfa741dfda69fb16d5

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:3500:12::1730:17bf Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

1ba0ff3994900740a94dc37300b7415b25d642f6ef495afc5ae4e16ae1128e66

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.welivesecurity.com/2017/07/04/analysis-of-telebots-cunning-backdoor/
Origin: https://www.welivesecurity.com
accept-language: fr-FR,fr;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

strict-transport-security: max-age=15724800
date: Thu, 08 Dec 2022 12:25:34 GMT
referrer-policy: no-referrer-when-downgrade
x-content-type-options: nosniff
last-modified: Sun, 13 Feb 2022 05:54:20 GMT
etag: "62089d0c-9ff1"
content-type: font/woff
access-control-allow-origin: *
cache-control: max-age=31536000, public
server-timing: cdn-cache; desc=HIT, edge; dur=16
accept-ranges: bytes
content-length: 40945
x-xss-protection: 1; mode=block
expires: Tue, 28 Feb 2023 15:46:21 GMT

GET
H2 200 main.css
www.welivesecurity.com/wp-content/themes/eset-wls-2018/assets/css/ 235 KB
32 KB 76ms
75ms Stylesheet
text/css 2a02:26f0:3500:12::1730:17bf
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.welivesecurity.com/wp-content/themes/eset-wls-2018/assets/css/main.css?id=c854c8614bc1ecc213b8

Requested by

Host: www.welivesecurity.com
URL: https://www.welivesecurity.com/2017/07/04/analysis-of-telebots-cunning-backdoor/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:3500:12::1730:17bf Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

aa5c8340e756a3d33b80707dc26e9e81c4110417bf5ca3f0c625a7fd9750c51f

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://www.welivesecurity.com/2017/07/04/analysis-of-telebots-cunning-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

strict-transport-security: max-age=15724800
content-encoding: br
x-content-type-options: nosniff
date: Thu, 08 Dec 2022 12:25:34 GMT
content-security-policy-report-only: default-src 'self'; img-src https://analytics.twitter.com https://googleads.g.doubleclick.net https://px.ads.linkedin.com https://syndication.twitter.com https://www.google-analytics.com https://www.google.cl https://www.google.com; script-src https://assets.esetstatic.com https://az416426.vo.msecnd.net https://googleads.g.doubleclick.net https://static.ads-twitter.com https://static.hotjar.com https://welivesecurity.disqus.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com; connect-src https://*.akstat.io https://adservice.google.com https://dc.services.visualstudio.com https://stats.g.doubleclick.net https://www.facebook.com https://www.google-analytics.com https://www.googletagmanager.com wss://*.hotjar.com wss://ws1.hotjar.com; child-src https://disqus.com https://vars.hotjar.com; frame-src https://disqus.com; style-src https://c.disquscdn.com; report-uri https://www-welivesecurity-com.api.cspconsole.com/v1/csp/report; report-to default;
server-timing: cdn-cache; desc=HIT, edge; dur=20
content-length: 31141
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
last-modified: Tue, 08 Nov 2022 09:30:26 GMT
etag: W/"6364e84b-3adf6"
report-to: {"group":"default","max_age":31536000,"endpoints":[{"url":"https://www-welivesecurity-com.api.cspconsole.com/v1/csp/report"}],"include_subdomains":false}
content-type: text/css
access-control-allow-origin: *
cache-control: public
expires: Mon, 06 Feb 2023 09:29:45 GMT

GET
H2 200 eset-wls-dark-header-1.svg
www.welivesecurity.com/wp-content/themes/eset-wls-2018/assets/img/new-logo/ 3 KB
1 KB 52ms
46ms Image
image/svg+xml 2a02:26f0:3500:12::1730:17bf
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.welivesecurity.com/wp-content/themes/eset-wls-2018/assets/img/new-logo/eset-wls-dark-header-1.svg

Requested by

Host: www.welivesecurity.com
URL: https://www.welivesecurity.com/2017/07/04/analysis-of-telebots-cunning-backdoor/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:3500:12::1730:17bf Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

f0edf4ed283d119399dcb7025914b6a68a187667085bcbc49fe91db20f952cc1

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://www.welivesecurity.com/2017/07/04/analysis-of-telebots-cunning-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

strict-transport-security: max-age=15724800
content-encoding: br
referrer-policy: no-referrer-when-downgrade
x-content-type-options: nosniff
last-modified: Wed, 08 Jun 2022 14:57:19 GMT
date: Thu, 08 Dec 2022 12:25:34 GMT
etag: W/"627b93fa-bb2"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public
server-timing: cdn-cache; desc=HIT, edge; dur=1
content-length: 1049
x-xss-protection: 1; mode=block
expires: Sat, 27 Aug 2022 15:22:05 GMT

GET
H2 200 eset-wls-dark-header-2.svg
www.welivesecurity.com/wp-content/themes/eset-wls-2018/assets/img/new-logo/ 3 KB
1 KB 52ms
46ms Image
image/svg+xml 2a02:26f0:3500:12::1730:17bf
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.welivesecurity.com/wp-content/themes/eset-wls-2018/assets/img/new-logo/eset-wls-dark-header-2.svg

Requested by

Host: www.welivesecurity.com
URL: https://www.welivesecurity.com/2017/07/04/analysis-of-telebots-cunning-backdoor/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:3500:12::1730:17bf Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

35ccbb14f6d8b7ed5eb03728f94221f27ed194ae83b32c40315d531f49b10bc1

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://www.welivesecurity.com/2017/07/04/analysis-of-telebots-cunning-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

strict-transport-security: max-age=15724800
content-encoding: br
referrer-policy: no-referrer-when-downgrade
x-content-type-options: nosniff
last-modified: Sun, 29 May 2022 11:16:53 GMT
date: Thu, 08 Dec 2022 12:25:34 GMT
etag: W/"62857b03-a8a"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public
server-timing: cdn-cache; desc=HIT, edge; dur=1
content-length: 1107
x-xss-protection: 1; mode=block
expires: Sat, 27 Aug 2022 11:02:03 GMT

GET
H2 200 eset-wls-light-header-1.svg
www.welivesecurity.com/wp-content/themes/eset-wls-2018/assets/img/new-logo/ 3 KB
2 KB 60ms
54ms Image
image/svg+xml 2a02:26f0:3500:12::1730:17bf
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.welivesecurity.com/wp-content/themes/eset-wls-2018/assets/img/new-logo/eset-wls-light-header-1.svg

Requested by

Host: www.welivesecurity.com
URL: https://www.welivesecurity.com/2017/07/04/analysis-of-telebots-cunning-backdoor/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:3500:12::1730:17bf Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

5813b04bb0c879b76179735995127ddc2af1867f42d4a4b5a8d7c3103f348b05

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://www.welivesecurity.com/2017/07/04/analysis-of-telebots-cunning-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

strict-transport-security: max-age=15724800
content-encoding: br
x-content-type-options: nosniff
date: Thu, 08 Dec 2022 12:25:34 GMT
content-security-policy-report-only: default-src 'self'; report-uri https://www-welivesecurity-com.api.cspconsole.com/v1/csp/report; report-to default;
server-timing: cdn-cache; desc=HIT, edge; dur=1
content-length: 1059
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
last-modified: Wed, 21 Sep 2022 21:22:14 GMT
etag: W/"62f17c72-bc1"
report-to: {"group":"default","max_age":31536000,"endpoints":[{"url":"https://www-welivesecurity-com.api.cspconsole.com/v1/csp/report"}],"include_subdomains":false}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public
expires: Fri, 25 Nov 2022 16:01:20 GMT

GET
H2 200 eset-wls-light-header-2.svg
www.welivesecurity.com/wp-content/themes/eset-wls-2018/assets/img/new-logo/ 2 KB
1 KB 61ms
55ms Image
image/svg+xml 2a02:26f0:3500:12::1730:17bf
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.welivesecurity.com/wp-content/themes/eset-wls-2018/assets/img/new-logo/eset-wls-light-header-2.svg

Requested by

Host: www.welivesecurity.com
URL: https://www.welivesecurity.com/2017/07/04/analysis-of-telebots-cunning-backdoor/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:3500:12::1730:17bf Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

12c42fa79dc321e56bb3c23008cacf7a79771bab4fa61f765556e24ba13a89ff

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://www.welivesecurity.com/2017/07/04/analysis-of-telebots-cunning-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

strict-transport-security: max-age=15724800
content-encoding: br
referrer-policy: no-referrer-when-downgrade
x-content-type-options: nosniff
last-modified: Mon, 06 Jun 2022 07:40:40 GMT
date: Thu, 08 Dec 2022 12:25:34 GMT
etag: W/"628b3b61-967"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public
server-timing: cdn-cache; desc=HIT, edge; dur=1
content-length: 986
x-xss-protection: 1; mode=block
expires: Sat, 27 Aug 2022 15:49:07 GMT

GET
H2 200 Anton_Cherepanov-222x179.jpg
www.welivesecurity.com/wp-content/uploads/2020/03/ 7 KB
8 KB 69ms
64ms Image
image/jpeg 2a02:26f0:3500:12::1730:17bf
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.welivesecurity.com/wp-content/uploads/2020/03/Anton_Cherepanov-222x179.jpg

Requested by

Host: www.welivesecurity.com
URL: https://www.welivesecurity.com/2017/07/04/analysis-of-telebots-cunning-backdoor/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:3500:12::1730:17bf Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

70a418910117277df96100b8163add8f820b4956a9cb53dcea92f3d11845b283

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://www.welivesecurity.com/2017/07/04/analysis-of-telebots-cunning-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

strict-transport-security: max-age=15724800
date: Thu, 08 Dec 2022 12:25:34 GMT
referrer-policy: no-referrer-when-downgrade
x-content-type-options: nosniff
last-modified: Thu, 16 Apr 2020 22:46:39 GMT
etag: "5e98e04f-1cef"
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=7776000, public
server-timing: cdn-cache; desc=HIT, edge; dur=16
accept-ranges: bytes
content-length: 7407
x-xss-protection: 1; mode=block
expires: Wed, 10 Aug 2022 18:09:13 GMT

GET
H2 200 image1.png
www.welivesecurity.com/wp-content/uploads/2017/07/ 21 KB
25 KB 64ms
59ms Image
image/png 2a02:26f0:3500:12::1730:17bf
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.welivesecurity.com/wp-content/uploads/2017/07/image1.png

Requested by

Host: www.welivesecurity.com
URL: https://www.welivesecurity.com/2017/07/04/analysis-of-telebots-cunning-backdoor/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:3500:12::1730:17bf Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

16b235a5b38fe6e9779d4fda7955c2706fe00113444aeec56b470fb4d2b94328

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; child-src https://disqus.com https://vars.hotjar.com; connect-src 'self' http://ad.doubleclick.net https://.akamaihd.net https://.akstat.io https://.hotjar.com https://adservice.google.com https://captcha.eset.com https://cc.welivesecurity.com https://cdn.linkedin.oribi.io https://in.hotjar.com https://region1.google-analytics.com https://stats.g.doubleclick.net https://surveystats.hotjar.io https://trial-eum-clientnsv4-s.akamaihd.net https://trial-eum-clienttons-s.akamaihd.net https://vc.hotjar.io https://ws22.hotjar.com https://ws32.hotjar.com https://www.facebook.com https://www.google-analytics.com https://www.google.com https://www.googletagmanager.com https://www.opinionstage.com wss://.hotjar.com wss://ws1.hotjar.com; font-src 'self'; frame-src 'self' https://c.disquscdn.com https://disqus.com https://m.facebook.com https://platform.twitter.com https://tpc.googlesyndication.com https://vars.hotjar.com https://www.facebook.com https://www.googletagmanager.com https://www.instagram.com https://www.opinionstage.com https://www.slideshare.net https://www.youtube-nocookie.com https://www.youtube.com; img-src 'self' data: https://*.ads.linkedin.com https://adservice.google.com https://analytics.twitter.com https://c.disquscdn.com https://captcha.eset.com https://cdn1.esetstatic.com https://googleads.g.doubleclick.net https://px.ads.linkedin.com https://referrer.disqus.com https://region1.google-analytics.com https://script.hotjar.com https://secure.eset.com https://syndication.twitter.com https://t.co https://www.facebook.com https://www.google-analytics.com https://www.google.ad https://www.google.ae https://www.google.al https://www.google.at https://www.google.ba https://www.google.be https://www.google.bf https://www.google.bg https://www.google.bj https://www.google.bs https://www.google.ca https://www.google.cd https://www.google.ch https://www.google.ci https://www.google.cl https://www.google.cm https://www.google.cn https://www.google.co.ao https://www.google.co.cr https://www.google.co.id https://www.google.co.il https://www.google.co.in https://www.google.co.jp https://www.google.co.ke https://www.google.co.kr https://www.google.co.ma https://www.google.co.mz https://www.google.co.nz https://www.google.co.th https://www.google.co.tz https://www.google.co.ug https://www.google.co.uk https://www.google.co.uz https://www.google.co.ve https://www.google.co.za https://www.google.co.zm https://www.google.com https://www.google.com.ar https://www.google.com.au https://www.google.com.bd https://www.google.com.bh https://www.google.com.bo https://www.google.com.br https://www.google.com.co https://www.google.com.cu https://www.google.com.cy https://www.google.com.do https://www.google.com.ec https://www.google.com.eg https://www.google.com.gh https://www.google.com.gt https://www.google.com.hk https://www.google.com.jm https://www.google.com.kw https://www.google.com.lb https://www.google.com.mt https://www.google.com.mx https://www.google.com.my https://www.google.com.ng https://www.google.com.ni https://www.google.com.np https://www.google.com.om https://www.google.com.pa https://www.google.com.pe https://www.google.com.ph https://www.google.com.pk https://www.google.com.pr https://www.google.com.py https://www.google.com.qa https://www.google.com.sa https://www.google.com.sg https://www.google.com.sl https://www.google.com.sv https://www.google.com.tr https://www.google.com.tw https://www.google.com.ua https://www.google.com.uy https://www.google.com.vn https://www.google.cz https://www.google.de https://www.google.dk https://www.google.dz https://www.google.ee https://www.google.es https://www.google.fi https://www.google.fr https://www.google.ge https://www.google.gr https://www.google.gy https://www.google.hn https://www.google.hr https://www.google.hu https://www.google.ie https://www.google.is https://www.google.it https://www.google.jo https://www.google.kg https://www.google.kz https://www.google.lk https://www.google.lt https://www.google.lu https://www.google.lv https://www.google.mk https://www.google.mn https://www.google.mv https://www.google.nl https://www.google.no https://www.google.pl https://www.google.pt https://www.google.ro https://www.google.rs https://www.google.ru https://www.google.sc https://www.google.se https://www.google.si https://www.google.sk https://www.google.sn https://www.google.tn https://www.google.tt https://www.google.vg https://www.googletagmanager.com https://www.linkedin.com https://www.youtube.com; manifest-src 'none'; media-src 'self'; object-src 'self'; prefetch-src 'none' https://c.disquscdn.com https://disqus.com; script-src 'self' 'unsafe-eval' 'unsafe-inline' https://assets.esetstatic.com https://cdn.esetstatic.com https://connect.facebook.net https://googleads.g.doubleclick.net https://platform.twitter.com https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tpc.googlesyndication.com https://welivesecurity.disqus.com https://www.google-analytics.com https://www.google.com https://www.googleadservices.com https://www.googletagmanager.com https://www.instagram.com https://www.opinionstage.com https://www.youtube.com; style-src 'self' 'unsafe-inline' https://assets.esetstatic.com https://c.disquscdn.com https://cdn.esetstatic.com; worker-src 'none'; report-uri https://www-welivesecurity-com.api.cspconsole.com/v1/csp/report; report-to default;
Strict-Transport-Security	max-age=15724800
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://www.welivesecurity.com/2017/07/04/analysis-of-telebots-cunning-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

content-security-policy: default-src 'none'; child-src https://disqus.com https://vars.hotjar.com; connect-src 'self' http://ad.doubleclick.net https://*.akamaihd.net https://*.akstat.io https://*.hotjar.com https://adservice.google.com https://captcha.eset.com https://cc.welivesecurity.com https://cdn.linkedin.oribi.io https://in.hotjar.com https://region1.google-analytics.com https://stats.g.doubleclick.net https://surveystats.hotjar.io https://trial-eum-clientnsv4-s.akamaihd.net https://trial-eum-clienttons-s.akamaihd.net https://vc.hotjar.io https://ws22.hotjar.com https://ws32.hotjar.com https://www.facebook.com https://www.google-analytics.com https://www.google.com https://www.googletagmanager.com https://www.opinionstage.com wss://*.hotjar.com wss://ws1.hotjar.com; font-src 'self'; frame-src 'self' https://c.disquscdn.com https://disqus.com https://m.facebook.com https://platform.twitter.com https://tpc.googlesyndication.com https://vars.hotjar.com https://www.facebook.com https://www.googletagmanager.com https://www.instagram.com https://www.opinionstage.com https://www.slideshare.net https://www.youtube-nocookie.com https://www.youtube.com; img-src 'self' data: https://*.ads.linkedin.com https://adservice.google.com https://analytics.twitter.com https://c.disquscdn.com https://captcha.eset.com https://cdn1.esetstatic.com https://googleads.g.doubleclick.net https://px.ads.linkedin.com https://referrer.disqus.com https://region1.google-analytics.com https://script.hotjar.com https://secure.eset.com https://syndication.twitter.com https://t.co https://www.facebook.com https://www.google-analytics.com https://www.google.ad https://www.google.ae https://www.google.al https://www.google.at https://www.google.ba https://www.google.be https://www.google.bf https://www.google.bg https://www.google.bj https://www.google.bs https://www.google.ca https://www.google.cd https://www.google.ch https://www.google.ci https://www.google.cl https://www.google.cm https://www.google.cn https://www.google.co.ao https://www.google.co.cr https://www.google.co.id https://www.google.co.il https://www.google.co.in https://www.google.co.jp https://www.google.co.ke https://www.google.co.kr https://www.google.co.ma https://www.google.co.mz https://www.google.co.nz https://www.google.co.th https://www.google.co.tz https://www.google.co.ug https://www.google.co.uk https://www.google.co.uz https://www.google.co.ve https://www.google.co.za https://www.google.co.zm https://www.google.com https://www.google.com.ar https://www.google.com.au https://www.google.com.bd https://www.google.com.bh https://www.google.com.bo https://www.google.com.br https://www.google.com.co https://www.google.com.cu https://www.google.com.cy https://www.google.com.do https://www.google.com.ec https://www.google.com.eg https://www.google.com.gh https://www.google.com.gt https://www.google.com.hk https://www.google.com.jm https://www.google.com.kw https://www.google.com.lb https://www.google.com.mt https://www.google.com.mx https://www.google.com.my https://www.google.com.ng https://www.google.com.ni https://www.google.com.np https://www.google.com.om https://www.google.com.pa https://www.google.com.pe https://www.google.com.ph https://www.google.com.pk https://www.google.com.pr https://www.google.com.py https://www.google.com.qa https://www.google.com.sa https://www.google.com.sg https://www.google.com.sl https://www.google.com.sv https://www.google.com.tr https://www.google.com.tw https://www.google.com.ua https://www.google.com.uy https://www.google.com.vn https://www.google.cz https://www.google.de https://www.google.dk https://www.google.dz https://www.google.ee https://www.google.es https://www.google.fi https://www.google.fr https://www.google.ge https://www.google.gr https://www.google.gy https://www.google.hn https://www.google.hr https://www.google.hu https://www.google.ie https://www.google.is https://www.google.it https://www.google.jo https://www.google.kg https://www.google.kz https://www.google.lk https://www.google.lt https://www.google.lu https://www.google.lv https://www.google.mk https://www.google.mn https://www.google.mv https://www.google.nl https://www.google.no https://www.google.pl https://www.google.pt https://www.google.ro https://www.google.rs https://www.google.ru https://www.google.sc https://www.google.se https://www.google.si https://www.google.sk https://www.google.sn https://www.google.tn https://www.google.tt https://www.google.vg https://www.googletagmanager.com https://www.linkedin.com https://www.youtube.com; manifest-src 'none'; media-src 'self'; object-src 'self'; prefetch-src 'none' https://c.disquscdn.com https://disqus.com; script-src 'self' 'unsafe-eval' 'unsafe-inline' https://assets.esetstatic.com https://cdn.esetstatic.com https://connect.facebook.net https://googleads.g.doubleclick.net https://platform.twitter.com https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tpc.googlesyndication.com https://welivesecurity.disqus.com https://www.google-analytics.com https://www.google.com https://www.googleadservices.com https://www.googletagmanager.com https://www.instagram.com https://www.opinionstage.com https://www.youtube.com; style-src 'self' 'unsafe-inline' https://assets.esetstatic.com https://c.disquscdn.com https://cdn.esetstatic.com; worker-src 'none'; report-uri https://www-welivesecurity-com.api.cspconsole.com/v1/csp/report; report-to default;
strict-transport-security: max-age=15724800
x-content-type-options: nosniff
date: Thu, 08 Dec 2022 12:25:34 GMT
server-timing: cdn-cache; desc=HIT, edge; dur=8
content-length: 21429
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
last-modified: Wed, 11 Nov 2020 18:18:44 GMT
etag: "5fac2b04-53b5"
report-to: {"group":"default","max_age":31536000,"endpoints":[{"url":"https://www-welivesecurity-com.api.cspconsole.com/v1/csp/report"}],"include_subdomains":false}
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=7776000, public
accept-ranges: bytes
expires: Sat, 25 Feb 2023 13:53:55 GMT

GET
H2 200 image2_edit.png
www.welivesecurity.com/wp-content/uploads/2017/07/ 49 KB
50 KB 86ms
81ms Image
image/png 2a02:26f0:3500:12::1730:17bf
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.welivesecurity.com/wp-content/uploads/2017/07/image2_edit.png

Requested by

Host: www.welivesecurity.com
URL: https://www.welivesecurity.com/2017/07/04/analysis-of-telebots-cunning-backdoor/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:3500:12::1730:17bf Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

b24406edbfc7c4b31c9ffd6fe042f1338d44a2367d3fca73b6f4d42f28671c8c

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://www.welivesecurity.com/2017/07/04/analysis-of-telebots-cunning-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

strict-transport-security: max-age=15724800
date: Thu, 08 Dec 2022 12:25:34 GMT
x-content-type-options: nosniff
content-security-policy-report-only: default-src 'self'; img-src https://analytics.twitter.com https://googleads.g.doubleclick.net https://px.ads.linkedin.com https://syndication.twitter.com https://www.google-analytics.com https://www.google.cl https://www.google.com; script-src https://assets.esetstatic.com https://az416426.vo.msecnd.net https://googleads.g.doubleclick.net https://static.ads-twitter.com https://static.hotjar.com https://welivesecurity.disqus.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com; connect-src https://*.akstat.io https://adservice.google.com https://dc.services.visualstudio.com https://stats.g.doubleclick.net https://www.facebook.com https://www.google-analytics.com https://www.googletagmanager.com wss://*.hotjar.com wss://ws1.hotjar.com; child-src https://disqus.com https://vars.hotjar.com; frame-src https://disqus.com; style-src https://c.disquscdn.com; report-uri https://www-welivesecurity-com.api.cspconsole.com/v1/csp/report; report-to default;
server-timing: cdn-cache; desc=HIT, edge; dur=25
content-length: 50218
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
last-modified: Wed, 11 Nov 2020 18:18:46 GMT
etag: "5fac2b06-c42a"
report-to: {"group":"default","max_age":31536000,"endpoints":[{"url":"https://www-welivesecurity-com.api.cspconsole.com/v1/csp/report"}],"include_subdomains":false}
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=7776000, public
accept-ranges: bytes
expires: Wed, 08 Feb 2023 09:24:42 GMT

GET
H2 200 image3.png
www.welivesecurity.com/wp-content/uploads/2017/07/ 28 KB
28 KB 86ms
81ms Image
image/png 2a02:26f0:3500:12::1730:17bf
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.welivesecurity.com/wp-content/uploads/2017/07/image3.png

Requested by

Host: www.welivesecurity.com
URL: https://www.welivesecurity.com/2017/07/04/analysis-of-telebots-cunning-backdoor/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:3500:12::1730:17bf Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

6f64d89a1569272ec61f0a87bebe1eefd7749517c672aa34c52efa4c0c82b6c9

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://www.welivesecurity.com/2017/07/04/analysis-of-telebots-cunning-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

strict-transport-security: max-age=15724800
date: Thu, 08 Dec 2022 12:25:34 GMT
x-content-type-options: nosniff
content-security-policy-report-only: default-src 'self'; report-uri https://www-welivesecurity-com.api.cspconsole.com/v1/csp/report; report-to default;
server-timing: cdn-cache; desc=HIT, edge; dur=24
content-length: 28553
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
last-modified: Mon, 13 Apr 2020 18:32:06 GMT
etag: "5e94b026-6f89"
report-to: {"group":"default","max_age":31536000,"endpoints":[{"url":"https://www-welivesecurity-com.api.cspconsole.com/v1/csp/report"}],"include_subdomains":false}
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=7776000, public
accept-ranges: bytes
expires: Thu, 24 Nov 2022 16:05:24 GMT

GET
H2 200 image4.png
www.welivesecurity.com/wp-content/uploads/2017/07/ 21 KB
22 KB 86ms
82ms Image
image/png 2a02:26f0:3500:12::1730:17bf
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.welivesecurity.com/wp-content/uploads/2017/07/image4.png

Requested by

Host: www.welivesecurity.com
URL: https://www.welivesecurity.com/2017/07/04/analysis-of-telebots-cunning-backdoor/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:3500:12::1730:17bf Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

f59a73a3cc82269c7341ae1d401a0b4ab33162b890939411de453f67dceea3a0

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://www.welivesecurity.com/2017/07/04/analysis-of-telebots-cunning-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

strict-transport-security: max-age=15724800
date: Thu, 08 Dec 2022 12:25:34 GMT
x-content-type-options: nosniff
content-security-policy-report-only: default-src 'self'; report-uri https://www-welivesecurity-com.api.cspconsole.com/v1/csp/report; report-to default;
server-timing: cdn-cache; desc=HIT, edge; dur=23
content-length: 21861
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
last-modified: Mon, 13 Apr 2020 18:32:09 GMT
etag: "5e94b029-5565"
report-to: {"group":"default","max_age":31536000,"endpoints":[{"url":"https://www-welivesecurity-com.api.cspconsole.com/v1/csp/report"}],"include_subdomains":false}
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=7776000, public
accept-ranges: bytes
expires: Tue, 20 Dec 2022 03:31:19 GMT

GET
H2 200 image5.png
www.welivesecurity.com/wp-content/uploads/2017/07/ 34 KB
35 KB 87ms
82ms Image
image/png 2a02:26f0:3500:12::1730:17bf
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.welivesecurity.com/wp-content/uploads/2017/07/image5.png

Requested by

Host: www.welivesecurity.com
URL: https://www.welivesecurity.com/2017/07/04/analysis-of-telebots-cunning-backdoor/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:3500:12::1730:17bf Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

45216aa0f15d7f304b6fe8cbde2090988d77bfc7ff11ff499869ba1aa6b30d9d

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://www.welivesecurity.com/2017/07/04/analysis-of-telebots-cunning-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

strict-transport-security: max-age=15724800
date: Thu, 08 Dec 2022 12:25:34 GMT
x-content-type-options: nosniff
content-security-policy-report-only: img-src 'self' data: https://analytics.twitter.com https://cdn1.esetstatic.com https://googleads.g.doubleclick.net https://px.ads.linkedin.com https://script.hotjar.com https://syndication.twitter.com https://www.facebook.com https://www.google-analytics.com https://www.google.ca https://www.google.cl https://www.google.com https://www.google.com.ar https://www.google.com.br https://www.google.com.sv https://www.googletagmanager.com; script-src 'self' 'unsafe-eval' 'unsafe-inline' https://assets.esetstatic.com https://az416426.vo.msecnd.net https://connect.facebook.net https://googleads.g.doubleclick.net https://platform.twitter.com https://script.hotjar.com https://static.ads-twitter.com https://static.hotjar.com https://welivesecurity.disqus.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://www.youtube.com; connect-src 'self' https://*.akstat.io https://adservice.google.com https://cc.welivesecurity.com https://cdn.linkedin.oribi.io https://dc.services.visualstudio.com https://in.hotjar.com https://region1.google-analytics.com https://stats.g.doubleclick.net https://vc.hotjar.io https://www.facebook.com https://www.google-analytics.com https://www.googletagmanager.com wss://*.hotjar.com wss://ws1.hotjar.com; child-src https://disqus.com https://vars.hotjar.com; frame-src 'self' https://disqus.com https://platform.twitter.com https://vars.hotjar.com https://www.youtube.com; style-src 'self' https://assets.esetstatic.com https://c.disquscdn.com; font-src 'self'; report-uri https://www-welivesecurity-com.api.cspconsole.com/v1/csp/report; report-to default;
server-timing: cdn-cache; desc=HIT, edge; dur=21
content-length: 34355
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
last-modified: Wed, 11 Nov 2020 18:18:49 GMT
etag: "5fac2b09-8633"
report-to: {"group":"default","max_age":31536000,"endpoints":[{"url":"https://www-welivesecurity-com.api.cspconsole.com/v1/csp/report"}],"include_subdomains":false}
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=7776000, public
accept-ranges: bytes
expires: Sun, 12 Feb 2023 13:04:35 GMT

GET
H2 200 image6.png
www.welivesecurity.com/wp-content/uploads/2017/07/ 14 KB
14 KB 90ms
86ms Image
image/png 2a02:26f0:3500:12::1730:17bf
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.welivesecurity.com/wp-content/uploads/2017/07/image6.png

Requested by

Host: www.welivesecurity.com
URL: https://www.welivesecurity.com/2017/07/04/analysis-of-telebots-cunning-backdoor/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:3500:12::1730:17bf Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

15299f8cce69e734ae086d3b960e628ef4362e1d1109b401fb8c2a81020bf9a7

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://www.welivesecurity.com/2017/07/04/analysis-of-telebots-cunning-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

strict-transport-security: max-age=15724800
date: Thu, 08 Dec 2022 12:25:34 GMT
x-content-type-options: nosniff
content-security-policy-report-only: default-src 'self'; report-uri https://www-welivesecurity-com.api.cspconsole.com/v1/csp/report; report-to default;
server-timing: cdn-cache; desc=HIT, edge; dur=20
content-length: 13886
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
last-modified: Mon, 13 Apr 2020 18:32:14 GMT
etag: "5e94b02e-363e"
report-to: {"group":"default","max_age":31536000,"endpoints":[{"url":"https://www-welivesecurity-com.api.cspconsole.com/v1/csp/report"}],"include_subdomains":false}
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=7776000, public
accept-ranges: bytes
expires: Wed, 07 Dec 2022 17:03:20 GMT

GET
H2 200 image7.png
www.welivesecurity.com/wp-content/uploads/2017/07/ 18 KB
19 KB 91ms
86ms Image
image/png 2a02:26f0:3500:12::1730:17bf
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.welivesecurity.com/wp-content/uploads/2017/07/image7.png

Requested by

Host: www.welivesecurity.com
URL: https://www.welivesecurity.com/2017/07/04/analysis-of-telebots-cunning-backdoor/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:3500:12::1730:17bf Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

07b08ea224b7494aff9e9acc5257c563d20f438b1944334fc11833461a2ef433

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://www.welivesecurity.com/2017/07/04/analysis-of-telebots-cunning-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

strict-transport-security: max-age=15724800
date: Thu, 08 Dec 2022 12:25:34 GMT
x-content-type-options: nosniff
content-security-policy-report-only: default-src 'self'; report-uri https://www-welivesecurity-com.api.cspconsole.com/v1/csp/report; report-to default;
server-timing: cdn-cache; desc=HIT, edge; dur=21
content-length: 18916
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
last-modified: Wed, 11 Nov 2020 18:18:52 GMT
etag: "5fac2b0c-49e4"
report-to: {"group":"default","max_age":31536000,"endpoints":[{"url":"https://www-welivesecurity-com.api.cspconsole.com/v1/csp/report"}],"include_subdomains":false}
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=7776000, public
accept-ranges: bytes
expires: Fri, 16 Dec 2022 09:03:52 GMT

GET
H2 200 image8.png
www.welivesecurity.com/wp-content/uploads/2017/07/ 50 KB
51 KB 92ms
88ms Image
image/png 2a02:26f0:3500:12::1730:17bf
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.welivesecurity.com/wp-content/uploads/2017/07/image8.png

Requested by

Host: www.welivesecurity.com
URL: https://www.welivesecurity.com/2017/07/04/analysis-of-telebots-cunning-backdoor/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:3500:12::1730:17bf Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

fd6b27d75d7c3ba5ce98297ce2261ff676140d12846fa5feb424f724936e2d1c

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://www.welivesecurity.com/2017/07/04/analysis-of-telebots-cunning-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

strict-transport-security: max-age=15724800
date: Thu, 08 Dec 2022 12:25:34 GMT
x-content-type-options: nosniff
content-security-policy-report-only: default-src 'self'; report-uri https://www-welivesecurity-com.api.cspconsole.com/v1/csp/report; report-to default;
server-timing: cdn-cache; desc=HIT, edge; dur=17
content-length: 51556
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
last-modified: Wed, 11 Nov 2020 18:18:53 GMT
etag: "5fac2b0d-c964"
report-to: {"group":"default","max_age":31536000,"endpoints":[{"url":"https://www-welivesecurity-com.api.cspconsole.com/v1/csp/report"}],"include_subdomains":false}
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=7776000, public
accept-ranges: bytes
expires: Fri, 14 Oct 2022 15:59:46 GMT

GET
H2 200 ransomboggs-ransomware-ukraine-sandworm-623x432.jpg
www.welivesecurity.com/wp-content/uploads/2022/11/ 39 KB
44 KB 70ms
66ms Image
image/jpeg 2a02:26f0:3500:12::1730:17bf
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.welivesecurity.com/wp-content/uploads/2022/11/ransomboggs-ransomware-ukraine-sandworm-623x432.jpg

Requested by

Host: www.welivesecurity.com
URL: https://www.welivesecurity.com/2017/07/04/analysis-of-telebots-cunning-backdoor/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:3500:12::1730:17bf Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

21f73559c1dfc0702d3ce7204103058c3947ab642eb48d53c436e32e5e59c56c

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; child-src https://disqus.com https://vars.hotjar.com; connect-src 'self' http://ad.doubleclick.net https://.akamaihd.net https://.akstat.io https://.hotjar.com https://adservice.google.com https://captcha.eset.com https://cc.welivesecurity.com https://cdn.linkedin.oribi.io https://in.hotjar.com https://region1.google-analytics.com https://stats.g.doubleclick.net https://surveystats.hotjar.io https://trial-eum-clientnsv4-s.akamaihd.net https://trial-eum-clienttons-s.akamaihd.net https://vc.hotjar.io https://ws22.hotjar.com https://ws32.hotjar.com https://www.facebook.com https://www.google-analytics.com https://www.google.com https://www.googletagmanager.com https://www.opinionstage.com wss://.hotjar.com wss://ws1.hotjar.com; font-src 'self'; frame-src 'self' https://c.disquscdn.com https://disqus.com https://m.facebook.com https://platform.twitter.com https://tpc.googlesyndication.com https://vars.hotjar.com https://www.facebook.com https://www.googletagmanager.com https://www.instagram.com https://www.opinionstage.com https://www.slideshare.net https://www.youtube-nocookie.com https://www.youtube.com; img-src 'self' data: https://*.ads.linkedin.com https://adservice.google.com https://analytics.twitter.com https://c.disquscdn.com https://captcha.eset.com https://cdn1.esetstatic.com https://googleads.g.doubleclick.net https://px.ads.linkedin.com https://referrer.disqus.com https://region1.google-analytics.com https://script.hotjar.com https://secure.eset.com https://syndication.twitter.com https://t.co https://www.facebook.com https://www.google-analytics.com https://www.google.ad https://www.google.ae https://www.google.al https://www.google.at https://www.google.ba https://www.google.be https://www.google.bf https://www.google.bg https://www.google.bj https://www.google.bs https://www.google.ca https://www.google.cd https://www.google.ch https://www.google.ci https://www.google.cl https://www.google.cm https://www.google.cn https://www.google.co.ao https://www.google.co.cr https://www.google.co.id https://www.google.co.il https://www.google.co.in https://www.google.co.jp https://www.google.co.ke https://www.google.co.kr https://www.google.co.ma https://www.google.co.mz https://www.google.co.nz https://www.google.co.th https://www.google.co.tz https://www.google.co.ug https://www.google.co.uk https://www.google.co.uz https://www.google.co.ve https://www.google.co.za https://www.google.co.zm https://www.google.com https://www.google.com.ar https://www.google.com.au https://www.google.com.bd https://www.google.com.bh https://www.google.com.bo https://www.google.com.br https://www.google.com.co https://www.google.com.cu https://www.google.com.cy https://www.google.com.do https://www.google.com.ec https://www.google.com.eg https://www.google.com.gh https://www.google.com.gt https://www.google.com.hk https://www.google.com.jm https://www.google.com.kw https://www.google.com.lb https://www.google.com.mt https://www.google.com.mx https://www.google.com.my https://www.google.com.ng https://www.google.com.ni https://www.google.com.np https://www.google.com.om https://www.google.com.pa https://www.google.com.pe https://www.google.com.ph https://www.google.com.pk https://www.google.com.pr https://www.google.com.py https://www.google.com.qa https://www.google.com.sa https://www.google.com.sg https://www.google.com.sl https://www.google.com.sv https://www.google.com.tr https://www.google.com.tw https://www.google.com.ua https://www.google.com.uy https://www.google.com.vn https://www.google.cz https://www.google.de https://www.google.dk https://www.google.dz https://www.google.ee https://www.google.es https://www.google.fi https://www.google.fr https://www.google.ge https://www.google.gr https://www.google.gy https://www.google.hn https://www.google.hr https://www.google.hu https://www.google.ie https://www.google.is https://www.google.it https://www.google.jo https://www.google.kg https://www.google.kz https://www.google.lk https://www.google.lt https://www.google.lu https://www.google.lv https://www.google.mk https://www.google.mn https://www.google.mv https://www.google.nl https://www.google.no https://www.google.pl https://www.google.pt https://www.google.ro https://www.google.rs https://www.google.ru https://www.google.sc https://www.google.se https://www.google.si https://www.google.sk https://www.google.sn https://www.google.tn https://www.google.tt https://www.google.vg https://www.googletagmanager.com https://www.linkedin.com https://www.youtube.com; manifest-src 'none'; media-src 'self'; object-src 'self'; prefetch-src 'none' https://c.disquscdn.com https://disqus.com; script-src 'self' 'unsafe-eval' 'unsafe-inline' https://assets.esetstatic.com https://cdn.esetstatic.com https://connect.facebook.net https://googleads.g.doubleclick.net https://platform.twitter.com https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tpc.googlesyndication.com https://welivesecurity.disqus.com https://www.google-analytics.com https://www.google.com https://www.googleadservices.com https://www.googletagmanager.com https://www.instagram.com https://www.opinionstage.com https://www.youtube.com; style-src 'self' 'unsafe-inline' https://assets.esetstatic.com https://c.disquscdn.com https://cdn.esetstatic.com; worker-src 'none'; report-uri https://www-welivesecurity-com.api.cspconsole.com/v1/csp/report; report-to default;
Strict-Transport-Security	max-age=15724800
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://www.welivesecurity.com/2017/07/04/analysis-of-telebots-cunning-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

content-security-policy: default-src 'none'; child-src https://disqus.com https://vars.hotjar.com; connect-src 'self' http://ad.doubleclick.net https://*.akamaihd.net https://*.akstat.io https://*.hotjar.com https://adservice.google.com https://captcha.eset.com https://cc.welivesecurity.com https://cdn.linkedin.oribi.io https://in.hotjar.com https://region1.google-analytics.com https://stats.g.doubleclick.net https://surveystats.hotjar.io https://trial-eum-clientnsv4-s.akamaihd.net https://trial-eum-clienttons-s.akamaihd.net https://vc.hotjar.io https://ws22.hotjar.com https://ws32.hotjar.com https://www.facebook.com https://www.google-analytics.com https://www.google.com https://www.googletagmanager.com https://www.opinionstage.com wss://*.hotjar.com wss://ws1.hotjar.com; font-src 'self'; frame-src 'self' https://c.disquscdn.com https://disqus.com https://m.facebook.com https://platform.twitter.com https://tpc.googlesyndication.com https://vars.hotjar.com https://www.facebook.com https://www.googletagmanager.com https://www.instagram.com https://www.opinionstage.com https://www.slideshare.net https://www.youtube-nocookie.com https://www.youtube.com; img-src 'self' data: https://*.ads.linkedin.com https://adservice.google.com https://analytics.twitter.com https://c.disquscdn.com https://captcha.eset.com https://cdn1.esetstatic.com https://googleads.g.doubleclick.net https://px.ads.linkedin.com https://referrer.disqus.com https://region1.google-analytics.com https://script.hotjar.com https://secure.eset.com https://syndication.twitter.com https://t.co https://www.facebook.com https://www.google-analytics.com https://www.google.ad https://www.google.ae https://www.google.al https://www.google.at https://www.google.ba https://www.google.be https://www.google.bf https://www.google.bg https://www.google.bj https://www.google.bs https://www.google.ca https://www.google.cd https://www.google.ch https://www.google.ci https://www.google.cl https://www.google.cm https://www.google.cn https://www.google.co.ao https://www.google.co.cr https://www.google.co.id https://www.google.co.il https://www.google.co.in https://www.google.co.jp https://www.google.co.ke https://www.google.co.kr https://www.google.co.ma https://www.google.co.mz https://www.google.co.nz https://www.google.co.th https://www.google.co.tz https://www.google.co.ug https://www.google.co.uk https://www.google.co.uz https://www.google.co.ve https://www.google.co.za https://www.google.co.zm https://www.google.com https://www.google.com.ar https://www.google.com.au https://www.google.com.bd https://www.google.com.bh https://www.google.com.bo https://www.google.com.br https://www.google.com.co https://www.google.com.cu https://www.google.com.cy https://www.google.com.do https://www.google.com.ec https://www.google.com.eg https://www.google.com.gh https://www.google.com.gt https://www.google.com.hk https://www.google.com.jm https://www.google.com.kw https://www.google.com.lb https://www.google.com.mt https://www.google.com.mx https://www.google.com.my https://www.google.com.ng https://www.google.com.ni https://www.google.com.np https://www.google.com.om https://www.google.com.pa https://www.google.com.pe https://www.google.com.ph https://www.google.com.pk https://www.google.com.pr https://www.google.com.py https://www.google.com.qa https://www.google.com.sa https://www.google.com.sg https://www.google.com.sl https://www.google.com.sv https://www.google.com.tr https://www.google.com.tw https://www.google.com.ua https://www.google.com.uy https://www.google.com.vn https://www.google.cz https://www.google.de https://www.google.dk https://www.google.dz https://www.google.ee https://www.google.es https://www.google.fi https://www.google.fr https://www.google.ge https://www.google.gr https://www.google.gy https://www.google.hn https://www.google.hr https://www.google.hu https://www.google.ie https://www.google.is https://www.google.it https://www.google.jo https://www.google.kg https://www.google.kz https://www.google.lk https://www.google.lt https://www.google.lu https://www.google.lv https://www.google.mk https://www.google.mn https://www.google.mv https://www.google.nl https://www.google.no https://www.google.pl https://www.google.pt https://www.google.ro https://www.google.rs https://www.google.ru https://www.google.sc https://www.google.se https://www.google.si https://www.google.sk https://www.google.sn https://www.google.tn https://www.google.tt https://www.google.vg https://www.googletagmanager.com https://www.linkedin.com https://www.youtube.com; manifest-src 'none'; media-src 'self'; object-src 'self'; prefetch-src 'none' https://c.disquscdn.com https://disqus.com; script-src 'self' 'unsafe-eval' 'unsafe-inline' https://assets.esetstatic.com https://cdn.esetstatic.com https://connect.facebook.net https://googleads.g.doubleclick.net https://platform.twitter.com https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tpc.googlesyndication.com https://welivesecurity.disqus.com https://www.google-analytics.com https://www.google.com https://www.googleadservices.com https://www.googletagmanager.com https://www.instagram.com https://www.opinionstage.com https://www.youtube.com; style-src 'self' 'unsafe-inline' https://assets.esetstatic.com https://c.disquscdn.com https://cdn.esetstatic.com; worker-src 'none'; report-uri https://www-welivesecurity-com.api.cspconsole.com/v1/csp/report; report-to default;
strict-transport-security: max-age=15724800
x-content-type-options: nosniff
date: Thu, 08 Dec 2022 12:25:34 GMT
server-timing: cdn-cache; desc=HIT, edge; dur=1
content-length: 40288
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
last-modified: Mon, 28 Nov 2022 14:17:35 GMT
etag: "6384c2ff-9d60"
report-to: {"group":"default","max_age":31536000,"endpoints":[{"url":"https://www-welivesecurity-com.api.cspconsole.com/v1/csp/report"}],"include_subdomains":false}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=7776000, public
accept-ranges: bytes
expires: Sun, 26 Feb 2023 15:23:55 GMT

GET
H2 200 shared-service-centers-cybersecurity-risks-623x415.jpg
www.welivesecurity.com/wp-content/uploads/2022/06/ 52 KB
52 KB 81ms
77ms Image
image/jpeg 2a02:26f0:3500:12::1730:17bf
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.welivesecurity.com/wp-content/uploads/2022/06/shared-service-centers-cybersecurity-risks-623x415.jpg

Requested by

Host: www.welivesecurity.com
URL: https://www.welivesecurity.com/2017/07/04/analysis-of-telebots-cunning-backdoor/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:3500:12::1730:17bf Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

409658f033da9872ab0c27643e1b6b03d694d372866f404a8410eb93274b7968

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://www.welivesecurity.com/2017/07/04/analysis-of-telebots-cunning-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

strict-transport-security: max-age=15724800
date: Thu, 08 Dec 2022 12:25:34 GMT
x-content-type-options: nosniff
content-security-policy-report-only: default-src 'self'; report-uri https://www-welivesecurity-com.api.cspconsole.com/v1/csp/report; report-to default;
server-timing: cdn-cache; desc=HIT, edge; dur=1
content-length: 53047
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
last-modified: Wed, 29 Jun 2022 04:05:34 GMT
etag: "62bbcf8e-cf37"
report-to: {"group":"default","max_age":31536000,"endpoints":[{"url":"https://www-welivesecurity-com.api.cspconsole.com/v1/csp/report"}],"include_subdomains":false}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=7776000, public
accept-ranges: bytes
expires: Tue, 27 Sep 2022 09:36:21 GMT

GET
H2 200 vpn-faq-common-questions-answered-623x415.jpg
www.welivesecurity.com/wp-content/uploads/2022/06/ 42 KB
43 KB 81ms
78ms Image
image/jpeg 2a02:26f0:3500:12::1730:17bf
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.welivesecurity.com/wp-content/uploads/2022/06/vpn-faq-common-questions-answered-623x415.jpg

Requested by

Host: www.welivesecurity.com
URL: https://www.welivesecurity.com/2017/07/04/analysis-of-telebots-cunning-backdoor/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:3500:12::1730:17bf Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

ed013239fcc3874aa2e9ab3a02864ca1e6fe0c98ce3aa297cd8f6a2fd6cace3b

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://www.welivesecurity.com/2017/07/04/analysis-of-telebots-cunning-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

strict-transport-security: max-age=15724800
date: Thu, 08 Dec 2022 12:25:34 GMT
x-content-type-options: nosniff
content-security-policy-report-only: default-src 'self'; report-uri https://www-welivesecurity-com.api.cspconsole.com/v1/csp/report; report-to default;
server-timing: cdn-cache; desc=HIT, edge; dur=1
content-length: 42963
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
last-modified: Fri, 24 Jun 2022 00:17:51 GMT
etag: "62b502af-a7d3"
report-to: {"group":"default","max_age":31536000,"endpoints":[{"url":"https://www-welivesecurity-com.api.cspconsole.com/v1/csp/report"}],"include_subdomains":false}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=7776000, public
accept-ranges: bytes
expires: Mon, 07 Nov 2022 06:10:37 GMT

GET
H2 200 industroyer-blackout-anniverary-fifth-623x415.jpg
www.welivesecurity.com/wp-content/uploads/2022/06/ 44 KB
45 KB 83ms
79ms Image
image/jpeg 2a02:26f0:3500:12::1730:17bf
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.welivesecurity.com/wp-content/uploads/2022/06/industroyer-blackout-anniverary-fifth-623x415.jpg

Requested by

Host: www.welivesecurity.com
URL: https://www.welivesecurity.com/2017/07/04/analysis-of-telebots-cunning-backdoor/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:3500:12::1730:17bf Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

a375e7cd427cc4636fd16334feac292258603559e5bed0936b77d6a2bdf87c47

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://www.welivesecurity.com/2017/07/04/analysis-of-telebots-cunning-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

strict-transport-security: max-age=15724800
date: Thu, 08 Dec 2022 12:25:34 GMT
x-content-type-options: nosniff
content-security-policy-report-only: default-src 'self'; img-src https://analytics.twitter.com https://googleads.g.doubleclick.net https://px.ads.linkedin.com https://syndication.twitter.com https://www.google-analytics.com https://www.google.cl https://www.google.com; script-src https://assets.esetstatic.com https://az416426.vo.msecnd.net https://googleads.g.doubleclick.net https://static.ads-twitter.com https://static.hotjar.com https://welivesecurity.disqus.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com; connect-src https://*.akstat.io https://adservice.google.com https://dc.services.visualstudio.com https://stats.g.doubleclick.net https://www.facebook.com https://www.google-analytics.com https://www.googletagmanager.com wss://*.hotjar.com wss://ws1.hotjar.com; child-src https://disqus.com https://vars.hotjar.com; frame-src https://disqus.com; style-src https://c.disquscdn.com; report-uri https://www-welivesecurity-com.api.cspconsole.com/v1/csp/report; report-to default;
server-timing: cdn-cache; desc=HIT, edge; dur=1
content-length: 44692
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
last-modified: Sat, 11 Jun 2022 01:42:06 GMT
etag: "62a3f2ee-ae94"
report-to: {"group":"default","max_age":31536000,"endpoints":[{"url":"https://www-welivesecurity-com.api.cspconsole.com/v1/csp/report"}],"include_subdomains":false}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=7776000, public
accept-ranges: bytes
expires: Sun, 22 Jan 2023 17:33:05 GMT

GET
H2 200 eset-wls-footer-1.svg
www.welivesecurity.com/wp-content/themes/eset-wls-2018/assets/img/new-logo/ 3 KB
2 KB 92ms
89ms Image
image/svg+xml 2a02:26f0:3500:12::1730:17bf
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.welivesecurity.com/wp-content/themes/eset-wls-2018/assets/img/new-logo/eset-wls-footer-1.svg

Requested by

Host: www.welivesecurity.com
URL: https://www.welivesecurity.com/2017/07/04/analysis-of-telebots-cunning-backdoor/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:3500:12::1730:17bf Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

7df5345a52f22643ef051bf74f41d9a5a5644d5e699480a81ae8825b8ab5e533

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://www.welivesecurity.com/2017/07/04/analysis-of-telebots-cunning-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

strict-transport-security: max-age=15724800
content-encoding: br
x-content-type-options: nosniff
date: Thu, 08 Dec 2022 12:25:34 GMT
content-security-policy-report-only: default-src 'self'; report-uri https://www-welivesecurity-com.api.cspconsole.com/v1/csp/report; report-to default;
server-timing: cdn-cache; desc=HIT, edge; dur=9
content-length: 1087
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
last-modified: Fri, 14 Oct 2022 21:41:22 GMT
etag: W/"62e3ef56-be5"
report-to: {"group":"default","max_age":31536000,"endpoints":[{"url":"https://www-welivesecurity-com.api.cspconsole.com/v1/csp/report"}],"include_subdomains":false}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public
expires: Fri, 25 Nov 2022 16:01:20 GMT

GET
H2 200 eset-wls-footer-2.svg
www.welivesecurity.com/wp-content/themes/eset-wls-2018/assets/img/new-logo/ 3 KB
2 KB 92ms
89ms Image
image/svg+xml 2a02:26f0:3500:12::1730:17bf
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.welivesecurity.com/wp-content/themes/eset-wls-2018/assets/img/new-logo/eset-wls-footer-2.svg

Requested by

Host: www.welivesecurity.com
URL: https://www.welivesecurity.com/2017/07/04/analysis-of-telebots-cunning-backdoor/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:3500:12::1730:17bf Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

e22e3416c5b454c2fc3c8e8185b478647446789abbee258ec18a5791880eaf1b

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://www.welivesecurity.com/2017/07/04/analysis-of-telebots-cunning-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

strict-transport-security: max-age=15724800
content-encoding: br
x-content-type-options: nosniff
date: Thu, 08 Dec 2022 12:25:34 GMT
content-security-policy-report-only: default-src 'self'; report-uri https://www-welivesecurity-com.api.cspconsole.com/v1/csp/report; report-to default;
server-timing: cdn-cache; desc=HIT, edge; dur=17
content-length: 1058
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
last-modified: Wed, 21 Sep 2022 13:23:04 GMT
etag: W/"62e3ef56-a0b"
report-to: {"group":"default","max_age":31536000,"endpoints":[{"url":"https://www-welivesecurity-com.api.cspconsole.com/v1/csp/report"}],"include_subdomains":false}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public
expires: Sat, 26 Nov 2022 00:28:09 GMT

GET
H2 200 main.js Show response
www.welivesecurity.com/wp-content/themes/eset-wls-2018/assets/js/ 318 KB
89 KB 33ms
33ms Script
application/javascript 2a02:26f0:3500:12::1730:17bf
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.welivesecurity.com/wp-content/themes/eset-wls-2018/assets/js/main.js?id=fef3139dcedd23afc232

Requested by

Host: www.welivesecurity.com
URL: https://www.welivesecurity.com/2017/07/04/analysis-of-telebots-cunning-backdoor/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:3500:12::1730:17bf Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

822800703045ecbccb15cff577f1f09d9b4efee6ae916396a6aceb3f6544b9a5

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://www.welivesecurity.com/2017/07/04/analysis-of-telebots-cunning-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

strict-transport-security: max-age=15724800
content-encoding: br
x-content-type-options: nosniff
date: Thu, 08 Dec 2022 12:25:34 GMT
content-security-policy-report-only: default-src 'self'; report-uri https://www-welivesecurity-com.api.cspconsole.com/v1/csp/report; report-to default;
server-timing: cdn-cache; desc=HIT, edge; dur=4
content-length: 89989
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
last-modified: Sat, 27 Aug 2022 17:01:14 GMT
etag: W/"62f17c72-4f74a"
report-to: {"group":"default","max_age":31536000,"endpoints":[{"url":"https://www-welivesecurity-com.api.cspconsole.com/v1/csp/report"}],"include_subdomains":false}
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public
expires: Fri, 25 Nov 2022 16:50:43 GMT

GET
H2 200 crayon.min.js Show response
www.welivesecurity.com/wp-content/themes/eset-wls-2018/assets/static/js/ 22 KB
6 KB 54ms
54ms Script
application/javascript 2a02:26f0:3500:12::1730:17bf
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.welivesecurity.com/wp-content/themes/eset-wls-2018/assets/static/js/crayon.min.js

Requested by

Host: www.welivesecurity.com
URL: https://www.welivesecurity.com/2017/07/04/analysis-of-telebots-cunning-backdoor/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:3500:12::1730:17bf Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

193fbb968733b8a7049da19274546e6b80b76e9a8f1b837fee9a5fdeb8f97c7b

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://www.welivesecurity.com/2017/07/04/analysis-of-telebots-cunning-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

strict-transport-security: max-age=15724800
content-encoding: br
referrer-policy: no-referrer-when-downgrade
x-content-type-options: nosniff
last-modified: Sun, 29 May 2022 15:53:35 GMT
date: Thu, 08 Dec 2022 12:25:34 GMT
etag: W/"627b93fa-5741"
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public
server-timing: cdn-cache; desc=HIT, edge; dur=2
content-length: 6050
x-xss-protection: 1; mode=block
expires: Sat, 27 Aug 2022 15:49:03 GMT

GET
H2 200 comment_count.js Show response
www.welivesecurity.com/wp-content/plugins/disqus-comment-system/public/js/ 889 B
628 B 59ms
54ms Script
application/javascript 2a02:26f0:3500:12::1730:17bf
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.welivesecurity.com/wp-content/plugins/disqus-comment-system/public/js/comment_count.js?ver=3.0.16

Requested by

Host: www.welivesecurity.com
URL: https://www.welivesecurity.com/2017/07/04/analysis-of-telebots-cunning-backdoor/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:3500:12::1730:17bf Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

cea0a05c5af6e21a409875328ed2e3dba79131b7c41f8ea07d0e0e02c7b7b59e

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://www.welivesecurity.com/2017/07/04/analysis-of-telebots-cunning-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

strict-transport-security: max-age=15724800
content-encoding: br
referrer-policy: no-referrer-when-downgrade
x-content-type-options: nosniff
last-modified: Sun, 29 May 2022 16:12:34 GMT
date: Thu, 08 Dec 2022 12:25:34 GMT
etag: W/"627b9494-379"
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public
server-timing: cdn-cache; desc=HIT, edge; dur=7
content-length: 307
x-xss-protection: 1; mode=block
expires: Sat, 27 Aug 2022 15:49:44 GMT

GET
H2 200 comment_embed.js Show response
www.welivesecurity.com/wp-content/plugins/disqus-comment-system/public/js/ 1 KB
700 B 63ms
56ms Script
application/javascript 2a02:26f0:3500:12::1730:17bf
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.welivesecurity.com/wp-content/plugins/disqus-comment-system/public/js/comment_embed.js?ver=3.0.16

Requested by

Host: www.welivesecurity.com
URL: https://www.welivesecurity.com/2017/07/04/analysis-of-telebots-cunning-backdoor/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:3500:12::1730:17bf Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

f055e217bde76d711bd8b42af773f9f99b8a29d81ad9ed10b6379cc7e6c60452

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://www.welivesecurity.com/2017/07/04/analysis-of-telebots-cunning-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

strict-transport-security: max-age=15724800
content-encoding: br
referrer-policy: no-referrer-when-downgrade
x-content-type-options: nosniff
last-modified: Sun, 29 May 2022 15:50:39 GMT
date: Thu, 08 Dec 2022 12:25:34 GMT
etag: W/"627b93fd-47e"
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public
server-timing: cdn-cache; desc=HIT, edge; dur=9
content-length: 379
x-xss-protection: 1; mode=block
expires: Sat, 27 Aug 2022 15:50:38 GMT

GET ai.0.js
az416426.vo.msecnd.net/scripts/a/ 0
0

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 293 KB
96 KB 138ms
53ms Script
application/javascript 2a00:1450:4001:810::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-PMDGSM

Requested by

Host: www.welivesecurity.com
URL: https://www.welivesecurity.com/2017/07/04/analysis-of-telebots-cunning-backdoor/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

667cfbb57ee3e8993768bd7d5014d330129d16fa2e99fde4eb58eddeaee54653

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://www.welivesecurity.com/2017/07/04/analysis-of-telebots-cunning-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 12:25:34 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 97564
x-xss-protection: 0
last-modified: Thu, 08 Dec 2022 12:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 08 Dec 2022 12:25:34 GMT

GET 7R9SM-QGSYF-QDLJK-UETXR-SPM6B
s.go-mpulse.net/boomerang/ 0
0

GET 7R9SM-QGSYF-QDLJK-UETXR-SPM6B
s.go-mpulse.net/boomerang/ Frame E278 0
0

GET
H2 200 collect
www.google-analytics.com/ 35 B
393 B 102ms
26ms Image
image/gif 2a00:1450:4001:806::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&cid=129900.9773623745&tid=UA-76266002-27&dl=https://www.welivesecurity.com/2017/07/04/analysis-of-telebots-cunning-backdoor/&t=event&ec=Tracking%20check%20-%20recurring&ea=Script%20loaded&ni=1&cd1=wls&aip=1&z=907765

Requested by

Host: www.welivesecurity.com
URL: https://www.welivesecurity.com/2017/07/04/analysis-of-telebots-cunning-backdoor/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://www.welivesecurity.com/2017/07/04/analysis-of-telebots-cunning-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 07 Dec 2022 12:43:05 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 85349
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 check.png
cdn1.esetstatic.com/ESET/INT/assets/img/ 68 B
414 B 159ms
30ms Image
image/png 18.66.97.100
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn1.esetstatic.com/ESET/INT/assets/img/check.png?country=wls&gcode=scriptLoaded&z=597546
Requested by: Host: www.welivesecurity.com
URL: https://www.welivesecurity.com/2017/07/04/analysis-of-telebots-cunning-backdoor/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.97.100 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-97-100.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 260865134b6e69ca7bafa9e8ddcd59fb6ffbf727f50a3d2dd186d217c8c79694

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://www.welivesecurity.com/2017/07/04/analysis-of-telebots-cunning-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Wed, 07 Dec 2022 21:54:09 GMT
via: 1.1 367a4718be97a49df7ac0500a986437a.cloudfront.net (CloudFront)
last-modified: Thu, 20 Oct 2022 06:22:16 GMT
server: AmazonS3
x-amz-cf-pop: FRA56-P2
age: 52287
etag: "5df0ac2d51cfecbde35e8dd1ba3a8d77"
vary: Accept-Encoding, Origin
x-cache: Hit from cloudfront
content-type: image/png
accept-ranges: bytes
content-length: 68
x-amz-cf-id: Izme1SRVidtxL5M9vjBseW7JGfL3k9Mjaxlja9JhLXZf9WHqd7lbuA==

GET
H2 200 li-shield-icon.svg
www.welivesecurity.com/wp-content/themes/eset-wls-2018/assets/images/ 961 B
1 KB 49ms
34ms Image
image/svg+xml 2a02:26f0:3500:12::1730:17bf
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.welivesecurity.com/wp-content/themes/eset-wls-2018/assets/images/li-shield-icon.svg?82256d0e5b3abb3d9d256afa85d732a4

Requested by

Host: www.welivesecurity.com
URL: https://www.welivesecurity.com/wp-content/themes/eset-wls-2018/assets/css/main.css?id=c854c8614bc1ecc213b8

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:3500:12::1730:17bf Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

e0c2fd69b7d441b42045d474afe52d2bdbb81a44c8d73e2c8271e4114003d991

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://www.welivesecurity.com/wp-content/themes/eset-wls-2018/assets/css/main.css?id=c854c8614bc1ecc213b8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

strict-transport-security: max-age=15724800
content-encoding: br
x-content-type-options: nosniff
date: Thu, 08 Dec 2022 12:25:34 GMT
content-security-policy-report-only: default-src 'self'; report-uri https://www-welivesecurity-com.api.cspconsole.com/v1/csp/report; report-to default;
server-timing: cdn-cache; desc=HIT, edge; dur=1
content-length: 487
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
last-modified: Thu, 13 Oct 2022 16:25:13 GMT
etag: W/"6326d12c-3c1"
report-to: {"group":"default","max_age":31536000,"endpoints":[{"url":"https://www-welivesecurity-com.api.cspconsole.com/v1/csp/report"}],"include_subdomains":false}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public
expires: Tue, 20 Dec 2022 21:04:32 GMT

GET
H2 200 button-flag-50x60.svg
www.welivesecurity.com/wp-content/themes/eset-wls-2018/assets/img/ 459 B
784 B 45ms
36ms Image
image/svg+xml 2a02:26f0:3500:12::1730:17bf
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.welivesecurity.com/wp-content/themes/eset-wls-2018/assets/img/button-flag-50x60.svg

Requested by

Host: www.welivesecurity.com
URL: https://www.welivesecurity.com/wp-content/themes/eset-wls-2018/assets/css/main.css?id=c854c8614bc1ecc213b8

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:3500:12::1730:17bf Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

5159dca2fe03c327248fd3b685f497f9f521c91d243ffaf43077601fedf56f7a

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://www.welivesecurity.com/wp-content/themes/eset-wls-2018/assets/css/main.css?id=c854c8614bc1ecc213b8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

strict-transport-security: max-age=15724800
content-encoding: br
x-content-type-options: nosniff
date: Thu, 08 Dec 2022 12:25:34 GMT
content-security-policy-report-only: default-src 'self'; report-uri https://www-welivesecurity-com.api.cspconsole.com/v1/csp/report; report-to default;
server-timing: cdn-cache; desc=HIT, edge; dur=4
content-length: 234
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
last-modified: Tue, 20 Sep 2022 09:21:18 GMT
etag: W/"631710bf-1cb"
report-to: {"group":"default","max_age":31536000,"endpoints":[{"url":"https://www-welivesecurity-com.api.cspconsole.com/v1/csp/report"}],"include_subdomains":false}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public
expires: Mon, 19 Dec 2022 09:21:18 GMT

GET
H2 200 Fedra-Sans-Alt-Book-Italic.woff
www.welivesecurity.com/wp-content/themes/eset-wls-2018/assets/fonts/ 40 KB
40 KB 47ms
38ms Font
font/woff 2a02:26f0:3500:12::1730:17bf
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.welivesecurity.com/wp-content/themes/eset-wls-2018/assets/fonts/Fedra-Sans-Alt-Book-Italic.woff?f299cc2feeecf266ff50b5ea8b3a3deb

Requested by

Host: www.welivesecurity.com
URL: https://www.welivesecurity.com/wp-content/themes/eset-wls-2018/assets/css/main.css?id=c854c8614bc1ecc213b8

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:3500:12::1730:17bf Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

63a41173db39c92635a87b39eedb581e8a1c3142372ebced441ce927fef343a1

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.welivesecurity.com/wp-content/themes/eset-wls-2018/assets/css/main.css?id=c854c8614bc1ecc213b8
Origin: https://www.welivesecurity.com
accept-language: fr-FR,fr;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

unused62: 8096267
strict-transport-security: max-age=15724800
date: Thu, 08 Dec 2022 12:25:34 GMT
referrer-policy: no-referrer-when-downgrade
x-content-type-options: nosniff
last-modified: Sun, 13 Feb 2022 05:51:53 GMT
etag: "62089c79-9ec0"
content-type: font/woff
access-control-allow-origin: *
cache-control: max-age=31536000, public
server-timing: cdn-cache; desc=HIT, edge; dur=3
accept-ranges: bytes
content-length: 40640
x-xss-protection: 1; mode=block
expires: Tue, 28 Feb 2023 15:46:53 GMT

GET
H/1.1 200
OK count.js Show response
welivesecurity.disqus.com/ 1 KB
2 KB 85ms
24ms Script
application/javascript 199.232.192.134
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://welivesecurity.disqus.com/count.js

Requested by

Host: www.welivesecurity.com
URL: https://www.welivesecurity.com/wp-content/plugins/disqus-comment-system/public/js/comment_count.js?ver=3.0.16

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

199.232.192.134 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

3487ef2baf0c08ba660a8a143cdeb8ebeec961eea04bccd7c49096b4eb26b875

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://www.welivesecurity.com/2017/07/04/analysis-of-telebots-cunning-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Date: Thu, 08 Dec 2022 12:25:34 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=300; includeSubdomains
X-Amz-Cf-Pop: DFW3-C1
Age: 100
Cross-Origin-Resource-Policy: cross-origin
Connection: keep-alive
Content-Length: 871
X-XSS-Protection: 1; mode=block
Last-Modified: Mon, 05 Dec 2022 18:18:14 GMT
Server: nginx
ETag: "638e35e6-367"
Vary: Accept-Encoding
Content-Type: application/javascript; charset=utf-8
Cache-Control: public, max-age=300
Link: <https://disqus.com>; rel=preconnect, <https://c.disquscdn.com>; rel=preconnect
X-Amz-Cf-Id: bARQwIs7aCMo2DjwF6ght2P0UinTk1x1f7lwOtcWDUOGjDn_eUXo6A==

GET
H/1.1 200
OK embed.js Show response
welivesecurity.disqus.com/ 78 KB
25 KB 208ms
147ms Script
application/javascript 199.232.192.134
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://welivesecurity.disqus.com/embed.js

Requested by

Host: www.welivesecurity.com
URL: https://www.welivesecurity.com/wp-content/plugins/disqus-comment-system/public/js/comment_embed.js?ver=3.0.16

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

199.232.192.134 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

openresty /

Resource Hash

5425ae5b9cba24d2af92cb5389060f9c1dd5ac7bbf45fdd73085fa2e7e5e0bae

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://www.welivesecurity.com/2017/07/04/analysis-of-telebots-cunning-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Date: Thu, 08 Dec 2022 12:25:34 GMT
Content-Encoding: gzip
Strict-Transport-Security: max-age=300; includeSubdomains
Server: openresty
Age: 0
Vary: Accept-Encoding
Content-Type: application/javascript; charset=utf-8
Cache-Control: private, max-age=60
X-Service: router
Cross-Origin-Resource-Policy: cross-origin
Connection: keep-alive
Link: <https://disqus.com>; rel=preconnect, <https://c.disquscdn.com>; rel=preconnect
Content-Length: 25623

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 49 KB
20 KB 27ms
26ms Script
text/javascript 2a00:1450:4001:806::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PMDGSM

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

b42e4a056cb5b80c5a315040826866445ec9332f0749e184509ab2d9d3b86719

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://www.welivesecurity.com/2017/07/04/analysis-of-telebots-cunning-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Thu, 08 Dec 2022 11:24:40 GMT
last-modified: Tue, 27 Sep 2022 22:01:05 GMT
server: Golfe2
age: 3654
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20039
expires: Thu, 08 Dec 2022 13:24:40 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 181 KB
66 KB 47ms
46ms Script
application/javascript 2a00:1450:4001:810::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-FBY6B30C4M&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PMDGSM

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

f5865f390994c61dc372c020365fed34264f1b38ab4359750363c8003d23dec4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://www.welivesecurity.com/2017/07/04/analysis-of-telebots-cunning-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 12:25:34 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 67311
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Thu, 08 Dec 2022 12:25:34 GMT

GET
H2 200 app.min.css
cdn.esetstatic.com/cookie-consent/v3/ 20 KB
4 KB 199ms
21ms Stylesheet
text/css 2620:1ec:46::44
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.esetstatic.com/cookie-consent/v3/app.min.css
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PMDGSM
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:46::44 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: ddf0e65e326bc99627ac2d1df7babf8780bb64fe4fa08bb1a0e5d772fb2e3c94

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://www.welivesecurity.com/2017/07/04/analysis-of-telebots-cunning-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 12:25:34 GMT
content-encoding: br
last-modified: Wed, 30 Nov 2022 12:49:33 GMT
server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0
content-md5: UNIR6ckj9LYv2HjS8DmsqQ==
x-azure-ref-originshield: 0cUeRYwAAAACa5EDk5YJcRaVYfW9tfEg8TE9OMjFFREdFMTcwNQA5NTkyY2QwMy0yOTk3LTRmYTYtYmU0Yi0wYmJiNGYyNGM5Mjk=
etag: "0x8DAD2D15474DB45"
x-azure-ref: 0vteRYwAAAADJAHd6LLRzQ5OBchOWVbvDTFRTRURHRTEyMTIAOTU5MmNkMDMtMjk5Ny00ZmE2LWJlNGItMGJiYjRmMjRjOTI5
x-cache: TCP_HIT
content-type: text/css
x-ms-request-id: 888ac078-d01e-0063-43c9-099d43000000
x-ms-version: 2018-03-28
accept-ranges: bytes

GET
H2 200 app.min.js Show response
cdn.esetstatic.com/cookie-consent/v3/ 380 KB
101 KB 201ms
23ms Script
text/javascript 2620:1ec:46::44
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.esetstatic.com/cookie-consent/v3/app.min.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PMDGSM
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:46::44 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: e3136ed18810649908a21e1af3d5ed10eb6f0b06f8e7653362e2303870aaf8b8

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://www.welivesecurity.com/2017/07/04/analysis-of-telebots-cunning-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 12:25:34 GMT
content-encoding: br
last-modified: Fri, 11 Nov 2022 13:55:52 GMT
server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0
content-md5: K5sSxzCCPHeLwhwvXztCjQ==
x-azure-ref-originshield: 0UhqQYwAAAADB7Nj2S0ZUTKqZh2pys9yVTE9OMjFFREdFMTYwNQA5NTkyY2QwMy0yOTk3LTRmYTYtYmU0Yi0wYmJiNGYyNGM5Mjk=
etag: "0x8DAC3EC72913F28"
x-azure-ref: 0vteRYwAAAADAhAyXCnYQTIynTnm2S+dqTFRTRURHRTEyMTIAOTU5MmNkMDMtMjk5Ny00ZmE2LWJlNGItMGJiYjRmMjRjOTI5
x-cache: TCP_HIT
content-type: text/javascript
x-ms-request-id: d7f0055d-901e-0062-13a0-09c29f000000
x-ms-version: 2018-03-28
accept-ranges: bytes

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 27ms
27ms Image
image/gif 2a00:1450:4001:806::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j98&aip=1&a=153485782&t=pageview&_s=1&dl=https%3A%2F%2Fwww.welivesecurity.com%2F2017%2F07%2F04%2Fanalysis-of-telebots-cunning-backdoor%2F&ul=en-us&de=UTF-8&dt=Analysis%20of%20TeleBots%E2%80%99%20cunning%20backdoor%20%7C%20WeLiveSecurity&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAEABAAAAAAAAIg~&cid=1685996167.1670502335&tid=UA-37839312-1&_gid=126200217.1670502335&gtm=2wgbu0PMDGSM&cd1=Ukraine%20Crisis%20%E2%80%93%20Digital%20Security%20Resource%20Center&cd2=Anton%20Cherepanov&cd3=1.1k-1.5k&cd4=&cd5=2022-12-08T12%3A25%3A34.634%2B00%3A00&cd6=Office%20Hours&cd7=www.welivesecurity.com%2F2017%2F07%2F04%2Fanalysis-of-telebots-cunning-backdoor%2F&cd8=https%3A%2F%2Fwww.welivesecurity.com%2F2017%2F07%2F04%2Fanalysis-of-telebots-cunning-backdoor%2F&cd10=Research&cd11=en&cd12=not-a-bot&cd25=GTM-PMDGSM&cd33=consent%20not%20set&cd34=consent%20not%20set&z=1512326880

Requested by

Host: www.welivesecurity.com
URL: https://www.welivesecurity.com/2017/07/04/analysis-of-telebots-cunning-backdoor/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://www.welivesecurity.com/2017/07/04/analysis-of-telebots-cunning-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 08 Dec 2022 02:42:31 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 34983
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
region1.google-analytics.com/g/ 0
352 B 92ms
35ms Ping
text/plain 2001:4860:4802:32::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-FBY6B30C4M&gtm=2oebu0&_p=153485782&cid=1685996167.1670502335&ul=en-us&sr=1600x1200&ir=1&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_eu=EA&_s=1&sid=1670502334&sct=1&seg=0&dl=https%3A%2F%2Fwww.welivesecurity.com%2F2017%2F07%2F04%2Fanalysis-of-telebots-cunning-backdoor%2F&dt=Analysis%20of%20TeleBots%E2%80%99%20cunning%20backdoor%20%7C%20WeLiveSecurity&en=page_view&_fv=2&_ss=2&ep.branch=en&ep.page_location_noquery=https%3A%2F%2Fwww.welivesecurity.com%2F2017%2F07%2F04%2Fanalysis-of-telebots-cunning-backdoor%2F&ep.hostname=www.welivesecurity.com&ep.useragent=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F108.0.5359.98%20Safari%2F537.36&ep.project_id=wls&ep.article_category=Ukraine%20Crisis%20%E2%80%93%20Digital%20Security%20Resource%20Center&ep.author=Anton%20Cherepanov&ep.blog_length=1.1k-1.5k&ep.article_section=Research&ep.cookie_consent=b%3A1%7Ca%3A0%7Cm%3A0
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-FBY6B30C4M&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://www.welivesecurity.com/2017/07/04/analysis-of-telebots-cunning-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 08 Dec 2022 12:25:34 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.welivesecurity.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 lounge.c0745c6021a8f18f6d2527a987edd4d3.css
c.disquscdn.com/next/embed/styles/ 0
30 KB 118ms
29ms Other
text/css 2600:9000:20eb:d600:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://c.disquscdn.com/next/embed/styles/lounge.c0745c6021a8f18f6d2527a987edd4d3.css

Requested by

Host: welivesecurity.disqus.com
URL: https://welivesecurity.disqus.com/embed.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:20eb:d600:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://www.welivesecurity.com/2017/07/04/analysis-of-telebots-cunning-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

x-cache-hits: 0
date: Tue, 06 Dec 2022 22:30:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
via: 1.1 f797fc0ae68a3abc35e081e46174c9f2.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA2-C1
age: 136496
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 30566
x-xss-protection: 1; mode=block
x-served-by: static-web-1
surrogate-key: next
last-modified: Tue, 06 Dec 2022 22:10:19 GMT
server: nginx
etag: "638fbdcb-7766"
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000, public, immutable, no-transform
timing-allow-origin: *
x-amz-cf-id: cEKHQm5IS3vI64FWM-_srvFOQfRmez9PncvWGiCbcxJjgGZM4_JixA==
expires: Wed, 06 Dec 2023 22:30:38 GMT

GET
H2 200 common.bundle.6dd0bd4924a2cd12ee7c955bcb3718e4.js
c.disquscdn.com/next/embed/ 0
93 KB 139ms
49ms Other
application/javascript 2600:9000:20eb:d600:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://c.disquscdn.com/next/embed/common.bundle.6dd0bd4924a2cd12ee7c955bcb3718e4.js

Requested by

Host: welivesecurity.disqus.com
URL: https://welivesecurity.disqus.com/embed.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:20eb:d600:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://www.welivesecurity.com/2017/07/04/analysis-of-telebots-cunning-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

x-cache-hits: 0
date: Thu, 01 Dec 2022 15:48:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
via: 1.1 f797fc0ae68a3abc35e081e46174c9f2.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA2-C1
age: 592615
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 94892
x-xss-protection: 1; mode=block
x-served-by: static-web-2
surrogate-key: next
last-modified: Wed, 30 Nov 2022 00:18:36 GMT
server: nginx
etag: "6386a15c-172ac"
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000, public, immutable, no-transform
timing-allow-origin: *
x-amz-cf-id: B0-xkbaJisArtYfV_OPwJIbP9O0ZzEU1Q43tEXCj_xAUqSLQ-nTKpw==
expires: Fri, 01 Dec 2023 15:48:39 GMT

GET
H2 200 lounge.bundle.1605337b9165b7dcf974a798ff31b341.js
c.disquscdn.com/next/embed/ 0
126 KB 168ms
79ms Other
application/javascript 2600:9000:20eb:d600:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://c.disquscdn.com/next/embed/lounge.bundle.1605337b9165b7dcf974a798ff31b341.js

Requested by

Host: welivesecurity.disqus.com
URL: https://welivesecurity.disqus.com/embed.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:20eb:d600:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://www.welivesecurity.com/2017/07/04/analysis-of-telebots-cunning-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

x-cache-hits: 0
date: Tue, 06 Dec 2022 22:30:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
via: 1.1 f797fc0ae68a3abc35e081e46174c9f2.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA2-C1
age: 136496
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 128710
x-xss-protection: 1; mode=block
x-served-by: static-web-1
surrogate-key: next
last-modified: Tue, 06 Dec 2022 22:10:19 GMT
server: nginx
etag: "638fbdcb-1f6c6"
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000, public, immutable, no-transform
timing-allow-origin: *
x-amz-cf-id: _h5Svs84ko8R8IyjGTcJs9b4MG9RDXh2-sBTF-lTZCQAQtXyb4Pk0w==
expires: Wed, 06 Dec 2023 22:30:38 GMT

GET
H/1.1 200
OK config.js
disqus.com/next/ 0
17 KB 82ms
20ms Other
application/javascript 151.101.128.134
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://disqus.com/next/config.js

Requested by

Host: welivesecurity.disqus.com
URL: https://welivesecurity.disqus.com/embed.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

151.101.128.134 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://www.welivesecurity.com/2017/07/04/analysis-of-telebots-cunning-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Date: Thu, 08 Dec 2022 12:25:34 GMT
Strict-Transport-Security: max-age=300; includeSubdomains
X-Content-Type-Options: nosniff
Server: nginx
Age: 58
X-Frame-Options: SAMEORIGIN
p3p: CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
Access-Control-Allow-Origin: *
Content-Type: application/javascript; charset=UTF-8
Cache-Control: public, stale-while-revalidate=300, s-stalewhilerevalidate=3600, max-age=60
Cross-Origin-Resource-Policy: cross-origin
Connection: keep-alive
Timing-Allow-Origin: *
Content-Length: 16895
X-XSS-Protection: 1; mode=block

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 27ms
26ms Image
image/gif 2a00:1450:4001:806::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j98&aip=1&a=153485782&t=event&ni=1&_s=1&dl=https%3A%2F%2Fwww.welivesecurity.com%2F2017%2F07%2F04%2Fanalysis-of-telebots-cunning-backdoor%2F&ul=en-us&de=UTF-8&dt=Analysis%20of%20TeleBots%E2%80%99%20cunning%20backdoor%20%7C%20WeLiveSecurity&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=cookie%20consent&ea=cookie-consent-visible&_u=aHDAAEABAAAAAAAAIg~&cid=1685996167.1670502335&tid=UA-37839312-1&_gid=126200217.1670502335&gtm=2wgbu0PMDGSM&cd1=Ukraine%20Crisis%20%E2%80%93%20Digital%20Security%20Resource%20Center&cd2=Anton%20Cherepanov&cd3=1.1k-1.5k&cd4=&cd5=2022-12-08T12%3A25%3A34.937%2B00%3A00&cd6=Office%20Hours&cd7=www.welivesecurity.com%2F2017%2F07%2F04%2Fanalysis-of-telebots-cunning-backdoor%2F&cd8=https%3A%2F%2Fwww.welivesecurity.com%2F2017%2F07%2F04%2Fanalysis-of-telebots-cunning-backdoor%2F&cd10=Research&cd11=en&cd12=not-a-bot&cd20=1685996167.1670502335&cd25=GTM-PMDGSM&cd33=consent%20not%20set&cd34=consent%20not%20set&z=1997815

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://www.welivesecurity.com/2017/07/04/analysis-of-telebots-cunning-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 08 Dec 2022 02:42:31 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 34983
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK / Show response
disqus.com/embed/comments/ Frame EBA2 30 KB
8 KB 238ms
238ms Document
text/html 151.101.128.134
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://disqus.com/embed/comments/?base=default&f=welivesecurity&t_i=96464%20https%3A%2F%2Fba-infohub-web01-v.hq.eset.com%2F%3Fp%3D96464&t_u=https%3A%2F%2Fwww.welivesecurity.com%2F2017%2F07%2F04%2Fanalysis-of-telebots-cunning-backdoor%2F&t_e=Analysis%20of%20TeleBots%E2%80%99%20cunning%20backdoor&t_d=Analysis%20of%20TeleBots%E2%80%99%20cunning%20backdoor&t_t=Analysis%20of%20TeleBots%E2%80%99%20cunning%20backdoor&s_o=default&l=en

Requested by

Host: welivesecurity.disqus.com
URL: https://welivesecurity.disqus.com/embed.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

151.101.128.134 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

18978d486a3d4d5d16aaff69e52972562bf97506f65e9d8c84cd2d16cacb18a6

Security Headers

Name	Value
Content-Security-Policy	script-src https://.twitter.com: https://www.gstatic.com/recaptcha/ https://a.disquscdn.com https://c.disquscdn.com c.disquscdn.com https://.services.disqus.com: https://cdn.boomtrain.com/p13n/ https://com-disqus.netmng.com:* 'unsafe-inline' https://referrer.disqus.com/juggler/ https://connect.facebook.net/en_US/sdk.js https://cdn.syndication.twimg.com/tweets.json https://apis.google.com https://www.google.com/recaptcha/ https://cf.ignitionone.com:* https://disqus.com
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.welivesecurity.com/2017/07/04/analysis-of-telebots-cunning-backdoor/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36
accept-language: fr-FR,fr;q=0.9

Response headers

Age: 0
Cache-Control: stale-if-error=3600, s-stalewhilerevalidate=3600, stale-while-revalidate=30, no-cache, must-revalidate, public, s-maxage=5
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 6924
Content-Security-Policy: script-src https://*.twitter.com:* https://www.gstatic.com/recaptcha/ https://a.disquscdn.com https://c.disquscdn.com c.disquscdn.com https://*.services.disqus.com:* https://cdn.boomtrain.com/p13n/ https://com-disqus.netmng.com:* 'unsafe-inline' https://referrer.disqus.com/juggler/ https://connect.facebook.net/en_US/sdk.js https://cdn.syndication.twimg.com/tweets.json https://apis.google.com https://www.google.com/recaptcha/ https://cf.ignitionone.com:* https://disqus.com
Content-Type: text/html; charset=utf-8
Cross-Origin-Resource-Policy: cross-origin
Date: Thu, 08 Dec 2022 12:25:35 GMT
ETag: W/"lounge:view:5962484775.18d72ca1fd45ca545d4272b8993c8354.2"
Last-Modified: Tue, 01 Nov 2022 06:02:49 GMT
Link: <https://c.disquscdn.com>;rel=preconnect,<https://c.disquscdn.com>;rel=dns-prefetch
Referrer-Policy: no-referrer-when-downgrade
Server: nginx
Strict-Transport-Security: max-age=300; includeSubdomains
Timing-Allow-Origin: *
Vary: Accept-Encoding
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
p3p: CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"

GET
H2 200 lounge.load.4c4ed5f9c855358a26d5235a7c63f777.js Show response
c.disquscdn.com/next/embed/ Frame EBA2 958 B
1 KB 74ms
23ms Script
application/javascript 2600:9000:20eb:d600:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://c.disquscdn.com/next/embed/lounge.load.4c4ed5f9c855358a26d5235a7c63f777.js

Requested by

Host: disqus.com
URL: https://disqus.com/embed/comments/?base=default&f=welivesecurity&t_i=96464%20https%3A%2F%2Fba-infohub-web01-v.hq.eset.com%2F%3Fp%3D96464&t_u=https%3A%2F%2Fwww.welivesecurity.com%2F2017%2F07%2F04%2Fanalysis-of-telebots-cunning-backdoor%2F&t_e=Analysis%20of%20TeleBots%E2%80%99%20cunning%20backdoor&t_d=Analysis%20of%20TeleBots%E2%80%99%20cunning%20backdoor&t_t=Analysis%20of%20TeleBots%E2%80%99%20cunning%20backdoor&s_o=default&l=en

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:20eb:d600:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

4093cb234c3178f43e5f022130a8090e5621e99047198e7d9d67c1328a5e4137

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://disqus.com/embed/comments/?base=default&f=welivesecurity&t_i=96464%20https%3A%2F%2Fba-infohub-web01-v.hq.eset.com%2F%3Fp%3D96464&t_u=https%3A%2F%2Fwww.welivesecurity.com%2F2017%2F07%2F04%2Fanalysis-of-telebots-cunning-backdoor%2F&t_e=Analysis%20of%20TeleBots%E2%80%99%20cunning%20backdoor&t_d=Analysis%20of%20TeleBots%E2%80%99%20cunning%20backdoor&t_t=Analysis%20of%20TeleBots%E2%80%99%20cunning%20backdoor&s_o=default&l=en
Origin: https://disqus.com
accept-language: fr-FR,fr;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

x-cache-hits: 0
date: Tue, 06 Dec 2022 22:30:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
via: 1.1 c379418fd6100691807f32f274ebe9ce.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA2-C1
age: 136496
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 495
x-xss-protection: 1; mode=block
x-served-by: static-web-1
surrogate-key: next
last-modified: Tue, 06 Dec 2022 22:10:19 GMT
server: nginx
etag: "638fbdcb-1ef"
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000, public, immutable, no-transform
timing-allow-origin: *
x-amz-cf-id: _ckknACu4Otfm0gNf_8qgX_rVTOH-rl3J3KeI8TUejMM3rI7ojGM8Q==
expires: Wed, 06 Dec 2023 22:30:39 GMT

GET
H2 200 common.bundle.6dd0bd4924a2cd12ee7c955bcb3718e4.js Show response
c.disquscdn.com/next/embed/ Frame EBA2 282 KB
93 KB 24ms
24ms Script
application/javascript 2600:9000:20eb:d600:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://c.disquscdn.com/next/embed/common.bundle.6dd0bd4924a2cd12ee7c955bcb3718e4.js

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/lounge.load.4c4ed5f9c855358a26d5235a7c63f777.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:20eb:d600:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

278f7c9d80a080385d0ac988d5dc97b7ec33d0ae378a4d8ae58afb6f03cb156d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://disqus.com/embed/comments/?base=default&f=welivesecurity&t_i=96464%20https%3A%2F%2Fba-infohub-web01-v.hq.eset.com%2F%3Fp%3D96464&t_u=https%3A%2F%2Fwww.welivesecurity.com%2F2017%2F07%2F04%2Fanalysis-of-telebots-cunning-backdoor%2F&t_e=Analysis%20of%20TeleBots%E2%80%99%20cunning%20backdoor&t_d=Analysis%20of%20TeleBots%E2%80%99%20cunning%20backdoor&t_t=Analysis%20of%20TeleBots%E2%80%99%20cunning%20backdoor&s_o=default&l=en
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

x-cache-hits: 0
date: Thu, 01 Dec 2022 15:48:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
via: 1.1 f797fc0ae68a3abc35e081e46174c9f2.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA2-C1
age: 592616
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 94892
x-xss-protection: 1; mode=block
x-served-by: static-web-2
surrogate-key: next
last-modified: Wed, 30 Nov 2022 00:18:36 GMT
server: nginx
etag: "6386a15c-172ac"
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000, public, immutable, no-transform
timing-allow-origin: *
x-amz-cf-id: C1EkP3w-n5CTS46W2s9WRw92zPsa2Jb-ffn2Q7gTopx0KpIAHwryMw==
expires: Fri, 01 Dec 2023 15:48:39 GMT

GET
H2 200 lounge.c0745c6021a8f18f6d2527a987edd4d3.css
c.disquscdn.com/next/embed/styles/ Frame EBA2 201 KB
30 KB 25ms
24ms Stylesheet
text/css 2600:9000:20eb:d600:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://c.disquscdn.com/next/embed/styles/lounge.c0745c6021a8f18f6d2527a987edd4d3.css

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/common.bundle.6dd0bd4924a2cd12ee7c955bcb3718e4.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:20eb:d600:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

3a490b34ba8411afa03552d884cf5d7da8cb48d7d167946d7ab83b6d697132b6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://disqus.com/embed/comments/?base=default&f=welivesecurity&t_i=96464%20https%3A%2F%2Fba-infohub-web01-v.hq.eset.com%2F%3Fp%3D96464&t_u=https%3A%2F%2Fwww.welivesecurity.com%2F2017%2F07%2F04%2Fanalysis-of-telebots-cunning-backdoor%2F&t_e=Analysis%20of%20TeleBots%E2%80%99%20cunning%20backdoor&t_d=Analysis%20of%20TeleBots%E2%80%99%20cunning%20backdoor&t_t=Analysis%20of%20TeleBots%E2%80%99%20cunning%20backdoor&s_o=default&l=en
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

x-cache-hits: 0
date: Tue, 06 Dec 2022 22:30:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
via: 1.1 f797fc0ae68a3abc35e081e46174c9f2.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA2-C1
age: 136497
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 30566
x-xss-protection: 1; mode=block
x-served-by: static-web-1
surrogate-key: next
last-modified: Tue, 06 Dec 2022 22:10:19 GMT
server: nginx
etag: "638fbdcb-7766"
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000, public, immutable, no-transform
timing-allow-origin: *
x-amz-cf-id: CUP5DtcOBBmEHOxPAud2TeLuzIrjViZbXrXaKUzV63p5_byUi9sDTQ==
expires: Wed, 06 Dec 2023 22:30:38 GMT

GET
H2 200 lounge.bundle.1605337b9165b7dcf974a798ff31b341.js Show response
c.disquscdn.com/next/embed/ Frame EBA2 503 KB
126 KB 25ms
24ms Script
application/javascript 2600:9000:20eb:d600:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://c.disquscdn.com/next/embed/lounge.bundle.1605337b9165b7dcf974a798ff31b341.js

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/common.bundle.6dd0bd4924a2cd12ee7c955bcb3718e4.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:20eb:d600:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

db6ec323207ebb78fc70f93f0b6b250ec6f4d16a4bf2a7983122e6337db93323

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://disqus.com/embed/comments/?base=default&f=welivesecurity&t_i=96464%20https%3A%2F%2Fba-infohub-web01-v.hq.eset.com%2F%3Fp%3D96464&t_u=https%3A%2F%2Fwww.welivesecurity.com%2F2017%2F07%2F04%2Fanalysis-of-telebots-cunning-backdoor%2F&t_e=Analysis%20of%20TeleBots%E2%80%99%20cunning%20backdoor&t_d=Analysis%20of%20TeleBots%E2%80%99%20cunning%20backdoor&t_t=Analysis%20of%20TeleBots%E2%80%99%20cunning%20backdoor&s_o=default&l=en
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

x-cache-hits: 0
date: Tue, 06 Dec 2022 22:30:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
via: 1.1 f797fc0ae68a3abc35e081e46174c9f2.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA2-C1
age: 136497
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 128710
x-xss-protection: 1; mode=block
x-served-by: static-web-1
surrogate-key: next
last-modified: Tue, 06 Dec 2022 22:10:19 GMT
server: nginx
etag: "638fbdcb-1f6c6"
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000, public, immutable, no-transform
timing-allow-origin: *
x-amz-cf-id: Ck06BA6hEF4wYPCuJd76F9axyhtMj0FGJwHPJxJ2j_bxSciyx5dBmw==
expires: Wed, 06 Dec 2023 22:30:38 GMT

GET
H/1.1 200
OK config.js Show response
disqus.com/next/ Frame EBA2 16 KB
17 KB 20ms
19ms Script
application/javascript 151.101.128.134
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://disqus.com/next/config.js

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/common.bundle.6dd0bd4924a2cd12ee7c955bcb3718e4.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

151.101.128.134 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

67af3e37e9bd319dfa5250a60e3849b2172a9727c2aa0e1cf27aac1a9f42b49a

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://disqus.com/embed/comments/?base=default&f=welivesecurity&t_i=96464%20https%3A%2F%2Fba-infohub-web01-v.hq.eset.com%2F%3Fp%3D96464&t_u=https%3A%2F%2Fwww.welivesecurity.com%2F2017%2F07%2F04%2Fanalysis-of-telebots-cunning-backdoor%2F&t_e=Analysis%20of%20TeleBots%E2%80%99%20cunning%20backdoor&t_d=Analysis%20of%20TeleBots%E2%80%99%20cunning%20backdoor&t_t=Analysis%20of%20TeleBots%E2%80%99%20cunning%20backdoor&s_o=default&l=en
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Date: Thu, 08 Dec 2022 12:25:35 GMT
Strict-Transport-Security: max-age=300; includeSubdomains
X-Content-Type-Options: nosniff
Server: nginx
Age: 59
X-Frame-Options: SAMEORIGIN
p3p: CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
Access-Control-Allow-Origin: *
Content-Type: application/javascript; charset=UTF-8
Cache-Control: public, stale-while-revalidate=300, s-stalewhilerevalidate=3600, max-age=60
Cross-Origin-Resource-Policy: cross-origin
Connection: keep-alive
Timing-Allow-Origin: *
Content-Length: 16895
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK details Show response
disqus.com/api/3.0/forums/ Frame EBA2 4 KB
4 KB 118ms
118ms XHR
application/json 151.101.128.134
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://disqus.com/api/3.0/forums/details?forum=welivesecurity&attach=forumFeatures&api_key=E8Uh5l5fHZ6gD8U3KycjAIAk46f68Zw7C6eW8WSjZvCLXebZ7p0r1yrYDrLilk2F

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/common.bundle.6dd0bd4924a2cd12ee7c955bcb3718e4.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

151.101.128.134 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

90514aacb5485e3aeb4bc8766c7ad3b6279254ea9806f9c463b9c82cb1f4b044

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: */*
Referer: https://disqus.com/embed/comments/?base=default&f=welivesecurity&t_i=96464%20https%3A%2F%2Fba-infohub-web01-v.hq.eset.com%2F%3Fp%3D96464&t_u=https%3A%2F%2Fwww.welivesecurity.com%2F2017%2F07%2F04%2Fanalysis-of-telebots-cunning-backdoor%2F&t_e=Analysis%20of%20TeleBots%E2%80%99%20cunning%20backdoor&t_d=Analysis%20of%20TeleBots%E2%80%99%20cunning%20backdoor&t_t=Analysis%20of%20TeleBots%E2%80%99%20cunning%20backdoor&s_o=default&l=en
X-Requested-With: XMLHttpRequest
accept-language: fr-FR,fr;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Date: Thu, 08 Dec 2022 12:25:35 GMT
Strict-Transport-Security: max-age=300; includeSubdomains
X-Content-Type-Options: nosniff
Server: nginx
Age: 0
X-Frame-Options: SAMEORIGIN
Vary: Origin, Cookie
p3p: CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
Content-Type: application/json
Cross-Origin-Resource-Policy: cross-origin
Connection: keep-alive
Content-Length: 3968
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK loadReactions Show response
disqus.com/api/3.0/threadReactions/ Frame EBA2 85 B
574 B 142ms
119ms XHR
application/json 151.101.128.134
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://disqus.com/api/3.0/threadReactions/loadReactions?thread=5962484775&api_key=E8Uh5l5fHZ6gD8U3KycjAIAk46f68Zw7C6eW8WSjZvCLXebZ7p0r1yrYDrLilk2F

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/common.bundle.6dd0bd4924a2cd12ee7c955bcb3718e4.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

151.101.128.134 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

867bde5f1930963a16e7dac4c891142edaa529a4428bb3486165757b7c8ead08

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://disqus.com/embed/comments/?base=default&f=welivesecurity&t_i=96464%20https%3A%2F%2Fba-infohub-web01-v.hq.eset.com%2F%3Fp%3D96464&t_u=https%3A%2F%2Fwww.welivesecurity.com%2F2017%2F07%2F04%2Fanalysis-of-telebots-cunning-backdoor%2F&t_e=Analysis%20of%20TeleBots%E2%80%99%20cunning%20backdoor&t_d=Analysis%20of%20TeleBots%E2%80%99%20cunning%20backdoor&t_t=Analysis%20of%20TeleBots%E2%80%99%20cunning%20backdoor&s_o=default&l=en
X-Requested-With: XMLHttpRequest
accept-language: fr-FR,fr;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Date: Thu, 08 Dec 2022 12:25:35 GMT
Strict-Transport-Security: max-age=300; includeSubdomains
X-Content-Type-Options: nosniff
Server: nginx
Age: 0
X-Frame-Options: SAMEORIGIN
Vary: Origin, Cookie
p3p: CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
Content-Type: application/json
Cache-Control: stale-while-revalidate=30, max-age=60
Cross-Origin-Resource-Policy: cross-origin
Connection: keep-alive
Content-Length: 85
X-XSS-Protection: 1; mode=block

GET
H2 200 avatar92.jpg
c.disquscdn.com/uploads/forums/215/2520/ Frame EBA2 3 KB
4 KB 26ms
25ms Image
image/jpeg 2600:9000:20eb:d600:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c.disquscdn.com/uploads/forums/215/2520/avatar92.jpg?1666017561

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:20eb:d600:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

547d64d9586e701e83fd750596ba4ad00437294bbb2377e68d38823b0d097911

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://disqus.com/embed/comments/?base=default&f=welivesecurity&t_i=96464%20https%3A%2F%2Fba-infohub-web01-v.hq.eset.com%2F%3Fp%3D96464&t_u=https%3A%2F%2Fwww.welivesecurity.com%2F2017%2F07%2F04%2Fanalysis-of-telebots-cunning-backdoor%2F&t_e=Analysis%20of%20TeleBots%E2%80%99%20cunning%20backdoor&t_d=Analysis%20of%20TeleBots%E2%80%99%20cunning%20backdoor&t_t=Analysis%20of%20TeleBots%E2%80%99%20cunning%20backdoor&s_o=default&l=en
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

x-cache-hits: 0
date: Wed, 07 Dec 2022 00:42:43 GMT
via: 1.1 f797fc0ae68a3abc35e081e46174c9f2.cloudfront.net (CloudFront)
x-content-type-options: nosniff
x-amz-cf-pop: FRA2-C1
age: 128572
x-cache: Hit from cloudfront
content-length: 3099
x-xss-protection: 1; mode=block
x-served-by: static-web-1
last-modified: Mon, 17 Oct 2022 14:39:22 GMT
server: nginx
etag: "03e2797add6e2cc784dc53b89eb72771"
content-type: image/jpeg
cache-control: max-age=31536000, public, immutable
accept-ranges: bytes
x-amz-cf-id: KaHUNrXLKQrWul4dm5pMW6aF-x6YjXLqCPqeD6obqzscKdiD93MxHQ==
expires: Thu, 07 Dec 2023 00:42:43 GMT

GET
H2 200 svg-sprite.4da5413f5086c5755b46094b813dbfcd.svg
c.disquscdn.com/next/embed/assets/img/ Frame EBA2 13 KB
13 KB 26ms
25ms Image
image/svg+xml 2600:9000:20eb:d600:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c.disquscdn.com/next/embed/assets/img/svg-sprite.4da5413f5086c5755b46094b813dbfcd.svg

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/styles/lounge.c0745c6021a8f18f6d2527a987edd4d3.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:20eb:d600:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

3270642c89180c12db93775e2a774b6dadd9bd98cffc963075c85afd2c17b6e4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://c.disquscdn.com/next/embed/styles/lounge.c0745c6021a8f18f6d2527a987edd4d3.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

x-cache-hits: 0
date: Sat, 03 Dec 2022 02:02:16 GMT
via: 1.1 f797fc0ae68a3abc35e081e46174c9f2.cloudfront.net (CloudFront)
x-content-type-options: nosniff
x-amz-cf-pop: FRA2-C1
age: 469399
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 13079
x-xss-protection: 1; mode=block
x-served-by: static-web-2
surrogate-key: next
last-modified: Thu, 01 Dec 2022 19:00:29 GMT
server: nginx
etag: "6388f9cd-3317"
content-type: image/svg+xml; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000, public, immutable, no-transform
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: hDqTRrYJ46VNKomdoCr__ccrp_LiaPYIuy37nmyfAnkZDxVymCYcWA==
expires: Sun, 03 Dec 2023 02:02:16 GMT

GET
H2 200 loader.ba7c86e8b4b6135bb668d05223f8f127.gif
c.disquscdn.com/next/embed/assets/img/ Frame EBA2 3 KB
3 KB 25ms
25ms Image
image/gif 2600:9000:20eb:d600:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c.disquscdn.com/next/embed/assets/img/loader.ba7c86e8b4b6135bb668d05223f8f127.gif

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/styles/lounge.c0745c6021a8f18f6d2527a987edd4d3.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:20eb:d600:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

4c4491dcfa94cb46fb73742fc2caf49a1cd59027304af1830c7dc6ce1889857c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://c.disquscdn.com/next/embed/styles/lounge.c0745c6021a8f18f6d2527a987edd4d3.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

x-cache-hits: 0
date: Wed, 30 Nov 2022 06:17:44 GMT
via: 1.1 f797fc0ae68a3abc35e081e46174c9f2.cloudfront.net (CloudFront)
x-content-type-options: nosniff
x-amz-cf-pop: FRA2-C1
age: 713270
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 2971
x-xss-protection: 1; mode=block
x-served-by: static-web-1
surrogate-key: next
last-modified: Fri, 25 Nov 2022 05:53:01 GMT
server: nginx
etag: "6380583d-b9b"
content-type: image/gif
access-control-allow-origin: *
cache-control: max-age=31536000, public, immutable, no-transform
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: Z1AHUW35_BKSuS10CL79s5UZN70Q7rlm2SBcahe2AGSJljzKTGVtlQ==
expires: Thu, 30 Nov 2023 06:17:44 GMT

GET
H2 200 sprite.ad630a07080a45451f139a7487853ff8.png
c.disquscdn.com/next/embed/assets/img/ Frame EBA2 2 KB
2 KB 25ms
25ms Image
image/png 2600:9000:20eb:d600:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c.disquscdn.com/next/embed/assets/img/sprite.ad630a07080a45451f139a7487853ff8.png

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/styles/lounge.c0745c6021a8f18f6d2527a987edd4d3.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:20eb:d600:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

9714221c828961b20f45a782c3281c0596f6652cfe1299bee18097f98e8fb7b3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://c.disquscdn.com/next/embed/styles/lounge.c0745c6021a8f18f6d2527a987edd4d3.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

x-cache-hits: 0
date: Sun, 04 Dec 2022 01:46:31 GMT
via: 1.1 f797fc0ae68a3abc35e081e46174c9f2.cloudfront.net (CloudFront)
x-content-type-options: nosniff
x-amz-cf-pop: FRA2-C1
age: 383944
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 1763
x-xss-protection: 1; mode=block
x-served-by: static-web-2
surrogate-key: next
last-modified: Thu, 01 Dec 2022 19:00:29 GMT
server: nginx
etag: "6388f9cd-6e3"
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31536000, public, immutable, no-transform
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: qwcG3bGbpYBjtwhqlu-07VvdfNo6kZaFNODqU5FZirl1wkuFx-i1EA==
expires: Mon, 04 Dec 2023 01:46:31 GMT

GET
H2 200 icons.4cc7a703d2fdfe684151ff8ac24d45f1.woff2
c.disquscdn.com/next/embed/assets/font/ Frame EBA2 8 KB
8 KB 26ms
26ms Font
application/octet-stream 2600:9000:20eb:d600:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://c.disquscdn.com/next/embed/assets/font/icons.4cc7a703d2fdfe684151ff8ac24d45f1.woff2

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/styles/lounge.c0745c6021a8f18f6d2527a987edd4d3.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:20eb:d600:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

f2a341fc815d45c21da726d4c843c2c5d3e1f333465347c3c75d040d556df4e5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://c.disquscdn.com/next/embed/styles/lounge.c0745c6021a8f18f6d2527a987edd4d3.css
Origin: https://disqus.com
accept-language: fr-FR,fr;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

x-cache-hits: 0
date: Tue, 06 Dec 2022 01:45:11 GMT
via: 1.1 c379418fd6100691807f32f274ebe9ce.cloudfront.net (CloudFront)
x-content-type-options: nosniff
x-amz-cf-pop: FRA2-C1
age: 211224
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 7900
x-xss-protection: 1; mode=block
x-served-by: static-web-1
surrogate-key: next
last-modified: Mon, 05 Dec 2022 20:37:04 GMT
server: nginx
etag: "638e5670-1edc"
content-type: application/octet-stream
access-control-allow-origin: *
cache-control: max-age=31536000, public, immutable, no-transform
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: Ycu8ELJStnOhlftwzUVnMaCu6qCbEBRtlh5CHVvD_i3t_8ElypK3bw==
expires: Wed, 06 Dec 2023 01:45:11 GMT

GET
H/1.1 200
OK event.gif
referrer.disqus.com/juggler/ Frame EBA2 43 B
339 B 179ms
99ms Image
image/gif 199.232.196.134
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://referrer.disqus.com/juggler/event.gif?abe=0&embed_hidden=0&integration=wordpress%203.0.16&load_time=272&event=init_embed&thread=5962484775&forum=welivesecurity&forum_id=2152520&imp=dh9afc3qs22c7&thread_slug=analysis_of_telebots_cunning_backdoor&user_type=anon&referrer=https%3A%2F%2Fwww.welivesecurity.com%2F2017%2F07%2F04%2Fanalysis-of-telebots-cunning-backdoor%2F&theme=next&dnt=0&tracking_enabled=0&experiment=network_default_hidden&variant=fallthrough&service=dynamic&promoted_enabled=false&max_enabled=false

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

199.232.196.134 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://disqus.com/embed/comments/?base=default&f=welivesecurity&t_i=96464%20https%3A%2F%2Fba-infohub-web01-v.hq.eset.com%2F%3Fp%3D96464&t_u=https%3A%2F%2Fwww.welivesecurity.com%2F2017%2F07%2F04%2Fanalysis-of-telebots-cunning-backdoor%2F&t_e=Analysis%20of%20TeleBots%E2%80%99%20cunning%20backdoor&t_d=Analysis%20of%20TeleBots%E2%80%99%20cunning%20backdoor&t_t=Analysis%20of%20TeleBots%E2%80%99%20cunning%20backdoor&s_o=default&l=en
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Date: Thu, 08 Dec 2022 12:25:35 GMT
X-Content-Type-Options: nosniff
Last-Modified: Mon, 28 Sep 1970 06:00:00 GMT
Server: nginx
Content-Type: image/gif
Cross-Origin-Resource-Policy: cross-origin
Connection: keep-alive
Content-Length: 43
X-XSS-Protection: 1; mode=block

GET
H2 200 avatar92.jpg
c.disquscdn.com/uploads/forums/215/2520/ Frame EBA2 3 KB
4 KB 29ms
28ms Image
image/jpeg 2600:9000:20eb:d600:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c.disquscdn.com/uploads/forums/215/2520/avatar92.jpg?1666017561

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/lounge.bundle.1605337b9165b7dcf974a798ff31b341.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:20eb:d600:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

547d64d9586e701e83fd750596ba4ad00437294bbb2377e68d38823b0d097911

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://disqus.com/embed/comments/?base=default&f=welivesecurity&t_i=96464%20https%3A%2F%2Fba-infohub-web01-v.hq.eset.com%2F%3Fp%3D96464&t_u=https%3A%2F%2Fwww.welivesecurity.com%2F2017%2F07%2F04%2Fanalysis-of-telebots-cunning-backdoor%2F&t_e=Analysis%20of%20TeleBots%E2%80%99%20cunning%20backdoor&t_d=Analysis%20of%20TeleBots%E2%80%99%20cunning%20backdoor&t_t=Analysis%20of%20TeleBots%E2%80%99%20cunning%20backdoor&s_o=default&l=en
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

x-cache-hits: 0
date: Wed, 07 Dec 2022 00:42:43 GMT
via: 1.1 f797fc0ae68a3abc35e081e46174c9f2.cloudfront.net (CloudFront)
x-content-type-options: nosniff
x-amz-cf-pop: FRA2-C1
age: 128572
x-cache: Hit from cloudfront
content-length: 3099
x-xss-protection: 1; mode=block
x-served-by: static-web-1
last-modified: Mon, 17 Oct 2022 14:39:22 GMT
server: nginx
etag: "03e2797add6e2cc784dc53b89eb72771"
content-type: image/jpeg
cache-control: max-age=31536000, public, immutable
accept-ranges: bytes
x-amz-cf-id: VJ8tglT-It0rJ346hRbxHsr9Aa2246Ri94hwlL1_BzOZEIyENcftdA==
expires: Thu, 07 Dec 2023 00:42:43 GMT

GET
H2 200 avatar92.jpg
c.disquscdn.com/uploads/forums/215/2520/ Frame EBA2 3 KB
4 KB 24ms
24ms Image
image/jpeg 2600:9000:20eb:d600:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c.disquscdn.com/uploads/forums/215/2520/avatar92.jpg?1666017561

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/lounge.bundle.1605337b9165b7dcf974a798ff31b341.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:20eb:d600:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

547d64d9586e701e83fd750596ba4ad00437294bbb2377e68d38823b0d097911

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://disqus.com/embed/comments/?base=default&f=welivesecurity&t_i=96464%20https%3A%2F%2Fba-infohub-web01-v.hq.eset.com%2F%3Fp%3D96464&t_u=https%3A%2F%2Fwww.welivesecurity.com%2F2017%2F07%2F04%2Fanalysis-of-telebots-cunning-backdoor%2F&t_e=Analysis%20of%20TeleBots%E2%80%99%20cunning%20backdoor&t_d=Analysis%20of%20TeleBots%E2%80%99%20cunning%20backdoor&t_t=Analysis%20of%20TeleBots%E2%80%99%20cunning%20backdoor&s_o=default&l=en
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

x-cache-hits: 0
date: Wed, 07 Dec 2022 00:42:43 GMT
via: 1.1 f797fc0ae68a3abc35e081e46174c9f2.cloudfront.net (CloudFront)
x-content-type-options: nosniff
x-amz-cf-pop: FRA2-C1
age: 128572
x-cache: Hit from cloudfront
content-length: 3099
x-xss-protection: 1; mode=block
x-served-by: static-web-1
last-modified: Mon, 17 Oct 2022 14:39:22 GMT
server: nginx
etag: "03e2797add6e2cc784dc53b89eb72771"
content-type: image/jpeg
cache-control: max-age=31536000, public, immutable
accept-ranges: bytes
x-amz-cf-id: se1CLASxiWTgAvOtPK9iq6eKr0IkJ17Avn0uHSMB13c4TgiBUlsuFw==
expires: Thu, 07 Dec 2023 00:42:43 GMT

GET
H2 200 avatar92.jpg
c.disquscdn.com/uploads/forums/215/2520/ Frame EBA2 3 KB
4 KB 24ms
24ms Image
image/jpeg 2600:9000:20eb:d600:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c.disquscdn.com/uploads/forums/215/2520/avatar92.jpg?1666017561

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/lounge.bundle.1605337b9165b7dcf974a798ff31b341.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:20eb:d600:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

547d64d9586e701e83fd750596ba4ad00437294bbb2377e68d38823b0d097911

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://disqus.com/embed/comments/?base=default&f=welivesecurity&t_i=96464%20https%3A%2F%2Fba-infohub-web01-v.hq.eset.com%2F%3Fp%3D96464&t_u=https%3A%2F%2Fwww.welivesecurity.com%2F2017%2F07%2F04%2Fanalysis-of-telebots-cunning-backdoor%2F&t_e=Analysis%20of%20TeleBots%E2%80%99%20cunning%20backdoor&t_d=Analysis%20of%20TeleBots%E2%80%99%20cunning%20backdoor&t_t=Analysis%20of%20TeleBots%E2%80%99%20cunning%20backdoor&s_o=default&l=en
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

x-cache-hits: 0
date: Wed, 07 Dec 2022 00:42:43 GMT
via: 1.1 f797fc0ae68a3abc35e081e46174c9f2.cloudfront.net (CloudFront)
x-content-type-options: nosniff
x-amz-cf-pop: FRA2-C1
age: 128572
x-cache: Hit from cloudfront
content-length: 3099
x-xss-protection: 1; mode=block
x-served-by: static-web-1
last-modified: Mon, 17 Oct 2022 14:39:22 GMT
server: nginx
etag: "03e2797add6e2cc784dc53b89eb72771"
content-type: image/jpeg
cache-control: max-age=31536000, public, immutable
accept-ranges: bytes
x-amz-cf-id: R9VhNVIJx9rg2TnR-TAybLXnvV6u9v_GrMYPCZVTopfUvORIGAVLqw==
expires: Thu, 07 Dec 2023 00:42:43 GMT

GET
H2 200 avatar92.jpg
c.disquscdn.com/uploads/forums/215/2520/ Frame EBA2 3 KB
4 KB 25ms
24ms Image
image/jpeg 2600:9000:20eb:d600:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c.disquscdn.com/uploads/forums/215/2520/avatar92.jpg?1666017561

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/lounge.bundle.1605337b9165b7dcf974a798ff31b341.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:20eb:d600:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

547d64d9586e701e83fd750596ba4ad00437294bbb2377e68d38823b0d097911

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://disqus.com/embed/comments/?base=default&f=welivesecurity&t_i=96464%20https%3A%2F%2Fba-infohub-web01-v.hq.eset.com%2F%3Fp%3D96464&t_u=https%3A%2F%2Fwww.welivesecurity.com%2F2017%2F07%2F04%2Fanalysis-of-telebots-cunning-backdoor%2F&t_e=Analysis%20of%20TeleBots%E2%80%99%20cunning%20backdoor&t_d=Analysis%20of%20TeleBots%E2%80%99%20cunning%20backdoor&t_t=Analysis%20of%20TeleBots%E2%80%99%20cunning%20backdoor&s_o=default&l=en
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

x-cache-hits: 0
date: Wed, 07 Dec 2022 00:42:43 GMT
via: 1.1 f797fc0ae68a3abc35e081e46174c9f2.cloudfront.net (CloudFront)
x-content-type-options: nosniff
x-amz-cf-pop: FRA2-C1
age: 128572
x-cache: Hit from cloudfront
content-length: 3099
x-xss-protection: 1; mode=block
x-served-by: static-web-1
last-modified: Mon, 17 Oct 2022 14:39:22 GMT
server: nginx
etag: "03e2797add6e2cc784dc53b89eb72771"
content-type: image/jpeg
cache-control: max-age=31536000, public, immutable
accept-ranges: bytes
x-amz-cf-id: qW9JNQxu8k_Y5JDAWnCAyTSD3OgluIDGZN8AZo0IThxp5KWNwfwFzQ==
expires: Thu, 07 Dec 2023 00:42:43 GMT

GET
H2 200 avatar92.jpg
c.disquscdn.com/uploads/forums/215/2520/ Frame EBA2 3 KB
4 KB 36ms
32ms Image
image/jpeg 2600:9000:20eb:d600:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c.disquscdn.com/uploads/forums/215/2520/avatar92.jpg?1666017561

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/lounge.bundle.1605337b9165b7dcf974a798ff31b341.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:20eb:d600:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

547d64d9586e701e83fd750596ba4ad00437294bbb2377e68d38823b0d097911

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://disqus.com/embed/comments/?base=default&f=welivesecurity&t_i=96464%20https%3A%2F%2Fba-infohub-web01-v.hq.eset.com%2F%3Fp%3D96464&t_u=https%3A%2F%2Fwww.welivesecurity.com%2F2017%2F07%2F04%2Fanalysis-of-telebots-cunning-backdoor%2F&t_e=Analysis%20of%20TeleBots%E2%80%99%20cunning%20backdoor&t_d=Analysis%20of%20TeleBots%E2%80%99%20cunning%20backdoor&t_t=Analysis%20of%20TeleBots%E2%80%99%20cunning%20backdoor&s_o=default&l=en
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

x-cache-hits: 0
date: Wed, 07 Dec 2022 00:42:43 GMT
via: 1.1 f797fc0ae68a3abc35e081e46174c9f2.cloudfront.net (CloudFront)
x-content-type-options: nosniff
x-amz-cf-pop: FRA2-C1
age: 128573
x-cache: Hit from cloudfront
content-length: 3099
x-xss-protection: 1; mode=block
x-served-by: static-web-1
last-modified: Mon, 17 Oct 2022 14:39:22 GMT
server: nginx
etag: "03e2797add6e2cc784dc53b89eb72771"
content-type: image/jpeg
cache-control: max-age=31536000, public, immutable
accept-ranges: bytes
x-amz-cf-id: pPFN0Zp2iFMpTYru4z7Bg2XSV8YPgvMMXV_sLAips978AM4992HZBQ==
expires: Thu, 07 Dec 2023 00:42:43 GMT

GET
H2 200 avatar92.jpg
c.disquscdn.com/uploads/forums/215/2520/ Frame EBA2 3 KB
4 KB 35ms
34ms Image
image/jpeg 2600:9000:20eb:d600:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c.disquscdn.com/uploads/forums/215/2520/avatar92.jpg?1666017561

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/lounge.bundle.1605337b9165b7dcf974a798ff31b341.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:20eb:d600:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

547d64d9586e701e83fd750596ba4ad00437294bbb2377e68d38823b0d097911

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://disqus.com/embed/comments/?base=default&f=welivesecurity&t_i=96464%20https%3A%2F%2Fba-infohub-web01-v.hq.eset.com%2F%3Fp%3D96464&t_u=https%3A%2F%2Fwww.welivesecurity.com%2F2017%2F07%2F04%2Fanalysis-of-telebots-cunning-backdoor%2F&t_e=Analysis%20of%20TeleBots%E2%80%99%20cunning%20backdoor&t_d=Analysis%20of%20TeleBots%E2%80%99%20cunning%20backdoor&t_t=Analysis%20of%20TeleBots%E2%80%99%20cunning%20backdoor&s_o=default&l=en
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

x-cache-hits: 0
date: Wed, 07 Dec 2022 00:42:43 GMT
via: 1.1 f797fc0ae68a3abc35e081e46174c9f2.cloudfront.net (CloudFront)
x-content-type-options: nosniff
x-amz-cf-pop: FRA2-C1
age: 128573
x-cache: Hit from cloudfront
content-length: 3099
x-xss-protection: 1; mode=block
x-served-by: static-web-1
last-modified: Mon, 17 Oct 2022 14:39:22 GMT
server: nginx
etag: "03e2797add6e2cc784dc53b89eb72771"
content-type: image/jpeg
cache-control: max-age=31536000, public, immutable
accept-ranges: bytes
x-amz-cf-id: oR49gLaIWdd1oPEH-XS_YMW7uZBCYY3kcX6ex1SIU_IsVqEYvf4U8Q==
expires: Thu, 07 Dec 2023 00:42:43 GMT

POST
H3 204 collect
region1.google-analytics.com/g/ 0
17 B 89ms
32ms Ping
text/plain 2001:4860:4802:32::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-FBY6B30C4M&gtm=2oebu0&_p=153485782&cid=1685996167.1670502335&ul=en-us&sr=1600x1200&ir=1&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_eu=EA&_s=2&sid=1670502334&sct=1&seg=0&dl=https%3A%2F%2Fwww.welivesecurity.com%2F2017%2F07%2F04%2Fanalysis-of-telebots-cunning-backdoor%2F&dt=Analysis%20of%20TeleBots%E2%80%99%20cunning%20backdoor%20%7C%20WeLiveSecurity&en=cookie_consent_visible&ep.branch=en&ep.page_location_noquery=https%3A%2F%2Fwww.welivesecurity.com%2F2017%2F07%2F04%2Fanalysis-of-telebots-cunning-backdoor%2F&ep.hostname=www.welivesecurity.com&ep.useragent=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F108.0.5359.98%20Safari%2F537.36&ep.project_id=wls&ep.article_category=Ukraine%20Crisis%20%E2%80%93%20Digital%20Security%20Resource%20Center&ep.author=Anton%20Cherepanov&ep.blog_length=1.1k-1.5k&ep.article_section=Research&ep.cookie_consent=b%3A1%7Ca%3A0%7Cm%3A0&_et=195
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-FBY6B30C4M&l=dataLayer&cx=c
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://www.welivesecurity.com/2017/07/04/analysis-of-telebots-cunning-backdoor/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 08 Dec 2022 12:25:40 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.welivesecurity.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js

Domain: s.go-mpulse.net
URL: https://s.go-mpulse.net/boomerang/7R9SM-QGSYF-QDLJK-UETXR-SPM6B

Domain: s.go-mpulse.net
URL: https://s.go-mpulse.net/boomerang/7R9SM-QGSYF-QDLJK-UETXR-SPM6B

Verdicts & Comments Add Verdict or Comment

56 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

6 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
www.welivesecurity.com/	1970-01-20 16:47:18	Name: pll_language Value: en
.welivesecurity.com/	1969-12-31 23:59:59	Name: TS01239cf7 Value: 0142213e1a48f2746cd7d6588e491d15489c60a5b6cc55152132fb4c6f7f77a81c63d52b0750eb1f1b762d2079c9db0e66b2c5d8a6
.welivesecurity.com/	1970-01-20 08:01:45	Name: AKA_A2 Value: A
.welivesecurity.com/	1970-01-20 08:03:08	Name: _gid Value: GA1.2.126200217.1670502335
.welivesecurity.com/	1970-01-20 17:37:42	Name: _ga_FBY6B30C4M Value: GS1.1.1670502334.1.0.1670502334.0.0.0
.welivesecurity.com/	1970-01-20 17:37:42	Name: _ga Value: GA1.2.1685996167.1670502335

9 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	error	URL: https://www.welivesecurity.com/2017/07/04/analysis-of-telebots-cunning-backdoor/ Message: The Content-Security-Policy directive 'prefetch-src' contains the keyword 'none' alongside with other source expressions. The keyword 'none' must be the only source expression in the directive value, otherwise it is ignored.
security	error	URL: https://www.welivesecurity.com/2017/07/04/analysis-of-telebots-cunning-backdoor/(Line 15) Message: Refused to load the script 'https://az416426.vo.msecnd.net/scripts/a/ai.0.js' because it violates the following Content Security Policy directive: "script-src 'self' 'unsafe-eval' 'unsafe-inline' https://assets.esetstatic.com https://cdn.esetstatic.com https://connect.facebook.net https://googleads.g.doubleclick.net https://platform.twitter.com https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tpc.googlesyndication.com https://welivesecurity.disqus.com https://www.google-analytics.com https://www.google.co.kr https://www.google.com https://www.googleadservices.com https://www.googletagmanager.com https://www.instagram.com https://www.opinionstage.com https://www.youtube.com". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.
security	error	URL: https://www.welivesecurity.com/2017/07/04/analysis-of-telebots-cunning-backdoor/(Line 66) Message: Refused to load the script 'https://s.go-mpulse.net/boomerang/7R9SM-QGSYF-QDLJK-UETXR-SPM6B' because it violates the following Content Security Policy directive: "script-src 'self' 'unsafe-eval' 'unsafe-inline' https://assets.esetstatic.com https://cdn.esetstatic.com https://connect.facebook.net https://googleads.g.doubleclick.net https://platform.twitter.com https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tpc.googlesyndication.com https://welivesecurity.disqus.com https://www.google-analytics.com https://www.google.co.kr https://www.google.com https://www.googleadservices.com https://www.googletagmanager.com https://www.instagram.com https://www.opinionstage.com https://www.youtube.com". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.
security	error	URL: https://www.welivesecurity.com/2017/07/04/analysis-of-telebots-cunning-backdoor/(Line 66) Message: The Content-Security-Policy directive 'prefetch-src' contains the keyword 'none' alongside with other source expressions. The keyword 'none' must be the only source expression in the directive value, otherwise it is ignored.
security	error	URL: https://www.welivesecurity.com/2017/07/04/analysis-of-telebots-cunning-backdoor/(Line 66) Message: The Content-Security-Policy directive 'prefetch-src' contains the keyword 'none' alongside with other source expressions. The keyword 'none' must be the only source expression in the directive value, otherwise it is ignored.
security	error	URL: https://www.welivesecurity.com/2017/07/04/analysis-of-telebots-cunning-backdoor/(Line 66) Message: Refused to load the script 'https://s.go-mpulse.net/boomerang/7R9SM-QGSYF-QDLJK-UETXR-SPM6B' because it violates the following Content Security Policy directive: "script-src 'self' 'unsafe-eval' 'unsafe-inline' https://assets.esetstatic.com https://cdn.esetstatic.com https://connect.facebook.net https://googleads.g.doubleclick.net https://platform.twitter.com https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tpc.googlesyndication.com https://welivesecurity.disqus.com https://www.google-analytics.com https://www.google.co.kr https://www.google.com https://www.googleadservices.com https://www.googletagmanager.com https://www.instagram.com https://www.opinionstage.com https://www.youtube.com". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.
security	error	URL: https://welivesecurity.disqus.com/embed.js(Line 46) Message: The Content-Security-Policy directive 'prefetch-src' contains the keyword 'none' alongside with other source expressions. The keyword 'none' must be the only source expression in the directive value, otherwise it is ignored.
security	error	URL: https://welivesecurity.disqus.com/embed.js(Line 46) Message: The Content-Security-Policy directive 'prefetch-src' contains the keyword 'none' alongside with other source expressions. The keyword 'none' must be the only source expression in the directive value, otherwise it is ignored.
security	error	URL: https://welivesecurity.disqus.com/embed.js(Line 46) Message: The Content-Security-Policy directive 'prefetch-src' contains the keyword 'none' alongside with other source expressions. The keyword 'none' must be the only source expression in the directive value, otherwise it is ignored.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	default-src 'none'; child-src https://disqus.com https://vars.hotjar.com; connect-src 'self' http://ad.doubleclick.net https://.akamaihd.net https://.akstat.io https://.hotjar.com https://adservice.google.com https://captcha.eset.com https://cc.welivesecurity.com https://cdn.linkedin.oribi.io https://in.hotjar.com https://region1.google-analytics.com https://stats.g.doubleclick.net https://surveystats.hotjar.io https://trial-eum-clientnsv4-s.akamaihd.net https://trial-eum-clienttons-s.akamaihd.net https://vc.hotjar.io https://ws22.hotjar.com https://ws32.hotjar.com https://www.facebook.com https://www.google-analytics.com https://www.google.com https://www.googletagmanager.com https://www.opinionstage.com wss://.hotjar.com wss://ws1.hotjar.com; font-src 'self'; frame-src 'self' https://c.disquscdn.com https://disqus.com https://m.facebook.com https://platform.twitter.com https://tpc.googlesyndication.com https://vars.hotjar.com https://www.facebook.com https://www.googletagmanager.com https://www.instagram.com https://www.opinionstage.com https://www.podbean.com https://www.screencast.com https://www.slideshare.net https://www.youtube-nocookie.com https://www.youtube.com; img-src 'self' data: https://*.ads.linkedin.com https://adservice.google.com https://analytics.twitter.com https://c.disquscdn.com https://captcha.eset.com https://cdn1.esetstatic.com https://googleads.g.doubleclick.net https://px.ads.linkedin.com https://referrer.disqus.com https://region1.google-analytics.com https://script.hotjar.com https://secure.eset.com https://syndication.twitter.com https://t.co https://www.facebook.com https://www.google-analytics.com https://www.google.ad https://www.google.ae https://www.google.al https://www.google.at https://www.google.az https://www.google.ba https://www.google.be https://www.google.bf https://www.google.bg https://www.google.bj https://www.google.bs https://www.google.ca https://www.google.cd https://www.google.ch https://www.google.ci https://www.google.cl https://www.google.cm https://www.google.cn https://www.google.co.ao https://www.google.co.cr https://www.google.co.id https://www.google.co.il https://www.google.co.in https://www.google.co.jp https://www.google.co.ke https://www.google.co.kr https://www.google.co.ls https://www.google.co.ma https://www.google.co.mz https://www.google.co.nz https://www.google.co.th https://www.google.co.tz https://www.google.co.ug https://www.google.co.uk https://www.google.co.uz https://www.google.co.ve https://www.google.co.za https://www.google.co.zm https://www.google.com https://www.google.com.ar https://www.google.com.au https://www.google.com.bd https://www.google.com.bh https://www.google.com.bo https://www.google.com.br https://www.google.com.bz https://www.google.com.co https://www.google.com.cu https://www.google.com.cy https://www.google.com.do https://www.google.com.ec https://www.google.com.eg https://www.google.com.et https://www.google.com.gh https://www.google.com.gt https://www.google.com.hk https://www.google.com.jm https://www.google.com.kh https://www.google.com.kw https://www.google.com.lb https://www.google.com.ly https://www.google.com.mt https://www.google.com.mx https://www.google.com.my https://www.google.com.ng https://www.google.com.ni https://www.google.com.np https://www.google.com.om https://www.google.com.pa https://www.google.com.pe https://www.google.com.ph https://www.google.com.pk https://www.google.com.pr https://www.google.com.py https://www.google.com.qa https://www.google.com.sa https://www.google.com.sg https://www.google.com.sl https://www.google.com.sv https://www.google.com.tr https://www.google.com.tw https://www.google.com.ua https://www.google.com.uy https://www.google.com.vn https://www.google.cv https://www.google.cz https://www.google.de https://www.google.dk https://www.google.dz https://www.google.ee https://www.google.es https://www.google.fi https://www.google.fr https://www.google.ge https://www.google.gr https://www.google.gy https://www.google.hn https://www.google.hr https://www.google.hu https://www.google.ie https://www.google.iq https://www.google.is https://www.google.it https://www.google.jo https://www.google.kg https://www.google.kz https://www.google.lk https://www.google.lt https://www.google.lu https://www.google.lv https://www.google.mk https://www.google.mn https://www.google.mv https://www.google.nl https://www.google.no https://www.google.pl https://www.google.pt https://www.google.ro https://www.google.rs https://www.google.ru https://www.google.sc https://www.google.se https://www.google.si https://www.google.sk https://www.google.sn https://www.google.tn https://www.google.tt https://www.google.vg https://www.googletagmanager.com https://www.linkedin.com https://www.youtube.com; manifest-src 'none'; media-src 'self'; object-src 'self' https://content.screencast.com; prefetch-src 'none' https://c.disquscdn.com https://disqus.com; script-src 'self' 'unsafe-eval' 'unsafe-inline' https://assets.esetstatic.com https://cdn.esetstatic.com https://connect.facebook.net https://googleads.g.doubleclick.net https://platform.twitter.com https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tpc.googlesyndication.com https://welivesecurity.disqus.com https://www.google-analytics.com https://www.google.co.kr https://www.google.com https://www.googleadservices.com https://www.googletagmanager.com https://www.instagram.com https://www.opinionstage.com https://www.youtube.com; style-src 'self' 'unsafe-inline' https://assets.esetstatic.com https://c.disquscdn.com https://cdn.esetstatic.com; worker-src 'none'; report-uri https://www-welivesecurity-com.api.cspconsole.com/v1/csp/report; report-to default;
Strict-Transport-Security	max-age=15724800
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

az416426.vo.msecnd.net
c.disquscdn.com
cdn.esetstatic.com
cdn1.esetstatic.com
disqus.com
referrer.disqus.com
region1.google-analytics.com
s.go-mpulse.net
welivesecurity.disqus.com
www.google-analytics.com
www.googletagmanager.com
www.welivesecurity.com
az416426.vo.msecnd.net
s.go-mpulse.net
151.101.128.134
18.66.97.100
199.232.192.134
199.232.196.134
2001:4860:4802:32::36
2600:9000:20eb:d600:6:8656:f5c0:93a1
2620:1ec:46::44
2a00:1450:4001:806::200e
2a00:1450:4001:810::2008
2a02:26f0:3500:12::1730:17bf
07b08ea224b7494aff9e9acc5257c563d20f438b1944334fc11833461a2ef433
12c42fa79dc321e56bb3c23008cacf7a79771bab4fa61f765556e24ba13a89ff
12f37c0a70377ac636345742e2eb0d2acb70d411612020ae1608193330a5b15d
15299f8cce69e734ae086d3b960e628ef4362e1d1109b401fb8c2a81020bf9a7
16b235a5b38fe6e9779d4fda7955c2706fe00113444aeec56b470fb4d2b94328
18978d486a3d4d5d16aaff69e52972562bf97506f65e9d8c84cd2d16cacb18a6
193fbb968733b8a7049da19274546e6b80b76e9a8f1b837fee9a5fdeb8f97c7b
1ba0ff3994900740a94dc37300b7415b25d642f6ef495afc5ae4e16ae1128e66
21f73559c1dfc0702d3ce7204103058c3947ab642eb48d53c436e32e5e59c56c
260865134b6e69ca7bafa9e8ddcd59fb6ffbf727f50a3d2dd186d217c8c79694
278f7c9d80a080385d0ac988d5dc97b7ec33d0ae378a4d8ae58afb6f03cb156d
3270642c89180c12db93775e2a774b6dadd9bd98cffc963075c85afd2c17b6e4
3487ef2baf0c08ba660a8a143cdeb8ebeec961eea04bccd7c49096b4eb26b875
34d8af20588a149e070529713e72323efe5e3bf627dc334f51e12c43a46d0f2f
35ccbb14f6d8b7ed5eb03728f94221f27ed194ae83b32c40315d531f49b10bc1
3a490b34ba8411afa03552d884cf5d7da8cb48d7d167946d7ab83b6d697132b6
4093cb234c3178f43e5f022130a8090e5621e99047198e7d9d67c1328a5e4137
409658f033da9872ab0c27643e1b6b03d694d372866f404a8410eb93274b7968
45216aa0f15d7f304b6fe8cbde2090988d77bfc7ff11ff499869ba1aa6b30d9d
4c4491dcfa94cb46fb73742fc2caf49a1cd59027304af1830c7dc6ce1889857c
5159dca2fe03c327248fd3b685f497f9f521c91d243ffaf43077601fedf56f7a
5425ae5b9cba24d2af92cb5389060f9c1dd5ac7bbf45fdd73085fa2e7e5e0bae
547d64d9586e701e83fd750596ba4ad00437294bbb2377e68d38823b0d097911
5813b04bb0c879b76179735995127ddc2af1867f42d4a4b5a8d7c3103f348b05
63a41173db39c92635a87b39eedb581e8a1c3142372ebced441ce927fef343a1
667cfbb57ee3e8993768bd7d5014d330129d16fa2e99fde4eb58eddeaee54653
67af3e37e9bd319dfa5250a60e3849b2172a9727c2aa0e1cf27aac1a9f42b49a
6f64d89a1569272ec61f0a87bebe1eefd7749517c672aa34c52efa4c0c82b6c9
70a418910117277df96100b8163add8f820b4956a9cb53dcea92f3d11845b283
7df5345a52f22643ef051bf74f41d9a5a5644d5e699480a81ae8825b8ab5e533
822800703045ecbccb15cff577f1f09d9b4efee6ae916396a6aceb3f6544b9a5
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
867bde5f1930963a16e7dac4c891142edaa529a4428bb3486165757b7c8ead08
8d8ba4c94f3b33965aa63ce307972277b1263dc40705b292af8f835f4eebd042
90514aacb5485e3aeb4bc8766c7ad3b6279254ea9806f9c463b9c82cb1f4b044
9714221c828961b20f45a782c3281c0596f6652cfe1299bee18097f98e8fb7b3
a375e7cd427cc4636fd16334feac292258603559e5bed0936b77d6a2bdf87c47
aa5c8340e756a3d33b80707dc26e9e81c4110417bf5ca3f0c625a7fd9750c51f
b24406edbfc7c4b31c9ffd6fe042f1338d44a2367d3fca73b6f4d42f28671c8c
b42e4a056cb5b80c5a315040826866445ec9332f0749e184509ab2d9d3b86719
cea0a05c5af6e21a409875328ed2e3dba79131b7c41f8ea07d0e0e02c7b7b59e
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
db6ec323207ebb78fc70f93f0b6b250ec6f4d16a4bf2a7983122e6337db93323
ddf0e65e326bc99627ac2d1df7babf8780bb64fe4fa08bb1a0e5d772fb2e3c94
e0c2fd69b7d441b42045d474afe52d2bdbb81a44c8d73e2c8271e4114003d991
e22e3416c5b454c2fc3c8e8185b478647446789abbee258ec18a5791880eaf1b
e3136ed18810649908a21e1af3d5ed10eb6f0b06f8e7653362e2303870aaf8b8
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ed013239fcc3874aa2e9ab3a02864ca1e6fe0c98ce3aa297cd8f6a2fd6cace3b
f055e217bde76d711bd8b42af773f9f99b8a29d81ad9ed10b6379cc7e6c60452
f0edf4ed283d119399dcb7025914b6a68a187667085bcbc49fe91db20f952cc1
f2a341fc815d45c21da726d4c843c2c5d3e1f333465347c3c75d040d556df4e5
f5865f390994c61dc372c020365fed34264f1b38ab4359750363c8003d23dec4
f59a73a3cc82269c7341ae1d401a0b4ab33162b890939411de453f67dceea3a0
fd6b27d75d7c3ba5ce98297ce2261ff676140d12846fa5feb424f724936e2d1c

www.welivesecurity.com Open in urlscan Pro 2a02:26f0:3500:12::1730:17bf Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

71 Requests

96 %HTTPS

60 %IPv6

8 Domains

12 Subdomains

11 IPs

2 Countries

1637 kBTransfer

3284 kBSize

6 Cookies

10 Outgoing links

Redirected requests

71 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

www.welivesecurity.com Open in urlscan Pro
2a02:26f0:3500:12::1730:17bf Public Scan

Screenshot
Live screenshot

Full Image

71
Requests

96 %
HTTPS

60 %
IPv6

8
Domains

12
Subdomains

11
IPs

2
Countries

1637 kB
Transfer

3284 kB
Size

6
Cookies

71 HTTP transactions
0 data transactions