yoroi.company Open in urlscan Pro
2a06:98c1:3121::3 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb...
Effective URL:
https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb...
Submission: On December 13 via api (December 13th 2023, 3:06:05 pm UTC) from DE — Scanned from NL

Summary HTTP 79 Redirects Links 7 Behaviour Indicators

Summary

This website contacted 14 IPs in 2 countries across 8 domains to perform 79 HTTP transactions. The main IP is 2a06:98c1:3121::3, located in United States and belongs to CLOUDFLARENET, US. The main domain is yoroi.company.
TLS certificate: Issued by E1 on November 8th 2023. Valid for: 3 months.

This is the only time yoroi.company was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 48	2a06:98c1:312... 2a06:98c1:3121::3	13335 (CLOUDFLAR...) (CLOUDFLARENET)
8	192.0.77.37 192.0.77.37	2635 (AUTOMATTIC) (AUTOMATTIC)
1	2a00:1450:400... 2a00:1450:4001:831::200a	15169 (GOOGLE) (GOOGLE)
1	192.0.77.32 192.0.77.32	2635 (AUTOMATTIC) (AUTOMATTIC)
2	2606:4700::68... 2606:4700::6810:5514	13335 (CLOUDFLAR...) (CLOUDFLARENET)
5	2a00:1450:400... 2a00:1450:4001:828::2004	15169 (GOOGLE) (GOOGLE)
3	192.0.76.3 192.0.76.3	2635 (AUTOMATTIC) (AUTOMATTIC)
1	2a02:26f0:310... 2a02:26f0:3100::1735:2a09	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
3	2a00:1450:400... 2a00:1450:4001:80f::2003	15169 (GOOGLE) (GOOGLE)
1	192.0.77.2 192.0.77.2	2635 (AUTOMATTIC) (AUTOMATTIC)
4	2a00:1450:400... 2a00:1450:4001:81c::2003	15169 (GOOGLE) (GOOGLE)
4 5	2620:1ec:21::14 2620:1ec:21::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	13.107.42.14 13.107.42.14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
79	14

48 2a06:98c1:3121::3 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

yoroi.company	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 192.0.77.37 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)
PTR: wordpress.com

c0.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:831::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 192.0.77.32 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)
PTR: wordpress.com

s0.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6810:5514 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:828::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 192.0.76.3 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)

stats.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pixel.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:3100::1735:2a09 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

snap.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:80f::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 192.0.77.2 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)
PTR: i1.wp.com

i0.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:81c::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2620:1ec:21::14 (United States) 4 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.107.42.14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px4.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
48	yoroi.company 1 redirects yoroi.company	301 KB
13	wp.com c0.wp.com — Cisco Umbrella Rank: 8588 s0.wp.com — Cisco Umbrella Rank: 7928 stats.wp.com — Cisco Umbrella Rank: 2814 i0.wp.com — Cisco Umbrella Rank: 3858 pixel.wp.com — Cisco Umbrella Rank: 2796	185 KB
7	gstatic.com fonts.gstatic.com www.gstatic.com	510 KB
6	linkedin.com 4 redirects px.ads.linkedin.com — Cisco Umbrella Rank: 327 www.linkedin.com — Cisco Umbrella Rank: 629 px4.ads.linkedin.com — Cisco Umbrella Rank: 6419	5 KB
5	google.com www.google.com — Cisco Umbrella Rank: 2	43 KB
2	jsdelivr.net cdn.jsdelivr.net — Cisco Umbrella Rank: 313	10 KB
1	licdn.com snap.licdn.com — Cisco Umbrella Rank: 763	15 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 29	1015 B
79	8

	Domain	Requested by
48	yoroi.company	1 redirects yoroi.company c0.wp.com
8	c0.wp.com	yoroi.company
5	www.google.com	yoroi.company www.gstatic.com www.google.com
4	px.ads.linkedin.com	3 redirects snap.licdn.com
4	www.gstatic.com	www.google.com www.gstatic.com
3	fonts.gstatic.com	fonts.googleapis.com www.google.com
2	pixel.wp.com	yoroi.company
2	cdn.jsdelivr.net	yoroi.company
1	px4.ads.linkedin.com	yoroi.company
1	www.linkedin.com	1 redirects
1	i0.wp.com	yoroi.company
1	snap.licdn.com	yoroi.company
1	stats.wp.com	yoroi.company
1	s0.wp.com	yoroi.company
1	fonts.googleapis.com	yoroi.company
79	15

This site contains links to these domains. Also see Links.

Domain
marcoramilli.com
goo.gl
twitter.com
www.linkedin.com
www.youtube.com
www.trusted-introducer.org
www.cookieyes.com

Subject Issuer	Validity	Valid
yoroi.company E1	`2023-11-08` - `2024-02-06`	3 months	crt.sh
*.wp.com Sectigo ECC Domain Validation Secure Server CA	`2023-11-28` - `2024-12-28`	a year	crt.sh
upload.video.google.com GTS CA 1C3	`2023-11-20` - `2024-02-12`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2023-05-02` - `2024-05-01`	a year	crt.sh
www.google.com GTS CA 1C3	`2023-11-20` - `2024-02-12`	3 months	crt.sh
snap.licdn.com DigiCert SHA2 Secure Server CA	`2023-02-01` - `2024-01-31`	a year	crt.sh
*.gstatic.com GTS CA 1C3	`2023-11-20` - `2024-02-12`	3 months	crt.sh
*.google.com GTS CA 1C3	`2023-11-20` - `2024-02-12`	3 months	crt.sh
www.linkedin.com DigiCert SHA2 Secure Server CA	`2023-11-03` - `2024-05-03`	6 months	crt.sh

This page contains 3 frames:

Primary Page: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
Frame ID: 352552E586C8F03E6BCFD43AA2EAD2CD
Requests: 71 HTTP requests in this frame

Frame: https://yoroi.company/cdn-cgi/challenge-platform/scripts/jsd/main.js
Frame ID: 4456D57F7F03360EC263DF34A655A6BA
Requests: 1 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfTr-AUAAAAANb_RvhTeWu00N_K6josD9XFY1OD&co=aHR0cHM6Ly95b3JvaS5jb21wYW55OjQ0Mw..&hl=nl&v=cwQvQhsy4_nYdnSDY4u7O5_B&size=invisible&cb=59iis4ma1kqj
Frame ID: FCA445FBDF1954C4A7810C7D01B40E13
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Unveiling “Vetta Loader”: A custom loader hitting Italy and spread through infected USB Drives - Yoroilinkedinfacebookpinterestyoutubersstwitterinstagramfacebook-blankrss-blanklinkedin-blankpinterestyoutubetwitterinstagram

Page URL History Show full URLs

http://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-... HTTP 301
https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-... Page URL

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

<link rel=["']stylesheet["'] [^>]+/wp-(?:content|includes)/
/wp-(?:content|includes)/

Oxygen (Page builders) Expand

Overall confidence: 100%
Detected patterns

wp-content/plugins/oxygen

ZURB Foundation (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]+foundation[^>"]+css

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
<link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Linkedin Insight Tag (Analytics) Expand

Overall confidence: 100%
Detected patterns

snap\.licdn\.com/li\.lms-analytics/insight\.min\.js

Modernizr (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

([\d.]+)?/modernizr(?:\.([\d.]+))?.*\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jsDelivr (CDN) Expand

Overall confidence: 100%
Detected patterns

//cdn\.jsdelivr\.net/

reCAPTCHA (Captchas) Expand

Overall confidence: 100%
Detected patterns

/recaptcha/api\.js

Page Statistics

79
Requests

97 %
HTTPS

62 %
IPv6

8
Domains

15
Subdomains

14
IPs

2
Countries

1065 kB
Transfer

3190 kB
Size

14
Cookies

7 Outgoing links

These are links going to different origins than the main page.

URL: https://marcoramilli.com/
Title: Marco Ramilli Blog

Search URL Search Domain Scan URL

URL: https://goo.gl/maps/HNzMBBYmJRoHoFtSA
Title: Piazza Sallustio, 900187 Roma (RM)

Search URL Search Domain Scan URL

URL: https://twitter.com/yoroisecurity

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/yoroi/

Search URL Search Domain Scan URL

URL: https://www.youtube.com/channel/UCb3woWzGtRO8tYHHpje3AMA

Search URL Search Domain Scan URL

URL: https://www.trusted-introducer.org/directory/teams/cert-yoroi.html

Search URL Search Domain Scan URL

URL: https://www.cookieyes.com/

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/ HTTP 301
https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 67

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=3795428&time=1702479959820&url=https%3A%2F%2Fyoroi.company%2Fen%2Fresearch%2Funveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives%2F HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=3795428&time=1702479959820&url=https%3A%2F%2Fyoroi.company%2Fen%2Fresearch%2Funveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives%2F&cookiesTest=true HTTP 302
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D3795428%26time%3D1702479959820%26url%3Dhttps%253A%252F%252Fyoroi.company%252Fen%252Fresearch%252Funveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives%252F%26cookiesTest%3Dtrue%26liSync%3Dtrue HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=3795428&time=1702479959820&url=https%3A%2F%2Fyoroi.company%2Fen%2Fresearch%2Funveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives%2F&cookiesTest=true&liSync=true HTTP 302
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=3795428&time=1702479959820&url=https%3A%2F%2Fyoroi.company%2Fen%2Fresearch%2Funveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives%2F&cookiesTest=true&liSync=true&e_ipv6=AQKEr3Yn5cX0YAAAAYxjtpk6NH0e6phLRf_P_ZHRkpkGhfLAnc_FyQRwcU9LowjGcZlUiw

79 HTTP transactions
2 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
Redirect Chain

http://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/

219 KB
33 KB

214ms
157ms

Document
text/html

2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

141ce5d6297abe5ae2728af403513bb9d6c8367cc291d9e1436388f47fc979e7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: nl-NL,nl;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: max-age=60, must-revalidate
cf-cache-status: DYNAMIC
cf-ray: 834f1bbbb8f40e60-AMS
content-encoding: br
content-type: text/html; charset=UTF-8
date: Wed, 13 Dec 2023 15:05:58 GMT
host-header: WordPress.com
last-modified: Wed, 13 Dec 2023 15:01:58 GMT
link: <https://yoroi.company/wp-json/>; rel="https://api.w.org/" <https://yoroi.company/wp-json/wp/v2/posts/7796>; rel="alternate"; type="application/json" <https://yoroi.company/?p=7796>; rel=shortlink
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vJgJy%2FCxKH4VrRyMCsccn6yJrKCsUN2nLmqFTWTHZLV5%2FAWrPXDq9KZ9ZRL0y9KDGg0o04K5dsLmCvdyGn8b2dj2MheIqAUNpdGAFUaUJ4FyLbWsJIjp71gYFa7WiIApqwCnqv8vYEx8p%2Btd"}],"group":"cf-nel","max_age":604800}
server: cloudflare
strict-transport-security: max-age=31536000
vary: Accept-Encoding Cookie
x-ac: 2.ams _atomic_ams BYPASS
x-hacker: Want root? Visit join.a8c.com and mention this header.
x-nananana: Batcache-Hit
x-pingback: https://yoroi.company/xmlrpc.php

Redirect headers

CF-Cache-Status: DYNAMIC
CF-RAY: 834f1bbb1c9e672a-AMS
Connection: keep-alive
Content-Type: text/html
Date: Wed, 13 Dec 2023 15:05:58 GMT
Location: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xaSKejNyC5r96u3A%2FyUhSQA46NQZJN5NC%2Fc%2FnZNR9rm%2BQJOaC9tn30wiDOFF5BTwzgH3glJvNRS8mT3kxnvSty%2FHBzshd%2FumgPAttvjFxVO%2Fpy9yzI%2B8eCihkWU7cn4aCwRwIXIjzqYTxGIu"}],"group":"cf-nel","max_age":604800}
Server: cloudflare
Transfer-Encoding: chunked
X-ac: 2.ams _atomic_ams BYPASS
alt-svc: h3=":443"; ma=86400

GET
H2 200 dashicons.min.css
c0.wp.com/c/6.4.2/wp-includes/css/ 58 KB
35 KB 81ms
26ms Stylesheet
text/css 192.0.77.37
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://c0.wp.com/c/6.4.2/wp-includes/css/dashicons.min.css

Requested by

Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.37 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

c21e5a2b32c47bc5f9d9efc97bc0e29fd081946d1d3ebffc5621cfafb1d3960e

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://yoroi.company/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

x-nc: HIT ams 2
date: Wed, 13 Dec 2023 15:05:58 GMT
content-encoding: br
strict-transport-security: max-age=15552000
last-modified: Wed, 03 Mar 2021 21:16:22 GMT
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
alt-svc: h3=":443"; ma=86400, h3=":443"; ma=86400
expires: Thu, 12 Dec 2024 15:05:58 GMT

GET
H2 200 elusive.min.css
yoroi.company/wp-content/plugins/slick-menu/includes/modules/slick-menu-icons/includes/library/slick-menu-icon-picker/css/types/ 12 KB
3 KB 42ms
33ms Stylesheet
text/css 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://yoroi.company/wp-content/plugins/slick-menu/includes/modules/slick-menu-icons/includes/library/slick-menu-icon-picker/css/types/elusive.min.css?ver=2.0

Requested by

Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6cf390024b9fb02ae1756d257499f568393acc60c76ae6b13ce986a46f396e34

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 15:05:58 GMT
strict-transport-security: max-age=31536000
x-ac: 2.ams _atomic_ams BYPASS
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 169911
content-encoding: br
alt-svc: h3=":443"; ma=86400
last-modified: Tue, 25 Jul 2023 02:32:20 GMT
server: cloudflare
etag: W/"64bf3434-31f0"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: text/css
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=OtYop05rVq69zDiX2HeMBzuxmpLvxi2ZP0bhrUdDCcgrOHclNMVWfO0OdJMTNMrRN5Tstvk4VCvaboxJNt6ACIUaiGJZbz39oV71jQmnugIpuJDngONZn6pWwLGOc2kS4k8NtaCjYsuNwjON"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=315360000
cf-ray: 834f1bbcca500e60-AMS
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 font-awesome.min.css
yoroi.company/wp-content/plugins/slick-menu/includes/modules/slick-menu-icons/includes/library/slick-menu-icon-picker/css/types/ 28 KB
7 KB 40ms
32ms Stylesheet
text/css 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://yoroi.company/wp-content/plugins/slick-menu/includes/modules/slick-menu-icons/includes/library/slick-menu-icon-picker/css/types/font-awesome.min.css?ver=4.6.3

Requested by

Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5fd50e41f2ce65b53589fb6ca59a03d2fc269d65db66f8c0b29fc5bc8ba84d08

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 15:05:58 GMT
strict-transport-security: max-age=31536000
x-ac: 2.ams _atomic_ams BYPASS
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 169911
content-encoding: br
alt-svc: h3=":443"; ma=86400
last-modified: Tue, 25 Jul 2023 02:32:20 GMT
server: cloudflare
etag: W/"64bf3434-7160"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: text/css
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=AoXlrq1RHtfrtSYHMrpDz0sWW0okUkEd55M2ssPCSAwPFiCUE%2BgG3hsjDAqwXrlQNlpK6ylOkmhabebApdGyQtRdhEzKQVf3uocyLbaYEMegb4pqeOC7fwra3mHRncEo88jUUb2ZhbHbQv2u"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=315360000
cf-ray: 834f1bbcca510e60-AMS
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 foundation-icons.min.css
yoroi.company/wp-content/plugins/slick-menu/includes/modules/slick-menu-icons/includes/library/slick-menu-icon-picker/css/types/ 17 KB
4 KB 46ms
38ms Stylesheet
text/css 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://yoroi.company/wp-content/plugins/slick-menu/includes/modules/slick-menu-icons/includes/library/slick-menu-icon-picker/css/types/foundation-icons.min.css?ver=3.0

Requested by

Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d51089ba164e46643145dc475cce83e53896a1e6541c68b20d841c1ab24e65b9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 15:05:58 GMT
strict-transport-security: max-age=31536000
x-ac: 2.ams _atomic_ams BYPASS
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 169911
content-encoding: br
alt-svc: h3=":443"; ma=86400
last-modified: Tue, 25 Jul 2023 02:32:20 GMT
server: cloudflare
etag: W/"64bf3434-439a"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: text/css
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=j3ISI3hzXpOQfJQ%2Fc3tUq0kCjbdIbFj%2B02VTJLb1wASAc1JeAXWyJhJQuBPxt7X5uCZLIahoosJrj5qBNMVsN5mtxMwOLYELr7zDbXj0Ve5nk1hH%2FHcBdrdbjkE7OyynJo1SVVEY51OdSPC%2B"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=315360000
cf-ray: 834f1bbcca530e60-AMS
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 genericons.min.css
yoroi.company/wp-content/plugins/slick-menu/includes/modules/slick-menu-icons/includes/library/slick-menu-icon-picker/css/types/ 26 KB
16 KB 41ms
34ms Stylesheet
text/css 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://yoroi.company/wp-content/plugins/slick-menu/includes/modules/slick-menu-icons/includes/library/slick-menu-icon-picker/css/types/genericons.min.css?ver=3.4

Requested by

Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2deb67a6ea5e9e0e254330515f7aa291a07618b72715a63971274378cd4d06c4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 15:05:58 GMT
strict-transport-security: max-age=31536000
x-ac: 2.ams _atomic_ams BYPASS
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 169911
content-encoding: br
alt-svc: h3=":443"; ma=86400
last-modified: Tue, 25 Jul 2023 02:32:20 GMT
server: cloudflare
etag: W/"64bf3434-683c"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: text/css
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2B1p35NMGmdwG%2Bxhk%2B2ZGUelRF7VUsvwa%2BN%2F3kIG8mDHPGNN%2BcuTM7wSxpuK9oHo%2B4SFfx0Wz04TzWwAAvFGcdGJxuMAUr8y2ScCR74Au22rq7BF2cLL85BdFlLtfOEqIukc4hR6x8XyoO9P9"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=315360000
cf-ray: 834f1bbcca540e60-AMS
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 extra.min.css
yoroi.company/wp-content/plugins/slick-menu/includes/modules/slick-menu-icons/css/ 1 KB
674 B 40ms
33ms Stylesheet
text/css 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://yoroi.company/wp-content/plugins/slick-menu/includes/modules/slick-menu-icons/css/extra.min.css?ver=0.10.1

Requested by

Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

cb45a5a7cef4f74f99afa05c6d5c244ed8f36799f372504b042a3e7e6c3d54b7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 15:05:58 GMT
strict-transport-security: max-age=31536000
x-ac: 2.ams _atomic_ams BYPASS
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 169911
content-encoding: br
alt-svc: h3=":443"; ma=86400
last-modified: Tue, 25 Jul 2023 02:32:20 GMT
server: cloudflare
etag: W/"64bf3434-4cc"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: text/css
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2B%2FGejLn2v3irGvd5FDWfvbUH4lP%2Ber9Jd9bYcQ%2FSgmmv%2BvmcF4lQFlRhSEWdTa77kl%2F0K9IdFieeYh1ESVoAvmrIc6%2Fl21kPaptb09xLUG5%2BhZ6sZEiumgIwYO0Y%2B5JghG6AZY5QIeTkQhiZ"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=315360000
cf-ray: 834f1bbcca550e60-AMS
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 style.min.css
c0.wp.com/c/6.4.2/wp-includes/css/dist/block-library/ 107 KB
13 KB 78ms
25ms Stylesheet
text/css 192.0.77.37
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://c0.wp.com/c/6.4.2/wp-includes/css/dist/block-library/style.min.css

Requested by

Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.37 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

698b89c0da3d319754d6a837b5e6d4e6a42dc402d9ffd7559b8c4cb29c644340

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://yoroi.company/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

x-nc: HIT ams 2
date: Wed, 13 Dec 2023 15:05:58 GMT
content-encoding: br
strict-transport-security: max-age=15552000
last-modified: Sun, 05 Nov 2023 19:40:32 GMT
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
alt-svc: h3=":443"; ma=86400, h3=":443"; ma=86400
expires: Thu, 12 Dec 2024 15:05:58 GMT

GET
H2 200 mediaelementplayer-legacy.min.css
c0.wp.com/c/6.4.2/wp-includes/js/mediaelement/ 11 KB
3 KB 79ms
26ms Stylesheet
text/css 192.0.77.37
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://c0.wp.com/c/6.4.2/wp-includes/js/mediaelement/mediaelementplayer-legacy.min.css

Requested by

Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.37 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

b7908a015a567ec2363011df2475368dbff34360e9da3fdff50604d6395fb646

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://yoroi.company/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

x-nc: HIT ams 2
date: Wed, 13 Dec 2023 15:05:58 GMT
content-encoding: br
strict-transport-security: max-age=15552000
last-modified: Tue, 29 Sep 2020 15:53:06 GMT
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
alt-svc: h3=":443"; ma=86400, h3=":443"; ma=86400
expires: Thu, 12 Dec 2024 15:05:58 GMT

GET
H2 200 wp-mediaelement.min.css
c0.wp.com/c/6.4.2/wp-includes/js/mediaelement/ 4 KB
1 KB 77ms
25ms Stylesheet
text/css 192.0.77.37
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://c0.wp.com/c/6.4.2/wp-includes/js/mediaelement/wp-mediaelement.min.css

Requested by

Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.37 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

2e10d353ff038c2cad3492fc17801af3e6ef2669c9e9713bdb78b1dcb104c4fe

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://yoroi.company/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

x-nc: HIT ams 2
date: Wed, 13 Dec 2023 15:05:58 GMT
content-encoding: br
strict-transport-security: max-age=15552000
last-modified: Fri, 07 Jun 2019 20:45:02 GMT
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
alt-svc: h3=":443"; ma=86400, h3=":443"; ma=86400
expires: Thu, 12 Dec 2024 15:05:58 GMT

GET
H2 200 styles.css
yoroi.company/wp-content/plugins/contact-form-7/includes/css/ 3 KB
1 KB 42ms
35ms Stylesheet
text/css 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://yoroi.company/wp-content/plugins/contact-form-7/includes/css/styles.css?ver=5.8.4

Requested by

Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ccd31ffa708d025833f954b3e0560cedd58df9a0d2706b2ccee5f501c5b2467b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 15:05:58 GMT
strict-transport-security: max-age=31536000
x-ac: 2.ams _atomic_ams BYPASS
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 900268
content-encoding: br
alt-svc: h3=":443"; ma=86400
last-modified: Sat, 02 Dec 2023 18:04:43 GMT
server: cloudflare
etag: W/"656b71bb-b4e"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: text/css
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qpfyd7Z%2FRaYGzTAaoMrd%2B4738iIxm7G8ZHrhUL7JdWnuOoqxVWEVvT4gbl6qTxB21GGwTRBEFgTdZbZaVFVcmkfcFs03EQjgICOZRmFpJN3Rnbgb2BFwRJseG8nyidTI0DFIzHZdASSWENh3"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=315360000
cf-ray: 834f1bbcca560e60-AMS
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 cookie-law-info-public.css
yoroi.company/wp-content/plugins/cookie-law-info/public/css/ 3 KB
1 KB 41ms
34ms Stylesheet
text/css 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://yoroi.company/wp-content/plugins/cookie-law-info/public/css/cookie-law-info-public.css?ver=2.1.3

Requested by

Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

fbe820b6140ad28e86f34ffae507d807cf591a22697a05b71958f2014e96a9e4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 15:05:58 GMT
strict-transport-security: max-age=31536000
x-ac: 2.ams _atomic_ams BYPASS
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 802
content-encoding: br
alt-svc: h3=":443"; ma=86400
last-modified: Thu, 22 Sep 2022 14:31:50 GMT
server: cloudflare
etag: W/"632c71d6-c22"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: text/css
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fiBl2CuXpJtozVcihRFr6KkhXQHs70v6KnszKOaEiynzPbCNJbhaMVegMkJyX9VOojimMeNm1Tut4kWHgpH7ZP%2F%2BwYK7gHc4gugb3qa1tm4vrbbAR7YBKbQ5Cq3TJBynbOT4rq4TjR6h7Qcu"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=315360000
cf-ray: 834f1bbcca5a0e60-AMS
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 cookie-law-info-gdpr.css
yoroi.company/wp-content/plugins/cookie-law-info/public/css/ 27 KB
5 KB 42ms
36ms Stylesheet
text/css 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://yoroi.company/wp-content/plugins/cookie-law-info/public/css/cookie-law-info-gdpr.css?ver=2.1.3

Requested by

Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

655ae452d922f501b62c7028fc35e238138de989387381cc1ed9cea9085864db

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 15:05:58 GMT
strict-transport-security: max-age=31536000
x-ac: 2.ams _atomic_ams BYPASS
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 3035716
content-encoding: br
alt-svc: h3=":443"; ma=86400
last-modified: Thu, 22 Sep 2022 14:31:50 GMT
server: cloudflare
etag: W/"632c71d6-6a71"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: text/css
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=SSxcxNBFEZa20y7xUo86awnIN5qDoqT6Av3YmclGfy0OJzqU5gt7A2F59qmQRH2cbNbGFFrC03QciYaXiRkklPIArvRejKG%2BUAGGY03IZZT6sxlY7biwJmFHaAeO4f%2FcQ1XJ%2BtGiYPE7ofNU"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=315360000
cf-ray: 834f1bbcca5b0e60-AMS
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 mailup-public.css
yoroi.company/wp-content/plugins/mailup-email-and-newsletter-subscription-form/public/css/ 3 KB
1 KB 42ms
36ms Stylesheet
text/css 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://yoroi.company/wp-content/plugins/mailup-email-and-newsletter-subscription-form/public/css/mailup-public.css?ver=1.2.5

Requested by

Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0d349f88844345061cef86a46e23bf67ae8ef16f7ec2453f20abe90add14655b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 15:05:58 GMT
strict-transport-security: max-age=31536000
x-ac: 2.ams _atomic_ams BYPASS
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 169911
content-encoding: br
alt-svc: h3=":443"; ma=86400
last-modified: Thu, 30 Nov 2023 17:00:58 GMT
server: cloudflare
etag: W/"6568bfca-b1d"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: text/css
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vALKs3ce2a297tMCkKrQlaI0%2Ff7IjpnWhjqmJhLK4CtQ0KGAozmuQRIfn%2F%2B00U0QrZpcoixAasdAiINgawQRWzuzK0WbVS73YIfyaFMp3B%2FOqg5%2FwTIPZNOls05c2%2FxLASeMsf39e2rFTilN"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=315360000
cf-ray: 834f1bbcca5c0e60-AMS
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 aos.css
yoroi.company/wp-content/plugins/oxygen/component-framework/vendor/aos/ 25 KB
2 KB 42ms
37ms Stylesheet
text/css 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://yoroi.company/wp-content/plugins/oxygen/component-framework/vendor/aos/aos.css?ver=6.4.2

Requested by

Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1aa8845fd06e475aefe733d4e55b36a92fcd487975049c8172341827ac9cc03e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 15:05:58 GMT
strict-transport-security: max-age=31536000
x-ac: 2.ams _atomic_ams BYPASS
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 169911
content-encoding: br
alt-svc: h3=":443"; ma=86400
last-modified: Sun, 18 Apr 2021 08:04:29 GMT
server: cloudflare
etag: W/"607be80d-65c5"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: text/css
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=YxUxDHS9sfjJsQ7aaOTiAM7ueNgniukyDn7za8IBac%2BQIU1NWcFHwKMus%2FJPS%2BguzJznLU%2BGqcNpF%2FOfuuWmqbgeXdEHaJmihTZi7rCOTUT8vdaSxxrswLupuQ7QaMe4lMr8z2jiDvPobeu8"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=315360000
cf-ray: 834f1bbcca5e0e60-AMS
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 oxygen.css
yoroi.company/wp-content/plugins/oxygen/component-framework/ 18 KB
4 KB 62ms
57ms Stylesheet
text/css 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://yoroi.company/wp-content/plugins/oxygen/component-framework/oxygen.css?ver=3.7.1

Requested by

Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3457140e78788c55cd49cc718bd4e91975bc7b3de7d2754dc3607563e510dced

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 15:05:58 GMT
strict-transport-security: max-age=31536000
x-ac: 2.ams _atomic_ams BYPASS
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 169911
content-encoding: br
alt-svc: h3=":443"; ma=86400
last-modified: Sun, 18 Apr 2021 08:04:29 GMT
server: cloudflare
etag: W/"607be80d-49c8"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: text/css
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=OfQ%2BbfKbi%2FKhxWh3kaMR7%2BA6AK8Y%2F2OwT5XzrlHpv47NGsFzJWNcM9ziXfwBbfyMQgwzU3T5LIPHA9sJffc%2BgU%2B0kFhrxOFsfmwbqtsnjnu8FrWahP24z9i5oHo2glnc%2FTsNzRX6zzEdBVTJ"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=315360000
cf-ray: 834f1bbcfa820e60-AMS
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 contact-form-7-email-spam-blocker-public.css
yoroi.company/wp-content/plugins/wp-contact-form7-email-spam-blocker/public/css/ 98 B
414 B 64ms
60ms Stylesheet
text/css 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://yoroi.company/wp-content/plugins/wp-contact-form7-email-spam-blocker/public/css/contact-form-7-email-spam-blocker-public.css?ver=1.0.0

Requested by

Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

547dda3c14b284819be511be1e410da94a5efc6ccc4a9afe1c75394f9333191a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 15:05:58 GMT
strict-transport-security: max-age=31536000
x-ac: 2.ams _atomic_ams BYPASS
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 169911
content-encoding: br
alt-svc: h3=":443"; ma=86400
last-modified: Tue, 04 Feb 2020 11:21:55 GMT
server: cloudflare
etag: W/"5e3953d3-62"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: text/css
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qNM4kydNg72bPHj0tKybb3o%2BgspVPEYConiSAs03GzU5CL5t%2FEuBKaFyd7lh%2BahHmKipMvLfsRrpYjH0WGxe%2FaV%2FLIDznijxJJEJ%2F1T5WuPUgfonj8oVXNKl3pQkzwYxveKRLV7ZnCu749GD"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=315360000
cf-ray: 834f1bbcfa830e60-AMS
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 animate.css
yoroi.company/wp-content/plugins/slick-menu/assets/vendors/animate/ 77 KB
5 KB 62ms
58ms Stylesheet
text/css 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://yoroi.company/wp-content/plugins/slick-menu/assets/vendors/animate/animate.css?ver=1.5.2

Requested by

Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

97470c6fac60d3431c7309907a10d67d0356b563c7bab67f7a44301d4164ac38

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 15:05:58 GMT
strict-transport-security: max-age=31536000
x-ac: 2.ams _atomic_ams BYPASS
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 169911
content-encoding: br
alt-svc: h3=":443"; ma=86400
last-modified: Tue, 25 Jul 2023 02:32:20 GMT
server: cloudflare
etag: W/"64bf3434-135d3"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: text/css
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kWD%2BqyKp1cLwzlxXZszuKXVRW6AGo5FTE%2FhQVDvT2SEU928au4EFhVTEtq%2B9dDqInju%2BbcGSAzUisjpGgFobm1Ih6DqswXIJqspQmfBN8%2FAgcJN%2B%2FEKSjKPROvxIGjP0YcL9rJeNkbfJXsr1"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=315360000
cf-ray: 834f1bbcfa840e60-AMS
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 slickmenu.min.css
yoroi.company/wp-content/plugins/slick-menu/assets/css/ 48 KB
8 KB 68ms
64ms Stylesheet
text/css 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://yoroi.company/wp-content/plugins/slick-menu/assets/css/slickmenu.min.css?ver=1.5.2

Requested by

Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

02e2dd08ed3c4680e621ea71891aa5675ed8afe3ea8e99dc5d4b0caa4e2ef799

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 15:05:58 GMT
strict-transport-security: max-age=31536000
x-ac: 2.ams _atomic_ams BYPASS
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1233226
content-encoding: br
alt-svc: h3=":443"; ma=86400
last-modified: Tue, 25 Jul 2023 02:32:19 GMT
server: cloudflare
etag: W/"64bf3433-be85"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: text/css
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ojuBreeKhgwfEx7a2lQTaDsFO5H2pZsptX9r5jYb7xM%2F83HCyutmwWxC3%2FSfVcU9EbPyKkV7JSFPY2BOl6Z6Uw9CDuwySnarfy3jNw8XgQpkS3UlqCNEbTuID0UQ7rRchdu7CFnKQbdcUEBN"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=315360000
cf-ray: 834f1bbcfa850e60-AMS
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 twentytwenty.css
yoroi.company/wp-content/plugins/jetpack/modules/theme-tools/compat/ 6 KB
2 KB 63ms
59ms Stylesheet
text/css 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://yoroi.company/wp-content/plugins/jetpack/modules/theme-tools/compat/twentytwenty.css?ver=13.0-a.1

Requested by

Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f99ea61de5d3dbaf01e20bf1efd0b8b834bc2ca576c6e4f7b68ab25b62e73a6f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 15:05:58 GMT
strict-transport-security: max-age=31536000
x-ac: 2.ams _atomic_ams BYPASS
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 69435
content-encoding: br
alt-svc: h3=":443"; ma=86400
last-modified: Tue, 09 Aug 2022 13:37:56 GMT
server: cloudflare
etag: W/"62f26334-16ea"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: text/css
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Fd4AFc%2BM%2FrJlJxpau2nNO6KrInsAFX3EbFbs0EG1fckKzH8gwjpuYlqgps%2BVx6%2Be2eljOlsQcIrNiaTUF70BQinrR8E01l9yh8Myg1OtvjJqmEXExNU%2Bc8rsXPS1J9yzkfebR1ZC9zDdu0RP"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=315360000
cf-ray: 834f1bbcfa870e60-AMS
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 /
yoroi.company/ 547 KB
18 KB 196ms
192ms Stylesheet
text/css 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://yoroi.company/?sm_ajax=dynamic_styles&t=1702454609&ver=1.5.2

Requested by

Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

03776ba2741b34dfc2f6a356327e2dc25cbb07f9138b5a779c6b187a58be39e0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

x-nananana: Batcache-Hit
date: Wed, 13 Dec 2023 15:05:58 GMT
strict-transport-security: max-age=31536000
x-hacker: Want root? Visit join.a8c.com and mention this header.
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-ac: 2.ams _atomic_ams BYPASS
content-encoding: br
host-header: WordPress.com
alt-svc: h3=":443"; ma=86400
last-modified: Wed, 13 Dec 2023 15:05:30 GMT
server: cloudflare
vary: Cookie
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6QxmPhfz%2F%2BQc4c7nN4UrxTf%2Br2vx3D7Cv%2BcYIMoa5v7eMgHZcM9cWFbGYoEjwRMJKkhkXnWV0JETWL3x80IGppTIUo54b8XvqDovgBnl3TssZPYPEPwwEGT%2BizupDpYWmsaq%2BxN5t%2FhVFp1l"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset: UTF-8;charset=utf-8
cache-control: max-age=272, must-revalidate
cf-ray: 834f1bbcfa880e60-AMS

GET
H2 200 jquery.min.js Show response
c0.wp.com/c/6.4.2/wp-includes/js/jquery/ 86 KB
29 KB 76ms
26ms Script
application/javascript 192.0.77.37
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://c0.wp.com/c/6.4.2/wp-includes/js/jquery/jquery.min.js

Requested by

Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.37 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

cb6f2d32c49d1c2b25e9ffc9aaafa3f83075346c01bcd4ae6eb187392a4292cf

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://yoroi.company/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

x-nc: HIT ams 2
date: Wed, 13 Dec 2023 15:05:58 GMT
content-encoding: br
strict-transport-security: max-age=15552000
last-modified: Mon, 28 Aug 2023 17:14:23 GMT
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
alt-svc: h3=":443"; ma=86400, h3=":443"; ma=86400
expires: Thu, 12 Dec 2024 15:05:58 GMT

GET
H2 200 cookie-law-info-public.js Show response
yoroi.company/wp-content/plugins/cookie-law-info/public/js/ 33 KB
8 KB 71ms
67ms Script
application/javascript 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://yoroi.company/wp-content/plugins/cookie-law-info/public/js/cookie-law-info-public.js?ver=2.1.3

Requested by

Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6c52384c7b0641dd1ead85d079c22d39bcc6dc5f2537afb1e6396bb619771a3f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 15:05:58 GMT
strict-transport-security: max-age=31536000
x-ac: 2.ams _atomic_ams BYPASS
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 169911
content-encoding: br
alt-svc: h3=":443"; ma=86400
last-modified: Thu, 22 Sep 2022 14:31:50 GMT
server: cloudflare
etag: W/"632c71d6-8583"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zXitcNHCQfTHTVuPo0GOh6%2FB958zyAS0heNTpEAMZnI%2B7j4c%2Bo%2Fga1ggDTXRnYOjqq48GJW8dd%2FHUN6Y64VW5YiKHeA%2BxFxkiQYgU1QgO5iKmI3i84A3JlQJuL5nWsBIcwXcwngu1s%2BoRjvi"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=315360000
cf-ray: 834f1bbcfa8a0e60-AMS
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 jquery.validate.min.js Show response
yoroi.company/wp-content/plugins/mailup-email-and-newsletter-subscription-form/admin/js/ 24 KB
8 KB 65ms
62ms Script
application/javascript 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://yoroi.company/wp-content/plugins/mailup-email-and-newsletter-subscription-form/admin/js/jquery.validate.min.js?ver=1.19.5

Requested by

Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

270524b0d27afd1d3b6622d1a176c678daed94564c143297e217a63e21ce9820

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 15:05:58 GMT
strict-transport-security: max-age=31536000
x-ac: 2.ams _atomic_ams BYPASS
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1107241
content-encoding: br
alt-svc: h3=":443"; ma=86400
last-modified: Thu, 30 Nov 2023 17:00:58 GMT
server: cloudflare
etag: W/"6568bfca-6019"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=MuyCOZmfM5Do7Wr6qLSIqfadAplhY9MNpmotEQ%2BZAi9uud%2F%2F8B5EOuZ8M57Fr%2F%2F85cTlwoJH%2BZCU2M4WwbNgvGR91DeuEBo68Y9gEp%2BXmBedxJL3NotCj3kWPhuJKY5kXWbBudPXVORHsads"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=315360000
cf-ray: 834f1bbcfa8b0e60-AMS
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 mailup-public.js Show response
yoroi.company/wp-content/plugins/mailup-email-and-newsletter-subscription-form/public/js/ 3 KB
2 KB 63ms
60ms Script
application/javascript 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://yoroi.company/wp-content/plugins/mailup-email-and-newsletter-subscription-form/public/js/mailup-public.js?ver=1.2.5

Requested by

Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

83d04fa061be70b12909406d9cdb1d5ba40596f512fc3c716ae04b645527648c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 15:05:58 GMT
strict-transport-security: max-age=31536000
x-ac: 2.ams _atomic_ams BYPASS
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 169910
content-encoding: br
alt-svc: h3=":443"; ma=86400
last-modified: Thu, 30 Nov 2023 17:00:58 GMT
server: cloudflare
etag: W/"6568bfca-c98"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gQkyVcmPG5Ajn0EYfx40vVW89D7hLcwe4zJmbjv3naO7iJDM%2Bf5qjnW93Q0uiBZMhJUz9p5S487G8WsQcl2rz7nCwwCpNlk0ElH50sOHaFtnXjt7QyXeG4DNHoUSeMH1pPjGf8p9%2F0rqo2r1"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=315360000
cf-ray: 834f1bbcfa8c0e60-AMS
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 aos.js Show response
yoroi.company/wp-content/plugins/oxygen/component-framework/vendor/aos/ 14 KB
5 KB 69ms
66ms Script
application/javascript 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://yoroi.company/wp-content/plugins/oxygen/component-framework/vendor/aos/aos.js?ver=1

Requested by

Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4460f1596174d06cca957fdaca2c71e1a377cf1d6f07ee4c75ffb3bf3fc97a03

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 15:05:58 GMT
strict-transport-security: max-age=31536000
x-ac: 2.ams _atomic_ams BYPASS
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 684934
content-encoding: br
alt-svc: h3=":443"; ma=86400
last-modified: Sun, 18 Apr 2021 08:04:29 GMT
server: cloudflare
etag: W/"607be80d-37a3"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=tYc6j2%2B%2F6uzxVxJCJ8igfMw6%2FylOjKax4x%2B3bMXVtYibDF1ZK0QNNIRbccT5V1TgfTvKmoRzWHXMu%2BqYt6aZsoK3hTb5gc55BOGQHgroBc1Q%2Fg%2BlgmYkP3Yst0BnGyh26gGoGw1GtsHDbIAf"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=315360000
cf-ray: 834f1bbcfa8d0e60-AMS
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 contact-form-7-email-spam-blocker-public.js Show response
yoroi.company/wp-content/plugins/wp-contact-form7-email-spam-blocker/public/js/ 838 B
873 B 68ms
65ms Script
application/javascript 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://yoroi.company/wp-content/plugins/wp-contact-form7-email-spam-blocker/public/js/contact-form-7-email-spam-blocker-public.js?ver=1.0.0

Requested by

Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

57a50c99a31ef4e89e86664e96f6dfbdde163a2eb96e88b3b492c49aa4be2f37

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 15:05:58 GMT
strict-transport-security: max-age=31536000
x-ac: 2.ams _atomic_ams BYPASS
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 744305
content-encoding: br
alt-svc: h3=":443"; ma=86400
last-modified: Tue, 04 Feb 2020 11:21:55 GMT
server: cloudflare
etag: W/"5e3953d3-346"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fdSm9VJBPtWJMN%2Bpmhppv3yQXlI%2FTx1TL3uw5k0yaRxtj0DifExEyEOAyE1BSR9b0uXutFJyTwZSC%2BUveZwkzk8whFCvo6%2Bo50uq2%2FsOnYUwVnCc49FUqKf4EI5iqdeEANTwkw7IhycDO6QV"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=315360000
cf-ray: 834f1bbcfa8e0e60-AMS
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 css
fonts.googleapis.com/ 10 KB
1015 B 206ms
68ms Stylesheet
text/css 2a00:1450:4001:831::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Work+Sans:100,200,300,400,500,600,700,800,900|Work+Sans:100,200,300,400,500,600,700,800,900

Requested by

Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

6f3b3eda120231c8b7775699ee027905ac6a8f998e7dddefe9bdab0a0b32219f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://yoroi.company/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Wed, 13 Dec 2023 15:05:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Wed, 13 Dec 2023 14:51:42 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 13 Dec 2023 15:05:58 GMT

GET
H2 200 /
yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/ 46 KB
9 KB 177ms
175ms Stylesheet
text/css 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/?xlink=css&ver=6.4.2

Requested by

Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

058518d45e49147be19e3e9847a1bb86c2fca0e546ecf62504aea2faaee0a72e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

x-nananana: Batcache-Hit
date: Wed, 13 Dec 2023 15:05:58 GMT
strict-transport-security: max-age=31536000
x-hacker: Want root? Visit join.a8c.com and mention this header.
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-ac: 2.ams _atomic_ams BYPASS
x-pingback: https://yoroi.company/xmlrpc.php
content-encoding: br
host-header: WordPress.com
alt-svc: h3=":443"; ma=86400
last-modified: Wed, 13 Dec 2023 15:01:59 GMT
server: cloudflare
vary: Accept-Encoding, Cookie
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=q2CwepvmHmYLxw8SWtw9PNQcRwsfMDEJoN3PO8oQWY0R5rpumKF84aGF6NBmYtKQ40SiU1MupzvqSt2EeP3od76R5sYkx8Gs6nvNKqeEcjoYy7tShiXr%2B4Bd7dkzw2McrLdy6CukJIbM5ime"}],"group":"cf-nel","max_age":604800}
content-type: text/css;charset=utf-8
cache-control: max-age=61, must-revalidate
cf-ray: 834f1bbcfa890e60-AMS
link: <https://yoroi.company/wp-json/>; rel="https://api.w.org/", <https://yoroi.company/wp-json/wp/v2/posts/7796>; rel="alternate"; type="application/json", <https://yoroi.company/?p=7796>; rel=shortlink

GET
H2 200 logo-head.svg
yoroi.company/wp-content/uploads/2020/01/ 3 KB
1 KB 60ms
58ms Image
image/svg+xml 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://yoroi.company/wp-content/uploads/2020/01/logo-head.svg

Requested by

Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

65158a29c17b7bd93fcb3409b97eda74a7c090d932a9ce494adb9f82d737894d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 15:05:58 GMT
strict-transport-security: max-age=31536000
x-ac: 2.ams _atomic_ams BYPASS
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 4008
content-encoding: br
alt-svc: h3=":443"; ma=86400
last-modified: Mon, 03 Feb 2020 11:41:20 GMT
server: cloudflare
etag: W/"5e3806e0-a21"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: image/svg+xml
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Q%2Bph0nhvjlyEvnVXYwG2opMs4%2BZ5EW4gC%2Bzzie%2Bj5lb4ZsyQlY6ikrJTbYwJbItww4hFwTKIl%2FwWXtr3fkG0QrupVkFQLsqUNLTjhzgdvD6wvdfKyM2m9esXX6pT0fs9rT6E86SvXCxk7y%2B3"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=604800
cf-ray: 834f1bbcfa8f0e60-AMS
expires: Wed, 20 Dec 2023 13:59:10 GMT

GET
H2 200 hamburger.svg
yoroi.company/wp-content/uploads/2020/01/ 488 B
598 B 63ms
61ms Image
image/svg+xml 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://yoroi.company/wp-content/uploads/2020/01/hamburger.svg

Requested by

Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f349f68dd834591897a2b648193d96446427a388772b17163e166c17bf4bb5f4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 15:05:58 GMT
strict-transport-security: max-age=31536000
x-ac: 2.ams _atomic_ams BYPASS
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 802
content-encoding: br
alt-svc: h3=":443"; ma=86400
last-modified: Mon, 03 Feb 2020 11:41:17 GMT
server: cloudflare
etag: W/"5e3806dd-1e8"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: image/svg+xml
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6Sz7Tf9AfUIqOBjADyRWLS%2Fj%2FnVA8XzEByjXO8qd2FV9dFB11SRKZrDEoGa59DzxxZsNbL82pXKvytJFtXU7o9sAiGg8I0TMfhUqrjCeDnEn9jnSzIT4O5WKN5MNduFA2LDdt4yIGCUaGhUS"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=604800
cf-ray: 834f1bbcfa910e60-AMS
expires: Wed, 20 Dec 2023 14:52:36 GMT

GET
H3 200 Risorsa-36-8.png
yoroi.company/wp-content/uploads/2020/01/ 30 KB
30 KB 63ms
61ms Image
image/png 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://yoroi.company/wp-content/uploads/2020/01/Risorsa-36-8.png

Requested by

Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

048e7b54fbc9022c80b0bf1144f55baaf814f91fe575515dbd4263634317013f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 15:05:58 GMT
strict-transport-security: max-age=31536000
x-ac: 2.ams _atomic_ams BYPASS
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 604301
alt-svc: h3=":443"; ma=86400
content-length: 30485
last-modified: Mon, 03 Feb 2020 11:41:18 GMT
server: cloudflare
etag: "5e3806de-7715"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: image/png
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=v2lEFNTRRO9771ZcmrDP2%2Fyn%2BHjp9pGG%2Bsz61exx2B2POwrqz33jqgmRlEgYUMFIuZz1dWhkoxEhx4NkwuYr66aEKg5mxj0ag5tYmQ73ORxpF3p0%2BV3tA%2FF%2FYBPUy4M5JSmEGwR6vq9g6qup"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=604800
accept-ranges: bytes
cf-ray: 834f1bbd3f04662d-AMS
expires: Wed, 13 Dec 2023 15:14:17 GMT

GET
H3 200 logo_tinexta-ai_3.png
yoroi.company/wp-content/uploads/2021/09/ 40 KB
41 KB 38ms
36ms Image
image/png 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://yoroi.company/wp-content/uploads/2021/09/logo_tinexta-ai_3.png

Requested by

Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

814005c14007af177ca97da8fdc108fa76b6765c1e2ed546280c7645a0a63ccd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 15:05:58 GMT
strict-transport-security: max-age=31536000
x-ac: 2.ams _atomic_ams BYPASS
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 96101
alt-svc: h3=":443"; ma=86400
content-length: 41285
last-modified: Thu, 02 Sep 2021 10:17:29 GMT
server: cloudflare
etag: "6130a4b9-a145"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: image/png
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=YQsahMpG4XuNKZGYzxOGOQR48IFA7INkqskn%2B3B22%2FPXsG2Vfong9xEh3C25PySIby%2BazfaERGus31ucexJW06ypxEo1B8T5zfd8I2bLQn92ZxMnIuKS%2BVkgMFKOPxGxPdEbbu%2B6QDEuCEGM"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=604800
accept-ranges: bytes
cf-ray: 834f1bbd3f06662d-AMS
expires: Tue, 19 Dec 2023 12:24:17 GMT

GET
H3 200 image-16.png
yoroi.company/wp-content/uploads/2021/03/ 11 KB
11 KB 33ms
33ms Image
image/png 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://yoroi.company/wp-content/uploads/2021/03/image-16.png

Requested by

Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

52a86f59fd1312a60def6374184c8055b7fa03858e8494a7c35d25f619156b0f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 15:05:58 GMT
strict-transport-security: max-age=31536000
x-ac: 2.ams _atomic_ams BYPASS
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 177315
alt-svc: h3=":443"; ma=86400
content-length: 10893
last-modified: Thu, 18 Mar 2021 10:17:13 GMT
server: cloudflare
etag: "605328a9-2a8d"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: image/png
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=pJi%2BUq41zSeDRZCxNkp%2B4%2FGzzjytqFGLwjKtkgKyjSMdDN817G2CkhiVbp7dwo430%2B2%2BsaBH7uaRPtqVHRPNZ3J3MIoO3QUofBjC%2F2bfntza48sSHMKJm4bYQoCAxLsMD9fVt%2BF7cfqxJsdj"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=604800
accept-ranges: bytes
cf-ray: 834f1bbdcf9c662d-AMS
expires: Mon, 18 Dec 2023 13:50:43 GMT

GET
H3 200 LOGO_YOROI_TC_WHITE-1.png
yoroi.company/wp-content/uploads/2021/10/ 14 KB
14 KB 36ms
35ms Image
image/png 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://yoroi.company/wp-content/uploads/2021/10/LOGO_YOROI_TC_WHITE-1.png

Requested by

Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

204a3227a3631e685f978c6567314a00f03a3bedbbbc947122c97bcc4ac62d9d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 15:05:59 GMT
strict-transport-security: max-age=31536000
x-ac: 2.ams _atomic_ams BYPASS
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 521944
alt-svc: h3=":443"; ma=86400
content-length: 14192
last-modified: Fri, 08 Oct 2021 10:47:32 GMT
server: cloudflare
etag: "616021c4-3770"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: image/png
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=B2nWy9m%2Bjy5PHSikpy6ha2cz%2F%2FFFCGF2p5idX%2FzSkBEPd41X2TFZVjNTcoLC8YH5puvBlKDVoJ32Q%2BkuvBiYtX%2Bqu%2B0lkS2BUj1xJ8VJbPbABiGdBIPLMn2XBbfAOJHrdJ9EidcF1P4UQZVN"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=604800
accept-ranges: bytes
cf-ray: 834f1bbffa07662d-AMS
expires: Thu, 14 Dec 2023 14:06:55 GMT

GET
H3 200 email-decode.min.js Show response
yoroi.company/cdn-cgi/scripts/5c5dd728/cloudflare-static/ 1 KB
1 KB 27ms
27ms Script
application/javascript 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://yoroi.company/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js

Requested by

Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 15:05:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Fri, 01 Dec 2023 15:04:24 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"6569f5f8-4d7"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Chsi6DXaYPi3Cu2Vg4HVfYEpW6cqH5ajpC%2FMcN7DKdko%2F1iJnW2LpsDkle6gAQfgSHzzLwuasl0jOQwfMRIucq5OKEnuNnd7wGBl27a1X0biikMFyylMRE%2Bv%2Fhs5TnXjtGgLcZKaXXRHVa%2F2"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
x-frame-options: DENY
cache-control: max-age=172800, public
cf-ray: 834f1bbdefc2662d-AMS
expires: Fri, 15 Dec 2023 15:05:58 GMT

GET
H2 200 bilmur.min.js Show response
s0.wp.com/wp-content/js/ 6 KB
3 KB 77ms
25ms Script
application/javascript 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/wp-content/js/bilmur.min.js?m=202350
Requested by: Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: 216728e33a7de4be9b784eff527c6ccf1658319ea78fe66a7864c0b923200252

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://yoroi.company/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

x-nc: HIT ams 2
date: Wed, 13 Dec 2023 15:05:59 GMT
content-encoding: br
x-ac: 4.ams _dfw MISS
last-modified: Wed, 15 Nov 2023 17:05:24 GMT
server: nginx
etag: W/"6554fa54-161b"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
alt-svc: h3=":443"; ma=86400
expires: Tue, 10 Dec 2024 00:00:00 GMT

GET
H3 200 logo-cookieyes.svg
yoroi.company/wp-content/plugins/cookie-law-info/public/images/ 3 KB
2 KB 36ms
36ms Image
image/svg+xml 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://yoroi.company/wp-content/plugins/cookie-law-info/public/images/logo-cookieyes.svg

Requested by

Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

fab005de52ce54d75f373c5a020e7ddd194caea5b4bf6e87886196e5d4451adc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 15:05:59 GMT
strict-transport-security: max-age=31536000
x-ac: 2.ams _atomic_ams BYPASS
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 277257
content-encoding: br
alt-svc: h3=":443"; ma=86400
last-modified: Thu, 22 Sep 2022 14:31:50 GMT
server: cloudflare
etag: W/"632c71d6-a15"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: image/svg+xml
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=M0hzNZhvsBkgMN%2Bv%2BiBQjMcFF4R4OD8TG%2BcwJ%2BJRh2UPA2C3awY%2BRCryRAKw9TDiH8lOQ0KXWeIoI%2BfHBUP%2FD9StoQoAyRU0XZvSnT3JdZQkzNAB3EelJqh0uPkXom2Vin9njB3pnV6NVn89"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=604800
cf-ray: 834f1bc0bae3662d-AMS
expires: Sun, 17 Dec 2023 10:05:02 GMT

GET
H2 200 countUp.min.js Show response
yoroi.company/wp-content/assets/js/ 5 KB
2 KB 48ms
47ms Script
application/javascript 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://yoroi.company/wp-content/assets/js/countUp.min.js

Requested by

Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c63a636fec47c33c1f90b009d2f95830d3492083c04e429cda86914834714967

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
Origin: https://yoroi.company
accept-language: nl-NL,nl;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 15:05:58 GMT
strict-transport-security: max-age=31536000
x-ac: 2.ams _atomic_ams BYPASS
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 69435
content-encoding: br
alt-svc: h3=":443"; ma=86400
last-modified: Mon, 03 Feb 2020 11:40:49 GMT
server: cloudflare
etag: W/"5e3806c1-126e"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=sCKhqKTlnUIMXs1g4FTQ2SC50FhUEfzfnCZ0EHa26XhKnUbXIXlws%2BV3sn%2B9mXjOpkVn1dwgMh0uXzyMAoDjvBm2JP13QDuvJzB%2BKRPxbfBOjMmq7WgGdVLS7CSFSjx6dTf%2FMmsgReQ7aGE8"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=604800
cf-ray: 834f1bbcfa920e60-AMS
expires: Tue, 19 Dec 2023 19:48:43 GMT

GET
H2 200 counters.js Show response
yoroi.company/wp-content/assets/js/ 2 KB
1 KB 47ms
47ms Script
application/javascript 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://yoroi.company/wp-content/assets/js/counters.js

Requested by

Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1c594062728319da3ecaa98c4c0b930b07d5e64207eb6e4987d4fcbff9134768

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
Origin: https://yoroi.company
accept-language: nl-NL,nl;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 15:05:58 GMT
strict-transport-security: max-age=31536000
x-ac: 2.ams _atomic_ams BYPASS
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 510983
content-encoding: br
alt-svc: h3=":443"; ma=86400
last-modified: Mon, 03 Feb 2020 11:40:49 GMT
server: cloudflare
etag: W/"5e3806c1-78d"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=IP7mWByMVpAX89o94TAi2hXk%2FA6LkucVlJ5vvyVXO5vKcSs10vHy7WpJOBM7qDEbGlWtJMafUMmds1sm97sFwT7iqJqJE1bRtUaNJB%2FPjs%2FErESuBqCVxFBkuW7NT6%2FXG8rWfD7zJ3lkQnr3"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=604800
cf-ray: 834f1bbcfa930e60-AMS
expires: Thu, 14 Dec 2023 17:09:35 GMT

GET
H3 200 parallax.min.js Show response
yoroi.company/wp-content/assets/js/ 17 KB
6 KB 35ms
34ms Script
application/javascript 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://yoroi.company/wp-content/assets/js/parallax.min.js

Requested by

Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

bf4d20b28de8c7f77428b24325ec3afb39b6f7e277f6b61666f3a0a17cc3b42b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 15:05:58 GMT
strict-transport-security: max-age=31536000
x-ac: 2.ams _atomic_ams BYPASS
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 794
content-encoding: br
alt-svc: h3=":443"; ma=86400
last-modified: Mon, 03 Feb 2020 11:40:49 GMT
server: cloudflare
etag: W/"5e3806c1-43a2"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=oiAcAHNksig9AeKLIE65zcVGJPi%2FCQ0f%2F%2BEAaup2ZyKz6CxYtq1PmPUbsEr7jzniuzdbuMOYx%2BgT%2FWGMUsSPktvaVbP5%2BFW3wp8XATelwODD3EGOUxs2awk9JkPADaOEXWXXpjOJxVGOz0Hj"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=604800
cf-ray: 834f1bbdffd3662d-AMS
expires: Wed, 20 Dec 2023 14:52:44 GMT

GET
H2 200 intersection-observer.js Show response
cdn.jsdelivr.net/npm/intersection-observer@0.7.0/ 22 KB
7 KB 98ms
35ms Script
application/javascript 2606:4700::6810:5514
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/intersection-observer@0.7.0/intersection-observer.js

Requested by

Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:5514 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1dc6d2d43514d1d8956877d1f2ef347cd5abdb8ecf8e47aba59d87b8a6da49bb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://yoroi.company/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 15:05:59 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 1080079
x-jsd-version: 0.7.0
content-encoding: br
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-served-by: cache-fra-eddf8230054-FRA, cache-ams21030-AMS
x-jsd-version-type: version
server: cloudflare
etag: W/"57ad-m3EaUx6495LHE8zS0+QpFP8kqM0"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mUR8n1cbE9dbdDo439Kw5wUOjOmaZgVkgPewpSH%2BqBWScRrWaH6a1MdCGwTS3WvV7wME%2B2zv2VM62mdeKmkpwiOP8Mdhkg1OEC%2FMZHAW1hpoJa8wyeiswpouHrYApcwfN9QkdNczZMUE3PJ0qrY%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
timing-allow-origin: *
cf-ray: 834f1bc15e9165f9-AMS

GET
H2 200 lazyload.min.js Show response
cdn.jsdelivr.net/npm/vanilla-lazyload@12.4.0/dist/ 6 KB
3 KB 35ms
34ms Script
application/javascript 2606:4700::6810:5514
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/vanilla-lazyload@12.4.0/dist/lazyload.min.js

Requested by

Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:5514 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0be502b9446e16b338d36ccadac232f4a68ab74655f98fec415ccdbbccbf5729

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://yoroi.company/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 15:05:59 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 3680907
x-jsd-version: 12.4.0
content-encoding: br
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-served-by: cache-fra-eddf8230062-FRA, cache-ams21050-AMS
x-jsd-version-type: version
server: cloudflare
etag: W/"1926-ftj+zhhSvu4E/RMH3S02cxSkfWc"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=NyxgV6XCEPXFbugd6MJ8IoEzIcqIjiQ%2BQ2Ojg1lclFB2JI51HWCUlNmj4Dk5nqAWZ2RnlMbjvyctWWAsX%2FOwlhPW30Ia0zF8Se4SP14Kd3loQsJIm%2FKDgRlL9s5GnIutIu%2BpIOFLF0DCM%2F1UK%2Fc%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
timing-allow-origin: *
cf-ray: 834f1bc19eee65f9-AMS

GET
H3 200 cookie-law-info-table.css
yoroi.company/wp-content/plugins/cookie-law-info/public/css/ 6 KB
2 KB 35ms
35ms Stylesheet
text/css 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://yoroi.company/wp-content/plugins/cookie-law-info/public/css/cookie-law-info-table.css?ver=2.1.3

Requested by

Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2e2f2336b5e6698b628afc75fa9a24c67b73d5872c1d4af99ca436064f636ee0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 15:05:58 GMT
strict-transport-security: max-age=31536000
x-ac: 2.ams _atomic_ams BYPASS
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1141797
content-encoding: br
alt-svc: h3=":443"; ma=86400
last-modified: Thu, 22 Sep 2022 14:31:50 GMT
server: cloudflare
etag: W/"632c71d6-17e1"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: text/css
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dI730iCjjNMoDEFajPC8SFFDPCZyp9Vra8XpuIZ8C%2Fs0ejphEGF9zzuDtUz7zmR67NM6WODkfKvoCAWsld6lZGxs5KBqzv2BNR5%2Fo%2FpA%2FPbHZ2JU7Hk6WjDCPEoPsYHHbApTbUqFZSMURTFH"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=315360000
cf-ray: 834f1bbe1ff3662d-AMS
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3 200 image-cdn.js Show response
yoroi.company/wp-content/plugins/jetpack/jetpack_vendor/automattic/jetpack-image-cdn/dist/ 701 B
879 B 38ms
38ms Script
application/javascript 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://yoroi.company/wp-content/plugins/jetpack/jetpack_vendor/automattic/jetpack-image-cdn/dist/image-cdn.js?minify=false&ver=132249e245926ae3e188

Requested by

Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

27dd9b075cc59cf5f3c0f6ee075f4bd113782d81ce30a4f16aac669ecfdc4fa2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 15:05:58 GMT
strict-transport-security: max-age=31536000
x-ac: 2.ams _atomic_ams BYPASS
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 277256
content-encoding: br
alt-svc: h3=":443"; ma=86400
last-modified: Mon, 08 May 2023 16:57:46 GMT
server: cloudflare
etag: W/"64592a0a-2bd"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4yLBtlDId%2ByvF9bRYaM6DYwkl9j%2FmKI7U9857S7CfPNnyts68QEVWoXlsU9osB6savQRBGbOcX%2F9ZbJOiKY1tSZkYS%2FCcI9rETkkmWLCXGpRkfTB%2FQZQ3Zu1ETXvpaCJcedIQ5gyGtjCAGFP"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=315360000
cf-ray: 834f1bbe380e662d-AMS
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3 200 index.js Show response
yoroi.company/wp-content/plugins/contact-form-7/includes/swv/js/ 11 KB
4 KB 34ms
33ms Script
application/javascript 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://yoroi.company/wp-content/plugins/contact-form-7/includes/swv/js/index.js?ver=5.8.4

Requested by

Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9c1989ecd392a0c54fb799409154242706940a8e6d800542ba579dfda576bb9d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 15:05:58 GMT
strict-transport-security: max-age=31536000
x-ac: 2.ams _atomic_ams BYPASS
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 931596
content-encoding: br
alt-svc: h3=":443"; ma=86400
last-modified: Sat, 02 Dec 2023 18:04:44 GMT
server: cloudflare
etag: W/"656b71bc-2b6d"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=M%2F17565WsaDa6ZAT2cjwevXOmuwmjJ2ejpIt%2FADqgHIwGtk0vkGtQYD%2BwkptFzTLKiMGnL6NZ8hXq0L5fKzoGKlV7aQAjg3yDzZJweq3wLj5fzvqsBNUagj04mIoyyF460wDlz5To4wKHqp8"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=315360000
cf-ray: 834f1bbe582d662d-AMS
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3 200 index.js Show response
yoroi.company/wp-content/plugins/contact-form-7/includes/js/ 13 KB
5 KB 33ms
33ms Script
application/javascript 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://yoroi.company/wp-content/plugins/contact-form-7/includes/js/index.js?ver=5.8.4

Requested by

Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7ee08c60d39f5712a56938fda3e2ab10fe3ef23ec98aeb3c9a29e54f6f31ffe1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 15:05:58 GMT
strict-transport-security: max-age=31536000
x-ac: 2.ams _atomic_ams BYPASS
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 931596
content-encoding: br
alt-svc: h3=":443"; ma=86400
last-modified: Sat, 02 Dec 2023 18:04:44 GMT
server: cloudflare
etag: W/"656b71bc-337e"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=e3IHhJai9unJTjj8n0qOaNc4ElLgCNhtrK%2BxrnUMiHo9v2OkyLx9ejpEDMegPnAXmzTw2eeUOUBLBX96LYGlSrR2nyBDvZKG%2BHAa30X8W60wEVec41rY3hN4g7SvGhi5YGUPMDZi1zEgbwCW"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=315360000
cf-ray: 834f1bbe7855662d-AMS
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 api.js Show response
www.google.com/recaptcha/ 1 KB
1 KB 118ms
46ms Script
text/javascript 2a00:1450:4001:828::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api.js?render=6LfTr-AUAAAAANb_RvhTeWu00N_K6josD9XFY1OD&ver=3.0

Requested by

Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

73a1f126cf805ced3f24d65132d3163821ed2bb33a62e83e4a305687045dcce5

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://yoroi.company/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 15:05:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy: frame-ancestors 'self'
server: GSE
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=utf-8
cache-control: private, max-age=300
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 1; mode=block
expires: Wed, 13 Dec 2023 15:05:58 GMT

GET
H2 200 wp-polyfill-inert.min.js Show response
c0.wp.com/c/6.4.2/wp-includes/js/dist/vendor/ 8 KB
3 KB 26ms
25ms Script
application/javascript 192.0.77.37
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://c0.wp.com/c/6.4.2/wp-includes/js/dist/vendor/wp-polyfill-inert.min.js

Requested by

Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.37 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

c1a9a3e223bad631dff12d33b5499eb145cb08d8621c20d9d73870e78d97afe4

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://yoroi.company/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

x-nc: HIT ams 2
date: Wed, 13 Dec 2023 15:05:58 GMT
content-encoding: br
strict-transport-security: max-age=15552000
last-modified: Wed, 18 Jan 2023 11:16:33 GMT
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
alt-svc: h3=":443"; ma=86400, h3=":443"; ma=86400
expires: Thu, 12 Dec 2024 15:05:58 GMT

GET
H2 200 regenerator-runtime.min.js Show response
c0.wp.com/c/6.4.2/wp-includes/js/dist/vendor/ 6 KB
3 KB 25ms
25ms Script
application/javascript 192.0.77.37
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://c0.wp.com/c/6.4.2/wp-includes/js/dist/vendor/regenerator-runtime.min.js

Requested by

Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.37 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

1d52e1ac7d3bc25a8b0ffc257153f9dd50249f96fe9a4df5e0d771241a69062c

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://yoroi.company/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

x-nc: HIT ams 2
date: Wed, 13 Dec 2023 15:05:58 GMT
content-encoding: br
strict-transport-security: max-age=15552000
last-modified: Tue, 19 Sep 2023 19:30:24 GMT
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
alt-svc: h3=":443"; ma=86400, h3=":443"; ma=86400
expires: Thu, 12 Dec 2024 15:05:58 GMT

GET
H3 200 wp-polyfill.min.js Show response
c0.wp.com/c/6.4.2/wp-includes/js/dist/vendor/ 112 KB
34 KB 25ms
25ms Script
application/javascript 192.0.77.37
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://c0.wp.com/c/6.4.2/wp-includes/js/dist/vendor/wp-polyfill.min.js

Requested by

Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/

Protocol

Security

QUIC, , AES_128_GCM

Server

192.0.77.37 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

da9ed5720b674f0d297fe621ac2d8d518c4e622bef1e9b0d4ae489dee9aa43f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://yoroi.company/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

x-nc: HIT ams 1
date: Wed, 13 Dec 2023 15:05:58 GMT
content-encoding: br
strict-transport-security: max-age=15552000
last-modified: Tue, 26 Sep 2023 14:23:26 GMT
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
alt-svc: h3=":443"; ma=86400, h3=":443"; ma=86400
expires: Thu, 12 Dec 2024 15:05:58 GMT

GET
H3 200 index.js Show response
yoroi.company/wp-content/plugins/contact-form-7/modules/recaptcha/ 934 B
983 B 33ms
33ms Script
application/javascript 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://yoroi.company/wp-content/plugins/contact-form-7/modules/recaptcha/index.js?ver=5.8.4

Requested by

Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

df0ec8330290d184b1084527076cb87d41b33ba706ff5ab579d761f0cb6a744b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 15:05:58 GMT
strict-transport-security: max-age=31536000
x-ac: 2.ams _atomic_ams BYPASS
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 277256
content-encoding: br
alt-svc: h3=":443"; ma=86400
last-modified: Sat, 02 Dec 2023 18:04:45 GMT
server: cloudflare
etag: W/"656b71bd-3a6"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JqjBKSnohASyvGdyEoVCerAglRQcasxjNi8SbrkTDbezFshh3IOw9II9TGmNttPt8cV4TAr62OZ%2Bh0LKsC0fc3OVaDHn%2BkYfjzpW5uFjop6WEJ8RH5ma77KkVcjzRs4t9jeOQS7anWZYlS7Q"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=315360000
cf-ray: 834f1bbf3926662d-AMS
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3 200 modernizr.js Show response
yoroi.company/wp-content/plugins/slick-menu/assets/vendors/modernizr/ 12 KB
5 KB 33ms
33ms Script
application/javascript 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://yoroi.company/wp-content/plugins/slick-menu/assets/vendors/modernizr/modernizr.js?ver=1.5.2

Requested by

Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

49cf0f2de45929d5674df4377cfc2363324674ca4dfdef454bc1dfeebcec9ca5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 15:05:58 GMT
strict-transport-security: max-age=31536000
x-ac: 2.ams _atomic_ams BYPASS
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 338772
content-encoding: br
alt-svc: h3=":443"; ma=86400
last-modified: Tue, 25 Jul 2023 02:32:20 GMT
server: cloudflare
etag: W/"64bf3434-317b"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qMsnTcGxlvR0t%2F3igzFTZ8Xv1KcVp%2B0jRPwUCD8v9m9NC5QaD6Iy9jbq5mcVgnUh3NrKe8qscQbnDtQ9HDregZ7pB2aKBWnDKVsJgXA8yY9rEovwF89Uzh17cEWUBc%2FLzR51DO6fdfpzOwUK"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=315360000
cf-ray: 834f1bbf4938662d-AMS
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3 200 body-scroll-lock.min.js Show response
yoroi.company/wp-content/plugins/slick-menu/assets/vendors/body-scroll-lock/ 3 KB
2 KB 35ms
35ms Script
application/javascript 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://yoroi.company/wp-content/plugins/slick-menu/assets/vendors/body-scroll-lock/body-scroll-lock.min.js?ver=1.5.2

Requested by

Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d947b55573f76b9876038798590599aef4ec471cd0b44a41438b02ae00fcee5b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 15:05:58 GMT
strict-transport-security: max-age=31536000
x-ac: 2.ams _atomic_ams BYPASS
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 277256
content-encoding: br
alt-svc: h3=":443"; ma=86400
last-modified: Tue, 25 Jul 2023 02:32:20 GMT
server: cloudflare
etag: W/"64bf3434-b15"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=EtR6aoEfW7XvdpW9niZBOOZZuYonOZrbx1R9hRCL4a0x4%2B6FLITQFf4iTzIxOw%2B1ZtPjhxXi83%2F6ab7lk14h5bBKbK90%2F478mw01K5zm11MojYHb40PqVPszoBFgltPNg64sqKXJeoMkbP%2F6"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=315360000
cf-ray: 834f1bbf6950662d-AMS
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3 200 utils.min.js Show response
yoroi.company/wp-content/plugins/slick-menu/assets/js/ 19 KB
8 KB 36ms
36ms Script
application/javascript 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://yoroi.company/wp-content/plugins/slick-menu/assets/js/utils.min.js?ver=1.5.2

Requested by

Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0f4a3ba36482c233c6d7970cd42fb5b76ea054044dbebe424176db9f176616cb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 15:05:58 GMT
strict-transport-security: max-age=31536000
x-ac: 2.ams _atomic_ams BYPASS
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1270601
content-encoding: br
alt-svc: h3=":443"; ma=86400
last-modified: Tue, 25 Jul 2023 02:32:19 GMT
server: cloudflare
etag: W/"64bf3433-4bab"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4phdYhGKRqMX%2FZe6jYyN3tazO63h6xhW0LJsyzh8v8pdYfUpWwgGpleWUCEImFyoiOBZZTgVS1qJmWZe0jAqZtTKjjDg8yq5iGz1KLwCEGBScZlPI97tsqGEe89NKYOV4wOmoENh%2FKtRGBA2"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=315360000
cf-ray: 834f1bbf8971662d-AMS
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3 200 slickmenu.min.js Show response
yoroi.company/wp-content/plugins/slick-menu/assets/js/ 34 KB
9 KB 35ms
35ms Script
application/javascript 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://yoroi.company/wp-content/plugins/slick-menu/assets/js/slickmenu.min.js?ver=1.5.2

Requested by

Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1e41b9ba20319d67b5b640af59346a76cec477cee421bfc5e05b1238eb292246

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 15:05:58 GMT
strict-transport-security: max-age=31536000
x-ac: 2.ams _atomic_ams BYPASS
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 2551129
content-encoding: br
alt-svc: h3=":443"; ma=86400
last-modified: Tue, 25 Jul 2023 02:32:19 GMT
server: cloudflare
etag: W/"64bf3433-8631"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=N7Xsu%2BKK2QUSQvsLGYTlxNvsaZyQBydg%2Fp8KpRR0%2FCy2LjzzHOA85hiZ27z5jgtoiW84fEyTN3BF5qeQrneAgymlUHVhNuqALwszSeyKs%2BW%2FyDjcyc4Yi84lofy6GGzOaVBJ8EhVNF5KyXP6"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=315360000
cf-ray: 834f1bbfa9a2662d-AMS
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 e-202350.js Show response
stats.wp.com/ 7 KB
3 KB 77ms
25ms Script
application/javascript 192.0.76.3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.wp.com/e-202350.js
Requested by: Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ca7752fb33cf3a98c0f29bc4eec563112025da4109a0dcc69dabf5f861751258

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://yoroi.company/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

x-minify-cache: hit
x-nc: HIT ams
date: Wed, 13 Dec 2023 15:05:59 GMT
content-encoding: br
server: nginx
x-minify: t
etag: W/13576-1695421998473.3982
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
expires: Sun, 08 Dec 2024 23:53:44 GMT

GET
H3 200 frontend.min.js Show response
yoroi.company/wp-content/plugins/slick-menu/assets/js/ 22 KB
8 KB 34ms
34ms Script
application/javascript 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://yoroi.company/wp-content/plugins/slick-menu/assets/js/frontend.min.js?ver=1.5.2

Requested by

Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d3ad83af3a48c24913133f351cc69b135c950df64ec6f0fefd414bc79249c6ba

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 15:05:59 GMT
strict-transport-security: max-age=31536000
x-ac: 2.ams _atomic_ams BYPASS
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 282362
content-encoding: br
alt-svc: h3=":443"; ma=86400
last-modified: Tue, 25 Jul 2023 02:32:19 GMT
server: cloudflare
etag: W/"64bf3433-581d"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VklfU2LcYzIB96nTMgLjq4zDj8Lr1QhM8Ila5q7ub5TW2TzbEhRdCVCdTE19BO6DICDB%2FsCtPslEbAHEoondjYwwZTKO4up6mEJ0WLLp62Bi9UW%2BpIJRF92htG0NBbXaPg2wcwgF8VZ4Vo6t"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=315360000
cf-ray: 834f1bbfc9b8662d-AMS
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
DATA 200
OK truncated
/ 350 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 7bdc4fd1b52f88617553782da88299fc8551f6921d5a30c5a29b96cb8b4c3eae

Request headers

accept-language: nl-NL,nl;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 234 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5486d67c53956813c2ab1fdef773516ee85aff7adae4ae0186cf09e398c1e28f

Request headers

accept-language: nl-NL,nl;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 42 KB
15 KB 107ms
34ms Script
application/javascript 2a02:26f0:3100::1735:2a09
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://snap.licdn.com/li.lms-analytics/insight.min.js

Requested by

Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:3100::1735:2a09 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

f3b0e2a3800f73c56a4dc78562fc32130a8eec6887982d10e6a5dcf6497969c6

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://yoroi.company/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 15:05:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 13 Dec 2023 13:09:33 GMT
x-cdn: AKAM
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
content-type: application/javascript;charset=utf-8
cache-control: max-age=79276
accept-ranges: bytes
content-length: 15541

GET
H2 200 QGYsz_wNahGAdqQ43Rh_fKDp.woff2
fonts.gstatic.com/s/worksans/v19/ 49 KB
50 KB 107ms
33ms Font
font/woff2 2a00:1450:4001:80f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/worksans/v19/QGYsz_wNahGAdqQ43Rh_fKDp.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Work+Sans:100,200,300,400,500,600,700,800,900|Work+Sans:100,200,300,400,500,600,700,800,900

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6912f7388531e949bd5406b5668cd6b55fea4cc7e2d123dbaed489054dd98438

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://yoroi.company
accept-language: nl-NL,nl;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 06:00:54 GMT
x-content-type-options: nosniff
age: 378305
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 50668
x-xss-protection: 0
last-modified: Thu, 14 Sep 2023 01:13:52 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 08 Dec 2024 06:00:54 GMT

GET
H2 200 vettaIMG.png
i0.wp.com/yoroi.company/wp-content/uploads/2023/12/ 58 KB
59 KB 82ms
26ms Image
image/webp 192.0.77.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i0.wp.com/yoroi.company/wp-content/uploads/2023/12/vettaIMG.png?w=480&ssl=1

Requested by

Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

i1.wp.com

Software

nginx /

Resource Hash

c59f8ce89d8016bba0fd065c18aa463688563cf18eb79226df9cb62e8e096533

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://yoroi.company/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 15:05:59 GMT
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
content-length: 59670
x-nc: HIT ams 8
last-modified: Mon, 11 Dec 2023 15:54:17 GMT
server: nginx
etag: "6e795eaf230cfa34"
vary: Accept
access-control-allow-methods: GET, HEAD
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=63115200
timing-allow-origin: *
link: <https://yoroi.company/wp-content/uploads/2023/12/vettaIMG.png>; rel="canonical"
expires: Thu, 11 Dec 2025 03:54:17 GMT

GET
H2 200 recaptcha__nl.js Show response
www.gstatic.com/recaptcha/releases/cwQvQhsy4_nYdnSDY4u7O5_B/ 502 KB
202 KB 192ms
62ms Script
text/javascript 2a00:1450:4001:81c::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/cwQvQhsy4_nYdnSDY4u7O5_B/recaptcha__nl.js

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api.js?render=6LfTr-AUAAAAANb_RvhTeWu00N_K6josD9XFY1OD&ver=3.0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e3f281a93c5293be122ec933426887f46ae314ffada3e3da98ac76f5ee5992cd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://yoroi.company/
Origin: https://yoroi.company
accept-language: nl-NL,nl;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Tue, 12 Dec 2023 08:54:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 108702
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 206030
x-xss-protection: 0
last-modified: Mon, 04 Dec 2023 17:08:31 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 11 Dec 2024 08:54:17 GMT

GET
H2 200 g.gif
pixel.wp.com/ 50 B
153 B 26ms
25ms Image
image/gif 192.0.76.3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.wp.com/g.gif?v=ext&blog=151656741&post=7796&tz=2&srv=yoroi.company&hp=atomic&ac=2&amp=0&j=1%3A13.0-a.1&host=yoroi.company&ref=&fcp=0&rand=0.7470064537762895
Requested by: Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://yoroi.company/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

access-control-allow-origin: *
date: Wed, 13 Dec 2023 15:05:59 GMT
cache-control: no-cache
server: nginx
content-length: 50
content-type: image/gif

GET
H3 200 schema Show response
yoroi.company/wp-json/contact-form-7/v1/contact-forms/223/feedback/ 476 B
946 B 149ms
148ms Fetch
application/json 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://yoroi.company/wp-json/contact-form-7/v1/contact-forms/223/feedback/schema

Requested by

Host: yoroi.company
URL: https://yoroi.company/wp-content/plugins/contact-form-7/includes/js/index.js?ver=5.8.4

Protocol

Security

QUIC, , AES_128_GCM

Server

2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9b53ba79fa63e6281e11715289c6da0ab79aeb98f98b3901685efbd32e708791

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, */*;q=0.1
Referer: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
accept-language: nl-NL,nl;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

x-nananana: Batcache-Hit
date: Wed, 13 Dec 2023 15:05:59 GMT
strict-transport-security: max-age=31536000
x-hacker: Want root? Visit join.a8c.com and mention this header.
x-content-type-options: nosniff
x-ac: 2.ams _atomic_ams BYPASS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-cache-status: DYNAMIC
content-encoding: br
host-header: WordPress.com
alt-svc: h3=":443"; ma=86400
last-modified: Wed, 13 Dec 2023 15:01:44 GMT
server: cloudflare
vary: Accept-Encoding, Cookie, Origin
allow: GET
content-type: application/json; charset=UTF-8
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VGq4JKKzh8nSCOftpKkRyCmWFZMIdjykqjKkns3LCe%2BRJGk3V2tkDkjXWEVy9YHvUcnnH2LPvDv2um9q%2BKhr6C0T9tEPgzSLt8rOYZp1Hkowiz1LAiYf9YSz%2Fc6eOGvR6UWZgAIfK%2BKEL5Cs"}],"group":"cf-nel","max_age":604800}
access-control-expose-headers: X-WP-Total, X-WP-TotalPages, Link
cache-control: max-age=45, must-revalidate
x-robots-tag: noindex
link: <https://yoroi.company/wp-json/>; rel="https://api.w.org/"
access-control-allow-headers: Authorization, X-WP-Nonce, Content-Disposition, Content-MD5, Content-Type
cf-ray: 834f1bc3fe6b662d-AMS

GET main.js
yoroi.company/cdn-cgi/challenge-platform/scripts/jsd/ Frame 4456 0
0

GET
H3 200 cookie-law-info-table.css
yoroi.company/wp-content/plugins/cookie-law-info/public/css/ 6 KB
2 KB 36ms
35ms Stylesheet
text/css 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://yoroi.company/wp-content/plugins/cookie-law-info/public/css/cookie-law-info-table.css?ver=2.1.3

Requested by

Host: c0.wp.com
URL: https://c0.wp.com/c/6.4.2/wp-includes/js/jquery/jquery.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2e2f2336b5e6698b628afc75fa9a24c67b73d5872c1d4af99ca436064f636ee0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 15:05:59 GMT
strict-transport-security: max-age=31536000
x-ac: 2.ams _atomic_ams BYPASS
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1141798
content-encoding: br
alt-svc: h3=":443"; ma=86400
last-modified: Thu, 22 Sep 2022 14:31:50 GMT
server: cloudflare
etag: W/"632c71d6-17e1"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: text/css
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6X3MywsMB4Xs%2FYy9tjxDUHfzlhHS79z3FcR9LCsNmt6HpXaweb0ZfKNt9hltpTHffb87V4gU1snVZKxA57MDCBJsF%2FhTyh2rNQIRAa4AGo4WFtt63IumFfe8sLX5zrIImQz4ccq9eGChUlG%2B"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=315360000
cf-ray: 834f1bc45ef2662d-AMS
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2

200

collect
px4.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=3795428&time=1702479959820&url=https%3A%2F%2Fyoroi.company%2Fen%2Fresearch%2Funveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-throu...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=3795428&time=1702479959820&url=https%3A%2F%2Fyoroi.company%2Fen%2Fresearch%2Funveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-throu...
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D3795428%26time%3D1702479959820%26url%3Dhttps%253A%252F%252Fyoroi.company%252Fen%2...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=3795428&time=1702479959820&url=https%3A%2F%2Fyoroi.company%2Fen%2Fresearch%2Funveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-throu...
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=3795428&time=1702479959820&url=https%3A%2F%2Fyoroi.company%2Fen%2Fresearch%2Funveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-thro...

0
266 B

202ms
135ms

Image
application/javascript

13.107.42.14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=3795428&time=1702479959820&url=https%3A%2F%2Fyoroi.company%2Fen%2Fresearch%2Funveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives%2F&cookiesTest=true&liSync=true&e_ipv6=AQKEr3Yn5cX0YAAAAYxjtpk6NH0e6phLRf_P_ZHRkpkGhfLAnc_FyQRwcU9LowjGcZlUiw
Requested by: Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
Protocol: H2
Server: 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://yoroi.company/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 15:06:00 GMT
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: 456159DA02934B88B13A5D0255A7825E Ref B: DUS30EDGE0811 Ref C: 2023-12-13T15:06:00Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
content-type: application/javascript
x-li-fabric: prod-lva1
x-li-proto: http/2
content-length: 0
x-li-uuid: AAYMZYFJaBt5HRFMeAKzmg==

Redirect headers

date: Wed, 13 Dec 2023 15:06:00 GMT
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: 698697BC0320442E86CDAAA5955ACEB2 Ref B: BRU30EDGE0607 Ref C: 2023-12-13T15:06:00Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-lva1
location: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=3795428&time=1702479959820&url=https%3A%2F%2Fyoroi.company%2Fen%2Fresearch%2Funveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives%2F&cookiesTest=true&liSync=true&e_ipv6=AQKEr3Yn5cX0YAAAAYxjtpk6NH0e6phLRf_P_ZHRkpkGhfLAnc_FyQRwcU9LowjGcZlUiw
x-li-proto: http/2
content-length: 0
x-li-uuid: AAYMZYFGcPAvF0yxwSWqng==

GET
H2 200 anchor Show response
www.google.com/recaptcha/api2/ Frame FCA4 41 KB
26 KB 78ms
77ms Document
text/html 2a00:1450:4001:828::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfTr-AUAAAAANb_RvhTeWu00N_K6josD9XFY1OD&co=aHR0cHM6Ly95b3JvaS5jb21wYW55OjQ0Mw..&hl=nl&v=cwQvQhsy4_nYdnSDY4u7O5_B&size=invisible&cb=59iis4ma1kqj

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/cwQvQhsy4_nYdnSDY4u7O5_B/recaptcha__nl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

c505bec1b37e9fada559b9a916bf8efa0e7cdae0e8356b039b3210f7f6d17a49

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-gKaJDof_iqk64CJjbQ_MUw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://yoroi.company/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: nl-NL,nl;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-gKaJDof_iqk64CJjbQ_MUw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Wed, 13 Dec 2023 15:05:59 GMT
expires: Mon, 01 Jan 1990 00:00:00 GMT
pragma: no-cache
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 200 styles__ltr.css
www.gstatic.com/recaptcha/releases/cwQvQhsy4_nYdnSDY4u7O5_B/ Frame FCA4 55 KB
24 KB 159ms
34ms Stylesheet
text/css 2a00:1450:4001:81c::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/cwQvQhsy4_nYdnSDY4u7O5_B/styles__ltr.css

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfTr-AUAAAAANb_RvhTeWu00N_K6josD9XFY1OD&co=aHR0cHM6Ly95b3JvaS5jb21wYW55OjQ0Mw..&hl=nl&v=cwQvQhsy4_nYdnSDY4u7O5_B&size=invisible&cb=59iis4ma1kqj

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7859a62e04b0acb06516eb12454de6673883ecfaeaed6c254659bca7cd59c050

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 14:03:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 3757
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 24606
x-xss-protection: 0
last-modified: Mon, 04 Dec 2023 17:08:31 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/css
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 12 Dec 2024 14:03:23 GMT

GET
H3 200 recaptcha__nl.js Show response
www.gstatic.com/recaptcha/releases/cwQvQhsy4_nYdnSDY4u7O5_B/ Frame FCA4 502 KB
201 KB 187ms
63ms Script
text/javascript 2a00:1450:4001:81c::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/cwQvQhsy4_nYdnSDY4u7O5_B/recaptcha__nl.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e3f281a93c5293be122ec933426887f46ae314ffada3e3da98ac76f5ee5992cd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Tue, 12 Dec 2023 08:54:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 108703
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 206030
x-xss-protection: 0
last-modified: Mon, 04 Dec 2023 17:08:31 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 11 Dec 2024 08:54:17 GMT

GET
H3 200 kn2owPU74JTsOwTGty0aoUlXRSKSJihCWxBMzE3aLQs.js Show response
www.google.com/js/bg/ Frame FCA4 17 KB
7 KB 44ms
43ms Script
text/javascript 2a00:1450:4001:828::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/js/bg/kn2owPU74JTsOwTGty0aoUlXRSKSJihCWxBMzE3aLQs.js

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/cwQvQhsy4_nYdnSDY4u7O5_B/recaptcha__nl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

927da8c0f53be094ec3b04c6b72d1aa149574522922628425b104ccc4dda2d0b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfTr-AUAAAAANb_RvhTeWu00N_K6josD9XFY1OD&co=aHR0cHM6Ly95b3JvaS5jb21wYW55OjQ0Mw..&hl=nl&v=cwQvQhsy4_nYdnSDY4u7O5_B&size=invisible&cb=59iis4ma1kqj
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Mon, 11 Dec 2023 15:24:10 GMT
content-encoding: br
x-content-type-options: nosniff
age: 171710
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6851
x-xss-protection: 0
last-modified: Tue, 28 Nov 2023 18:30:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 10 Dec 2024 15:24:10 GMT

GET
H3 200 logo_48.png
www.gstatic.com/recaptcha/api2/ Frame FCA4 2 KB
2 KB 34ms
32ms Image
image/png 2a00:1450:4001:81c::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/recaptcha/api2/logo_48.png

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/cwQvQhsy4_nYdnSDY4u7O5_B/styles__ltr.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1b9efb22c938500971aac2b2130a475fa23684dd69e43103894968df83145b8a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.gstatic.com/recaptcha/releases/cwQvQhsy4_nYdnSDY4u7O5_B/styles__ltr.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Mon, 11 Dec 2023 21:09:58 GMT
x-content-type-options: nosniff
age: 150962
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2228
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: image/png
cache-control: public, max-age=604800
accept-ranges: bytes
expires: Mon, 18 Dec 2023 21:09:58 GMT

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v18/ Frame FCA4 15 KB
15 KB 35ms
33ms Font
font/woff2 2a00:1450:4001:80f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.google.com/
Origin: https://www.google.com
accept-language: nl-NL,nl;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Thu, 07 Dec 2023 23:26:56 GMT
x-content-type-options: nosniff
age: 488344
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15344
x-xss-protection: 0
last-modified: Mon, 16 Oct 2017 17:32:55 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 06 Dec 2024 23:26:56 GMT

GET
H2 200 KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v18/ Frame FCA4 15 KB
15 KB 42ms
40ms Font
font/woff2 2a00:1450:4001:80f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5a8c1e7681318caa29e9f44e8a6e271f6a4067a2703e9916dfd4fe9099241db7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.google.com/
Origin: https://www.google.com
accept-language: nl-NL,nl;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 06 Dec 2023 21:01:27 GMT
x-content-type-options: nosniff
age: 583473
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15552
x-xss-protection: 0
last-modified: Mon, 16 Oct 2017 17:33:02 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 05 Dec 2024 21:01:27 GMT

GET
H3 200 webworker.js
www.google.com/recaptcha/api2/ Frame FCA4 102 B
134 B 42ms
42ms Other
text/javascript 2a00:1450:4001:828::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/webworker.js?hl=nl&v=cwQvQhsy4_nYdnSDY4u7O5_B

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

5ae64d93a741f65b963259f6f6985cf60f834b4966e67c65dc68a3de17674baf

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfTr-AUAAAAANb_RvhTeWu00N_K6josD9XFY1OD&co=aHR0cHM6Ly95b3JvaS5jb21wYW55OjQ0Mw..&hl=nl&v=cwQvQhsy4_nYdnSDY4u7O5_B&size=invisible&cb=59iis4ma1kqj
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 13 Dec 2023 15:06:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy: frame-ancestors 'self'
server: GSE
cross-origin-embedder-policy: require-corp
x-frame-options: SAMEORIGIN
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/javascript; charset=utf-8
cache-control: private, max-age=300
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 1; mode=block
expires: Wed, 13 Dec 2023 15:06:00 GMT

POST
H2 204 / Show response
px.ads.linkedin.com/wa/ 0
195 B 127ms
127ms XHR
text/plain 2620:1ec:21::14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://px.ads.linkedin.com/wa/
Requested by: Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: *
Referer: https://yoroi.company/
accept-language: nl-NL,nl;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Wed, 13 Dec 2023 15:06:00 GMT
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: 2AD543C3A4FF480CAD38BF4CDAE2B96D Ref B: BRU30EDGE0607 Ref C: 2023-12-13T15:06:00Z
linkedin-action: 1
vary: Origin
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-lva1
access-control-allow-origin: https://yoroi.company
x-li-proto: http/2
access-control-allow-credentials: true
x-li-uuid: AAYMZYFL9I7htR5zelGI2Q==

GET
H3 200 refill Show response
yoroi.company/wp-json/contact-form-7/v1/contact-forms/223/ 2 B
768 B 146ms
146ms Fetch
application/json 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://yoroi.company/wp-json/contact-form-7/v1/contact-forms/223/refill

Requested by

Host: yoroi.company
URL: https://yoroi.company/wp-content/plugins/contact-form-7/includes/js/index.js?ver=5.8.4

Protocol

Security

QUIC, , AES_128_GCM

Server

2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, */*;q=0.1
Referer: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
accept-language: nl-NL,nl;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

x-nananana: Batcache-Hit
date: Wed, 13 Dec 2023 15:06:00 GMT
strict-transport-security: max-age=31536000
x-hacker: Want root? Visit join.a8c.com and mention this header.
x-content-type-options: nosniff
x-ac: 2.ams _atomic_ams BYPASS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-cache-status: DYNAMIC
content-encoding: br
host-header: WordPress.com
alt-svc: h3=":443"; ma=86400
last-modified: Wed, 13 Dec 2023 15:05:58 GMT
server: cloudflare
vary: Accept-Encoding, Cookie, Origin
allow: GET
content-type: application/json; charset=UTF-8
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=AmBbzCcYebKVepnOpxuZpKDv6LxTo7TVdlgYSwZz5KGpvphfKQ5BmDxk2XuRJuSpjwP8dSRrJErZV4ad2DXzE%2BbBswOY8Y6RzG6qRgwPtK4K4vQwZI14Ms7MQeP7dNrCkqw47eIpbuf21jzj"}],"group":"cf-nel","max_age":604800}
access-control-expose-headers: X-WP-Total, X-WP-TotalPages, Link
cache-control: max-age=298, must-revalidate
x-robots-tag: noindex
link: <https://yoroi.company/wp-json/>; rel="https://api.w.org/"
access-control-allow-headers: Authorization, X-WP-Nonce, Content-Disposition, Content-MD5, Content-Type
cf-ray: 834f1bca4de2662d-AMS

POST
H3 200 reload Show response
www.google.com/recaptcha/api2/ Frame FCA4 13 KB
9 KB 77ms
76ms XHR
application/json 2a00:1450:4001:828::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/reload?k=6LfTr-AUAAAAANb_RvhTeWu00N_K6josD9XFY1OD

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/cwQvQhsy4_nYdnSDY4u7O5_B/recaptcha__nl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

8b3492b6880d2eec2e9dc6294908f2ece269f8cea80fd07b17e9f87fba87c21d

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfTr-AUAAAAANb_RvhTeWu00N_K6josD9XFY1OD&co=aHR0cHM6Ly95b3JvaS5jb21wYW55OjQ0Mw..&hl=nl&v=cwQvQhsy4_nYdnSDY4u7O5_B&size=invisible&cb=59iis4ma1kqj
accept-language: nl-NL,nl;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: application/x-protobuffer

Response headers

date: Wed, 13 Dec 2023 15:06:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy: frame-ancestors 'self'
server: GSE
x-frame-options: SAMEORIGIN
content-type: application/json; charset=utf-8
cache-control: private, max-age=0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 1; mode=block
expires: Wed, 13 Dec 2023 15:06:00 GMT

GET
H2 204 boom.gif
pixel.wp.com/ 0
81 B 25ms
25ms Image
text/plain 192.0.76.3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.wp.com/boom.gif?bilmur=1&cumulative_layout_shift=0.007&largest_contentful_paint=1590&batcache_hit=1&provider=wordpress.com&service=atomic&effective_connection_type=4g&rtt=0&downlink=10000&host_name=yoroi.company&url_path=%2Fen%2Fresearch%2Funveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives%2F&nt_fetchStart=76&nt_domainLookupStart=77&nt_domainLookupEnd=77&nt_connectStart=77&nt_connectEnd=134&nt_secureConnectionStart=101&nt_requestStart=134&nt_responseStart=290&nt_responseEnd=304&nt_domLoading=293&nt_domInteractive=1441&nt_domContentLoadedEventStart=1443&nt_domContentLoadedEventEnd=1458&nt_domComplete=2461&nt_loadEventStart=2461&nt_loadEventEnd=2463&nt_redirectCount=0&nt_nextHopProtocol=h2&nt_api_level=2&start_render=1395&first_contentful_paint=1590&resource_size=1684266&resource_transferred=400092&resource_cache_percent=0&js_size=472026&js_transferred=156324&js_cache_percent=0&blocking_size=1268248&blocking_transferred=194158&blocking_cache_percent=0&last_resource_end=2610
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://yoroi.company/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

access-control-allow-origin: *
date: Wed, 13 Dec 2023 15:06:02 GMT
cache-control: no-cache
server: nginx

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: yoroi.company
URL: https://yoroi.company/cdn-cgi/challenge-platform/scripts/jsd/main.js

Verdicts & Comments Add Verdict or Comment

70 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

14 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
www.google.com/recaptcha	1970-01-20 21:13:51	Name: _GRECAPTCHA Value: 09APfP6pUQyjw5B-CysErZP9uNe1MHdXXWeyxJXTMWQdZjMzNb-UAnDWQBj7BX2OaQ0ICp1vtKVyOy6_1btfKh7DU
yoroi.company/	1970-01-21 01:40:15	Name: pll_language Value: en
yoroi.company/	1970-01-21 01:40:15	Name: cookielawinfo-checkbox-necessary Value: yes
yoroi.company/	1970-01-21 01:40:15	Name: cookielawinfo-checkbox-performance Value: no
yoroi.company/	1970-01-21 01:40:15	Name: cookielawinfo-checkbox-advertisement Value: no
yoroi.company/	1970-01-21 01:40:15	Name: cookielawinfo-checkbox-others Value: no
yoroi.company/	1970-01-21 01:40:15	Name: cookielawinfo-checkbox-analytics-it Value: no
.linkedin.com/	1970-01-20 19:04:15	Name: li_sugr Value: fc3ce820-ccc6-4598-989a-3f40c5ae713d
.linkedin.com/	1970-01-21 01:40:15	Name: bcookie Value: "v=2&dae77a1c-0195-4a03-875a-d2683252993e"
.linkedin.com/	1970-01-20 16:56:06	Name: lidc Value: "b=VGST09:s=V:r=V:a=V:p=V:g=2741:u=1:x=1:i=1702479959:t=1702566359:v=2:sig=AQH7LmEzmv503Q5wOvMyaYIQsQp5NihC"
.linkedin.com/	1970-01-20 17:37:51	Name: UserMatchHistory Value: AQLvw8rjXP_gRwAAAYxjtpgu3zmfmX4XRk9ObZv8_-m-Eyb-NeE1Sp0LfbdJNCIkLOBP1U6bf1-ndw
.linkedin.com/	1970-01-20 17:37:51	Name: AnalyticsSyncHistory Value: AQKjXvjCAjlwYgAAAYxjtpguVxxCKbRa6N82c0TdJ6dDg49Q2Ab-qWCsKE68Fd4Bb1Abp4Xpo_UOKL1D2s66eg
.www.linkedin.com/	1970-01-21 01:40:15	Name: bscookie Value: "v=1&20231213150600cda07ff4-9bdd-4140-8836-a954c909faddAQHNYAEIe1YHpTl0DSYOKnlj_mrE_usZ"
.linkedin.com/	1970-01-20 21:13:51	Name: li_gc Value: MTswOzE3MDI0Nzk5NjA7MjswMjGZU1Z5Ux+2EmN9dePyMLrRuhjozm8fVA4blpcDsl9nUA==

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

c0.wp.com
cdn.jsdelivr.net
fonts.googleapis.com
fonts.gstatic.com
i0.wp.com
pixel.wp.com
px.ads.linkedin.com
px4.ads.linkedin.com
s0.wp.com
snap.licdn.com
stats.wp.com
www.google.com
www.gstatic.com
www.linkedin.com
yoroi.company
yoroi.company
13.107.42.14
192.0.76.3
192.0.77.2
192.0.77.32
192.0.77.37
2606:4700::6810:5514
2620:1ec:21::14
2a00:1450:4001:80f::2003
2a00:1450:4001:81c::2003
2a00:1450:4001:828::2004
2a00:1450:4001:831::200a
2a02:26f0:3100::1735:2a09
2a06:98c1:3121::3
02e2dd08ed3c4680e621ea71891aa5675ed8afe3ea8e99dc5d4b0caa4e2ef799
03776ba2741b34dfc2f6a356327e2dc25cbb07f9138b5a779c6b187a58be39e0
048e7b54fbc9022c80b0bf1144f55baaf814f91fe575515dbd4263634317013f
058518d45e49147be19e3e9847a1bb86c2fca0e546ecf62504aea2faaee0a72e
0be502b9446e16b338d36ccadac232f4a68ab74655f98fec415ccdbbccbf5729
0d349f88844345061cef86a46e23bf67ae8ef16f7ec2453f20abe90add14655b
0f4a3ba36482c233c6d7970cd42fb5b76ea054044dbebe424176db9f176616cb
141ce5d6297abe5ae2728af403513bb9d6c8367cc291d9e1436388f47fc979e7
1aa8845fd06e475aefe733d4e55b36a92fcd487975049c8172341827ac9cc03e
1b9efb22c938500971aac2b2130a475fa23684dd69e43103894968df83145b8a
1c594062728319da3ecaa98c4c0b930b07d5e64207eb6e4987d4fcbff9134768
1d52e1ac7d3bc25a8b0ffc257153f9dd50249f96fe9a4df5e0d771241a69062c
1dc6d2d43514d1d8956877d1f2ef347cd5abdb8ecf8e47aba59d87b8a6da49bb
1e41b9ba20319d67b5b640af59346a76cec477cee421bfc5e05b1238eb292246
204a3227a3631e685f978c6567314a00f03a3bedbbbc947122c97bcc4ac62d9d
216728e33a7de4be9b784eff527c6ccf1658319ea78fe66a7864c0b923200252
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
270524b0d27afd1d3b6622d1a176c678daed94564c143297e217a63e21ce9820
27dd9b075cc59cf5f3c0f6ee075f4bd113782d81ce30a4f16aac669ecfdc4fa2
2deb67a6ea5e9e0e254330515f7aa291a07618b72715a63971274378cd4d06c4
2e10d353ff038c2cad3492fc17801af3e6ef2669c9e9713bdb78b1dcb104c4fe
2e2f2336b5e6698b628afc75fa9a24c67b73d5872c1d4af99ca436064f636ee0
3457140e78788c55cd49cc718bd4e91975bc7b3de7d2754dc3607563e510dced
3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc
4460f1596174d06cca957fdaca2c71e1a377cf1d6f07ee4c75ffb3bf3fc97a03
49cf0f2de45929d5674df4377cfc2363324674ca4dfdef454bc1dfeebcec9ca5
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
52a86f59fd1312a60def6374184c8055b7fa03858e8494a7c35d25f619156b0f
547dda3c14b284819be511be1e410da94a5efc6ccc4a9afe1c75394f9333191a
5486d67c53956813c2ab1fdef773516ee85aff7adae4ae0186cf09e398c1e28f
57a50c99a31ef4e89e86664e96f6dfbdde163a2eb96e88b3b492c49aa4be2f37
5a8c1e7681318caa29e9f44e8a6e271f6a4067a2703e9916dfd4fe9099241db7
5ae64d93a741f65b963259f6f6985cf60f834b4966e67c65dc68a3de17674baf
5fd50e41f2ce65b53589fb6ca59a03d2fc269d65db66f8c0b29fc5bc8ba84d08
65158a29c17b7bd93fcb3409b97eda74a7c090d932a9ce494adb9f82d737894d
655ae452d922f501b62c7028fc35e238138de989387381cc1ed9cea9085864db
6912f7388531e949bd5406b5668cd6b55fea4cc7e2d123dbaed489054dd98438
698b89c0da3d319754d6a837b5e6d4e6a42dc402d9ffd7559b8c4cb29c644340
6c52384c7b0641dd1ead85d079c22d39bcc6dc5f2537afb1e6396bb619771a3f
6cf390024b9fb02ae1756d257499f568393acc60c76ae6b13ce986a46f396e34
6f3b3eda120231c8b7775699ee027905ac6a8f998e7dddefe9bdab0a0b32219f
73a1f126cf805ced3f24d65132d3163821ed2bb33a62e83e4a305687045dcce5
7859a62e04b0acb06516eb12454de6673883ecfaeaed6c254659bca7cd59c050
7bdc4fd1b52f88617553782da88299fc8551f6921d5a30c5a29b96cb8b4c3eae
7ee08c60d39f5712a56938fda3e2ab10fe3ef23ec98aeb3c9a29e54f6f31ffe1
814005c14007af177ca97da8fdc108fa76b6765c1e2ed546280c7645a0a63ccd
83d04fa061be70b12909406d9cdb1d5ba40596f512fc3c716ae04b645527648c
8b3492b6880d2eec2e9dc6294908f2ece269f8cea80fd07b17e9f87fba87c21d
927da8c0f53be094ec3b04c6b72d1aa149574522922628425b104ccc4dda2d0b
97470c6fac60d3431c7309907a10d67d0356b563c7bab67f7a44301d4164ac38
9b53ba79fa63e6281e11715289c6da0ab79aeb98f98b3901685efbd32e708791
9c1989ecd392a0c54fb799409154242706940a8e6d800542ba579dfda576bb9d
b7908a015a567ec2363011df2475368dbff34360e9da3fdff50604d6395fb646
bf4d20b28de8c7f77428b24325ec3afb39b6f7e277f6b61666f3a0a17cc3b42b
c1a9a3e223bad631dff12d33b5499eb145cb08d8621c20d9d73870e78d97afe4
c21e5a2b32c47bc5f9d9efc97bc0e29fd081946d1d3ebffc5621cfafb1d3960e
c505bec1b37e9fada559b9a916bf8efa0e7cdae0e8356b039b3210f7f6d17a49
c59f8ce89d8016bba0fd065c18aa463688563cf18eb79226df9cb62e8e096533
c63a636fec47c33c1f90b009d2f95830d3492083c04e429cda86914834714967
ca7752fb33cf3a98c0f29bc4eec563112025da4109a0dcc69dabf5f861751258
cb45a5a7cef4f74f99afa05c6d5c244ed8f36799f372504b042a3e7e6c3d54b7
cb6f2d32c49d1c2b25e9ffc9aaafa3f83075346c01bcd4ae6eb187392a4292cf
ccd31ffa708d025833f954b3e0560cedd58df9a0d2706b2ccee5f501c5b2467b
d3ad83af3a48c24913133f351cc69b135c950df64ec6f0fefd414bc79249c6ba
d51089ba164e46643145dc475cce83e53896a1e6541c68b20d841c1ab24e65b9
d947b55573f76b9876038798590599aef4ec471cd0b44a41438b02ae00fcee5b
da9ed5720b674f0d297fe621ac2d8d518c4e622bef1e9b0d4ae489dee9aa43f8
df0ec8330290d184b1084527076cb87d41b33ba706ff5ab579d761f0cb6a744b
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e3f281a93c5293be122ec933426887f46ae314ffada3e3da98ac76f5ee5992cd
f349f68dd834591897a2b648193d96446427a388772b17163e166c17bf4bb5f4
f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1
f3b0e2a3800f73c56a4dc78562fc32130a8eec6887982d10e6a5dcf6497969c6
f99ea61de5d3dbaf01e20bf1efd0b8b834bc2ca576c6e4f7b68ab25b62e73a6f
fab005de52ce54d75f373c5a020e7ddd194caea5b4bf6e87886196e5d4451adc
fbe820b6140ad28e86f34ffae507d807cf591a22697a05b71958f2014e96a9e4

yoroi.company Open in urlscan Pro 2a06:98c1:3121::3 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

79 Requests

97 %HTTPS

62 %IPv6

8 Domains

15 Subdomains

14 IPs

2 Countries

1065 kBTransfer

3190 kBSize

14 Cookies

7 Outgoing links

Page URL History

Redirected requests

79 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

yoroi.company Open in urlscan Pro
2a06:98c1:3121::3 Public Scan

Screenshot
Live screenshot

Full Image

79
Requests

97 %
HTTPS

62 %
IPv6

8
Domains

15
Subdomains

14
IPs

2
Countries

1065 kB
Transfer

3190 kB
Size

14
Cookies

79 HTTP transactions
2 data transactions