www.seqrite.com Open in urlscan Pro
103.228.50.137 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-...
Submission: On August 29 via api (August 29th 2024, 2:21:06 pm UTC) from IT — Scanned from IT

Summary HTTP 91 Redirects Links 12 Behaviour Indicators

Summary

This website contacted 8 IPs in 3 countries across 6 domains to perform 91 HTTP transactions. The main IP is 103.228.50.137, located in India and belongs to BALASAINET-AS Balasai Net Pvt. Ltd., IN. The main domain is www.seqrite.com.
TLS certificate: Issued by RapidSSL TLS RSA CA G1 on January 2nd 2024. Valid for: a year.

This is the only time www.seqrite.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
82	103.228.50.137 103.228.50.137	133288 (BALASAINE...) (BALASAINET-AS Balasai Net Pvt. Ltd.)
1	2a00:1450:400... 2a00:1450:4001:81c::2008	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:831::200a	15169 (GOOGLE) (GOOGLE)
2	2606:2800:234... 2606:2800:234:59:254c:406:2366:268c	15133 (EDGECAST) (EDGECAST)
1	2a00:1450:400... 2a00:1450:4001:812::200a	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:813::200e	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:80e::2003	15169 (GOOGLE) (GOOGLE)
91	8

82 103.228.50.137 (India)

ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN)
PTR: ComputeH-pnq83.balasai.com

www.seqrite.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:81c::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:831::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:2800:234:59:254c:406:2366:268c (United States)

ASN15133 (EDGECAST, US)

platform.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:812::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:813::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:80e::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
82	seqrite.com www.seqrite.com	3 MB
2	gstatic.com fonts.gstatic.com	72 KB
2	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 104	21 KB
2	twitter.com platform.twitter.com — Cisco Umbrella Rank: 1868	28 KB
2	googleapis.com ajax.googleapis.com — Cisco Umbrella Rank: 641 fonts.googleapis.com — Cisco Umbrella Rank: 110	9 KB
1	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 112	72 KB
91	6

	Domain	Requested by
82	www.seqrite.com	www.seqrite.com
2	fonts.gstatic.com	fonts.googleapis.com
2	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com
2	platform.twitter.com	www.seqrite.com platform.twitter.com
1	fonts.googleapis.com	ajax.googleapis.com
1	ajax.googleapis.com	www.seqrite.com
1	www.googletagmanager.com	www.seqrite.com
91	7

This site contains links to these domains. Also see Links.

Domain
www.facebook.com
twitter.com
www.linkedin.com
plus.google.com
www.youtube.com
api.whatsapp.com
x.com
github.com
www.virustotal.com
docs.seqrite.com

Subject Issuer	Validity	Valid
*.seqrite.com RapidSSL TLS RSA CA G1	`2024-01-02` - `2025-01-08`	a year	crt.sh
*.google-analytics.com WR2	`2024-08-05` - `2024-10-28`	3 months	crt.sh
upload.video.google.com WR2	`2024-08-05` - `2024-10-28`	3 months	crt.sh
*.twimg.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-07-08` - `2025-07-07`	a year	crt.sh
*.gstatic.com WR2	`2024-08-05` - `2024-10-28`	3 months	crt.sh

This page contains 2 frames:

Primary Page: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/
Frame ID: DAF157DA66FC70680B26A2B65D70DBDC
Requests: 94 HTTP requests in this frame

Frame: https://platform.twitter.com/widgets/widget_iframe.2f70fb173b9000da126c79afe2098f02.html?origin=https%3A%2F%2Fwww.seqrite.com
Frame ID: E055A5301A32C47138D0341419EA4330
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Operation Oxidový: Sophisticated Malware Campaign Targets Czech Officials Using NATO-Themed Decoys

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

<link rel=["']stylesheet["'] [^>]+/wp-(?:content|includes)/
/wp-(?:content|includes)/
wp-embed\.min\.js\?ver=([\d.]+)

Yoast SEO (SEO) Expand

Overall confidence: 100%
Detected patterns

<!-- This site is optimized with the Yoast (?:WordPress )?SEO plugin v([\d.]+) -

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
<link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

googleapis\.com/.+webfont

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtag/js

Twitter (Widgets) Expand

Overall confidence: 100%
Detected patterns

//platform\.twitter\.com/widgets\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jQuery Migrate (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?

Page Statistics

91
Requests

100 %
HTTPS

86 %
IPv6

6
Domains

7
Subdomains

8
IPs

3
Countries

3321 kB
Transfer

4010 kB
Size

4
Cookies

12 Outgoing links

These are links going to different origins than the main page.

URL: https://www.facebook.com/seqrite

Search URL Search Domain Scan URL

URL: https://twitter.com/Seqrite

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/seqrite

Search URL Search Domain Scan URL

URL: https://plus.google.com/114969253508422817802/posts

Search URL Search Domain Scan URL

URL: https://www.youtube.com/channel/UCPgS-p40ag_l8i3mhMWW7Gg

Search URL Search Domain Scan URL

URL: https://api.whatsapp.com/send?text=Operation%20Oxidov%C3%BD%3A%20Sophisticated%20Malware%20Campaign%20Targets%20Czech%20Officials%20Using%20NATO-Themed%20Decoys%20https%3A%2F%2Fwww.seqrite.com%2Fblog%2Foperation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys%2F

Search URL Search Domain Scan URL

URL: https://x.com/StrikeReadyLabs/status/1820422011149037830
Title: threat researchers

Search URL Search Domain Scan URL

URL: https://github.com/optiv/Freeze.rs/blob/main/lib/src/lib.rs
Title: Freeze

Search URL Search Domain Scan URL

URL: https://github.com/kunpen/Havoc-C2
Title: Havoc.

Search URL Search Domain Scan URL

URL: https://github.com/BishopFox/sliver/wiki/Stagers/7116c1c26c5d4e783d60e4e622bd98c67b13f740
Title: Sliver Stager

Search URL Search Domain Scan URL

URL: https://www.virustotal.com/gui/search/name%253ANatoDoc.pdf
Title: NatoDoc.pdf

Search URL Search Domain Scan URL

URL: https://docs.seqrite.com/docs
Title: Manuals

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

91 HTTP transactions
4 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request / Show response
www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/ 124 KB
28 KB 2588ms
1398ms Document
text/html 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

3a643b4e2767f6ece0e835994d8c4134421d743ae0356a3ce7cc7945d1db5947

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Cache-Control: max-age=2592000, private, must-revalidate
Connection: keep-alive, Keep-Alive
Content-Encoding: gzip
Content-Length: 26877
Content-Security-Policy: upgrade-insecure-requests
Content-Type: text/html; charset=UTF-8
Date: Thu, 29 Aug 2024 14:20:34 GMT
Expires: Sat, 28 Sep 2024 14:20:34 GMT
Keep-Alive: timeout=10, max=100
Link: <https://www.seqrite.com/blog/wp-json/>; rel="https://api.w.org/" <https://www.seqrite.com/blog/?p=6378>; rel=shortlink
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Referrer-Policy: no-referrer-when-downgrade
Server: Apache
Strict-Transport-Security: max-age=63072000; includeSubDomains
Vary: Accept-Encoding,User-Agent
X-Content-Type-Options: nosniff
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Pingback: https://www.seqrite.com/blog/xmlrpc.php
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK font-awesome.css
www.seqrite.com/blog/wp-content/themes/goblog/css/ 28 KB
7 KB 344ms
180ms Stylesheet
text/css 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.seqrite.com/blog/wp-content/themes/goblog/css/font-awesome.css

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

6f20c872577786195e3973e8b5f2f9063214f32171ccf196b90c4710b9df99ee

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date: Thu, 29 Aug 2024 14:20:35 GMT
Content-Security-Policy: upgrade-insecure-requests
Content-Encoding: gzip
Strict-Transport-Security: max-age=63072000; includeSubDomains
X-Content-Type-Options: nosniff
Connection: keep-alive, Keep-Alive
Content-Length: 5376
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Wed, 16 Feb 2022 06:49:58 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: text/css
Cache-Control: max-age=2592000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=99
Expires: Sat, 28 Sep 2024 14:20:35 GMT

GET
H/1.1 200
OK email-subscribers-public.css
www.seqrite.com/blog/wp-content/plugins/email-subscribers/public/css/ 807 B
2 KB 523ms
180ms Stylesheet
text/css 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.seqrite.com/blog/wp-content/plugins/email-subscribers/public/css/email-subscribers-public.css

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

f84eb4571c0eb40823ed47af468684cc9703ecfc89f6a38e569a470d504a3504

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date: Thu, 29 Aug 2024 14:20:35 GMT
Content-Security-Policy: upgrade-insecure-requests
Content-Encoding: gzip
Strict-Transport-Security: max-age=63072000; includeSubDomains
X-Content-Type-Options: nosniff
Connection: keep-alive, Keep-Alive
Content-Length: 363
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Mon, 05 Aug 2019 06:40:46 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: text/css
Cache-Control: max-age=2592000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=98
Expires: Sat, 28 Sep 2024 14:20:35 GMT

GET
H/1.1 200
OK style.css
www.seqrite.com/blog/wp-content/themes/goblog/ 73 KB
17 KB 530ms
184ms Stylesheet
text/css 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.seqrite.com/blog/wp-content/themes/goblog/style.css?ver=4.8.25

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

880701812604e09fd133b76474940aed0f05d802a80945c798cfae067d53bda0

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date: Thu, 29 Aug 2024 14:20:35 GMT
Content-Security-Policy: upgrade-insecure-requests
Content-Encoding: gzip
Strict-Transport-Security: max-age=63072000; includeSubDomains
X-Content-Type-Options: nosniff
Connection: keep-alive, Keep-Alive
Content-Length: 15516
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Wed, 12 Apr 2023 11:35:15 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: text/css
Cache-Control: max-age=2592000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=100
Expires: Sat, 28 Sep 2024 14:20:35 GMT

GET
H/1.1 200
OK magnific-popup.css
www.seqrite.com/blog/wp-content/themes/goblog/css/ 8 KB
3 KB 548ms
184ms Stylesheet
text/css 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.seqrite.com/blog/wp-content/themes/goblog/css/magnific-popup.css?ver=4.8.25

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

0fbf945eae1c5869be401c6db68da93f5a47f2c1ff6072151ebb4b2dea6d4f62

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date: Thu, 29 Aug 2024 14:20:36 GMT
Content-Security-Policy: upgrade-insecure-requests
Content-Encoding: gzip
Strict-Transport-Security: max-age=63072000; includeSubDomains
X-Content-Type-Options: nosniff
Connection: keep-alive, Keep-Alive
Content-Length: 1936
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Thu, 25 Feb 2016 09:40:14 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: text/css
Cache-Control: max-age=2592000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=100
Expires: Sat, 28 Sep 2024 14:20:36 GMT

GET
H/1.1 200
OK responsive.css
www.seqrite.com/blog/wp-content/themes/goblog/css/ 13 KB
5 KB 557ms
185ms Stylesheet
text/css 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.seqrite.com/blog/wp-content/themes/goblog/css/responsive.css?ver=4.8.25

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

93754643da5a46ca1b7e1f6ba4378655974e11e1cbb432e8c5cbf54804b722bc

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date: Thu, 29 Aug 2024 14:20:36 GMT
Content-Security-Policy: upgrade-insecure-requests
Content-Encoding: gzip
Strict-Transport-Security: max-age=63072000; includeSubDomains
X-Content-Type-Options: nosniff
Connection: keep-alive, Keep-Alive
Content-Length: 3334
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Thu, 25 Feb 2016 09:40:14 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: text/css
Cache-Control: max-age=2592000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=100
Expires: Sat, 28 Sep 2024 14:20:36 GMT

GET
H/1.1 200
OK wpp.css
www.seqrite.com/blog/wp-content/plugins/wordpress-popular-posts/style/ 889 B
2 KB 574ms
194ms Stylesheet
text/css 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.seqrite.com/blog/wp-content/plugins/wordpress-popular-posts/style/wpp.css?ver=3.2.2

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

b4ae8ad8c560bb87aa8fe03d597e2a69eef809072a35415d32ba68757e13ece6

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date: Thu, 29 Aug 2024 14:20:36 GMT
Content-Security-Policy: upgrade-insecure-requests
Content-Encoding: gzip
Strict-Transport-Security: max-age=63072000; includeSubDomains
X-Content-Type-Options: nosniff
Connection: keep-alive, Keep-Alive
Content-Length: 433
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Thu, 25 Feb 2016 09:41:46 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: text/css
Cache-Control: max-age=2592000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=100
Expires: Sat, 28 Sep 2024 14:20:36 GMT

GET
H/1.1 200
OK sassy-social-share-public.css
www.seqrite.com/blog/wp-content/plugins/sassy-social-share/public/css/ 30 KB
10 KB 584ms
201ms Stylesheet
text/css 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.seqrite.com/blog/wp-content/plugins/sassy-social-share/public/css/sassy-social-share-public.css?ver=3.2.3

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

680a80d356565114378e038218e6971571fb76e54ff0530999d38f2b3c99368f

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date: Thu, 29 Aug 2024 14:20:36 GMT
Content-Security-Policy: upgrade-insecure-requests
Content-Encoding: gzip
Strict-Transport-Security: max-age=63072000; includeSubDomains
X-Content-Type-Options: nosniff
Connection: keep-alive, Keep-Alive
Content-Length: 8569
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Tue, 03 Jul 2018 09:32:39 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: text/css
Cache-Control: max-age=2592000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=100
Expires: Sat, 28 Sep 2024 14:20:36 GMT

GET
H/1.1 200
OK sassy-social-share-svg.css
www.seqrite.com/blog/wp-content/plugins/sassy-social-share/admin/css/ 117 KB
37 KB 733ms
211ms Stylesheet
text/css 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.seqrite.com/blog/wp-content/plugins/sassy-social-share/admin/css/sassy-social-share-svg.css?ver=3.2.3

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

1c5fe2a18d6a2a223e6b8ee3f1876e841873b9235e2f170226eb583e073f587c

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date: Thu, 29 Aug 2024 14:20:36 GMT
Content-Security-Policy: upgrade-insecure-requests
Content-Encoding: gzip
Strict-Transport-Security: max-age=63072000; includeSubDomains
X-Content-Type-Options: nosniff
Connection: keep-alive, Keep-Alive
Content-Length: 36679
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Tue, 03 Jul 2018 09:32:39 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: text/css
Cache-Control: max-age=2592000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=97
Expires: Sat, 28 Sep 2024 14:20:36 GMT

GET
H/1.1 200
OK jquery-3.6.0.min.js Show response
www.seqrite.com/blog/wp-content/plugins/jquery-updater/js/ 87 KB
32 KB 747ms
198ms Script
application/javascript 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.seqrite.com/blog/wp-content/plugins/jquery-updater/js/jquery-3.6.0.min.js?ver=4.8.25

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date: Thu, 29 Aug 2024 14:20:36 GMT
Content-Security-Policy: upgrade-insecure-requests
Content-Encoding: gzip
Strict-Transport-Security: max-age=63072000; includeSubDomains
X-Content-Type-Options: nosniff
Connection: keep-alive, Keep-Alive
Content-Length: 30902
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Tue, 22 Jun 2021 11:50:20 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: application/javascript
Cache-Control: max-age=2592000, private
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=99
Expires: Sat, 28 Sep 2024 14:20:36 GMT

GET
H/1.1 200
OK jquery-migrate-3.3.2.min.js Show response
www.seqrite.com/blog/wp-content/plugins/jquery-updater/js/ 11 KB
6 KB 740ms
183ms Script
application/javascript 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.seqrite.com/blog/wp-content/plugins/jquery-updater/js/jquery-migrate-3.3.2.min.js?ver=4.8.25

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

f7e248392cea6eed6651423f5b9a4adafec5b15921a2f16ec54e1012be0aaee5

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date: Thu, 29 Aug 2024 14:20:36 GMT
Content-Security-Policy: upgrade-insecure-requests
Content-Encoding: gzip
Strict-Transport-Security: max-age=63072000; includeSubDomains
X-Content-Type-Options: nosniff
Connection: keep-alive, Keep-Alive
Content-Length: 4170
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Tue, 22 Jun 2021 11:50:20 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: application/javascript
Cache-Control: max-age=2592000, private
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=99
Expires: Sat, 28 Sep 2024 14:20:36 GMT

GET
H/1.1 200
OK email-subscribers-public.js Show response
www.seqrite.com/blog/wp-content/plugins/email-subscribers/public/js/ 3 KB
3 KB 761ms
188ms Script
application/javascript 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.seqrite.com/blog/wp-content/plugins/email-subscribers/public/js/email-subscribers-public.js

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

34e35f893b634d5439db39f3c4f202ddc21aaf406e5724e8c118d513f086752f

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date: Thu, 29 Aug 2024 14:20:36 GMT
Content-Security-Policy: upgrade-insecure-requests
Content-Encoding: gzip
Strict-Transport-Security: max-age=63072000; includeSubDomains
X-Content-Type-Options: nosniff
Connection: keep-alive, Keep-Alive
Content-Length: 1458
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Mon, 05 Aug 2019 06:40:50 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: application/javascript
Cache-Control: max-age=2592000, private
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=99
Expires: Sat, 28 Sep 2024 14:20:36 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 198 KB
72 KB 116ms
46ms Script
application/javascript 2a00:1450:4001:81c::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-104093208-1

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

0a38ec5d222521e313a46c8b807e2b57957b2919f9b3a08fa6e33c05f959aaa3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Thu, 29 Aug 2024 14:20:59 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 73176
x-xss-protection: 0
last-modified: Thu, 29 Aug 2024 12:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 29 Aug 2024 14:20:59 GMT

GET
H/1.1 200
OK logo-seqrite.png
www.seqrite.com/blog/wp-content/uploads/2024/04/ 5 KB
6 KB 465ms
178ms Image
image/png 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.seqrite.com/blog/wp-content/uploads/2024/04/logo-seqrite.png

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

34092036b671b8a82a328dbfe91a14db473da80b478b04c6261d8e436eb06d77

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date: Thu, 29 Aug 2024 14:20:36 GMT
Content-Security-Policy: upgrade-insecure-requests
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=63072000; includeSubDomains
Connection: keep-alive, Keep-Alive
Content-Length: 4653
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Tue, 02 Apr 2024 09:43:46 GMT
Server: Apache
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=31536000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=97
Expires: Fri, 29 Aug 2025 14:20:36 GMT

GET
H2 200 webfont.js Show response
ajax.googleapis.com/ajax/libs/webfont/1.5.3/ 17 KB
7 KB 102ms
32ms Script
text/javascript 2a00:1450:4001:831::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/webfont/1.5.3/webfont.js

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

36ef095d011c4ced97b0acef551ca36d76b95299518595dc1acab792a2344601

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 27 Aug 2024 14:14:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 173215
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6791
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
vary: Accept-Encoding
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 27 Aug 2025 14:14:04 GMT

GET
H/1.1 200
OK SEQRITE-Blog-Operation-Oxidovy-770x360.png
www.seqrite.com/blog/wp-content/uploads/2024/08/ 332 KB
334 KB 188ms
188ms Image
image/png 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.seqrite.com/blog/wp-content/uploads/2024/08/SEQRITE-Blog-Operation-Oxidovy-770x360.png

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

e92974ab4514271196a5fd0e8298d84dcb0d712e6716dbcc3a674c64a5b81839

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date: Thu, 29 Aug 2024 14:20:36 GMT
Content-Security-Policy: upgrade-insecure-requests
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=63072000; includeSubDomains
Connection: keep-alive, Keep-Alive
Content-Length: 340469
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Wed, 28 Aug 2024 06:40:31 GMT
Server: Apache
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=31536000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=99
Expires: Fri, 29 Aug 2025 14:20:36 GMT

GET
H/1.1 200
OK avatar-default.jpeg
www.seqrite.com/blog/wp-content/uploads/2016/09/ 2 KB
3 KB 517ms
175ms Image
image/jpeg 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.seqrite.com/blog/wp-content/uploads/2016/09/avatar-default.jpeg

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

3f70bc98d579c557f8669b9ddca7c40ca193cc25a6b30c0ee1d91a443c2d3032

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date: Thu, 29 Aug 2024 14:20:36 GMT
Content-Security-Policy: upgrade-insecure-requests
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=63072000; includeSubDomains
Connection: keep-alive, Keep-Alive
Content-Length: 1757
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Tue, 06 Sep 2016 11:56:51 GMT
Server: Apache
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: image/jpeg
Cache-Control: max-age=31536000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=97
Expires: Fri, 29 Aug 2025 14:20:36 GMT

GET
H/1.1 200
OK Image-1-1.png
www.seqrite.com/blog/wp-content/uploads/2024/08/ 89 KB
90 KB 181ms
178ms Image
image/png 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.seqrite.com/blog/wp-content/uploads/2024/08/Image-1-1.png

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

b306eaf93ca19101f9ae5b465bb45e381055b901474fb2b60a2b1eb52b409d19

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date: Thu, 29 Aug 2024 14:20:36 GMT
Content-Security-Policy: upgrade-insecure-requests
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=63072000; includeSubDomains
Connection: keep-alive, Keep-Alive
Content-Length: 90822
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Wed, 28 Aug 2024 06:42:47 GMT
Server: Apache
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=31536000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=99
Expires: Fri, 29 Aug 2025 14:20:36 GMT

GET
H/1.1 200
OK Image-2-1.png
www.seqrite.com/blog/wp-content/uploads/2024/08/ 56 KB
57 KB 182ms
181ms Image
image/png 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.seqrite.com/blog/wp-content/uploads/2024/08/Image-2-1.png

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

4ab34abe594a903a88dd062fe1d6f4071619e53d5dacee1ad97f8f49ebcd4c6f

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date: Thu, 29 Aug 2024 14:20:36 GMT
Content-Security-Policy: upgrade-insecure-requests
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=63072000; includeSubDomains
Connection: keep-alive, Keep-Alive
Content-Length: 56847
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Wed, 28 Aug 2024 06:43:18 GMT
Server: Apache
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=31536000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=96
Expires: Fri, 29 Aug 2025 14:20:36 GMT

GET
H/1.1 200
OK Image-3-1.png
www.seqrite.com/blog/wp-content/uploads/2024/08/ 69 KB
71 KB 188ms
188ms Image
image/png 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.seqrite.com/blog/wp-content/uploads/2024/08/Image-3-1.png

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

ef63999491072b9ad7e6868336b9b080687b0c200d40f19bce5c00420aac32b2

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date: Thu, 29 Aug 2024 14:20:36 GMT
Content-Security-Policy: upgrade-insecure-requests
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=63072000; includeSubDomains
Connection: keep-alive, Keep-Alive
Content-Length: 71086
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Wed, 28 Aug 2024 06:44:06 GMT
Server: Apache
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=31536000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=98
Expires: Fri, 29 Aug 2025 14:20:36 GMT

GET
H/1.1 200
OK Image-4-1.png
www.seqrite.com/blog/wp-content/uploads/2024/08/ 34 KB
36 KB 179ms
179ms Image
image/png 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.seqrite.com/blog/wp-content/uploads/2024/08/Image-4-1.png

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

fdbab62badcc15af602d1111bd69012d3b4e86c290d1677c7ed7ac2e5f851df4

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date: Thu, 29 Aug 2024 14:20:36 GMT
Content-Security-Policy: upgrade-insecure-requests
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=63072000; includeSubDomains
Connection: keep-alive, Keep-Alive
Content-Length: 34945
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Wed, 28 Aug 2024 06:45:10 GMT
Server: Apache
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=31536000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=98
Expires: Fri, 29 Aug 2025 14:20:36 GMT

GET
H/1.1 200
OK Image-5-1.png
www.seqrite.com/blog/wp-content/uploads/2024/08/ 26 KB
28 KB 197ms
196ms Image
image/png 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.seqrite.com/blog/wp-content/uploads/2024/08/Image-5-1.png

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

eaefcd91dffce5aa105ba84fa99ba8fe333971e365084a5412ebac1f76d25dc7

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date: Thu, 29 Aug 2024 14:20:37 GMT
Content-Security-Policy: upgrade-insecure-requests
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=63072000; includeSubDomains
Connection: keep-alive, Keep-Alive
Content-Length: 26754
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Wed, 28 Aug 2024 06:45:33 GMT
Server: Apache
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=31536000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=95
Expires: Fri, 29 Aug 2025 14:20:37 GMT

GET
H/1.1 200
OK oxy.png
www.seqrite.com/blog/wp-content/uploads/2024/08/ 32 KB
33 KB 207ms
207ms Image
image/png 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.seqrite.com/blog/wp-content/uploads/2024/08/oxy.png

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

aaa6c592ab437a257e9ef68aae2cdbea0d96c51729c6c729036f7e6433f906cf

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date: Thu, 29 Aug 2024 14:20:37 GMT
Content-Security-Policy: upgrade-insecure-requests
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=63072000; includeSubDomains
Connection: keep-alive, Keep-Alive
Content-Length: 32842
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Wed, 28 Aug 2024 06:47:51 GMT
Server: Apache
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=31536000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=96
Expires: Fri, 29 Aug 2025 14:20:37 GMT

GET
H/1.1 200
OK Image-6-1.png
www.seqrite.com/blog/wp-content/uploads/2024/08/ 72 KB
74 KB 195ms
195ms Image
image/png 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.seqrite.com/blog/wp-content/uploads/2024/08/Image-6-1.png

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

bba07dfa1b44bad0129ccb839b50cf86a51bccb97c8e1422ef6fa0ea89c1091c

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date: Thu, 29 Aug 2024 14:20:37 GMT
Content-Security-Policy: upgrade-insecure-requests
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=63072000; includeSubDomains
Connection: keep-alive, Keep-Alive
Content-Length: 74182
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Wed, 28 Aug 2024 06:53:03 GMT
Server: Apache
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=31536000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=95
Expires: Fri, 29 Aug 2025 14:20:37 GMT

GET
H/1.1 200
OK Image-7-1.png
www.seqrite.com/blog/wp-content/uploads/2024/08/ 38 KB
40 KB 183ms
183ms Image
image/png 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.seqrite.com/blog/wp-content/uploads/2024/08/Image-7-1.png

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

5c52202a253d3372d2512babb6e500e3fd1323495ddbc099028934e25d855a29

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date: Thu, 29 Aug 2024 14:20:37 GMT
Content-Security-Policy: upgrade-insecure-requests
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=63072000; includeSubDomains
Connection: keep-alive, Keep-Alive
Content-Length: 39098
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Wed, 28 Aug 2024 06:53:51 GMT
Server: Apache
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=31536000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=93
Expires: Fri, 29 Aug 2025 14:20:37 GMT

GET
H/1.1 200
OK Image-8-1.png
www.seqrite.com/blog/wp-content/uploads/2024/08/ 34 KB
35 KB 178ms
178ms Image
image/png 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.seqrite.com/blog/wp-content/uploads/2024/08/Image-8-1.png

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

abd83672a9a04a6685a2df16ad137f535dcbd886f5fbab448aade70173ddb964

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date: Thu, 29 Aug 2024 14:20:37 GMT
Content-Security-Policy: upgrade-insecure-requests
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=63072000; includeSubDomains
Connection: keep-alive, Keep-Alive
Content-Length: 34760
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Wed, 28 Aug 2024 06:54:45 GMT
Server: Apache
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=31536000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=90
Expires: Fri, 29 Aug 2025 14:20:37 GMT

GET
H/1.1 200
OK Image-9-1.png
www.seqrite.com/blog/wp-content/uploads/2024/08/ 73 KB
74 KB 197ms
196ms Image
image/png 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.seqrite.com/blog/wp-content/uploads/2024/08/Image-9-1.png

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

aacedfb00288798884bf2a01a62e745bda44c38570e45c618015b93aaa4c85a0

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date: Thu, 29 Aug 2024 14:20:37 GMT
Content-Security-Policy: upgrade-insecure-requests
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=63072000; includeSubDomains
Connection: keep-alive, Keep-Alive
Content-Length: 74751
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Wed, 28 Aug 2024 06:55:15 GMT
Server: Apache
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=31536000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=93
Expires: Fri, 29 Aug 2025 14:20:37 GMT

GET
H/1.1 200
OK Image-10-2.png
www.seqrite.com/blog/wp-content/uploads/2024/08/ 40 KB
41 KB 176ms
176ms Image
image/png 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.seqrite.com/blog/wp-content/uploads/2024/08/Image-10-2.png

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

6e65d27cd18a8df5f487dbcd2a5be08d6dc995eaccf95a69091f20cd5772489f

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date: Thu, 29 Aug 2024 14:20:37 GMT
Content-Security-Policy: upgrade-insecure-requests
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=63072000; includeSubDomains
Connection: keep-alive, Keep-Alive
Content-Length: 40818
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Wed, 28 Aug 2024 06:57:12 GMT
Server: Apache
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=31536000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=92
Expires: Fri, 29 Aug 2025 14:20:37 GMT

GET
H/1.1 200
OK Image-11-1.png
www.seqrite.com/blog/wp-content/uploads/2024/08/ 56 KB
57 KB 178ms
177ms Image
image/png 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.seqrite.com/blog/wp-content/uploads/2024/08/Image-11-1.png

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

09fa90b9e3353f8105e98323695ee35cd5e73f42917a1ff76cf0cd8e1c7a1618

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date: Thu, 29 Aug 2024 14:20:37 GMT
Content-Security-Policy: upgrade-insecure-requests
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=63072000; includeSubDomains
Connection: keep-alive, Keep-Alive
Content-Length: 57348
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Wed, 28 Aug 2024 06:58:22 GMT
Server: Apache
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=31536000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=89
Expires: Fri, 29 Aug 2025 14:20:37 GMT

GET
H/1.1 200
OK Image-12-1.png
www.seqrite.com/blog/wp-content/uploads/2024/08/ 10 KB
11 KB 220ms
219ms Image
image/png 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.seqrite.com/blog/wp-content/uploads/2024/08/Image-12-1.png

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

f9a5ea6542a0b4c213746e9a577816da06c354e3421f28586b3f0ca2765394ba

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date: Thu, 29 Aug 2024 14:20:37 GMT
Content-Security-Policy: upgrade-insecure-requests
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=63072000; includeSubDomains
Connection: keep-alive, Keep-Alive
Content-Length: 10220
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Wed, 28 Aug 2024 06:58:24 GMT
Server: Apache
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=31536000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=93
Expires: Fri, 29 Aug 2025 14:20:37 GMT

GET
H/1.1 200
OK Image-13-1.png
www.seqrite.com/blog/wp-content/uploads/2024/08/ 7 KB
8 KB 189ms
188ms Image
image/png 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.seqrite.com/blog/wp-content/uploads/2024/08/Image-13-1.png

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

f60d24fb254a22c7a4e8d29622ca6f3dc0f723a11e78b3bef83fc077242cb66e

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date: Thu, 29 Aug 2024 14:20:37 GMT
Content-Security-Policy: upgrade-insecure-requests
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=63072000; includeSubDomains
Connection: keep-alive, Keep-Alive
Content-Length: 6866
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Wed, 28 Aug 2024 06:58:24 GMT
Server: Apache
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=31536000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=94
Expires: Fri, 29 Aug 2025 14:20:37 GMT

GET
H/1.1 200
OK Image-14-1.png
www.seqrite.com/blog/wp-content/uploads/2024/08/ 8 KB
10 KB 197ms
196ms Image
image/png 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.seqrite.com/blog/wp-content/uploads/2024/08/Image-14-1.png

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

f281c30dcaf89b3716e280f6250b7a85249ba9f714175c6db861f0f948a58c2a

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date: Thu, 29 Aug 2024 14:20:38 GMT
Content-Security-Policy: upgrade-insecure-requests
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=63072000; includeSubDomains
Connection: keep-alive, Keep-Alive
Content-Length: 8479
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Wed, 28 Aug 2024 06:58:25 GMT
Server: Apache
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=31536000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=94
Expires: Fri, 29 Aug 2025 14:20:38 GMT

GET
H/1.1 200
OK Image-15-2.png
www.seqrite.com/blog/wp-content/uploads/2024/08/ 28 KB
30 KB 177ms
176ms Image
image/png 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.seqrite.com/blog/wp-content/uploads/2024/08/Image-15-2.png

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

f37758351f668e064270d8dda7f1dc84e8e44725e1efd8e8c00cbaee1727d1a8

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date: Thu, 29 Aug 2024 14:20:38 GMT
Content-Security-Policy: upgrade-insecure-requests
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=63072000; includeSubDomains
Connection: keep-alive, Keep-Alive
Content-Length: 28997
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Wed, 28 Aug 2024 06:59:55 GMT
Server: Apache
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=31536000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=91
Expires: Fri, 29 Aug 2025 14:20:38 GMT

GET
H/1.1 200
OK Image-16-1.png
www.seqrite.com/blog/wp-content/uploads/2024/08/ 67 KB
68 KB 182ms
181ms Image
image/png 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.seqrite.com/blog/wp-content/uploads/2024/08/Image-16-1.png

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

eb625c1398f4be99e59c1488c6c9056b93b0a18c9f7c6b538290b81d65c33655

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date: Thu, 29 Aug 2024 14:20:38 GMT
Content-Security-Policy: upgrade-insecure-requests
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=63072000; includeSubDomains
Connection: keep-alive, Keep-Alive
Content-Length: 68385
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Wed, 28 Aug 2024 07:00:33 GMT
Server: Apache
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=31536000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=88
Expires: Fri, 29 Aug 2025 14:20:38 GMT

GET
H/1.1 200
OK Image-17-1.png
www.seqrite.com/blog/wp-content/uploads/2024/08/ 108 KB
110 KB 184ms
184ms Image
image/png 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.seqrite.com/blog/wp-content/uploads/2024/08/Image-17-1.png

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

ab1bbbfa7a7c36498f7dd1c0aa105d1bb5663469169592943794b434999bbbb7

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date: Thu, 29 Aug 2024 14:20:38 GMT
Content-Security-Policy: upgrade-insecure-requests
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=63072000; includeSubDomains
Connection: keep-alive, Keep-Alive
Content-Length: 111089
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Wed, 28 Aug 2024 07:01:12 GMT
Server: Apache
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=31536000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=92
Expires: Fri, 29 Aug 2025 14:20:38 GMT

GET
H/1.1 200
OK Image-18-1.png
www.seqrite.com/blog/wp-content/uploads/2024/08/ 793 KB
794 KB 211ms
186ms Image
image/png 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.seqrite.com/blog/wp-content/uploads/2024/08/Image-18-1.png

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

037ce341af8af57d21fe98794ae4cbc711356660d29f3c6589575787cff16ec8

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date: Thu, 29 Aug 2024 14:20:38 GMT
Content-Security-Policy: upgrade-insecure-requests
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=63072000; includeSubDomains
Connection: keep-alive, Keep-Alive
Content-Length: 811580
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Wed, 28 Aug 2024 07:01:55 GMT
Server: Apache
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=31536000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=93
Expires: Fri, 29 Aug 2025 14:20:38 GMT

GET
H/1.1 200
OK Image-19-1.png
www.seqrite.com/blog/wp-content/uploads/2024/08/ 71 KB
72 KB 196ms
196ms Image
image/png 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.seqrite.com/blog/wp-content/uploads/2024/08/Image-19-1.png

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

4f1b1318fe2b4ae9b69b6ec79a28765439cb6f4eeb68e43648d0a8c73438d9c2

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date: Thu, 29 Aug 2024 14:20:38 GMT
Content-Security-Policy: upgrade-insecure-requests
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=63072000; includeSubDomains
Connection: keep-alive, Keep-Alive
Content-Length: 72506
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Wed, 28 Aug 2024 07:02:46 GMT
Server: Apache
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=31536000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=92
Expires: Fri, 29 Aug 2025 14:20:38 GMT

GET
H/1.1 200
OK Image-20-1.png
www.seqrite.com/blog/wp-content/uploads/2024/08/ 10 KB
12 KB 202ms
201ms Image
image/png 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.seqrite.com/blog/wp-content/uploads/2024/08/Image-20-1.png

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

6d6dec8fd9aa11933b83fb068e65c8183a721a3aadfbd9948c276e052d7361c5

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date: Thu, 29 Aug 2024 14:20:38 GMT
Content-Security-Policy: upgrade-insecure-requests
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=63072000; includeSubDomains
Connection: keep-alive, Keep-Alive
Content-Length: 10620
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Wed, 28 Aug 2024 07:03:12 GMT
Server: Apache
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=31536000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=93
Expires: Fri, 29 Aug 2025 14:20:38 GMT

GET
H/1.1 200
OK Image-21-1.png
www.seqrite.com/blog/wp-content/uploads/2024/08/ 46 KB
48 KB 178ms
178ms Image
image/png 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.seqrite.com/blog/wp-content/uploads/2024/08/Image-21-1.png

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

1df42da4364541dc5bafc9020644225077a2302a003e21b7a8083d4d585492a3

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date: Thu, 29 Aug 2024 14:20:38 GMT
Content-Security-Policy: upgrade-insecure-requests
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=63072000; includeSubDomains
Connection: keep-alive, Keep-Alive
Content-Length: 47278
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Wed, 28 Aug 2024 07:04:09 GMT
Server: Apache
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=31536000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=90
Expires: Fri, 29 Aug 2025 14:20:38 GMT

GET
H/1.1 200
OK Image-22-1.png
www.seqrite.com/blog/wp-content/uploads/2024/08/ 18 KB
20 KB 178ms
177ms Image
image/png 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.seqrite.com/blog/wp-content/uploads/2024/08/Image-22-1.png

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

8747fb42316175fc0fdc4342229710f43900b53fe19017afe4448b844d8c1000

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date: Thu, 29 Aug 2024 14:20:38 GMT
Content-Security-Policy: upgrade-insecure-requests
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=63072000; includeSubDomains
Connection: keep-alive, Keep-Alive
Content-Length: 18766
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Wed, 28 Aug 2024 07:04:11 GMT
Server: Apache
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=31536000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=87
Expires: Fri, 29 Aug 2025 14:20:38 GMT

GET
H/1.1 200
OK Image-23-1.png
www.seqrite.com/blog/wp-content/uploads/2024/08/ 52 KB
54 KB 194ms
194ms Image
image/png 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.seqrite.com/blog/wp-content/uploads/2024/08/Image-23-1.png

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

04a19526bf20bb6a97325f442f11a4955a430492dcef7040a700ba350cee81da

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date: Thu, 29 Aug 2024 14:20:38 GMT
Content-Security-Policy: upgrade-insecure-requests
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=63072000; includeSubDomains
Connection: keep-alive, Keep-Alive
Content-Length: 53512
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Wed, 28 Aug 2024 07:04:11 GMT
Server: Apache
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=31536000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=91
Expires: Fri, 29 Aug 2025 14:20:38 GMT

GET
H/1.1 200
OK Image-24.png
www.seqrite.com/blog/wp-content/uploads/2024/08/ 17 KB
19 KB 176ms
176ms Image
image/png 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.seqrite.com/blog/wp-content/uploads/2024/08/Image-24.png

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

4390baea06f47a8df11f7a3619ebdc677771145d8d8e637821168997e019a5de

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date: Thu, 29 Aug 2024 14:20:38 GMT
Content-Security-Policy: upgrade-insecure-requests
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=63072000; includeSubDomains
Connection: keep-alive, Keep-Alive
Content-Length: 17800
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Wed, 28 Aug 2024 07:04:12 GMT
Server: Apache
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=31536000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=89
Expires: Fri, 29 Aug 2025 14:20:38 GMT

GET
H/1.1 200
OK Image-25.png
www.seqrite.com/blog/wp-content/uploads/2024/08/ 43 KB
45 KB 198ms
198ms Image
image/png 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.seqrite.com/blog/wp-content/uploads/2024/08/Image-25.png

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

ad59a025116bc363253e6d706488d13d6a53108e3df3e8573d367b7398a79561

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date: Thu, 29 Aug 2024 14:20:38 GMT
Content-Security-Policy: upgrade-insecure-requests
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=63072000; includeSubDomains
Connection: keep-alive, Keep-Alive
Content-Length: 44427
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Wed, 28 Aug 2024 07:06:04 GMT
Server: Apache
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=31536000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=92
Expires: Fri, 29 Aug 2025 14:20:38 GMT

GET
H/1.1 200
OK Image-26.png
www.seqrite.com/blog/wp-content/uploads/2024/08/ 30 KB
31 KB 178ms
178ms Image
image/png 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.seqrite.com/blog/wp-content/uploads/2024/08/Image-26.png

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

562f0154656f28cc34f877aff120cd8257c92c2d9ce2f159f1818c621fc70bb5

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date: Thu, 29 Aug 2024 14:20:38 GMT
Content-Security-Policy: upgrade-insecure-requests
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=63072000; includeSubDomains
Connection: keep-alive, Keep-Alive
Content-Length: 30381
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Wed, 28 Aug 2024 07:06:05 GMT
Server: Apache
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=31536000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=86
Expires: Fri, 29 Aug 2025 14:20:38 GMT

GET
H/1.1 200
OK Image-27.png
www.seqrite.com/blog/wp-content/uploads/2024/08/ 6 KB
8 KB 194ms
194ms Image
image/png 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.seqrite.com/blog/wp-content/uploads/2024/08/Image-27.png

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

4d09160d4caae6fbbb1f00ada77f5a1af71c7382276ced5f324a15503490c4f2

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date: Thu, 29 Aug 2024 14:20:38 GMT
Content-Security-Policy: upgrade-insecure-requests
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=63072000; includeSubDomains
Connection: keep-alive, Keep-Alive
Content-Length: 6247
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Wed, 28 Aug 2024 07:06:06 GMT
Server: Apache
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=31536000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=90
Expires: Fri, 29 Aug 2025 14:20:38 GMT

GET
H/1.1 200
OK Image-28.png
www.seqrite.com/blog/wp-content/uploads/2024/08/ 16 KB
17 KB 204ms
203ms Image
image/png 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.seqrite.com/blog/wp-content/uploads/2024/08/Image-28.png

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

9510cf0ed644d211d0bd61c236a1d4e8c4c7ff4ac01203f1256ae6f757033fb7

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date: Thu, 29 Aug 2024 14:20:38 GMT
Content-Security-Policy: upgrade-insecure-requests
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=63072000; includeSubDomains
Connection: keep-alive, Keep-Alive
Content-Length: 16132
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Wed, 28 Aug 2024 07:08:42 GMT
Server: Apache
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=31536000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=91
Expires: Fri, 29 Aug 2025 14:20:38 GMT

GET
H/1.1 200
OK Image-29.png
www.seqrite.com/blog/wp-content/uploads/2024/08/ 10 KB
12 KB 179ms
179ms Image
image/png 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.seqrite.com/blog/wp-content/uploads/2024/08/Image-29.png

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

a26595a3aac0b136c061728c9f9c6b4b9d6703e17863cd314a124b30068d7058

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date: Thu, 29 Aug 2024 14:20:38 GMT
Content-Security-Policy: upgrade-insecure-requests
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=63072000; includeSubDomains
Connection: keep-alive, Keep-Alive
Content-Length: 10384
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Wed, 28 Aug 2024 07:08:43 GMT
Server: Apache
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=31536000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=88
Expires: Fri, 29 Aug 2025 14:20:38 GMT

GET
H/1.1 200
OK Image30.png
www.seqrite.com/blog/wp-content/uploads/2024/08/ 50 KB
52 KB 212ms
212ms Image
image/png 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.seqrite.com/blog/wp-content/uploads/2024/08/Image30.png

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

49558a319e53a06a92fae9491e299d82f2db402f7a3633a1eb2cc12c6a8f62b2

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date: Thu, 29 Aug 2024 14:20:38 GMT
Content-Security-Policy: upgrade-insecure-requests
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=63072000; includeSubDomains
Connection: keep-alive, Keep-Alive
Content-Length: 51645
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Wed, 28 Aug 2024 07:10:32 GMT
Server: Apache
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=31536000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=91
Expires: Fri, 29 Aug 2025 14:20:38 GMT

GET
H/1.1 200
OK Image-31.png
www.seqrite.com/blog/wp-content/uploads/2024/08/ 45 KB
46 KB 183ms
183ms Image
image/png 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.seqrite.com/blog/wp-content/uploads/2024/08/Image-31.png

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

76339c0a2882dee0599f6944ef152ac13607d7c828c9e75c00c8651df09be7b4

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date: Thu, 29 Aug 2024 14:20:38 GMT
Content-Security-Policy: upgrade-insecure-requests
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=63072000; includeSubDomains
Connection: keep-alive, Keep-Alive
Content-Length: 45780
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Wed, 28 Aug 2024 07:13:11 GMT
Server: Apache
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=31536000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=85
Expires: Fri, 29 Aug 2025 14:20:38 GMT

GET
H/1.1 200
OK Image-32.png
www.seqrite.com/blog/wp-content/uploads/2024/08/ 29 KB
30 KB 201ms
200ms Image
image/png 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.seqrite.com/blog/wp-content/uploads/2024/08/Image-32.png

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

7c0668265842380bf8d18ae243758d90869bc8ea366078c226fd1db6013c682e

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date: Thu, 29 Aug 2024 14:20:38 GMT
Content-Security-Policy: upgrade-insecure-requests
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=63072000; includeSubDomains
Connection: keep-alive, Keep-Alive
Content-Length: 29694
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Wed, 28 Aug 2024 07:13:12 GMT
Server: Apache
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=31536000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=89
Expires: Fri, 29 Aug 2025 14:20:38 GMT

GET
H/1.1 200
OK Image-33.png
www.seqrite.com/blog/wp-content/uploads/2024/08/ 12 KB
14 KB 180ms
180ms Image
image/png 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.seqrite.com/blog/wp-content/uploads/2024/08/Image-33.png

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

28724ce4bab1cf0d98da3e33e0b0729ecc7728db4854aee8215ff1874abef615

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date: Thu, 29 Aug 2024 14:20:38 GMT
Content-Security-Policy: upgrade-insecure-requests
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=63072000; includeSubDomains
Connection: keep-alive, Keep-Alive
Content-Length: 12475
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Wed, 28 Aug 2024 07:13:13 GMT
Server: Apache
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=31536000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=87
Expires: Fri, 29 Aug 2025 14:20:38 GMT

GET
H/1.1 200
OK Image-34.png
www.seqrite.com/blog/wp-content/uploads/2024/08/ 28 KB
30 KB 199ms
199ms Image
image/png 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.seqrite.com/blog/wp-content/uploads/2024/08/Image-34.png

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

3e0629a3bf858bea50192caf9f172c89d6d5c84988ec97d3003a268369ec5377

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date: Thu, 29 Aug 2024 14:20:38 GMT
Content-Security-Policy: upgrade-insecure-requests
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=63072000; includeSubDomains
Connection: keep-alive, Keep-Alive
Content-Length: 28986
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Wed, 28 Aug 2024 07:14:57 GMT
Server: Apache
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=31536000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=90
Expires: Fri, 29 Aug 2025 14:20:38 GMT

GET
H/1.1 200
OK Image-35.png
www.seqrite.com/blog/wp-content/uploads/2024/08/ 17 KB
19 KB 199ms
198ms Image
image/png 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.seqrite.com/blog/wp-content/uploads/2024/08/Image-35.png

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

d40db97b9a9828a7c7d95b63c2df7206ca607c1a28703bf4e5c3dbb59e13f879

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date: Thu, 29 Aug 2024 14:20:38 GMT
Content-Security-Policy: upgrade-insecure-requests
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=63072000; includeSubDomains
Connection: keep-alive, Keep-Alive
Content-Length: 17714
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Wed, 28 Aug 2024 07:15:54 GMT
Server: Apache
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=31536000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=90
Expires: Fri, 29 Aug 2025 14:20:38 GMT

GET
H/1.1 200
OK Image-36.png
www.seqrite.com/blog/wp-content/uploads/2024/08/ 28 KB
29 KB 179ms
179ms Image
image/png 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.seqrite.com/blog/wp-content/uploads/2024/08/Image-36.png

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

20513405d051debdef384307a258d755ca4ee28a56b5f976cb53d0fa3b42816a

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date: Thu, 29 Aug 2024 14:20:38 GMT
Content-Security-Policy: upgrade-insecure-requests
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=63072000; includeSubDomains
Connection: keep-alive, Keep-Alive
Content-Length: 28366
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Wed, 28 Aug 2024 07:15:55 GMT
Server: Apache
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=31536000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=84
Expires: Fri, 29 Aug 2025 14:20:38 GMT

GET
H/1.1 200
OK Image-37.png
www.seqrite.com/blog/wp-content/uploads/2024/08/ 24 KB
26 KB 193ms
193ms Image
image/png 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.seqrite.com/blog/wp-content/uploads/2024/08/Image-37.png

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

bb5987c2bf670da63901e613680a66b0126242995c66e22dbcdfc411402937b1

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date: Thu, 29 Aug 2024 14:20:38 GMT
Content-Security-Policy: upgrade-insecure-requests
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=63072000; includeSubDomains
Connection: keep-alive, Keep-Alive
Content-Length: 24823
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Wed, 28 Aug 2024 07:15:56 GMT
Server: Apache
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=31536000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=88
Expires: Fri, 29 Aug 2025 14:20:38 GMT

GET
H/1.1 200
OK SEQRITE-Blog-Aug-Unlock-240x185.png
www.seqrite.com/blog/wp-content/uploads/2024/08/ 73 KB
75 KB 176ms
175ms Image
image/png 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.seqrite.com/blog/wp-content/uploads/2024/08/SEQRITE-Blog-Aug-Unlock-240x185.png

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

d2a54615c54ad15d4d3e834a311fa28ff555c169cdce48c98221563ff533f110

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date: Thu, 29 Aug 2024 14:20:38 GMT
Content-Security-Policy: upgrade-insecure-requests
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=63072000; includeSubDomains
Connection: keep-alive, Keep-Alive
Content-Length: 74956
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Fri, 23 Aug 2024 10:54:29 GMT
Server: Apache
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=31536000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=86
Expires: Fri, 29 Aug 2025 14:20:38 GMT

GET
H/1.1 200
OK SEQRITE-Blog-August-Cronus-Ransomware-240x185.png
www.seqrite.com/blog/wp-content/uploads/2024/08/ 48 KB
49 KB 198ms
198ms Image
image/png 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.seqrite.com/blog/wp-content/uploads/2024/08/SEQRITE-Blog-August-Cronus-Ransomware-240x185.png

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

c13afd5e77ab6543a6a81519d08b6892abad728ab81844d29f6abf92254dfe16

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date: Thu, 29 Aug 2024 14:20:39 GMT
Content-Security-Policy: upgrade-insecure-requests
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=63072000; includeSubDomains
Connection: keep-alive, Keep-Alive
Content-Length: 48659
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Tue, 06 Aug 2024 11:55:48 GMT
Server: Apache
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=31536000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=89
Expires: Fri, 29 Aug 2025 14:20:39 GMT

GET
H/1.1 200
OK TOI_Image-240x185.jpg
www.seqrite.com/blog/wp-content/uploads/2024/07/ 15 KB
16 KB 180ms
179ms Image
image/jpeg 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.seqrite.com/blog/wp-content/uploads/2024/07/TOI_Image-240x185.jpg

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

99dabd65f2c3b172c0f794baa69f3ea2236e9680789c65cb602aaa70fbe3e22c

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date: Thu, 29 Aug 2024 14:20:39 GMT
Content-Security-Policy: upgrade-insecure-requests
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=63072000; includeSubDomains
Connection: keep-alive, Keep-Alive
Content-Length: 15241
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Tue, 30 Jul 2024 07:16:41 GMT
Server: Apache
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: image/jpeg
Cache-Control: max-age=31536000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=83
Expires: Fri, 29 Aug 2025 14:20:39 GMT

GET
H/1.1 200
OK securimage_show.php
www.seqrite.com/blog/wp-content/plugins/si-captcha-for-wordpress/captcha/ 5 KB
6 KB 265ms
265ms Image
image/png 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.seqrite.com/blog/wp-content/plugins/si-captcha-for-wordpress/captcha/securimage_show.php?si_form_id=com&prefix=K6dOZC8wfdEgbEom

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

798476999f1b548c7ac39f66d3f92693323400fcd65a09fced7117609a267935

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date: Thu, 29 Aug 2024 14:20:39 GMT
Content-Security-Policy: upgrade-insecure-requests
Content-Encoding: gzip
Strict-Transport-Security: max-age=63072000; includeSubDomains
X-Content-Type-Options: nosniff
Connection: keep-alive, Keep-Alive
Content-Length: 4875
X-XSS-Protection: 1; mode=block
Pragma: no-cache
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Thu, 29 Aug 2024 14:20:39GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: image/png
Cache-Control: no-store, no-cache, must-revalidate, private, must-revalidate, post-check=0, pre-check=0
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Keep-Alive: timeout=10, max=89
Expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H/1.1 200
OK refresh.png
www.seqrite.com/blog/wp-content/plugins/si-captcha-for-wordpress/captcha/images/ 1 KB
3 KB 200ms
200ms Image
image/png 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.seqrite.com/blog/wp-content/plugins/si-captcha-for-wordpress/captcha/images/refresh.png

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

7efa72f5d3878a1f7145d552d8d2186bac3942fce7b3d7e3a51550c3bc9ab3cb

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date: Thu, 29 Aug 2024 14:20:39 GMT
Content-Security-Policy: upgrade-insecure-requests
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=63072000; includeSubDomains
Connection: keep-alive, Keep-Alive
Content-Length: 1106
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Thu, 25 Feb 2016 09:42:14 GMT
Server: Apache
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=31536000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=87
Expires: Fri, 29 Aug 2025 14:20:39 GMT

GET
H/1.1 200
OK 6322-featured-80x81.png
www.seqrite.com/blog/wp-content/uploads/wordpress-popular-posts/ 8 KB
10 KB 596ms
178ms Image
image/png 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.seqrite.com/blog/wp-content/uploads/wordpress-popular-posts/6322-featured-80x81.png

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

ed614962a78ea3327258c6d68c454871eb7dd5462d4902f150be21f39cdd20bc

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date: Thu, 29 Aug 2024 14:20:37 GMT
Content-Security-Policy: upgrade-insecure-requests
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=63072000; includeSubDomains
Connection: keep-alive, Keep-Alive
Content-Length: 8441
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Wed, 07 Aug 2024 12:40:25 GMT
Server: Apache
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=31536000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=96
Expires: Fri, 29 Aug 2025 14:20:37 GMT

GET
H/1.1 200
OK 6248-featured-80x81.png
www.seqrite.com/blog/wp-content/uploads/wordpress-popular-posts/ 12 KB
14 KB 657ms
178ms Image
image/png 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.seqrite.com/blog/wp-content/uploads/wordpress-popular-posts/6248-featured-80x81.png

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

bec591f181fd0bc95e712d1913c21292ff3a15cc61446b11c0b98fb9049aabaa

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date: Thu, 29 Aug 2024 14:20:37 GMT
Content-Security-Policy: upgrade-insecure-requests
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=63072000; includeSubDomains
Connection: keep-alive, Keep-Alive
Content-Length: 12526
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Mon, 29 Jul 2024 12:31:13 GMT
Server: Apache
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=31536000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=93
Expires: Fri, 29 Aug 2025 14:20:37 GMT

GET
H/1.1 200
OK 6360-featured-80x81.png
www.seqrite.com/blog/wp-content/uploads/wordpress-popular-posts/ 14 KB
16 KB 648ms
178ms Image
image/png 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.seqrite.com/blog/wp-content/uploads/wordpress-popular-posts/6360-featured-80x81.png

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

4c6885a4880546e3e6829dbb39b4fd121955892d82a29c487f3329caaf94c1a7

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date: Thu, 29 Aug 2024 14:20:37 GMT
Content-Security-Policy: upgrade-insecure-requests
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=63072000; includeSubDomains
Connection: keep-alive, Keep-Alive
Content-Length: 14578
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Sat, 24 Aug 2024 15:03:55 GMT
Server: Apache
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=31536000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=96
Expires: Fri, 29 Aug 2025 14:20:37 GMT

GET
H/1.1 200
OK favicon-seqrite.png
www.seqrite.com/blog/wp-content/uploads/2024/04/ 5 KB
7 KB 784ms
177ms Image
image/png 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.seqrite.com/blog/wp-content/uploads/2024/04/favicon-seqrite.png

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

ac3a4f50b88ecc84b7aa0ede2c8509f06d8257d136948d42d39d8bbc4310bc9d

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date: Thu, 29 Aug 2024 14:20:37 GMT
Content-Security-Policy: upgrade-insecure-requests
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=63072000; includeSubDomains
Connection: keep-alive, Keep-Alive
Content-Length: 5519
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Tue, 02 Apr 2024 10:18:04 GMT
Server: Apache
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=31536000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=95
Expires: Fri, 29 Aug 2025 14:20:37 GMT

GET
H/1.1 200
OK SK_Photo12-150x149.jpg
www.seqrite.com/blog/wp-content/uploads/2017/09/ 5 KB
6 KB 844ms
191ms Image
image/jpeg 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.seqrite.com/blog/wp-content/uploads/2017/09/SK_Photo12-150x149.jpg

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

c4594d5cd9d4ae7683d9af90f8946692ded44d22e423bc6700ff671c8fe2d00f

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date: Thu, 29 Aug 2024 14:20:37 GMT
Content-Security-Policy: upgrade-insecure-requests
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=63072000; includeSubDomains
Connection: keep-alive, Keep-Alive
Content-Length: 4765
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Mon, 25 Sep 2017 06:43:44 GMT
Server: Apache
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: image/jpeg
Cache-Control: max-age=31536000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=95
Expires: Fri, 29 Aug 2025 14:20:37 GMT

GET
H/1.1 200
OK MicrosoftTeams-image-223.png
www.seqrite.com/blog/wp-content/uploads/2023/12/ 16 KB
17 KB 663ms
184ms Image
image/png 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.seqrite.com/blog/wp-content/uploads/2023/12/MicrosoftTeams-image-223.png

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

c62716f2d2181727cdd1d399be91e6b96ab7a914e97c83157aeefcda38452d26

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date: Thu, 29 Aug 2024 14:20:37 GMT
Content-Security-Policy: upgrade-insecure-requests
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=63072000; includeSubDomains
Connection: keep-alive, Keep-Alive
Content-Length: 16119
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Wed, 13 Dec 2023 12:16:39 GMT
Server: Apache
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=31536000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=97
Expires: Fri, 29 Aug 2025 14:20:37 GMT

GET
H/1.1 200
OK spinner.gif
www.seqrite.com/blog/wp-content/plugins/email-subscribers/public/images/ 3 KB
5 KB 176ms
176ms Image
image/gif 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.seqrite.com/blog/wp-content/plugins/email-subscribers/public/images/spinner.gif

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

7837e876f1eef549b3250b78380ec2df00ad6da4da6c27667424b1636854df3c

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date: Thu, 29 Aug 2024 14:20:39 GMT
Content-Security-Policy: upgrade-insecure-requests
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=63072000; includeSubDomains
Connection: keep-alive, Keep-Alive
Content-Length: 3208
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Mon, 05 Aug 2019 06:40:50 GMT
Server: Apache
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: image/gif
Cache-Control: max-age=31536000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=85
Expires: Fri, 29 Aug 2025 14:20:39 GMT

GET
H/1.1 200
OK si_captcha.js Show response
www.seqrite.com/blog/wp-content/plugins/si-captcha-for-wordpress/captcha/ 685 B
2 KB 517ms
179ms Script
application/javascript 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.seqrite.com/blog/wp-content/plugins/si-captcha-for-wordpress/captcha/si_captcha.js?ver=1.0

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

c52d8ecaada50da7a9739ca285872b431fad51042eccf398e2c2ecad8013880b

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date: Thu, 29 Aug 2024 14:20:36 GMT
Content-Security-Policy: upgrade-insecure-requests
Content-Encoding: gzip
Strict-Transport-Security: max-age=63072000; includeSubDomains
X-Content-Type-Options: nosniff
Connection: keep-alive, Keep-Alive
Content-Length: 380
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Thu, 25 Feb 2016 09:42:14 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: application/javascript
Cache-Control: max-age=2592000, private
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=94
Expires: Sat, 28 Sep 2024 14:20:36 GMT

GET
H/1.1 200
OK slickQuiz.css
www.seqrite.com/blog/wp-content/plugins/slickquiz/slickquiz/css/ 908 B
2 KB 201ms
186ms Stylesheet
text/css 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.seqrite.com/blog/wp-content/plugins/slickquiz/slickquiz/css/slickQuiz.css?ver=4.8.25

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

48d1d7078b27223c895b4a9604916429879cc4e00e3a8772d64c76aa406711f6

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date: Thu, 29 Aug 2024 14:20:37 GMT
Content-Security-Policy: upgrade-insecure-requests
Content-Encoding: gzip
Strict-Transport-Security: max-age=63072000; includeSubDomains
X-Content-Type-Options: nosniff
Connection: keep-alive, Keep-Alive
Content-Length: 475
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Mon, 03 Apr 2017 09:41:26 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: text/css
Cache-Control: max-age=2592000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=98
Expires: Sat, 28 Sep 2024 14:20:37 GMT

GET
H/1.1 200
OK front.css
www.seqrite.com/blog/wp-content/plugins/slickquiz/css/ 3 KB
2 KB 224ms
176ms Stylesheet
text/css 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.seqrite.com/blog/wp-content/plugins/slickquiz/css/front.css?ver=4.8.25

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

0f8a76154e9d4d4f95724c6fa01caa18d4511ad594363004e03055859da90ccf

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date: Thu, 29 Aug 2024 14:20:37 GMT
Content-Security-Policy: upgrade-insecure-requests
Content-Encoding: gzip
Strict-Transport-Security: max-age=63072000; includeSubDomains
X-Content-Type-Options: nosniff
Connection: keep-alive, Keep-Alive
Content-Length: 929
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Mon, 03 Apr 2017 09:38:50 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: text/css
Cache-Control: max-age=2592000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=97
Expires: Sat, 28 Sep 2024 14:20:37 GMT

GET
H/1.1 200
OK comment-reply.min.js Show response
www.seqrite.com/blog/wp-includes/js/ 1 KB
2 KB 369ms
182ms Script
application/javascript 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.seqrite.com/blog/wp-includes/js/comment-reply.min.js?ver=4.8.25

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

6b2e2d56e7b0e80d919bc65dd94f8cd95e57ad9298fc4fecc005301ea8339c9f

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date: Thu, 29 Aug 2024 14:20:37 GMT
Content-Security-Policy: upgrade-insecure-requests
Content-Encoding: gzip
Strict-Transport-Security: max-age=63072000; includeSubDomains
X-Content-Type-Options: nosniff
Connection: keep-alive, Keep-Alive
Content-Length: 580
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Thu, 18 Jul 2024 19:30:11 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: application/javascript
Cache-Control: max-age=2592000, private
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=92
Expires: Sat, 28 Sep 2024 14:20:37 GMT

GET
H/1.1 200
OK jquery.magnific-popup.min.js Show response
www.seqrite.com/blog/wp-content/themes/goblog/js/ 21 KB
9 KB 198ms
197ms Script
application/javascript 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.seqrite.com/blog/wp-content/themes/goblog/js/jquery.magnific-popup.min.js?ver=0.9.9

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

21afd5dde7c1a80e8227df99b65b838d02411ee25dd37c8c6de6ab9b4a6a11f9

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date: Thu, 29 Aug 2024 14:20:37 GMT
Content-Security-Policy: upgrade-insecure-requests
Content-Encoding: gzip
Strict-Transport-Security: max-age=63072000; includeSubDomains
X-Content-Type-Options: nosniff
Connection: keep-alive, Keep-Alive
Content-Length: 7840
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Thu, 25 Feb 2016 09:40:16 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: application/javascript
Cache-Control: max-age=2592000, private
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=96
Expires: Sat, 28 Sep 2024 14:20:37 GMT

GET
H/1.1 200
OK theme-scripts.js Show response
www.seqrite.com/blog/wp-content/themes/goblog/js/ 64 KB
16 KB 204ms
202ms Script
application/javascript 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.seqrite.com/blog/wp-content/themes/goblog/js/theme-scripts.js?ver=1.0

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

a46ad0cf194211eaa38d041861c834baca57d2531fa6bf7ed766441400f8c914

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date: Thu, 29 Aug 2024 14:20:37 GMT
Content-Security-Policy: upgrade-insecure-requests
Content-Encoding: gzip
Strict-Transport-Security: max-age=63072000; includeSubDomains
X-Content-Type-Options: nosniff
Connection: keep-alive, Keep-Alive
Content-Length: 14567
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Thu, 25 Feb 2016 09:40:16 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: application/javascript
Cache-Control: max-age=2592000, private
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=97
Expires: Sat, 28 Sep 2024 14:20:37 GMT

GET
H/1.1 200
OK sassy-social-share-public.js Show response
www.seqrite.com/blog/wp-content/plugins/sassy-social-share/public/js/ 46 KB
13 KB 191ms
190ms Script
application/javascript 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.seqrite.com/blog/wp-content/plugins/sassy-social-share/public/js/sassy-social-share-public.js?ver=3.2.3

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

d4e8aef3270141a3bd33cfa0c36a91d75a3960a1e4a7eb346aa72101fa99f34b

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date: Thu, 29 Aug 2024 14:20:37 GMT
Content-Security-Policy: upgrade-insecure-requests
Content-Encoding: gzip
Strict-Transport-Security: max-age=63072000; includeSubDomains
X-Content-Type-Options: nosniff
Connection: keep-alive, Keep-Alive
Content-Length: 11655
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Tue, 03 Jul 2018 09:32:39 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: application/javascript
Cache-Control: max-age=2592000, private
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=96
Expires: Sat, 28 Sep 2024 14:20:37 GMT

GET
H/1.1 200
OK wp-embed.min.js Show response
www.seqrite.com/blog/wp-includes/js/ 1 KB
2 KB 177ms
177ms Script
application/javascript 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.seqrite.com/blog/wp-includes/js/wp-embed.min.js?ver=4.8.25

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

c23627dccb22a7fff7141f0ffe282891eb02fb87d8a4a636ad08d7429e7e2103

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date: Thu, 29 Aug 2024 14:20:37 GMT
Content-Security-Policy: upgrade-insecure-requests
Content-Encoding: gzip
Strict-Transport-Security: max-age=63072000; includeSubDomains
X-Content-Type-Options: nosniff
Connection: keep-alive, Keep-Alive
Content-Length: 774
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Thu, 18 Jul 2024 19:30:11 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: application/javascript
Cache-Control: max-age=2592000, private
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=94
Expires: Sat, 28 Sep 2024 14:20:37 GMT

GET
H/1.1 200
OK slickQuiz.js Show response
www.seqrite.com/blog/wp-content/plugins/slickquiz/slickquiz/js/ 37 KB
9 KB 190ms
190ms Script
application/javascript 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.seqrite.com/blog/wp-content/plugins/slickquiz/slickquiz/js/slickQuiz.js?ver=4.8.25

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

5ac7017782855b44f36da92da024c5de980002bd06ca9c94dc631e8c26e9b57c

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date: Thu, 29 Aug 2024 14:20:37 GMT
Content-Security-Policy: upgrade-insecure-requests
Content-Encoding: gzip
Strict-Transport-Security: max-age=63072000; includeSubDomains
X-Content-Type-Options: nosniff
Connection: keep-alive, Keep-Alive
Content-Length: 7289
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Mon, 03 Apr 2017 09:41:43 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: application/javascript
Cache-Control: max-age=2592000, private
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=94
Expires: Sat, 28 Sep 2024 14:20:37 GMT

GET
H/1.1 200
OK widgets.js Show response
platform.twitter.com/ 91 KB
28 KB 77ms
20ms Script
application/javascript 2606:2800:234:59:254c:406:2366:268c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/widgets.js?ver=4.8.25
Requested by: Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (mil/6CF2) /
Resource Hash: 173460e89e6a7244218badae2016f65c48a3eae9d400802273eeca18b07336f1

Request headers

Referer: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date: Thu, 29 Aug 2024 14:20:59 GMT
Content-Encoding: gzip
Age: 314
x-amz-server-side-encryption: AES256
X-Cache: HIT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server-Timing: x-cache;desc= HIT,x-tw-cdn;desc=VZ
Content-Length: 27597
Last-Modified: Mon, 11 Dec 2023 17:20:28 GMT
Server: ECS (mil/6CF2)
Etag: "824beb891744db98ccbd3a456e59e0f7+gzip"
Access-Control-Max-Age: 3000
Access-Control-Allow-Methods: GET
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
x-tw-cdn: VZ
Cache-Control: public, max-age=1800
Vary: Accept-Encoding

GET
H/1.1 200
OK main.min.js Show response
www.seqrite.com/blog/wp-content/plugins/icegram/assets/js/ 3 KB
2 KB 179ms
179ms Script
application/javascript 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.seqrite.com/blog/wp-content/plugins/icegram/assets/js/main.min.js?ver=1.10.16

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

9ebff7017dd268671621d8ee78f8d0fbbc8acf656f7f7988aec31da68be69e2a

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date: Thu, 29 Aug 2024 14:20:37 GMT
Content-Security-Policy: upgrade-insecure-requests
Content-Encoding: gzip
Strict-Transport-Security: max-age=63072000; includeSubDomains
X-Content-Type-Options: nosniff
Connection: keep-alive, Keep-Alive
Content-Length: 975
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Fri, 23 Mar 2018 10:38:53 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: application/javascript
Cache-Control: max-age=2592000, private
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=91
Expires: Sat, 28 Sep 2024 14:20:37 GMT

POST
H/1.1 200
OK admin-ajax.php Show response
www.seqrite.com/blog/wp-admin/ 41 B
2 KB 606ms
605ms XHR
text/html 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.seqrite.com/blog/wp-admin/admin-ajax.php

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

84f5af435a9771328122a3c6426936e08f5d0e414adcb4f8277b4c3c4d06e9e2

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

Date: Thu, 29 Aug 2024 14:20:36 GMT
Content-Security-Policy: upgrade-insecure-requests
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=63072000; includeSubDomains
Connection: keep-alive, Keep-Alive
Content-Length: 41
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Server: Apache
X-Frame-Options: SAMEORIGIN, SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Vary: User-Agent
Content-Type: text/html; charset=UTF-8
Access-Control-Allow-Origin: https://www.seqrite.com
Cache-Control: no-cache, must-revalidate, max-age=0, private, must-revalidate
Access-Control-Allow-Credentials: true
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
X-Robots-Tag: noindex
Keep-Alive: timeout=10, max=98
Expires: Wed, 11 Jan 1984 05:00:00 GMT

GET
H/1.1 200
OK bg.png
www.seqrite.com/blog/wp-content/themes/goblog/images/ 95 B
2 KB 346ms
187ms Image
image/png 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.seqrite.com/blog/wp-content/themes/goblog/images/bg.png

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date: Thu, 29 Aug 2024 14:20:36 GMT
Content-Security-Policy: upgrade-insecure-requests
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=63072000; includeSubDomains
Connection: keep-alive, Keep-Alive
Content-Length: 95
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Thu, 25 Feb 2016 09:40:14 GMT
Server: Apache
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=31536000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=95
Expires: Fri, 29 Aug 2025 14:20:36 GMT

GET
DATA 200
OK truncated
/ 302 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b980f62a2d545d64f24e6f96902c8fbf5da0018569c369bc18f9e5b5fcf099ed

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=utf8

GET
DATA 200
OK truncated
/ 682 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c2e8b4fba49f90cfca5a43371c09879aed7447e0ba2ed4abd75b81448776c4f7

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=utf8

GET
DATA 200
OK truncated
/ 425 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 54c9560cb0117d8d1f955aefe0f88b843517964e118512d8f1a224a8a9b662f4

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=utf8

GET
DATA 200
OK truncated
/ 436 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 2662e0eef0f270830358bb255f079f695da71794ecbe8ba0825200862d8e9746

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=utf8

GET
H/1.1 200
OK fontawesome-webfont.woff
www.seqrite.com/blog/wp-content/themes/goblog/fonts/ 64 KB
65 KB 273ms
184ms Font
application/font-woff 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.seqrite.com/blog/wp-content/themes/goblog/fonts/fontawesome-webfont.woff?v=4.2.0

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/wp-content/themes/goblog/css/font-awesome.css

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

199411f659f41aaccb959bacb1b0de30e54f244352a48c6f9894e65ae0f8a9a1

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.seqrite.com/blog/wp-content/themes/goblog/css/font-awesome.css
Origin: https://www.seqrite.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date: Thu, 29 Aug 2024 14:20:36 GMT
Content-Security-Policy: upgrade-insecure-requests
Content-Encoding: gzip
Strict-Transport-Security: max-age=63072000; includeSubDomains
X-Content-Type-Options: nosniff
Connection: keep-alive, Keep-Alive
Content-Length: 65453
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Thu, 25 Feb 2016 09:40:18 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: application/font-woff
Cache-Control: max-age=31536000
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=98
Expires: Fri, 29 Aug 2025 14:20:36 GMT

GET
H2 200 css
fonts.googleapis.com/ 17 KB
2 KB 120ms
52ms Stylesheet
text/css 2a00:1450:4001:812::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Open+Sans:400,700,600&display=swap

Requested by

Host: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/webfont/1.5.3/webfont.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

851699a18b631a7bd68efc99598701293a6065b463fced7b68d8d6d9227bd8e7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Thu, 29 Aug 2024 14:20:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Thu, 29 Aug 2024 14:15:59 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 29 Aug 2024 14:20:59 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 52 KB
21 KB 98ms
29ms Script
text/javascript 2a00:1450:4001:813::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-104093208-1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Thu, 29 Aug 2024 13:15:05 GMT
last-modified: Tue, 12 Dec 2023 18:09:08 GMT
server: Golfe2
age: 3954
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20994
expires: Thu, 29 Aug 2024 15:15:05 GMT

GET
H2 200 memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v40/ 47 KB
47 KB 156ms
68ms Font
font/woff2 2a00:1450:4001:80e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:400,700,600&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3c4d6a1421c7ddb7e404521fe8c4cd5be5af446d7689cd880be26612eaad3cfa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.seqrite.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 27 Aug 2024 12:26:16 GMT
x-content-type-options: nosniff
age: 179683
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 48236
x-xss-protection: 0
last-modified: Thu, 14 Dec 2023 02:08:40 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 27 Aug 2025 12:26:16 GMT

GET
H2 200 memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTUGmu1aB.woff2
fonts.gstatic.com/s/opensans/v40/ 24 KB
25 KB 121ms
33ms Font
font/woff2 2a00:1450:4001:80e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTUGmu1aB.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:400,700,600&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7e510e61c497d334da21eccda06df5d3a428c9ea94d6903b6138e7c7255aba0f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.seqrite.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 27 Aug 2024 14:12:02 GMT
x-content-type-options: nosniff
age: 173337
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 24984
x-xss-protection: 0
last-modified: Thu, 14 Dec 2023 02:04:54 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 27 Aug 2025 14:12:02 GMT

POST
H2 200 collect Show response
www.google-analytics.com/j/ 1 B
206 B 36ms
35ms XHR
text/plain 2a00:1450:4001:813::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=966462441&t=pageview&_s=1&dl=https%3A%2F%2Fwww.seqrite.com%2Fblog%2Foperation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys%2F&ul=it-it&de=UTF-8&dt=Operation%20Oxidov%C3%BD%3A%20Sophisticated%20Malware%20Campaign%20Targets%20Czech%20Officials%20Using%20NATO-Themed%20Decoys&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAUABAAAAACAAI~&jid=1282869791&gjid=460775901&cid=864235295.1724941259&tid=UA-104093208-1&_gid=2124502785.1724941259&_r=1&gtm=457e48r0za200&gcd=13l3l3l2l1l1&dma_cps=syphamo&dma=1&tag_exp=0&jsscut=1&npa=1&z=137093053

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 29 Aug 2024 14:20:59 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.seqrite.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK frontend.min.css
www.seqrite.com/blog/wp-content/plugins/icegram/assets/css/ 19 KB
4 KB 233ms
207ms Stylesheet
text/css 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.seqrite.com/blog/wp-content/plugins/icegram/assets/css/frontend.min.css?var=1.10.16

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/wp-content/plugins/jquery-updater/js/jquery-3.6.0.min.js?ver=4.8.25

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

92d8884bb3f73093e6d0d49afb2d4e3129c7f92f5f9b0b741d2dc61a75dff904

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date: Thu, 29 Aug 2024 14:20:37 GMT
Content-Security-Policy: upgrade-insecure-requests
Content-Encoding: gzip
Strict-Transport-Security: max-age=63072000; includeSubDomains
X-Content-Type-Options: nosniff
Connection: keep-alive, Keep-Alive
Content-Length: 2386
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Fri, 23 Mar 2018 10:38:15 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: text/css
Cache-Control: max-age=2592000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=94
Expires: Sat, 28 Sep 2024 14:20:37 GMT

GET
H/1.1 200
OK popup.min.css
www.seqrite.com/blog/wp-content/plugins/icegram/message-types/popup/themes/ 21 KB
6 KB 262ms
207ms Stylesheet
text/css 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.seqrite.com/blog/wp-content/plugins/icegram/message-types/popup/themes/popup.min.css?var=1.10.16

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/wp-content/plugins/jquery-updater/js/jquery-3.6.0.min.js?ver=4.8.25

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

2fea67957caea31ef5c4541c83f121cb0dd690da9c3e16c8a1a88ab60b7fcccb

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date: Thu, 29 Aug 2024 14:20:37 GMT
Content-Security-Policy: upgrade-insecure-requests
Content-Encoding: gzip
Strict-Transport-Security: max-age=63072000; includeSubDomains
X-Content-Type-Options: nosniff
Connection: keep-alive, Keep-Alive
Content-Length: 4400
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Fri, 23 Mar 2018 10:39:41 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: text/css
Cache-Control: max-age=2592000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=95
Expires: Sat, 28 Sep 2024 14:20:37 GMT

GET
H/1.1 200
OK icegram.min.js Show response
www.seqrite.com/blog/wp-content/plugins/icegram/assets/js/ 45 KB
14 KB 214ms
214ms Script
application/javascript 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.seqrite.com/blog/wp-content/plugins/icegram/assets/js/icegram.min.js?var=1.10.16

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/wp-content/plugins/jquery-updater/js/jquery-3.6.0.min.js?ver=4.8.25

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

9bfbc0be0ca1c7fc6220860de2077caec179c03c5ff29e68bbeb148fe23d657c

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date: Thu, 29 Aug 2024 14:20:39 GMT
Content-Security-Policy: upgrade-insecure-requests
Content-Encoding: gzip
Strict-Transport-Security: max-age=63072000; includeSubDomains
X-Content-Type-Options: nosniff
Connection: keep-alive, Keep-Alive
Content-Length: 13287
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Fri, 23 Mar 2018 10:38:53 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: application/javascript
Cache-Control: max-age=2592000, private
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=88
Expires: Sat, 28 Sep 2024 14:20:39 GMT

GET
H/1.1 200
OK widget_iframe.2f70fb173b9000da126c79afe2098f02.html
platform.twitter.com/widgets/ Frame E055 0
0 85ms
21ms Document
text/html 2606:2800:234:59:254c:406:2366:268c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/widgets/widget_iframe.2f70fb173b9000da126c79afe2098f02.html?origin=https%3A%2F%2Fwww.seqrite.com
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js?ver=4.8.25
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (mil/6CEA) /
Resource Hash

Request headers

Referer: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Access-Control-Allow-Methods: GET
Access-Control-Allow-Origin: *
Age: 13609108
Cache-Control: public, max-age=315360000
Content-Encoding: gzip
Content-Length: 105429
Content-Type: text/html; charset=utf-8
Date: Thu, 29 Aug 2024 14:21:00 GMT
Etag: "81267302efdfb3e4524a22631a8fc99e+gzip"
Last-Modified: Mon, 11 Dec 2023 17:19:49 GMT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server: ECS (mil/6CEA)
Server-Timing: x-cache;desc= HIT,x-tw-cdn;desc=VZ
Vary: Accept-Encoding
X-Cache: HIT
X-EC-BBR-Enable: 1
x-amz-server-side-encryption: AES256
x-tw-cdn: VZ

GET
H/1.1 200
OK favicon.png
www.seqrite.com/blog/wp-content/uploads/2015/07/ 1 KB
3 KB 179ms
179ms Other
image/png 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.seqrite.com/blog/wp-content/uploads/2015/07/favicon.png

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

b1c27546d4683a5082ca81f6fdb6bfcbe595aa47d744d3ce2419ce82d440977e

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date: Thu, 29 Aug 2024 14:20:40 GMT
Content-Security-Policy: upgrade-insecure-requests
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=63072000; includeSubDomains
Connection: keep-alive, Keep-Alive
Content-Length: 1399
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Tue, 02 Apr 2024 09:52:30 GMT
Server: Apache
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=31536000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=92
Expires: Fri, 29 Aug 2025 14:20:40 GMT

Verdicts & Comments Add Verdict or Comment

71 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

4 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.seqrite.com/	1970-01-21 08:45:01	Name: _ga Value: GA1.2.864235295.1724941259
.seqrite.com/	1970-01-20 23:10:27	Name: _gid Value: GA1.2.2124502785.1724941259
.seqrite.com/	1970-01-20 23:09:01	Name: _gat_gtag_UA_104093208_1 Value: 1
www.seqrite.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: 02fr7fu4i3djstam6pcfhtl5b3

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	error	Message: Error with Permissions-Policy header: Parse of permissions policy failed because of errors reported by structured header parser.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
fonts.googleapis.com
fonts.gstatic.com
platform.twitter.com
www.google-analytics.com
www.googletagmanager.com
www.seqrite.com
103.228.50.137
2606:2800:234:59:254c:406:2366:268c
2a00:1450:4001:80e::2003
2a00:1450:4001:812::200a
2a00:1450:4001:813::200e
2a00:1450:4001:81c::2008
2a00:1450:4001:831::200a
037ce341af8af57d21fe98794ae4cbc711356660d29f3c6589575787cff16ec8
04a19526bf20bb6a97325f442f11a4955a430492dcef7040a700ba350cee81da
09fa90b9e3353f8105e98323695ee35cd5e73f42917a1ff76cf0cd8e1c7a1618
0a38ec5d222521e313a46c8b807e2b57957b2919f9b3a08fa6e33c05f959aaa3
0f8a76154e9d4d4f95724c6fa01caa18d4511ad594363004e03055859da90ccf
0fbf945eae1c5869be401c6db68da93f5a47f2c1ff6072151ebb4b2dea6d4f62
173460e89e6a7244218badae2016f65c48a3eae9d400802273eeca18b07336f1
199411f659f41aaccb959bacb1b0de30e54f244352a48c6f9894e65ae0f8a9a1
1c5fe2a18d6a2a223e6b8ee3f1876e841873b9235e2f170226eb583e073f587c
1df42da4364541dc5bafc9020644225077a2302a003e21b7a8083d4d585492a3
20513405d051debdef384307a258d755ca4ee28a56b5f976cb53d0fa3b42816a
21afd5dde7c1a80e8227df99b65b838d02411ee25dd37c8c6de6ab9b4a6a11f9
2662e0eef0f270830358bb255f079f695da71794ecbe8ba0825200862d8e9746
28724ce4bab1cf0d98da3e33e0b0729ecc7728db4854aee8215ff1874abef615
2fea67957caea31ef5c4541c83f121cb0dd690da9c3e16c8a1a88ab60b7fcccb
34092036b671b8a82a328dbfe91a14db473da80b478b04c6261d8e436eb06d77
34e35f893b634d5439db39f3c4f202ddc21aaf406e5724e8c118d513f086752f
36ef095d011c4ced97b0acef551ca36d76b95299518595dc1acab792a2344601
3a643b4e2767f6ece0e835994d8c4134421d743ae0356a3ce7cc7945d1db5947
3c4d6a1421c7ddb7e404521fe8c4cd5be5af446d7689cd880be26612eaad3cfa
3e0629a3bf858bea50192caf9f172c89d6d5c84988ec97d3003a268369ec5377
3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517
3f70bc98d579c557f8669b9ddca7c40ca193cc25a6b30c0ee1d91a443c2d3032
4390baea06f47a8df11f7a3619ebdc677771145d8d8e637821168997e019a5de
48d1d7078b27223c895b4a9604916429879cc4e00e3a8772d64c76aa406711f6
49558a319e53a06a92fae9491e299d82f2db402f7a3633a1eb2cc12c6a8f62b2
4ab34abe594a903a88dd062fe1d6f4071619e53d5dacee1ad97f8f49ebcd4c6f
4c6885a4880546e3e6829dbb39b4fd121955892d82a29c487f3329caaf94c1a7
4d09160d4caae6fbbb1f00ada77f5a1af71c7382276ced5f324a15503490c4f2
4f1b1318fe2b4ae9b69b6ec79a28765439cb6f4eeb68e43648d0a8c73438d9c2
54c9560cb0117d8d1f955aefe0f88b843517964e118512d8f1a224a8a9b662f4
562f0154656f28cc34f877aff120cd8257c92c2d9ce2f159f1818c621fc70bb5
5ac7017782855b44f36da92da024c5de980002bd06ca9c94dc631e8c26e9b57c
5c52202a253d3372d2512babb6e500e3fd1323495ddbc099028934e25d855a29
680a80d356565114378e038218e6971571fb76e54ff0530999d38f2b3c99368f
6b2e2d56e7b0e80d919bc65dd94f8cd95e57ad9298fc4fecc005301ea8339c9f
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
6d6dec8fd9aa11933b83fb068e65c8183a721a3aadfbd9948c276e052d7361c5
6e65d27cd18a8df5f487dbcd2a5be08d6dc995eaccf95a69091f20cd5772489f
6f20c872577786195e3973e8b5f2f9063214f32171ccf196b90c4710b9df99ee
76339c0a2882dee0599f6944ef152ac13607d7c828c9e75c00c8651df09be7b4
7837e876f1eef549b3250b78380ec2df00ad6da4da6c27667424b1636854df3c
798476999f1b548c7ac39f66d3f92693323400fcd65a09fced7117609a267935
7c0668265842380bf8d18ae243758d90869bc8ea366078c226fd1db6013c682e
7e510e61c497d334da21eccda06df5d3a428c9ea94d6903b6138e7c7255aba0f
7efa72f5d3878a1f7145d552d8d2186bac3942fce7b3d7e3a51550c3bc9ab3cb
84f5af435a9771328122a3c6426936e08f5d0e414adcb4f8277b4c3c4d06e9e2
851699a18b631a7bd68efc99598701293a6065b463fced7b68d8d6d9227bd8e7
8747fb42316175fc0fdc4342229710f43900b53fe19017afe4448b844d8c1000
880701812604e09fd133b76474940aed0f05d802a80945c798cfae067d53bda0
92d8884bb3f73093e6d0d49afb2d4e3129c7f92f5f9b0b741d2dc61a75dff904
93754643da5a46ca1b7e1f6ba4378655974e11e1cbb432e8c5cbf54804b722bc
9510cf0ed644d211d0bd61c236a1d4e8c4c7ff4ac01203f1256ae6f757033fb7
99dabd65f2c3b172c0f794baa69f3ea2236e9680789c65cb602aaa70fbe3e22c
9bfbc0be0ca1c7fc6220860de2077caec179c03c5ff29e68bbeb148fe23d657c
9ebff7017dd268671621d8ee78f8d0fbbc8acf656f7f7988aec31da68be69e2a
a26595a3aac0b136c061728c9f9c6b4b9d6703e17863cd314a124b30068d7058
a46ad0cf194211eaa38d041861c834baca57d2531fa6bf7ed766441400f8c914
aaa6c592ab437a257e9ef68aae2cdbea0d96c51729c6c729036f7e6433f906cf
aacedfb00288798884bf2a01a62e745bda44c38570e45c618015b93aaa4c85a0
ab1bbbfa7a7c36498f7dd1c0aa105d1bb5663469169592943794b434999bbbb7
abd83672a9a04a6685a2df16ad137f535dcbd886f5fbab448aade70173ddb964
ac3a4f50b88ecc84b7aa0ede2c8509f06d8257d136948d42d39d8bbc4310bc9d
ad59a025116bc363253e6d706488d13d6a53108e3df3e8573d367b7398a79561
b1c27546d4683a5082ca81f6fdb6bfcbe595aa47d744d3ce2419ce82d440977e
b306eaf93ca19101f9ae5b465bb45e381055b901474fb2b60a2b1eb52b409d19
b4ae8ad8c560bb87aa8fe03d597e2a69eef809072a35415d32ba68757e13ece6
b980f62a2d545d64f24e6f96902c8fbf5da0018569c369bc18f9e5b5fcf099ed
bb5987c2bf670da63901e613680a66b0126242995c66e22dbcdfc411402937b1
bba07dfa1b44bad0129ccb839b50cf86a51bccb97c8e1422ef6fa0ea89c1091c
bec591f181fd0bc95e712d1913c21292ff3a15cc61446b11c0b98fb9049aabaa
c13afd5e77ab6543a6a81519d08b6892abad728ab81844d29f6abf92254dfe16
c23627dccb22a7fff7141f0ffe282891eb02fb87d8a4a636ad08d7429e7e2103
c2e8b4fba49f90cfca5a43371c09879aed7447e0ba2ed4abd75b81448776c4f7
c4594d5cd9d4ae7683d9af90f8946692ded44d22e423bc6700ff671c8fe2d00f
c52d8ecaada50da7a9739ca285872b431fad51042eccf398e2c2ecad8013880b
c62716f2d2181727cdd1d399be91e6b96ab7a914e97c83157aeefcda38452d26
d2a54615c54ad15d4d3e834a311fa28ff555c169cdce48c98221563ff533f110
d40db97b9a9828a7c7d95b63c2df7206ca607c1a28703bf4e5c3dbb59e13f879
d4e8aef3270141a3bd33cfa0c36a91d75a3960a1e4a7eb346aa72101fa99f34b
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
e92974ab4514271196a5fd0e8298d84dcb0d712e6716dbcc3a674c64a5b81839
eaefcd91dffce5aa105ba84fa99ba8fe333971e365084a5412ebac1f76d25dc7
eb625c1398f4be99e59c1488c6c9056b93b0a18c9f7c6b538290b81d65c33655
ed614962a78ea3327258c6d68c454871eb7dd5462d4902f150be21f39cdd20bc
ef63999491072b9ad7e6868336b9b080687b0c200d40f19bce5c00420aac32b2
f281c30dcaf89b3716e280f6250b7a85249ba9f714175c6db861f0f948a58c2a
f37758351f668e064270d8dda7f1dc84e8e44725e1efd8e8c00cbaee1727d1a8
f60d24fb254a22c7a4e8d29622ca6f3dc0f723a11e78b3bef83fc077242cb66e
f7e248392cea6eed6651423f5b9a4adafec5b15921a2f16ec54e1012be0aaee5
f84eb4571c0eb40823ed47af468684cc9703ecfc89f6a38e569a470d504a3504
f9a5ea6542a0b4c213746e9a577816da06c354e3421f28586b3f0ca2765394ba
fdbab62badcc15af602d1111bd69012d3b4e86c290d1677c7ed7ac2e5f851df4
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

www.seqrite.com Open in urlscan Pro 103.228.50.137 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

91 Requests

100 %HTTPS

86 %IPv6

6 Domains

7 Subdomains

8 IPs

3 Countries

3321 kBTransfer

4010 kBSize

4 Cookies

12 Outgoing links

Redirected requests

91 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 4 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

www.seqrite.com Open in urlscan Pro
103.228.50.137 Public Scan

Screenshot
Live screenshot

Full Image

91
Requests

100 %
HTTPS

86 %
IPv6

6
Domains

7
Subdomains

8
IPs

3
Countries

3321 kB
Transfer

4010 kB
Size

4
Cookies

91 HTTP transactions
4 data transactions