therecord.media Open in urlscan Pro
2606:4700::6812:721 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://therecord.media/hackers-using-follina-windows-zero-day-to-spread-qbot-malware/
Submission: On June 10 via manual (June 10th 2022, 1:54:59 am UTC) from IT — Scanned from IT

Summary HTTP 131 Redirects Links 23 Behaviour Indicators

Summary

This website contacted 21 IPs in 3 countries across 18 domains to perform 131 HTTP transactions. The main IP is 2606:4700::6812:721, located in United States and belongs to CLOUDFLARENET, US. The main domain is therecord.media. The Cisco Umbrella rank of the primary domain is 473049.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on July 18th 2021. Valid for: a year.

This is the only time therecord.media was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
28	2606:4700::68... 2606:4700::6812:721	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	2606:4700::68... 2606:4700::6811:190e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	2606:4700::68... 2606:4700::6810:5514	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	151.101.194.216 151.101.194.216	54113 (FASTLY) (FASTLY)
45	2606:2800:234... 2606:2800:234:59:254c:406:2366:268c	15133 (EDGECAST) (EDGECAST)
2	2a00:1450:400... 2a00:1450:4001:82a::2008	15169 (GOOGLE) (GOOGLE)
2	2606:4700::68... 2606:4700::6811:d4cc	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2600:9000:205... 2600:9000:2057:4400:c:7d55:b3c0:93a1	16509 (AMAZON-02) (AMAZON-02)
4	2a00:1450:400... 2a00:1450:4001:80b::200e	15169 (GOOGLE) (GOOGLE)
1	2606:4700::68... 2606:4700::6811:46b0	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700:440... 2606:4700:4400::6812:21ab	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6811:eacc	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2a04:fa87:fff... 2a04:fa87:fffe::c000:4902	2635 (AUTOMATTIC) (AUTOMATTIC)
9	104.244.42.72 104.244.42.72	13414 (TWITTER) (TWITTER)
9	96.16.137.162 96.16.137.162	16625 (AKAMAI-AS) (AKAMAI-AS)
2	18.195.235.189 18.195.235.189	16509 (AMAZON-02) (AMAZON-02)
1	37.252.172.123 37.252.172.123	29990 (ASN-APPNEX) (ASN-APPNEX)
1	2a02:26f0:170... 2a02:26f0:1700:1b1::1c91	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
7	2606:2800:134... 2606:2800:134:fa2:1627:1fe:edb:1665	15133 (EDGECAST) (EDGECAST)
3	2606:4700::68... 2606:4700::6813:9b53	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:2c40::c7... 2606:2c40::c73c:6702	209242 (CLOUDFLAR...) (CLOUDFLARESPECTRUM Cloudflare)
131	21

28 2606:4700::6812:721 (United States)

ASN13335 (CLOUDFLARENET, US)

therecord.media	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2606:4700::6811:190e (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2606:4700::6810:5514 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 151.101.194.216 (United States)

ASN54113 (FASTLY, US)

cms.recordedfuture.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

45 2606:2800:234:59:254c:406:2366:268c (United States)

ASN15133 (EDGECAST, US)

platform.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:82a::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6811:d4cc (United States)

ASN13335 (CLOUDFLARENET, US)

js.hs-scripts.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:9000:2057:4400:c:7d55:b3c0:93a1 (United States)

ASN16509 (AMAZON-02, US)

cdn.matomo.cloud	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:80b::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.youtube.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:46b0 (United States)

ASN13335 (CLOUDFLARENET, US)

js.hs-analytics.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:4400::6812:21ab (United States)

ASN13335 (CLOUDFLARENET, US)

js.hs-banner.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:eacc (United States)

ASN13335 (CLOUDFLARENET, US)

js.hsleadflows.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a04:fa87:fffe::c000:4902 (Ireland)

ASN2635 (AUTOMATTIC, US)

secure.gravatar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 104.244.42.72 (United States)

ASN13414 (TWITTER, US)

syndication.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 96.16.137.162 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a96-16-137-162.deploy.static.akamaitechnologies.com

j.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
c.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
b.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 18.195.235.189 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-195-235-189.eu-central-1.compute.amazonaws.com

recordedfuture.matomo.cloud	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 37.252.172.123 (Frankfurt am Main, Germany)

ASN29990 (ASN-APPNEX, US)
PTR: 868.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

secure.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:1700:1b1::1c91 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

ipv6.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2606:2800:134:fa2:1627:1fe:edb:1665 (United States)

ASN15133 (EDGECAST, US)

cdn.syndication.twimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pbs.twimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2606:4700::6813:9b53 (United States)

ASN13335 (CLOUDFLARENET, US)

track.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
forms.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:2c40::c73c:6702 (United States)

ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US)

go.recordedfuture.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
54	twitter.com platform.twitter.com — Cisco Umbrella Rank: 647 syndication.twitter.com — Cisco Umbrella Rank: 845	2 MB
28	therecord.media therecord.media — Cisco Umbrella Rank: 473049	427 KB
10	6sc.co j.6sc.co — Cisco Umbrella Rank: 6827 c.6sc.co — Cisco Umbrella Rank: 10191 ipv6.6sc.co — Cisco Umbrella Rank: 7050 b.6sc.co — Cisco Umbrella Rank: 4588	16 KB
7	twimg.com cdn.syndication.twimg.com — Cisco Umbrella Rank: 1387 pbs.twimg.com — Cisco Umbrella Rank: 696	365 KB
4	matomo.cloud cdn.matomo.cloud — Cisco Umbrella Rank: 22643 recordedfuture.matomo.cloud	66 KB
4	recordedfuture.com cms.recordedfuture.com go.recordedfuture.com — Cisco Umbrella Rank: 389122	741 KB
4	cloudflare.com cdnjs.cloudflare.com — Cisco Umbrella Rank: 215	20 KB
3	hubspot.com track.hubspot.com — Cisco Umbrella Rank: 2037 forms.hubspot.com — Cisco Umbrella Rank: 2913	4 KB
3	jsdelivr.net cdn.jsdelivr.net — Cisco Umbrella Rank: 427	30 KB
2	gravatar.com secure.gravatar.com — Cisco Umbrella Rank: 1519	40 KB
2	youtube.com www.youtube.com — Cisco Umbrella Rank: 103	53 KB
2	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 43	20 KB
2	hs-scripts.com js.hs-scripts.com — Cisco Umbrella Rank: 2141	1 KB
2	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 75	75 KB
1	adnxs.com secure.adnxs.com — Cisco Umbrella Rank: 393	705 B
1	hsleadflows.net js.hsleadflows.net — Cisco Umbrella Rank: 3875	88 KB
1	hs-banner.com js.hs-banner.com — Cisco Umbrella Rank: 1953	16 KB
1	hs-analytics.net js.hs-analytics.net — Cisco Umbrella Rank: 1949	20 KB
131	18

	Domain	Requested by
45	platform.twitter.com	therecord.media platform.twitter.com
28	therecord.media	therecord.media
9	syndication.twitter.com	platform.twitter.com
7	b.6sc.co
4	cdn.syndication.twimg.com	platform.twitter.com
4	cdnjs.cloudflare.com	therecord.media cdn.matomo.cloud
3	pbs.twimg.com
3	cms.recordedfuture.com	therecord.media
3	cdn.jsdelivr.net	therecord.media cdn.matomo.cloud
2	track.hubspot.com
2	recordedfuture.matomo.cloud	cdn.matomo.cloud
2	secure.gravatar.com
2	www.youtube.com	therecord.media www.youtube.com
2	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com
2	cdn.matomo.cloud	therecord.media
2	js.hs-scripts.com	therecord.media www.googletagmanager.com
2	www.googletagmanager.com	therecord.media
1	go.recordedfuture.com
1	forms.hubspot.com	js.hsleadflows.net
1	ipv6.6sc.co	j.6sc.co
1	c.6sc.co	j.6sc.co
1	secure.adnxs.com	j.6sc.co
1	j.6sc.co	therecord.media
1	js.hsleadflows.net	js.hs-scripts.com
1	js.hs-banner.com	js.hs-scripts.com
1	js.hs-analytics.net	js.hs-scripts.com
131	26

This site contains links to these domains. Also see Links.

Domain
www.recordedfuture.com
twitter.com
www.linkedin.com
www.facebook.com
www.reddit.com
news.ycombinator.com
msrc.microsoft.com
doublepulsar.com
www.proofpoint.com
msrc-blog.microsoft.com
isc.sans.edu
www.scythe.io
blog.malwarebytes.com
www.huntress.com
www.youtube.com
www.instagram.com

Subject Issuer	Validity	Valid
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2021-07-18` - `2022-07-17`	a year	crt.sh
cms.recordedfuture.com R3	`2022-05-24` - `2022-08-22`	3 months	crt.sh
*.twimg.com DigiCert TLS RSA SHA256 2020 CA1	`2021-10-20` - `2022-10-19`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2022-05-09` - `2022-08-01`	3 months	crt.sh
cdn.matomo.cloud Amazon	`2021-12-28` - `2023-01-25`	a year	crt.sh
*.google.com GTS CA 1C3	`2022-05-25` - `2022-08-17`	3 months	crt.sh
*.gravatar.com Sectigo RSA Domain Validation Secure Server CA	`2020-08-14` - `2022-11-16`	2 years	crt.sh
syndication.twitter.com DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2022-03-07` - `2023-03-06`	a year	crt.sh
*.6sc.co DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2022-03-08` - `2023-03-11`	a year	crt.sh
*.matomo.cloud Amazon	`2021-08-20` - `2022-09-18`	a year	crt.sh
*.adnxs.com GeoTrust ECC CA 2018	`2022-02-11` - `2023-03-14`	a year	crt.sh
hubspot.com Cloudflare Inc ECC CA-3	`2022-03-08` - `2023-03-07`	a year	crt.sh
go.recordedfuture.com Cloudflare Inc ECC CA-3	`2021-07-16` - `2022-07-15`	a year	crt.sh

This page contains 6 frames:

Primary Page: https://therecord.media/hackers-using-follina-windows-zero-day-to-spread-qbot-malware/
Frame ID: B5CE19ACCC6771928468A8A0A2DD2753
Requests: 76 HTTP requests in this frame

Frame: https://platform.twitter.com/widgets/widget_iframe.d7fc2fc075c61f6fa34d79a0cbbf1e34.html?origin=https%3A%2F%2Ftherecord.media
Frame ID: 7C28438943FBC53269B2565585AB9E5D
Requests: 2 HTTP requests in this frame

Frame: https://platform.twitter.com/embed/Tweet.html?creatorScreenName=jgreigj&dnt=true&embedId=twitter-widget-0&features=eyJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3JlZnNyY19zZXNzaW9uIjp7ImJ1Y2tldCI6Im9mZiIsInZlcnNpb24iOm51bGx9LCJ0Zndfc2Vuc2l0aXZlX21lZGlhX2ludGVyc3RpdGlhbF8xMzk2MyI6eyJidWNrZXQiOiJpbnRlcnN0aXRpYWwiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3R3ZWV0X3Jlc3VsdF9taWdyYXRpb25fMTM5NzkiOnsiYnVja2V0IjoidHdlZXRfcmVzdWx0IiwidmVyc2lvbiI6bnVsbH19&frame=false&hideCard=false&hideThread=false&id=1534227619222196224&lang=en&origin=https%3A%2F%2Ftherecord.media%2Fhackers-using-follina-windows-zero-day-to-spread-qbot-malware%2F&sessionId=8052476664b15c65e1b059b9c5151d88882dc921&siteScreenName=therecord_media&theme=light&widgetsVersion=b45a03c79d4c1%3A1654150928467&width=500px
Frame ID: 32097B2A5BA44897437F41409E57ED33
Requests: 14 HTTP requests in this frame

Frame: https://platform.twitter.com/embed/Tweet.html?creatorScreenName=jgreigj&dnt=true&embedId=twitter-widget-1&features=eyJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3JlZnNyY19zZXNzaW9uIjp7ImJ1Y2tldCI6Im9mZiIsInZlcnNpb24iOm51bGx9LCJ0Zndfc2Vuc2l0aXZlX21lZGlhX2ludGVyc3RpdGlhbF8xMzk2MyI6eyJidWNrZXQiOiJpbnRlcnN0aXRpYWwiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3R3ZWV0X3Jlc3VsdF9taWdyYXRpb25fMTM5NzkiOnsiYnVja2V0IjoidHdlZXRfcmVzdWx0IiwidmVyc2lvbiI6bnVsbH19&frame=false&hideCard=false&hideThread=false&id=1534213925750841346&lang=en&origin=https%3A%2F%2Ftherecord.media%2Fhackers-using-follina-windows-zero-day-to-spread-qbot-malware%2F&sessionId=8052476664b15c65e1b059b9c5151d88882dc921&siteScreenName=therecord_media&theme=light&widgetsVersion=b45a03c79d4c1%3A1654150928467&width=500px
Frame ID: E29408467FAC444118B7CF7E2AB3EF19
Requests: 15 HTTP requests in this frame

Frame: https://platform.twitter.com/embed/Tweet.html?creatorScreenName=jgreigj&dnt=true&embedId=twitter-widget-0&features=eyJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3JlZnNyY19zZXNzaW9uIjp7ImJ1Y2tldCI6Im9mZiIsInZlcnNpb24iOm51bGx9LCJ0Zndfc2Vuc2l0aXZlX21lZGlhX2ludGVyc3RpdGlhbF8xMzk2MyI6eyJidWNrZXQiOiJpbnRlcnN0aXRpYWwiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3R3ZWV0X3Jlc3VsdF9taWdyYXRpb25fMTM5NzkiOnsiYnVja2V0IjoidHdlZXRfcmVzdWx0IiwidmVyc2lvbiI6bnVsbH19&frame=false&hideCard=false&hideThread=false&id=1534227619222196224&lang=en&origin=https%3A%2F%2Ftherecord.media%2Fhackers-using-follina-windows-zero-day-to-spread-qbot-malware%2F&sessionId=8052476664b15c65e1b059b9c5151d88882dc921&siteScreenName=therecord_media&theme=light&widgetsVersion=b45a03c79d4c1%3A1654150928467&width=500px
Frame ID: 8E4AB130AA6799090CF80F6070C788F5
Requests: 12 HTTP requests in this frame

Frame: https://platform.twitter.com/embed/Tweet.html?creatorScreenName=jgreigj&dnt=true&embedId=twitter-widget-1&features=eyJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3JlZnNyY19zZXNzaW9uIjp7ImJ1Y2tldCI6Im9mZiIsInZlcnNpb24iOm51bGx9LCJ0Zndfc2Vuc2l0aXZlX21lZGlhX2ludGVyc3RpdGlhbF8xMzk2MyI6eyJidWNrZXQiOiJpbnRlcnN0aXRpYWwiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3R3ZWV0X3Jlc3VsdF9taWdyYXRpb25fMTM5NzkiOnsiYnVja2V0IjoidHdlZXRfcmVzdWx0IiwidmVyc2lvbiI6bnVsbH19&frame=false&hideCard=false&hideThread=false&id=1534213925750841346&lang=en&origin=https%3A%2F%2Ftherecord.media%2Fhackers-using-follina-windows-zero-day-to-spread-qbot-malware%2F&sessionId=8052476664b15c65e1b059b9c5151d88882dc921&siteScreenName=therecord_media&theme=light&widgetsVersion=b45a03c79d4c1%3A1654150928467&width=500px
Frame ID: 68C2FCD4E3EC34CF4BB688230A46F623
Requests: 12 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Hackers using Follina Windows zero-day to spread Qbot malware - The Record by Recorded Future

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

<link rel=["']stylesheet["'] [^>]+/wp-(?:content|includes)/
/wp-(?:content|includes)/

AMP (JavaScript frameworks) Expand

Overall confidence: 100%
Detected patterns

<link rel="amphtml"

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.(?:net|com)

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

HubSpot Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

js\.hs-analytics\.net/analytics

Modernizr (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

([\d.]+)?/modernizr(?:\.([\d.]+))?.*\.js

Osano (Cookie compliance) Expand

Overall confidence: 100%
Detected patterns

cookieconsent\.min\.js

Twitter (Widgets) Expand

Overall confidence: 100%
Detected patterns

//platform\.twitter\.com/widgets\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jQuery Migrate (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?

jsDelivr (CDN) Expand

Overall confidence: 100%
Detected patterns

<link [^>]*?href="?[a-zA-Z]*?:?//cdn\.jsdelivr\.net/
//cdn\.jsdelivr\.net/

Page Statistics

131
Requests

100 %
HTTPS

76 %
IPv6

18
Domains

26
Subdomains

21
IPs

3
Countries

3549 kB
Transfer

8997 kB
Size

22
Cookies

23 Outgoing links

These are links going to different origins than the main page.

URL: https://www.recordedfuture.com/privacy-policy/?__hstc=156209188.fc2d1c43bfd46df00838aa51fb26a347.1654826094419.1654826094419.1654826094419.1&__hssc=156209188.1.1654826094419&__hsfp=2389647166
Title: Cookie Policy

Search URL Search Domain Scan URL

URL: https://twitter.com/intent/tweet?url=https://therecord.media/hackers-using-follina-windows-zero-day-to-spread-qbot-malware/&text=Hackers%20using%20Follina%20Windows%20zero-day%20to%20spread%20Qbot%20malware

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/shareArticle?mini=true&url=https://therecord.media/hackers-using-follina-windows-zero-day-to-spread-qbot-malware/&title=Hackers%20using%20Follina%20Windows%20zero-day%20to%20spread%20Qbot%20malware

Search URL Search Domain Scan URL

URL: https://www.facebook.com/sharer/sharer.php?u=https://therecord.media/hackers-using-follina-windows-zero-day-to-spread-qbot-malware/

Search URL Search Domain Scan URL

URL: https://www.reddit.com/submit?url=https://therecord.media/hackers-using-follina-windows-zero-day-to-spread-qbot-malware/&title=Hackers%20using%20Follina%20Windows%20zero-day%20to%20spread%20Qbot%20malware

Search URL Search Domain Scan URL

URL: https://news.ycombinator.com/submitlink?u=https://therecord.media/hackers-using-follina-windows-zero-day-to-spread-qbot-malware/&t=Hackers%20using%20Follina%20Windows%20zero-day%20to%20spread%20Qbot%20malware

Search URL Search Domain Scan URL

URL: https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2022-30190
Title: CVE-2022-30190

Search URL Search Domain Scan URL

URL: https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e
Title: Follina

Search URL Search Domain Scan URL

URL: https://twitter.com/threatinsight/status/1531688214993555457
Title: Proofpoint

Search URL Search Domain Scan URL

URL: https://www.proofpoint.com/us/blog/threat-insight/first-step-initial-access-leads-ransomware
Title: been tracking since 2018

Search URL Search Domain Scan URL

URL: https://msrc-blog.microsoft.com/2022/05/30/guidance-for-cve-2022-30190-microsoft-support-diagnostic-tool-vulnerability/
Title: documents they published

Search URL Search Domain Scan URL

URL: https://isc.sans.edu/diary/28694
Title: Several security researchers

Search URL Search Domain Scan URL

URL: https://www.scythe.io/library/breaking-follina-msdt-vulnerability
Title: tested the issue

Search URL Search Domain Scan URL

URL: https://twitter.com/buffaloverflow/status/1530866518279565312
Title: found

Search URL Search Domain Scan URL

URL: https://blog.malwarebytes.com/exploits-and-vulnerabilities/2022/05/microsoft-office-zero-day-follina-its-not-a-bug-its-a-feature-its-a-bug/
Title: published suggestions

Search URL Search Domain Scan URL

URL: https://www.huntress.com/blog/microsoft-office-remote-code-execution-follina-msdt-bug
Title: for security teams

Search URL Search Domain Scan URL

URL: https://www.recordedfuture.com/vulnerability-spotlight-dirty-pipe?__hstc=156209188.fc2d1c43bfd46df00838aa51fb26a347.1654826094419.1654826094419.1654826094419.1&__hssc=156209188.1.1654826094419&__hsfp=2389647166
Title: Insikt Group: Dirty Pipe

Search URL Search Domain Scan URL

URL: https://www.recordedfuture.com/business-fraud-bank-fraud?__hstc=156209188.fc2d1c43bfd46df00838aa51fb26a347.1654826094419.1654826094419.1654826094419.1&__hssc=156209188.1.1654826094419&__hsfp=2389647166
Title: Insikt Group: Bank Fraud

Search URL Search Domain Scan URL

URL: https://www.recordedfuture.com/overview-9-district-data-wipers-ukraine-war?__hstc=156209188.fc2d1c43bfd46df00838aa51fb26a347.1654826094419.1654826094419.1654826094419.1&__hssc=156209188.1.1654826094419&__hsfp=2389647166
Title: Insikt Group: Data Wipers

Search URL Search Domain Scan URL

URL: https://www.youtube.com/channel/UCuBJQyzTWDP3C-BQTPG4DaQ

Search URL Search Domain Scan URL

URL: https://twitter.com/TheRecord_Media

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/the-record-by-recorded-future

Search URL Search Domain Scan URL

URL: https://www.instagram.com/therecord_media/

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

131 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
therecord.media/hackers-using-follina-windows-zero-day-to-spread-qbot-malware/ 70 KB
16 KB 944ms
881ms Document
text/html 2606:4700::6812:721
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://therecord.media/hackers-using-follina-windows-zero-day-to-spread-qbot-malware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:721 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

80036d26afc2e4804105573de106ca7cdccf739f5ec9e71728da83404fd97105

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
accept-language: it-IT,it;q=0.9

Response headers

age: 0
cache-control: public, max-age=600
cf-cache-status: DYNAMIC
cf-ray: 718e7b4309770f76-MXP
content-encoding: br
content-type: text/html; charset=UTF-8
date: Fri, 10 Jun 2022 01:54:52 GMT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
link: <https://therecord.media/?p=14414>; rel=shortlink
server: cloudflare
strict-transport-security: max-age=31536000; includeSubDomains
traceparent: 00-8d87e8b00a3a4de8837d184821b84350-d8787372d7d84c38-00
vary: Accept-Encoding, Cookie, Cookie
via: 1.1 varnish, 1.1 varnish
x-cache: MISS, MISS
x-cache-hits: 0, 0
x-cloud-trace-context: 8d87e8b00a3a4de8837d184821b84350/15598344246482455608;o=0
x-pantheon-styx-hostname: styx-fe2-a-55c99944f8-hnr97
x-pingback: https://therecord.media/xmlrpc.php
x-served-by: cache-mdw17351-MDW, cache-iad-kiad7000169-IAD
x-styx-req-id: 518c8707-e860-11ec-936b-4e5bb135fd6e
x-timer: S1654826092.392164,VS0,VE407

GET
H2 200 style.min.css
therecord.media/wp-includes/css/dist/block-library/ 77 KB
11 KB 35ms
32ms Stylesheet
text/css 2606:4700::6812:721
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://therecord.media/wp-includes/css/dist/block-library/style.min.css?ver=5.9

Requested by

Host: therecord.media
URL: https://therecord.media/hackers-using-follina-windows-zero-day-to-spread-qbot-malware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:721 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7b6fef0a63424245b31b293b1a3bfd074c9da482e28fb9e920e1cf306e54e8a2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://therecord.media/hackers-using-follina-windows-zero-day-to-spread-qbot-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Fri, 10 Jun 2022 01:54:52 GMT
via: 1.1 varnish, 1.1 varnish
vary: Accept-Encoding
cf-cache-status: HIT
age: 64894
x-pantheon-styx-hostname: styx-fe2-a-8dffc8694-cgfdq
x-cache: MISS, HIT
x-cloud-trace-context: 22ded8a1566749b4ae208a98cf5989a1/9690390622249084644;o=0
content-encoding: br
x-served-by: cache-mdw17383-MDW, cache-iad-kcgs7200151-IAD
last-modified: Sun, 15 May 2022 14:53:57 GMT
server: cloudflare
traceparent: 00-22ded8a1566749b4ae208a98cf5989a1-867b2eedd5eee6e4-00
x-timer: S1654761199.721910,VS0,VE1
etag: W/"62811405-1357b"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: text/css
x-styx-req-id: 08f151d5-d5de-11ec-8d78-62fd88d1513f
expires: Sun, 11 Jun 2023 01:54:52 GMT
cache-control: public, max-age=31622400
cf-ray: 718e7b48ab8d0f76-MXP
x-cache-hits: 0, 1

GET
H2 200 rf-rss-widget.css
therecord.media/wp-content/plugins/rf-rss-feed/public/css/ 473 B
617 B 32ms
28ms Stylesheet
text/css 2606:4700::6812:721
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://therecord.media/wp-content/plugins/rf-rss-feed/public/css/rf-rss-widget.css?ver=5.9

Requested by

Host: therecord.media
URL: https://therecord.media/hackers-using-follina-windows-zero-day-to-spread-qbot-malware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:721 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

77e8232dee29ca904e5726f29b02f784c6155de5e388e61570a74aedf61b69de

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://therecord.media/hackers-using-follina-windows-zero-day-to-spread-qbot-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Fri, 10 Jun 2022 01:54:52 GMT
via: 1.1 varnish, 1.1 varnish
vary: Accept-Encoding
cf-cache-status: HIT
age: 64894
cf-polished: origSize=944
x-cache: MISS, HIT
x-cloud-trace-context: 2badc7f18bab4e0a8c11756f77d2c721/2401941661330626942;o=0
x-cache-hits: 0, 1
cf-bgj: minify
content-encoding: br
x-served-by: cache-mdw17378-MDW, cache-iad-kcgs7200076-IAD
last-modified: Mon, 16 May 2022 02:06:26 GMT
server: cloudflare
traceparent: 00-2badc7f18bab4e0a8c11756f77d2c721-2155693706d2d97e-00
x-timer: S1654761199.801588,VS0,VE1
etag: W/"6281b1a2-3b0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: text/css
x-styx-req-id: acce92b1-d535-11ec-823b-02233f09a3f7
expires: Sun, 11 Jun 2023 01:54:52 GMT
cache-control: public, max-age=31622400
cf-ray: 718e7b48ab8e0f76-MXP
x-pantheon-styx-hostname: styx-fe2-a-8dffc8694-h5mtw

GET
H2 200 jquery.mCustomScrollbar.min.css
cdnjs.cloudflare.com/ajax/libs/malihu-custom-scrollbar-plugin/3.1.5/ 42 KB
4 KB 81ms
30ms Stylesheet
text/css 2606:4700::6811:190e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/malihu-custom-scrollbar-plugin/3.1.5/jquery.mCustomScrollbar.min.css?ver=2022-01-20_3

Requested by

Host: therecord.media
URL: https://therecord.media/hackers-using-follina-windows-zero-day-to-spread-qbot-malware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

247184981eb6f698a94e431a83d68c6b0df623cce57b6e29dc5a6c11e23aa195

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://therecord.media/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Fri, 10 Jun 2022 01:54:52 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 705531
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 3359
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:12:04 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03ed4-a757"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=MQaFZmdHZBh0n0kEBuJ7%2Fx93%2BDty9sJndQIkCHP94tKF6REIn4QTM%2B%2B3xSnBqQUK4IGa9kPZLZclLuPtpMcNK54Pjea0bT1Ph%2Bu6o%2Fqym1Ac3sGDG2lEJjQhhtln2u9iiYFMpG21%2FMOSdlW%2FieD134Hr"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 718e7b48f8ca5a2b-MXP
expires: Wed, 31 May 2023 01:54:52 GMT

GET
H2 200 jquery.fancybox.min.css
cdn.jsdelivr.net/gh/fancyapps/fancybox@3.5.7/dist/ 12 KB
4 KB 86ms
35ms Stylesheet
text/css 2606:4700::6810:5514
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/gh/fancyapps/fancybox@3.5.7/dist/jquery.fancybox.min.css?ver=2022-01-20_3

Requested by

Host: therecord.media
URL: https://therecord.media/hackers-using-follina-windows-zero-day-to-spread-qbot-malware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:5514 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5736e3eec0c34bfc288854b7b8d2a8f1e22e9e2e7dae3c8d1ad5dfb2d4734ad0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://therecord.media/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Fri, 10 Jun 2022 01:54:52 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 6971593
x-jsd-version: 3.5.7
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains; preload
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-served-by: cache-fra19177-FRA, cache-mxp6953-MXP
timing-allow-origin: *
x-jsd-version-type: version
server: cloudflare
etag: W/"31fb-G+m3m+AqHPxdlsSl4P649HK6vZU"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=i8qNPxDuQN8Zm3v91P5u08cxWCQMuznnv0Ssfz6%2FNfm6lI%2Fzk3n6LSLRmzXDLUKC0oZ5M5hFmdKuF2%2BMr9HTeMagj6UWZzKEIHSKKSvnjxnL5ptMtiFwcYXY4MrvtVWwnel7b%2FIDCZN3c2bUgPY%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
cf-ray: 718e7b48fbee59d1-MXP

GET
H2 200 style-v5.css
therecord.media/wp-content/themes/therecordmedia/assets/css/ 346 KB
48 KB 41ms
37ms Stylesheet
text/css 2606:4700::6812:721
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://therecord.media/wp-content/themes/therecordmedia/assets/css/style-v5.css?ver=2022-01-20_3

Requested by

Host: therecord.media
URL: https://therecord.media/hackers-using-follina-windows-zero-day-to-spread-qbot-malware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:721 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ec64e8bf74d64b707cd6de6fb37c0953911a1b054b9a1736086ece17a200f2b3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://therecord.media/hackers-using-follina-windows-zero-day-to-spread-qbot-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Fri, 10 Jun 2022 01:54:52 GMT
via: 1.1 varnish, 1.1 varnish
vary: Accept-Encoding
cf-cache-status: HIT
age: 64894
cf-polished: origSize=460519
x-cache: MISS, HIT
x-cloud-trace-context: 14ae0d09ec154b1b94c0719b2e27bad6/7791678703608324840;o=0
x-cache-hits: 0, 1
cf-bgj: minify
content-encoding: br
x-served-by: cache-mdw17365-MDW, cache-iad-kcgs7200148-IAD
last-modified: Sun, 15 May 2022 14:53:57 GMT
server: cloudflare
traceparent: 00-14ae0d09ec154b1b94c0719b2e27bad6-6c219a7fb48ce2e8-00
x-timer: S1654761199.800765,VS0,VE19
etag: W/"62811405-706e7"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: text/css
x-styx-req-id: 08f16e14-d5de-11ec-8d78-62fd88d1513f
expires: Sun, 11 Jun 2023 01:54:52 GMT
cache-control: public, max-age=31622400
cf-ray: 718e7b48ab910f76-MXP
x-pantheon-styx-hostname: styx-fe2-a-8dffc8694-cgfdq

GET
H2 200 custom-v8.css
therecord.media/wp-content/themes/therecordmedia/assets/css/ 6 KB
2 KB 34ms
31ms Stylesheet
text/css 2606:4700::6812:721
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://therecord.media/wp-content/themes/therecordmedia/assets/css/custom-v8.css?ver=2022-01-20_3

Requested by

Host: therecord.media
URL: https://therecord.media/hackers-using-follina-windows-zero-day-to-spread-qbot-malware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:721 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a01127152b090004aa159e0d56664e2268a1de5334ba6d9d6515388a0f53a3b9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://therecord.media/hackers-using-follina-windows-zero-day-to-spread-qbot-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Fri, 10 Jun 2022 01:54:52 GMT
via: 1.1 varnish, 1.1 varnish
vary: Accept-Encoding
cf-cache-status: HIT
age: 64894
cf-polished: origSize=7291
x-cache: MISS, HIT
x-cloud-trace-context: aa3f4fafc610470c98d532a4cfe39f86/12682453660530403472;o=0
x-cache-hits: 0, 1
cf-bgj: minify
content-encoding: br
x-served-by: cache-mdw17348-MDW, cache-iad-kjyo7100062-IAD
last-modified: Tue, 17 May 2022 08:22:29 GMT
server: cloudflare
traceparent: 00-aa3f4fafc610470c98d532a4cfe39f86-b0012068e4446890-00
x-timer: S1654761199.866727,VS0,VE2
etag: W/"62835b45-1c7b"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: text/css
x-styx-req-id: f9c46596-d5d0-11ec-a3f4-b23862e2270a
expires: Sun, 11 Jun 2023 01:54:52 GMT
cache-control: public, max-age=31622400
cf-ray: 718e7b48ab920f76-MXP
x-pantheon-styx-hostname: styx-fe2-b-5b85c46fc7-cjkxj

GET
H2 200 ytprefs.min.css
therecord.media/wp-content/plugins/youtube-embed-plus/styles/ 8 KB
2 KB 36ms
34ms Stylesheet
text/css 2606:4700::6812:721
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://therecord.media/wp-content/plugins/youtube-embed-plus/styles/ytprefs.min.css?ver=14.0.1.4

Requested by

Host: therecord.media
URL: https://therecord.media/hackers-using-follina-windows-zero-day-to-spread-qbot-malware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:721 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

fe6fb394ee0ca825d246e96f55680f2c732a677e8720d4d02bf2bc2ae256c58c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://therecord.media/hackers-using-follina-windows-zero-day-to-spread-qbot-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Fri, 10 Jun 2022 01:54:52 GMT
via: 1.1 varnish, 1.1 varnish
vary: Accept-Encoding
cf-cache-status: HIT
age: 64894
x-pantheon-styx-hostname: styx-fe2-b-5d8c4d9d59-lh42g
x-cache: MISS, HIT
x-cloud-trace-context: 09abf1cbaf1343639abe7ff96e4e795e/15657668102045924531;o=0
content-encoding: br
x-served-by: cache-mdw17371-MDW, cache-iad-kiad7000052-IAD
last-modified: Mon, 06 Jun 2022 11:37:23 GMT
server: cloudflare
traceparent: 00-09abf1cbaf1343639abe7ff96e4e795e-d94b362e51697cb3-00
x-timer: S1654761199.762744,VS0,VE3
etag: W/"629de6f3-2046"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: text/css
x-styx-req-id: 3b205ed4-e5b3-11ec-aa4c-123f3b800958
expires: Sun, 11 Jun 2023 01:54:52 GMT
cache-control: public, max-age=31622400
cf-ray: 718e7b48ab930f76-MXP
x-cache-hits: 0, 1

GET
H2 200 cookieconsent.min.css
therecord.media/wp-content/plugins/complianz-gdpr-premium/assets/css/ 20 KB
4 KB 34ms
32ms Stylesheet
text/css 2606:4700::6812:721
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://therecord.media/wp-content/plugins/complianz-gdpr-premium/assets/css/cookieconsent.min.css?ver=5.2.5.1

Requested by

Host: therecord.media
URL: https://therecord.media/hackers-using-follina-windows-zero-day-to-spread-qbot-malware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:721 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c21f3f80c9adfdf9070c994d881f2069818a2d409b62834c805a7f17f08c91ef

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://therecord.media/hackers-using-follina-windows-zero-day-to-spread-qbot-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Fri, 10 Jun 2022 01:54:52 GMT
via: 1.1 varnish, 1.1 varnish
vary: Accept-Encoding
cf-cache-status: HIT
age: 64894
x-pantheon-styx-hostname: styx-fe2-b-7d66648565-qk9wk
x-cache: HIT, HIT
x-cloud-trace-context: 329f4d4cea304e9db99694f90c5d96af/209328192743834999;o=0
content-encoding: br
x-served-by: cache-mdw17370-MDW, cache-iad-kjyo7100116-IAD
last-modified: Mon, 30 May 2022 08:22:19 GMT
server: cloudflare
traceparent: 00-329f4d4cea304e9db99694f90c5d96af-02e7aee1d9f88577-00
x-timer: S1654761199.850947,VS0,VE1
etag: W/"62947ebb-519d"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: text/css
x-styx-req-id: 409b07a9-e169-11ec-853a-ba4f8aa48311
expires: Sun, 11 Jun 2023 01:54:52 GMT
cache-control: public, max-age=31622400
cf-ray: 718e7b48ab940f76-MXP
x-cache-hits: 1, 1

GET
H2 200 PrimaryLogo-RGB-Carrot.svg
therecord.media/wp-content/uploads/2021/06/ 5 KB
2 KB 32ms
32ms Image
image/svg+xml 2606:4700::6812:721
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://therecord.media/wp-content/uploads/2021/06/PrimaryLogo-RGB-Carrot.svg

Requested by

Host: therecord.media
URL: https://therecord.media/hackers-using-follina-windows-zero-day-to-spread-qbot-malware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:721 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6429c09d26d4abed1c51691f17eb89c9c1fedf440964890e2a0fe9801e93e653

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://therecord.media/hackers-using-follina-windows-zero-day-to-spread-qbot-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Fri, 10 Jun 2022 01:54:52 GMT
via: 1.1 varnish, 1.1 varnish
cf-cache-status: HIT
age: 1074384
x-pantheon-styx-hostname: styx-fe2-a-8dffc8694-rvctd
x-cache: MISS, HIT
x-cloud-trace-context: 0724553d20d14569b9c4aa74dd1e5800/17432653239179559981;o=0
strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: br
x-served-by: cache-mdw17377-MDW, cache-iad-kiad7000132-IAD
last-modified: Mon, 25 Oct 2021 16:39:37 GMT
server: cloudflare
traceparent: 00-0724553d20d14569b9c4aa74dd1e5800-f1ed39c245dc442d-00
x-timer: S1653751709.625416,VS0,VE24
etag: W/"6176ddc9-1421"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
expires: Sun, 11 Jun 2023 01:54:52 GMT
cache-control: public, max-age=31622400
cf-ray: 718e7b48ebaa0f76-MXP
x-styx-req-id: 08f25e83-d5de-11ec-af7a-feafbb5d6829
x-cache-hits: 0, 1

GET
H2 200 Microsoft-e1624670867152.jpg
therecord.media/wp-content/uploads/2021/05/ 70 KB
71 KB 33ms
33ms Image
image/jpeg 2606:4700::6812:721
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://therecord.media/wp-content/uploads/2021/05/Microsoft-e1624670867152.jpg

Requested by

Host: therecord.media
URL: https://therecord.media/hackers-using-follina-windows-zero-day-to-spread-qbot-malware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:721 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f9d488df78ccf25073da6dacead57f6ea162df7d0633409529e49d1c953f9808

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://therecord.media/hackers-using-follina-windows-zero-day-to-spread-qbot-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Fri, 10 Jun 2022 01:54:52 GMT
via: 1.1 varnish, 1.1 varnish
cf-cache-status: HIT
age: 31857
cf-polished: origSize=75277, status=webp_bigger
x-cache: MISS, HIT
x-cloud-trace-context: de75b013f3bc4ae083b2220567553d48/17694361228752410440;o=0
x-cache-hits: 0, 1
cf-bgj: imgq:100,h2pri
content-length: 71931
x-served-by: cache-mdw17354-MDW, cache-iad-kjyo7100119-IAD
last-modified: Mon, 25 Oct 2021 16:35:59 GMT
server: cloudflare
traceparent: 00-de75b013f3bc4ae083b2220567553d48-f58effc9ef3b5748-00
x-timer: S1654794236.535266,VS0,VE3
etag: "6176dcef-1260d"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/jpeg
x-styx-req-id: f017be29-dc3c-11ec-b11c-126e0dd15a40
expires: Sun, 11 Jun 2023 01:54:52 GMT
cache-control: public, max-age=31622400
accept-ranges: bytes
cf-ray: 718e7b48fbab0f76-MXP
x-pantheon-styx-hostname: styx-fe2-b-d84bbb664-c5vvj

GET
H2 200 icomoon.ttf
therecord.media/wp-content/themes/therecordmedia/assets/fonts/custom/ 4 KB
4 KB 33ms
32ms Font
application/x-font-ttf 2606:4700::6812:721
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://therecord.media/wp-content/themes/therecordmedia/assets/fonts/custom/icomoon.ttf?fiuh6y

Requested by

Host: therecord.media
URL: https://therecord.media/wp-content/themes/therecordmedia/assets/css/style-v5.css?ver=2022-01-20_3

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:721 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4a6db13132ef5e4dc98723529dedf677f84b4993b7db70339cb1de93a910ffce

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://therecord.media/wp-content/themes/therecordmedia/assets/css/style-v5.css?ver=2022-01-20_3
Origin: https://therecord.media
accept-language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Fri, 10 Jun 2022 01:54:53 GMT
via: 1.1 varnish, 1.1 varnish
cf-cache-status: HIT
age: 56033
x-pantheon-styx-hostname: styx-fe2-a-69877596b-vb4d8
x-cache: MISS, HIT
x-cloud-trace-context: 381381b11dcf4f51b42854299fed7359/18244824652295449113;o=0
strict-transport-security: max-age=31536000; includeSubDomains
x-served-by: cache-mdw17352-MDW, cache-iad-kiad7000098-IAD
last-modified: Mon, 30 May 2022 08:22:20 GMT
server: cloudflare
traceparent: 00-381381b11dcf4f51b42854299fed7359-fd32a35b255c2a19-00
x-timer: S1654770061.616075,VS0,VE2
etag: W/"62947ebc-107c"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/x-font-ttf
access-control-allow-origin: *
expires: Sun, 11 Jun 2023 01:54:53 GMT
cache-control: public, max-age=31622400
cf-ray: 718e7b493bd30f76-MXP
x-styx-req-id: 7563b0d5-e100-11ec-b852-4ae4d4b60697
x-cache-hits: 0, 1

GET
H2 200 gudea-400-latin.woff2
therecord.media/wp-content/themes/therecordmedia/assets/fonts/gudea/ 8 KB
8 KB 31ms
30ms Font
font/woff2 2606:4700::6812:721
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://therecord.media/wp-content/themes/therecordmedia/assets/fonts/gudea/gudea-400-latin.woff2

Requested by

Host: therecord.media
URL: https://therecord.media/wp-content/themes/therecordmedia/assets/css/style-v5.css?ver=2022-01-20_3

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:721 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f23ec5c633f64e45cdb8119ea2bd55f81bd2bf4a46131cc6e7aa415024db18f1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://therecord.media/wp-content/themes/therecordmedia/assets/css/style-v5.css?ver=2022-01-20_3
Origin: https://therecord.media
accept-language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Fri, 10 Jun 2022 01:54:53 GMT
via: 1.1 varnish, 1.1 varnish
cf-cache-status: HIT
age: 192017
x-pantheon-styx-hostname: styx-fe2-a-77dfbb8967-tv48f
x-cache: MISS, HIT
x-cloud-trace-context: d33a14eb9acb447f878010e157671529/12122197045759871625;o=0
strict-transport-security: max-age=31536000; includeSubDomains
content-length: 7856
x-served-by: cache-mdw17367-MDW, cache-iad-kcgs7200089-IAD
last-modified: Mon, 09 May 2022 20:10:07 GMT
server: cloudflare
traceparent: 00-d33a14eb9acb447f878010e157671529-a83ab1fca9ce8a89-00
x-timer: S1654634077.849196,VS0,VE2
etag: "6279751f-1eb0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: font/woff2
access-control-allow-origin: *
expires: Sun, 11 Jun 2023 01:54:53 GMT
cache-control: public, max-age=31622400
accept-ranges: bytes
cf-ray: 718e7b493bd40f76-MXP
x-styx-req-id: 9ced7859-d03a-11ec-917f-8268c10533a6
x-cache-hits: 0, 1

GET
H2 200 oswald-400-latin.woff2
therecord.media/wp-content/themes/therecordmedia/assets/fonts/oswald/ 24 KB
24 KB 35ms
34ms Font
font/woff2 2606:4700::6812:721
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://therecord.media/wp-content/themes/therecordmedia/assets/fonts/oswald/oswald-400-latin.woff2

Requested by

Host: therecord.media
URL: https://therecord.media/wp-content/themes/therecordmedia/assets/css/style-v5.css?ver=2022-01-20_3

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:721 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f1010cf08825a41c768a117755a496da61a306c41b83c383ea66f1bb3334bb14

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://therecord.media/wp-content/themes/therecordmedia/assets/css/style-v5.css?ver=2022-01-20_3
Origin: https://therecord.media
accept-language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Fri, 10 Jun 2022 01:54:53 GMT
via: 1.1 varnish, 1.1 varnish
cf-cache-status: HIT
age: 665959
x-pantheon-styx-hostname: styx-fe2-b-d84bbb664-c5vvj
x-cache: MISS, HIT
x-cloud-trace-context: 997ab1929ad74b408ec6d2bb41db26f8/11147761195073342000;o=0
strict-transport-security: max-age=31536000; includeSubDomains
content-length: 24064
x-served-by: cache-mdw17336-MDW, cache-iad-kjyo7100110-IAD
last-modified: Mon, 23 May 2022 17:38:03 GMT
server: cloudflare
traceparent: 00-997ab1929ad74b408ec6d2bb41db26f8-9ab4cdbe593b0a30-00
x-timer: S1654160134.988134,VS0,VE5
etag: "628bc67b-5e00"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: font/woff2
access-control-allow-origin: *
expires: Sun, 11 Jun 2023 01:54:53 GMT
cache-control: public, max-age=31622400
accept-ranges: bytes
cf-ray: 718e7b493bd50f76-MXP
x-styx-req-id: a7ddecda-db4f-11ec-b11c-126e0dd15a40
x-cache-hits: 0, 1

GET
H2 200 oswald-700-latin.woff2
therecord.media/wp-content/themes/therecordmedia/assets/fonts/oswald/ 24 KB
24 KB 32ms
31ms Font
font/woff2 2606:4700::6812:721
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://therecord.media/wp-content/themes/therecordmedia/assets/fonts/oswald/oswald-700-latin.woff2

Requested by

Host: therecord.media
URL: https://therecord.media/wp-content/themes/therecordmedia/assets/css/style-v5.css?ver=2022-01-20_3

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:721 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f1010cf08825a41c768a117755a496da61a306c41b83c383ea66f1bb3334bb14

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://therecord.media/wp-content/themes/therecordmedia/assets/css/style-v5.css?ver=2022-01-20_3
Origin: https://therecord.media
accept-language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Fri, 10 Jun 2022 01:54:53 GMT
via: 1.1 varnish, 1.1 varnish
cf-cache-status: HIT
age: 56033
x-pantheon-styx-hostname: styx-fe2-a-69877596b-qnq9f
x-cache: MISS, HIT
x-cloud-trace-context: dc25f5b569644d229abcd339d248dbbc/4202586138159344889;o=0
strict-transport-security: max-age=31536000; includeSubDomains
content-length: 24064
x-served-by: cache-mdw17339-MDW, cache-iad-kcgs7200159-IAD
last-modified: Mon, 30 May 2022 09:09:05 GMT
server: cloudflare
traceparent: 00-dc25f5b569644d229abcd339d248dbbc-3a5295d38ef7ecf9-00
x-timer: S1654770061.631092,VS0,VE2
etag: "629489b1-5e00"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: font/woff2
access-control-allow-origin: *
expires: Sun, 11 Jun 2023 01:54:53 GMT
cache-control: public, max-age=31622400
accept-ranges: bytes
cf-ray: 718e7b493bd60f76-MXP
x-styx-req-id: ef970ac8-e0d1-11ec-b200-8a4955314b05
x-cache-hits: 0, 1

GET
H2 200 vulnerability_spotlight_dirty_pipe_86e5122687.jpg
cms.recordedfuture.com/uploads/ 105 KB
105 KB 577ms
508ms Image
image/jpeg 151.101.194.216
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cms.recordedfuture.com/uploads/vulnerability_spotlight_dirty_pipe_86e5122687.jpg

Requested by

Host: therecord.media
URL: https://therecord.media/hackers-using-follina-windows-zero-day-to-spread-qbot-malware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.194.216 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

bec29820bbf127195176a43bcc12f19d5b9f2707a4b65c15799debcf5606858a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31557600

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://therecord.media/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Fri, 10 Jun 2022 01:54:53 GMT
via: 1.1 varnish
x-platform-server: i-bac7380798664d7697b0cf11d33520e7, i-bac7380798664d7697b0cf11d33520e7
age: 0
x-cache: MISS
fastly-io-info: ifsz=107095 idim=1920x440 ifmt=jpeg ofsz=107095 odim=1920x440 ofmt=jpeg
fastly-stats: io=1
content-length: 107095
x-request-id: 00-16f66edca75f0d48d336dd891d3b1f1f-837f6f31cb9fe141-00
x-served-by: cache-mxp6952-MXP
etag: "JCT9swaS2XRtWMU+XNSn49+9HqIf3c9iR063vRcX//0"
vary: Accept-Encoding
strict-transport-security: max-age=31557600
content-type: image/jpeg
expires: Tue, 07 Jun 2022 20:01:47 GMT
cache-control: max-age=300
fastly-io-warning: Failed to shrink image
accept-ranges: bytes
x-debug-info: eyJyZXRyaWVzIjowfQ==
x-cache-hits: 0

GET
H2 200 business_fraud_bank_fraud_d279ba323f.jpg
cms.recordedfuture.com/uploads/ 107 KB
107 KB 516ms
448ms Image
image/jpeg 151.101.194.216
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cms.recordedfuture.com/uploads/business_fraud_bank_fraud_d279ba323f.jpg

Requested by

Host: therecord.media
URL: https://therecord.media/hackers-using-follina-windows-zero-day-to-spread-qbot-malware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.194.216 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

44a9331e991ab7a492e95f1d5f8295a63676a35ce1bf998400a3042e2a75c521

Security Headers

Name	Value
Strict-Transport-Security	max-age=31557600

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://therecord.media/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Fri, 10 Jun 2022 01:54:53 GMT
via: 1.1 varnish
x-platform-server: i-72f68d9e5fc844fb8d11227fc18ff9f4, i-72f68d9e5fc844fb8d11227fc18ff9f4
age: 0
x-cache: MISS
fastly-io-info: ifsz=109327 idim=1920x440 ifmt=jpeg ofsz=109327 odim=1920x440 ofmt=jpeg
fastly-stats: io=1
content-length: 109327
x-request-id: 00-16f66edcaf42ec95a0eed274a45b78d9-f46e866f0210a7a7-00
x-served-by: cache-mxp6952-MXP
etag: "5aNIsOmoQgBNHgzFkzoT6aOq7tQurJh7bq3vEhdqFMo"
vary: Accept-Encoding
strict-transport-security: max-age=31557600
content-type: image/jpeg
expires: Tue, 07 Jun 2022 20:01:47 GMT
cache-control: max-age=300
fastly-io-warning: Failed to shrink image
accept-ranges: bytes
x-debug-info: eyJyZXRyaWVzIjowfQ==
x-cache-hits: 0

GET
H2 200 webinar_header_analysis_mitigations_wiper_malware_variants_used_against_ukraine_c6144dd081.jpg
cms.recordedfuture.com/uploads/ 337 KB
337 KB 643ms
575ms Image
image/jpeg 151.101.194.216
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cms.recordedfuture.com/uploads/webinar_header_analysis_mitigations_wiper_malware_variants_used_against_ukraine_c6144dd081.jpg

Requested by

Host: therecord.media
URL: https://therecord.media/hackers-using-follina-windows-zero-day-to-spread-qbot-malware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.194.216 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

aa131d8e527f225fd8fb8e4d1844562d128263f09c0e649363987bba2857a7d5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31557600

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://therecord.media/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Fri, 10 Jun 2022 01:54:53 GMT
via: 1.1 varnish
x-platform-server: i-bac7380798664d7697b0cf11d33520e7, i-bac7380798664d7697b0cf11d33520e7
age: 0
x-cache: MISS
fastly-io-info: ifsz=345132 idim=2189x768 ifmt=jpeg ofsz=345132 odim=2189x768 ofmt=jpeg
fastly-stats: io=1
content-length: 345132
x-request-id: 00-16f7142fd679c601e9dc67e6f4c66fb3-67937734f0deb348-00
x-served-by: cache-mxp6952-MXP
etag: "i6GRAdWMnElLxS30W5lkTmBKY/TfcrKB1AdZaX9huTA"
vary: Accept-Encoding
strict-transport-security: max-age=31557600
content-type: image/jpeg
expires: Thu, 09 Jun 2022 22:31:23 GMT
cache-control: max-age=300
fastly-io-warning: Failed to shrink image
accept-ranges: bytes
x-debug-info: eyJyZXRyaWVzIjowfQ==
x-cache-hits: 0

GET
H2 200 rocket-loader.min.js Show response
therecord.media/cdn-cgi/scripts/7d0fa10a/cloudflare-static/ 12 KB
4 KB 25ms
24ms Script
application/javascript 2606:4700::6812:721
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://therecord.media/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Requested by

Host: therecord.media
URL: https://therecord.media/hackers-using-follina-windows-zero-day-to-spread-qbot-malware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:721 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ccf00d1923b0131a10e0c6d26f95e5dee6ebf8621a27e83c5a2f68a2e0093142

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://therecord.media/hackers-using-follina-windows-zero-day-to-spread-qbot-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Fri, 10 Jun 2022 01:54:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 01 Jun 2022 16:41:14 GMT
server: cloudflare
x-frame-options: DENY
etag: W/"629796aa-302c"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=172800, public
strict-transport-security: max-age=31536000; includeSubDomains
cf-ray: 718e7b496be40f76-MXP
expires: Sun, 12 Jun 2022 01:54:53 GMT

GET
H2 200 gudea-700-latin.woff2
therecord.media/wp-content/themes/therecordmedia/assets/fonts/gudea/ 8 KB
8 KB 34ms
34ms Font
font/woff2 2606:4700::6812:721
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://therecord.media/wp-content/themes/therecordmedia/assets/fonts/gudea/gudea-700-latin.woff2

Requested by

Host: therecord.media
URL: https://therecord.media/wp-content/themes/therecordmedia/assets/css/style-v5.css?ver=2022-01-20_3

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:721 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3d3367b895674ec706b02be65ae0ee7416f158836f88ddc1d3e469e3bdd6cd4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://therecord.media/wp-content/themes/therecordmedia/assets/css/style-v5.css?ver=2022-01-20_3
Origin: https://therecord.media
accept-language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Fri, 10 Jun 2022 01:54:53 GMT
via: 1.1 varnish, 1.1 varnish
cf-cache-status: HIT
age: 64884
x-pantheon-styx-hostname: styx-fe2-a-69877596b-46vcm
x-cache: MISS, HIT
x-cloud-trace-context: c23c28ba9da741979bb8a4165d1967a0/17054734361491218047;o=0
strict-transport-security: max-age=31536000; includeSubDomains
content-length: 7932
x-served-by: cache-mdw17330-MDW, cache-iad-kjyo7100037-IAD
last-modified: Wed, 01 Jun 2022 05:53:50 GMT
server: cloudflare
traceparent: 00-c23c28ba9da741979bb8a4165d1967a0-ecae968abb551e7f-00
x-timer: S1654761210.817807,VS0,VE2
etag: "6296feee-1efc"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: font/woff2
access-control-allow-origin: *
expires: Sun, 11 Jun 2023 01:54:53 GMT
cache-control: public, max-age=31622400
accept-ranges: bytes
cf-ray: 718e7b497be70f76-MXP
x-styx-req-id: 6b9ba80a-e17f-11ec-ade1-be43aeef22df
x-cache-hits: 0, 1

GET
H2 200 2021_1209-Victim-Data-Released-on-Ransomware-Extortion-Sites-1-1024x607.jpg
therecord.media/wp-content/uploads/2021/12/ 45 KB
45 KB 34ms
33ms Image
image/webp 2606:4700::6812:721
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://therecord.media/wp-content/uploads/2021/12/2021_1209-Victim-Data-Released-on-Ransomware-Extortion-Sites-1-1024x607.jpg

Requested by

Host: therecord.media
URL: https://therecord.media/hackers-using-follina-windows-zero-day-to-spread-qbot-malware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:721 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d9697e2769a5484e3d9086c6f3c97746dff2d88d5c0bd7c5367a020dd5d097ce

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://therecord.media/hackers-using-follina-windows-zero-day-to-spread-qbot-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Fri, 10 Jun 2022 01:54:53 GMT
via: 1.1 varnish, 1.1 varnish
vary: Accept
cf-cache-status: HIT
age: 56651
cf-polished: origFmt=jpeg, origSize=56591
x-cache: MISS, HIT
x-cache-hits: 0, 1
content-disposition: inline; filename="2021_1209-Victim-Data-Released-on-Ransomware-Extortion-Sites-1-1024x607.webp"
cf-bgj: imgq:100,h2pri
content-length: 45912
x-served-by: cache-mdw17356-MDW, cache-iad-kiad7000102-IAD
expires: Sun, 11 Jun 2023 01:54:53 GMT
last-modified: Fri, 10 Dec 2021 22:23:57 GMT
server: cloudflare
traceparent: 00-f140d4c02b2248f7a8bb011c54f0e4e7-028b4f8be070caa2-00
x-timer: S1654769443.619846,VS0,VE1
etag: "61b3d37d-dd0f"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/webp
x-styx-req-id: 629bcbe5-e662-11ec-bed6-d28cca7ddd64
x-cloud-trace-context: f140d4c02b2248f7a8bb011c54f0e4e7/183327672023173794;o=0
cache-control: public, max-age=31622400
accept-ranges: bytes
cf-ray: 718e7b498bed0f76-MXP
x-pantheon-styx-hostname: styx-fe2-a-c84d4fcb-4fljp

GET
H2 200 complianz.min.js Show response
therecord.media/wp-content/plugins/complianz-gdpr-premium/assets/js/ 40 KB
9 KB 31ms
30ms Script
application/x-javascript 2606:4700::6812:721
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://therecord.media/wp-content/plugins/complianz-gdpr-premium/assets/js/complianz.min.js?ver=5.2.5.1

Requested by

Host: therecord.media
URL: https://therecord.media/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:721 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

326d6c39524da9a4b3d35286c798b93738a4665b29ce498d5b5df959a3a19012

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://therecord.media/hackers-using-follina-windows-zero-day-to-spread-qbot-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Fri, 10 Jun 2022 01:54:53 GMT
via: 1.1 varnish, 1.1 varnish
vary: Accept-Encoding
cf-cache-status: HIT
age: 72636
x-pantheon-styx-hostname: styx-fe2-a-c84d4fcb-gjq4t
x-cache: HIT, HIT
x-cloud-trace-context: 7e51b19f42f747d989fe1ed27d7aaaa5/9694591902006402143;o=0
content-encoding: br
x-served-by: cache-mdw17328-MDW, cache-iad-kcgs7200085-IAD
last-modified: Mon, 06 Jun 2022 22:09:09 GMT
server: cloudflare
traceparent: 00-7e51b19f42f747d989fe1ed27d7aaaa5-868a1bf881785c5f-00
x-timer: S1654753457.339640,VS0,VE2
etag: W/"629e7b05-9e2d"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/x-javascript
x-styx-req-id: a8e55511-e729-11ec-92ce-b674ac6eaa3a
expires: Sun, 11 Jun 2023 01:54:53 GMT
cache-control: public, max-age=31622400
cf-ray: 718e7b49ac010f76-MXP
x-cache-hits: 1, 1

GET
H2 200 postscribe.min.js Show response
therecord.media/wp-content/plugins/complianz-gdpr-premium/assets/js/ 17 KB
6 KB 34ms
33ms Script
application/x-javascript 2606:4700::6812:721
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://therecord.media/wp-content/plugins/complianz-gdpr-premium/assets/js/postscribe.min.js?ver=5.2.5.1

Requested by

Host: therecord.media
URL: https://therecord.media/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:721 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c4e20f53f5ef0ed44b783437aa3f4638a9a56cc4aa29ae83ed9212eb2807052a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://therecord.media/hackers-using-follina-windows-zero-day-to-spread-qbot-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Fri, 10 Jun 2022 01:54:53 GMT
via: 1.1 varnish, 1.1 varnish
vary: Accept-Encoding
cf-cache-status: HIT
age: 1074385
x-pantheon-styx-hostname: styx-fe2-b-d84bbb664-9r5dn
x-cache: HIT, HIT
x-cloud-trace-context: 791061d277ba47fba0595e61cf7eba8a/13360405679066491431;o=0
content-encoding: br
x-served-by: cache-mdw17365-MDW, cache-iad-kjyo7100132-IAD
last-modified: Tue, 24 May 2022 15:11:34 GMT
server: cloudflare
traceparent: 00-791061d277ba47fba0595e61cf7eba8a-b969b22dbbdeaa27-00
x-timer: S1653751709.663630,VS0,VE2
etag: W/"628cf5a6-45f4"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/x-javascript
x-styx-req-id: a38ff467-dc02-11ec-9a5d-5ad473118d89
expires: Sun, 11 Jun 2023 01:54:53 GMT
cache-control: public, max-age=31622400
cf-ray: 718e7b49ac020f76-MXP
x-cache-hits: 1, 1

GET
H2 200 cookieconsent.min.js Show response
therecord.media/wp-content/plugins/complianz-gdpr-premium/assets/js/ 25 KB
8 KB 32ms
31ms Script
application/x-javascript 2606:4700::6812:721
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://therecord.media/wp-content/plugins/complianz-gdpr-premium/assets/js/cookieconsent.min.js?ver=5.2.5.1

Requested by

Host: therecord.media
URL: https://therecord.media/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:721 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

81dbdd695385ce9e3065e0cf1d8f058169de79244b1d1be4059b527e31d23c77

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://therecord.media/hackers-using-follina-windows-zero-day-to-spread-qbot-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Fri, 10 Jun 2022 01:54:53 GMT
via: 1.1 varnish, 1.1 varnish
vary: Accept-Encoding
cf-cache-status: HIT
age: 334941
x-pantheon-styx-hostname: styx-fe2-a-69877596b-qnq9f
x-cache: HIT, HIT
x-cloud-trace-context: f1e48beb19b04cb4b25bb68d8bde3546/693785502166801446;o=0
content-encoding: br
x-served-by: cache-mdw17351-MDW, cache-iad-kcgs7200105-IAD
last-modified: Mon, 30 May 2022 09:09:04 GMT
server: cloudflare
traceparent: 00-f1e48beb19b04cb4b25bb68d8bde3546-09a0d23d06f7dc26-00
x-timer: S1654491153.505291,VS0,VE2
etag: W/"629489b0-6441"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/x-javascript
x-styx-req-id: 19385dbf-e177-11ec-b200-8a4955314b05
expires: Sun, 11 Jun 2023 01:54:53 GMT
cache-control: public, max-age=31622400
cf-ray: 718e7b49ac030f76-MXP
x-cache-hits: 1, 1

GET
H2 200 fitvids.min.js Show response
therecord.media/wp-content/plugins/youtube-embed-plus/scripts/ 3 KB
1 KB 33ms
31ms Script
application/x-javascript 2606:4700::6812:721
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://therecord.media/wp-content/plugins/youtube-embed-plus/scripts/fitvids.min.js?ver=14.0.1.4

Requested by

Host: therecord.media
URL: https://therecord.media/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:721 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d8be3a402a3b2ad808402cea111ba3d286239d88e06c8e2969c84f46050dc88a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://therecord.media/hackers-using-follina-windows-zero-day-to-spread-qbot-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Fri, 10 Jun 2022 01:54:53 GMT
via: 1.1 varnish, 1.1 varnish
vary: Accept-Encoding
cf-cache-status: HIT
age: 64895
x-pantheon-styx-hostname: styx-fe2-a-69877596b-fjtrh
x-cache: MISS, HIT
x-cloud-trace-context: 8821a503a8e4489fb77abf9af177ed8e/3979686807238543715;o=0
content-encoding: br
x-served-by: cache-mdw17331-MDW, cache-iad-kjyo7100113-IAD
last-modified: Wed, 01 Jun 2022 05:53:50 GMT
server: cloudflare
traceparent: 00-8821a503a8e4489fb77abf9af177ed8e-373ab010dec30963-00
x-timer: S1654761199.930281,VS0,VE2
etag: W/"6296feee-c1f"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/x-javascript
x-styx-req-id: 02f44e6d-e1a7-11ec-b61e-0288f5e19fbf
expires: Sun, 11 Jun 2023 01:54:53 GMT
cache-control: public, max-age=31622400
cf-ray: 718e7b49ac040f76-MXP
x-cache-hits: 0, 1

GET
H2 200 main.js Show response
therecord.media/wp-content/themes/therecordmedia/assets/js/ 24 KB
7 KB 32ms
29ms Script
application/x-javascript 2606:4700::6812:721
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://therecord.media/wp-content/themes/therecordmedia/assets/js/main.js?ver=2022-01-20_3

Requested by

Host: therecord.media
URL: https://therecord.media/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:721 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

13a5d6deee5c86d1c86f8ab010b3dfcab1b0b500590024d8c7a44c279c96d443

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://therecord.media/hackers-using-follina-windows-zero-day-to-spread-qbot-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Fri, 10 Jun 2022 01:54:53 GMT
via: 1.1 varnish, 1.1 varnish
vary: Accept-Encoding
cf-cache-status: HIT
age: 1074385
cf-polished: origSize=45161
x-cache: MISS, HIT
x-cloud-trace-context: 614b22db28bc48b3940b62cb6fd48236/4717546399557599316;o=0
x-cache-hits: 0, 1
cf-bgj: minify
content-encoding: br
x-served-by: cache-mdw17347-MDW, cache-iad-kjyo7100156-IAD
last-modified: Sun, 01 May 2022 08:53:05 GMT
server: cloudflare
traceparent: 00-614b22db28bc48b3940b62cb6fd48236-41781774ad0dc054-00
x-timer: S1653751709.697803,VS0,VE2
etag: W/"626e4a71-b069"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/x-javascript
x-styx-req-id: 9323f4e8-caac-11ec-b55c-96fc0d9547b7
expires: Sun, 11 Jun 2023 01:54:53 GMT
cache-control: public, max-age=31622400
cf-ray: 718e7b49ac050f76-MXP
x-pantheon-styx-hostname: styx-fe2-b-545c7b55b6-trzlb

GET
H2 200 jquery.fancybox.min.js Show response
cdn.jsdelivr.net/gh/fancyapps/fancybox@3.5.7/dist/ 67 KB
22 KB 36ms
33ms Script
application/javascript 2606:4700::6810:5514
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/gh/fancyapps/fancybox@3.5.7/dist/jquery.fancybox.min.js?ver=2022-01-20_3

Requested by

Host: therecord.media
URL: https://therecord.media/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:5514 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

cadda460ccb4c3c01bb45f3d5976f63f5adf8dc3ff1d31cb4fbd3ded4f18e5bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://therecord.media/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Fri, 10 Jun 2022 01:54:53 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 6971594
x-jsd-version: 3.5.7
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains; preload
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-served-by: cache-fra19141-FRA, cache-mxp6961-MXP
timing-allow-origin: *
x-jsd-version-type: version
server: cloudflare
etag: W/"10a9d-YYFBLnOWZpbQjh5bEkOlctDyK6Y"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=WwJWzD6UqeruZDKE%2F3Gr%2B8zw2dliJihzx%2B3bNdM6n0m2cu7snttr4aTOoFxtgZ05zid7lndigGE2G0fvH6M8ttJ%2FoYmtIVzbWM6D7TWhGeK7A60ajvd4yqpCKtPVtQE9NlGXLTfA59F7bqEfq0I%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
cf-ray: 718e7b49ac5a59d1-MXP

GET
H2 200 jquery.mCustomScrollbar.min.js Show response
cdnjs.cloudflare.com/ajax/libs/malihu-custom-scrollbar-plugin/3.1.5/ 39 KB
11 KB 32ms
30ms Script
application/javascript 2606:4700::6811:190e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/malihu-custom-scrollbar-plugin/3.1.5/jquery.mCustomScrollbar.min.js?ver=2022-01-20_3

Requested by

Host: therecord.media
URL: https://therecord.media/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

00a1230e22b6af3f9df1348f2cd54dc9dbe026f3a41b9bde3009dcefd1648ae1

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://therecord.media/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Fri, 10 Jun 2022 01:54:53 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 1700723
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 10595
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:12:04 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03ed4-9cd4"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8aVHGibJWJzWdnTelpVeLpGnZ7rEbYrirxs%2B0FBXnRkUMj2P58kpq4blG7sNXD5qyFuQm7l24Ehp6EbuI1b6NxZ4IKEmKeOZlsHyy0wiFTNbaa3snzl2l8f8qiAQZ1j6gpcUgZ2GceIMOmluiiCGqGCQ"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 718e7b49a9715a2b-MXP
expires: Wed, 31 May 2023 01:54:53 GMT

GET
H2 200 custom-v5.js Show response
therecord.media/wp-content/themes/therecordmedia/assets/js/ 3 KB
2 KB 33ms
31ms Script
application/x-javascript 2606:4700::6812:721
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://therecord.media/wp-content/themes/therecordmedia/assets/js/custom-v5.js?ver=2022-01-20_3

Requested by

Host: therecord.media
URL: https://therecord.media/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:721 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

66ddc36b286dc2588bac8e45fdbfa6134f21938d71ade0497276c263fee05372

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://therecord.media/hackers-using-follina-windows-zero-day-to-spread-qbot-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Fri, 10 Jun 2022 01:54:53 GMT
via: 1.1 varnish, 1.1 varnish
vary: Accept-Encoding
cf-cache-status: HIT
age: 64895
cf-polished: origSize=5580
x-cache: HIT, HIT
x-cloud-trace-context: 5caf9ee044d0445b972ef128a678bf39/13332503002701548788;o=0
x-cache-hits: 1, 1
cf-bgj: minify
content-encoding: br
x-served-by: cache-mdw17379-MDW, cache-iad-kcgs7200035-IAD
last-modified: Mon, 06 Jun 2022 11:37:23 GMT
server: cloudflare
traceparent: 00-5caf9ee044d0445b972ef128a678bf39-b90690d7a2daccf4-00
x-timer: S1654761199.646851,VS0,VE1
etag: W/"629de6f3-15cc"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/x-javascript
x-styx-req-id: 9834fc32-e715-11ec-963a-f644679e56b0
expires: Sun, 11 Jun 2023 01:54:53 GMT
cache-control: public, max-age=31622400
cf-ray: 718e7b49ac090f76-MXP
x-pantheon-styx-hostname: styx-fe2-a-c84d4fcb-nwdqs

GET
H2 200 bundle.js Show response
therecord.media/wp-content/themes/therecordmedia/assets/js/ 276 KB
72 KB 40ms
39ms Script
application/x-javascript 2606:4700::6812:721
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://therecord.media/wp-content/themes/therecordmedia/assets/js/bundle.js?ver=2022-01-20_3

Requested by

Host: therecord.media
URL: https://therecord.media/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:721 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8df981a2e0d74a44530cfe140f2ce72ad4cb7be724706b7a3cfcb160bd06590f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://therecord.media/hackers-using-follina-windows-zero-day-to-spread-qbot-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Fri, 10 Jun 2022 01:54:53 GMT
via: 1.1 varnish, 1.1 varnish
vary: Accept-Encoding
cf-cache-status: HIT
age: 1074385
cf-polished: origSize=525445
x-cache: MISS, HIT
x-cloud-trace-context: aafffe33f3a94e30934d3fc889f346c7/7541254080452786341;o=0
x-cache-hits: 0, 1
cf-bgj: minify
content-encoding: br
x-served-by: cache-mdw17351-MDW, cache-iad-kjyo7100147-IAD
last-modified: Tue, 10 May 2022 13:25:01 GMT
server: cloudflare
traceparent: 00-aafffe33f3a94e30934d3fc889f346c7-68a7eaa1825a78a5-00
x-timer: S1653751709.715339,VS0,VE3
etag: W/"627a67ad-80485"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/x-javascript
x-styx-req-id: 9b71127e-d06e-11ec-9491-962e6f6f2faa
expires: Sun, 11 Jun 2023 01:54:53 GMT
cache-control: public, max-age=31622400
cf-ray: 718e7b49ac0a0f76-MXP
x-pantheon-styx-hostname: styx-fe2-a-5659d4cf87-7xm8h

GET
H/1.1 200
OK widgets.js Show response
platform.twitter.com/ 97 KB
29 KB 157ms
23ms Script
application/javascript 2606:2800:234:59:254c:406:2366:268c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/widgets.js
Requested by: Host: therecord.media
URL: https://therecord.media/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (mil/6CDF) /
Resource Hash: dccafac57a7fcedce0d95d35007b502104f45b82f43f052159c370258ef13a53

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://therecord.media/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date: Fri, 10 Jun 2022 01:54:53 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Age: 1474
X-Cache: HIT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server-Timing: "x-cache;desc= HIT,x-tw-cdn;desc=VZ",edge;dur=1
Content-Length: 29459
x-tw-cdn: VZ
Last-Modified: Thu, 02 Jun 2022 18:12:37 GMT
Server: ECS (mil/6CDF)
Etag: "5d21dece96ce474f5f1ac122cbdef6eb+gzip"
Access-Control-Max-Age: 3000
Access-Control-Allow-Methods: GET
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=1800

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 101 KB
39 KB 116ms
45ms Script
application/javascript 2a00:1450:4001:82a::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-9153858-16

Requested by

Host: therecord.media
URL: https://therecord.media/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

3e76f6eb7177b6265e04001fc393c14a138f6dec73fced2ff447f115287909a3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://therecord.media/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Fri, 10 Jun 2022 01:54:53 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 39817
x-xss-protection: 0
last-modified: Fri, 10 Jun 2022 00:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Fri, 10 Jun 2022 01:54:53 GMT

GET
H2 200 252628.js Show response
js.hs-scripts.com/ 1 KB
955 B 201ms
144ms Script
application/javascript 2606:4700::6811:d4cc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hs-scripts.com/252628.js
Requested by: Host: therecord.media
URL: https://therecord.media/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:d4cc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1fdd7e24f137d4adb881e20c9fd09448ea82acb4909fccb59c575648550b5bdc

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://therecord.media/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Fri, 10 Jun 2022 01:54:53 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: EXPIRED
x-hubspot-correlation-id: 670bf64a-fd8b-4228-81d7-109557d5ade6
last-modified: Thu, 09 Jun 2022 23:38:33 GMT
server: cloudflare
x-trace: 2B3C59E6E99ABA00ED03B6E564D5D99778969C8E93000000000000000000
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age: 3600
content-type: application/javascript;charset=utf-8
access-control-allow-origin: https://therecord.media
cache-control: public, max-age=60
access-control-allow-credentials: true
cf-ray: 718e7b4a0ec5375c-MXP
expires: Fri, 10 Jun 2022 01:55:53 GMT

GET
H2 200 ytprefs.min.js Show response
therecord.media/wp-content/plugins/youtube-embed-plus/scripts/ 12 KB
4 KB 31ms
30ms Script
application/x-javascript 2606:4700::6812:721
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://therecord.media/wp-content/plugins/youtube-embed-plus/scripts/ytprefs.min.js?ver=14.0.1.4

Requested by

Host: therecord.media
URL: https://therecord.media/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:721 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

eeed30be41165ff65cb948a306a545dfafc224b8ae24558cc4d145c8bd5ce65b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://therecord.media/hackers-using-follina-windows-zero-day-to-spread-qbot-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Fri, 10 Jun 2022 01:54:53 GMT
via: 1.1 varnish, 1.1 varnish
vary: Accept-Encoding
cf-cache-status: HIT
age: 334941
x-pantheon-styx-hostname: styx-fe2-a-69877596b-fjtrh
x-cache: MISS, HIT
x-cloud-trace-context: 472fda1e399842d888a75215627324be/4620817919058726982;o=0
content-encoding: br
x-served-by: cache-mdw17345-MDW, cache-iad-kcgs7200130-IAD
last-modified: Mon, 30 May 2022 08:22:20 GMT
server: cloudflare
traceparent: 00-472fda1e399842d888a75215627324be-4020716a4d415046-00
x-timer: S1654491152.231983,VS0,VE2
etag: W/"62947ebc-3026"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/x-javascript
x-styx-req-id: 752ac6d7-e100-11ec-b61e-0288f5e19fbf
expires: Sun, 11 Jun 2023 01:54:53 GMT
cache-control: public, max-age=31622400
cf-ray: 718e7b49ac0b0f76-MXP
x-cache-hits: 0, 1

GET
H2 200 modernizr_2.8.3.js Show response
therecord.media/wp-content/themes/therecordmedia/assets/js/ 15 KB
6 KB 32ms
31ms Script
application/x-javascript 2606:4700::6812:721
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://therecord.media/wp-content/themes/therecordmedia/assets/js/modernizr_2.8.3.js?ver=2022-01-20_3

Requested by

Host: therecord.media
URL: https://therecord.media/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:721 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

82bfc506040c981ec142b63ec85a43e603310d9b5fac6598c5664a144f3c4e3e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://therecord.media/hackers-using-follina-windows-zero-day-to-spread-qbot-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Fri, 10 Jun 2022 01:54:53 GMT
via: 1.1 varnish, 1.1 varnish
vary: Accept-Encoding
cf-cache-status: HIT
age: 1074385
cf-polished: origSize=15506
x-cache: MISS, HIT
x-cloud-trace-context: 06604edfc94a4501ad28d8f63f9c5f67/9051284171001719787;o=0
x-cache-hits: 0, 1
cf-bgj: minify
content-encoding: br
x-served-by: cache-mdw17362-MDW, cache-iad-kjyo7100127-IAD
last-modified: Mon, 23 May 2022 05:22:27 GMT
server: cloudflare
traceparent: 00-06604edfc94a4501ad28d8f63f9c5f67-7d9c9eff6dac6beb-00
x-timer: S1653751709.720667,VS0,VE2
etag: W/"628b1a13-3c92"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/x-javascript
x-styx-req-id: 3e44f9df-db4c-11ec-a254-7a420a75f39a
expires: Sun, 11 Jun 2023 01:54:53 GMT
cache-control: public, max-age=31622400
cf-ray: 718e7b49ac0c0f76-MXP
x-pantheon-styx-hostname: styx-fe2-b-d84bbb664-8l85v

GET
H2 200 jquery-migrate.min.js Show response
therecord.media/wp-includes/js/jquery/ 11 KB
5 KB 34ms
33ms Script
application/x-javascript 2606:4700::6812:721
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://therecord.media/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.3.2

Requested by

Host: therecord.media
URL: https://therecord.media/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:721 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

029e0a2e809fd6b5dbe76abe8b7a74936be306c9a8c27c814c4d44aa54623300

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://therecord.media/hackers-using-follina-windows-zero-day-to-spread-qbot-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Fri, 10 Jun 2022 01:54:53 GMT
via: 1.1 varnish, 1.1 varnish
vary: Accept-Encoding
cf-cache-status: HIT
age: 64894
x-pantheon-styx-hostname: styx-fe2-b-d84bbb664-97mfl
x-cache: MISS, HIT
x-cloud-trace-context: c29233ede5bd46e190df631994fa20bd/15931504997933117130;o=0
content-encoding: br
x-served-by: cache-mdw17365-MDW, cache-iad-kcgs7200081-IAD
last-modified: Tue, 24 May 2022 15:11:41 GMT
server: cloudflare
traceparent: 00-c29233ede5bd46e190df631994fa20bd-dd1813630b29eeca-00
x-timer: S1654761199.011009,VS0,VE2
etag: W/"628cf5ad-2bd8"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/x-javascript
x-styx-req-id: 15b1ee61-db8b-11ec-87fa-4e5961dd8519
expires: Sun, 11 Jun 2023 01:54:53 GMT
cache-control: public, max-age=31622400
cf-ray: 718e7b49ac0d0f76-MXP
x-cache-hits: 0, 1

GET
H2 200 jquery.min.js Show response
therecord.media/wp-includes/js/jquery/ 87 KB
32 KB 36ms
35ms Script
application/x-javascript 2606:4700::6812:721
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://therecord.media/wp-includes/js/jquery/jquery.min.js?ver=3.6.0

Requested by

Host: therecord.media
URL: https://therecord.media/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:721 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

bd4de6a3fc0fb68d6f76ba7b93514b96a92e585c295b5351c31ad92a4b0777ea

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://therecord.media/hackers-using-follina-windows-zero-day-to-spread-qbot-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Fri, 10 Jun 2022 01:54:53 GMT
via: 1.1 varnish, 1.1 varnish
vary: Accept-Encoding
cf-cache-status: HIT
age: 64894
x-pantheon-styx-hostname: styx-fe2-b-7d66648565-qk9wk
x-cache: MISS, HIT
x-cloud-trace-context: 5ce1923ff0c64f6c865b0914d5f6209e/12473853690860531872;o=0
content-encoding: br
x-served-by: cache-mdw17381-MDW, cache-iad-kjyo7100110-IAD
last-modified: Tue, 31 May 2022 01:06:22 GMT
server: cloudflare
traceparent: 00-5ce1923ff0c64f6c865b0914d5f6209e-ad1c07d7afeff0a0-00
x-timer: S1654761199.995925,VS0,VE2
etag: W/"62956a0e-15db1"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/x-javascript
x-styx-req-id: 2315ece4-e0d4-11ec-853a-ba4f8aa48311
expires: Sun, 11 Jun 2023 01:54:53 GMT
cache-control: public, max-age=31622400
cf-ray: 718e7b49ac0e0f76-MXP
x-cache-hits: 0, 1

GET
H3 200 gtm.js Show response
www.googletagmanager.com/ 94 KB
36 KB 111ms
45ms Script
application/javascript 2a00:1450:4001:82a::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-PVJ5W86

Requested by

Host: therecord.media
URL: https://therecord.media/hackers-using-follina-windows-zero-day-to-spread-qbot-malware/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

ebbf76aa03394da0ae0eb13d70f24860fbc9c20fb4f3641a6ba9cc46be464511

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://therecord.media/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Fri, 10 Jun 2022 01:54:53 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36719
x-xss-protection: 0
last-modified: Fri, 10 Jun 2022 00:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Fri, 10 Jun 2022 01:54:53 GMT

GET
H2 200 matomo.js Show response
cdn.matomo.cloud/recordedfuture.matomo.cloud/ 196 KB
57 KB 107ms
32ms Script
application/javascript 2600:9000:2057:4400:c:7d55:b3c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.matomo.cloud/recordedfuture.matomo.cloud/matomo.js
Requested by: Host: therecord.media
URL: https://therecord.media/hackers-using-follina-windows-zero-day-to-spread-qbot-malware/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2057:4400:c:7d55:b3c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 982b571ec32f7957a421f8c8c5328ea3e03e0e1da66106fd466417d22a82a962

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://therecord.media/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Fri, 03 Jun 2022 18:35:21 GMT
content-encoding: gzip
age: 544773
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Mon, 23 May 2022 01:52:25 GMT
server: AmazonS3
etag: W/"f7541cea4d4145d53f6fd1c0c4a8a107"
vary: Accept-Encoding
x-amz-version-id: Po1DJGFQoXJ2VVqfK41cmKxBSM0o3FaH
via: 1.1 1b412557b82dda96e078541f9ee8dfb2.cloudfront.net (CloudFront)
cache-control: max-age=691200
x-amz-cf-pop: FRA6-C1
content-type: application/javascript; charset=utf-8
x-amz-cf-id: vhUtmj3biT7JpzQT-HPIZ-DwsOfw-P2LBG47o8fuVkzD1PoG9zvP5g==

GET
H2 200 container_41sBJe2I.js Show response
cdn.matomo.cloud/recordedfuture.matomo.cloud/ 25 KB
8 KB 107ms
32ms Script
application/javascript 2600:9000:2057:4400:c:7d55:b3c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.matomo.cloud/recordedfuture.matomo.cloud/container_41sBJe2I.js
Requested by: Host: therecord.media
URL: https://therecord.media/hackers-using-follina-windows-zero-day-to-spread-qbot-malware/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2057:4400:c:7d55:b3c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 368b1c951cdaeec5da3bcbb94ba7e9857eab072c81170c1f40b21e21e2e84f4e

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://therecord.media/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Wed, 08 Jun 2022 21:27:47 GMT
content-encoding: gzip
age: 102427
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Wed, 09 Mar 2022 00:05:14 GMT
server: AmazonS3
etag: W/"9b1a4110a486775edfe6380976be97a1"
vary: Accept-Encoding
x-amz-version-id: BSLfAVnr_0vNH1otSRL6_DRX_fyF9RuU
via: 1.1 1b412557b82dda96e078541f9ee8dfb2.cloudfront.net (CloudFront)
cache-control: max-age=691200
x-amz-cf-pop: FRA6-C1
content-type: application/javascript; charset=utf-8
x-amz-cf-id: 9y1Bxj9FIxMnoijq-hzjRVuDlbZG6sS4nj12DacrP1M7atc0kxrWHA==

GET
H/1.1 200
OK widgets.js Show response
platform.twitter.com/ 97 KB
29 KB 22ms
22ms Script
application/javascript 2606:2800:234:59:254c:406:2366:268c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/widgets.js
Requested by: Host: therecord.media
URL: https://therecord.media/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (mil/6CDF) /
Resource Hash: dccafac57a7fcedce0d95d35007b502104f45b82f43f052159c370258ef13a53

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://therecord.media/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date: Fri, 10 Jun 2022 01:54:53 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Age: 1474
X-Cache: HIT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server-Timing: "x-cache;desc= HIT,x-tw-cdn;desc=VZ",edge;dur=1
Content-Length: 29459
x-tw-cdn: VZ
Last-Modified: Thu, 02 Jun 2022 18:12:37 GMT
Server: ECS (mil/6CDF)
Etag: "5d21dece96ce474f5f1ac122cbdef6eb+gzip"
Access-Control-Max-Age: 3000
Access-Control-Allow-Methods: GET
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=1800

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 49 KB
20 KB 112ms
30ms Script
text/javascript 2a00:1450:4001:80b::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-9153858-16

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://therecord.media/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 13 Apr 2022 21:02:38 GMT
server: Golfe2
age: 5745
date: Fri, 10 Jun 2022 00:19:08 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20006
expires: Fri, 10 Jun 2022 02:19:08 GMT

GET
H3 200 jquery.mousewheel.min.js Show response
cdnjs.cloudflare.com/ajax/libs/jquery-mousewheel/3.1.13/ 3 KB
2 KB 28ms
28ms Script
application/javascript 2606:4700::6811:190e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/jquery-mousewheel/3.1.13/jquery.mousewheel.min.js

Requested by

Host: therecord.media
URL: https://therecord.media/wp-content/themes/therecordmedia/assets/js/bundle.js?ver=2022-01-20_3

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8e73a30d35c83ea6a597c3343324d2b7df097ad26e67b62efb5266ee12d317b5

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://therecord.media/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Fri, 10 Jun 2022 01:54:53 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 4942005
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 1046
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:11:46 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03ec2-ad3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=A0scYUWNNn%2B3aQVF5ZeSwcz28bu0HcoOBF39C%2BIDkz%2FbnOSHgLvANiBBtSmBTnicSmItS2tFxwxve8LSUm3JXPV6wGgTfPa11jRwNlC5qvaLSDibgASigGkyXW3xwoCTZvEflhFKvaU0FBmQLtR2ZX%2F8"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 718e7b4dfbe10f6a-MXP
expires: Wed, 31 May 2023 01:54:53 GMT

GET
H2 200 iframe_api Show response
www.youtube.com/ 980 B
2 KB 131ms
49ms Script
text/javascript 2a00:1450:4001:80b::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/iframe_api

Requested by

Host: therecord.media
URL: https://therecord.media/wp-content/themes/therecordmedia/assets/js/main.js?ver=2022-01-20_3

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

fd70985405d6434c27e69458ef268e95cea31329039be3a4111d7ebf83cb5ce6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://therecord.media/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Fri, 10 Jun 2022 01:54:53 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=it for more info."
critical-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
server: ESF
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
report-to: {"group":"youtube_main","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube_main"}]}
content-type: text/javascript; charset=utf-8
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
vary: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cache-control: private, max-age=0
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-platform=*, ch-ua-platform-version=*
cross-origin-opener-policy-report-only: same-origin; report-to="youtube_main"
expires: Fri, 10 Jun 2022 01:54:53 GMT

GET
H2 200 252628.js Show response
js.hs-analytics.net/analytics/1654825800000/ 63 KB
20 KB 633ms
576ms Script
text/javascript 2606:4700::6811:46b0
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hs-analytics.net/analytics/1654825800000/252628.js
Requested by: Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/252628.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:46b0 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 62395d926b25ea273b4f45626005c84bc919c4099006f3f3032f6d92b3be219a

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://therecord.media/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Fri, 10 Jun 2022 01:54:54 GMT
content-encoding: br
cf-cache-status: MISS
x-amz-request-id: BC5WZGR9EJ1SZSDC
x-amz-server-side-encryption: AES256
cf-ray: 718e7b4e6f8a839c-MXP
x-amz-id-2: n6F3StEDXI2FlQ4ApQwUKhx5vkxfDTV5F1Aua7V45jqeF4pt3REMufx4ZHm49iX/HhgdBIT82kc=
last-modified: Thu, 14 Apr 2022 15:08:53 GMT
server: cloudflare
etag: W/"29b7b72215c515a90d13d633b8baa906"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-amz-version-id: null
cache-control: max-age=300, public
access-control-allow-credentials: false
content-type: text/javascript
expires: Fri, 10 Jun 2022 01:59:54 GMT

GET
H2 200 252628.js Show response
js.hs-banner.com/ 60 KB
16 KB 213ms
157ms Script
text/javascript 2606:4700:4400::6812:21ab
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hs-banner.com/252628.js
Requested by: Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/252628.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::6812:21ab , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0c1a8712c3329cb66f31c312bb7d8c86ec03fb2ee2fcf76dea25b5af4fa69c93

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://therecord.media/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Fri, 10 Jun 2022 01:54:53 GMT
content-encoding: br
cf-cache-status: REVALIDATED
x-amz-request-id: 2D4MFFHH0PB8F6A0
x-amz-server-side-encryption: AES256
content-type: text/javascript; charset=UTF-8
access-control-max-age: 604800
x-amz-id-2: d7LtSBy3rmvfQZn+5gRtj7PE5bWzDXsKo7rjnpbzbq4CfT0uOrke1HF4v5gIuo+k/pKE+PFmfwo=
timing-allow-origin: *
last-modified: Fri, 27 May 2022 15:24:28 GMT
server: cloudflare
etag: W/"d10fe869af73b694a3c5ea1b88e0c3c4"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
x-amz-version-id: DtW3ZEzOoAB5SQrV4dVg6MlTna4ArD4J
access-control-allow-origin: https://www.recordedfuture.com
access-control-expose-headers: x-last-modified-timestamp, X-HubSpot-NotFound, X-HS-User-Request, Link, Server-Timing
cache-control: max-age=300, public
access-control-allow-credentials: true
cf-ray: 718e7b4e59b983b4-MXP
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Accept-Charset, Accept-Encoding, X-Override-Internal-Permissions, X-Properties-Source, X-Properties-SourceId, X-Properties-Flag, X-Hubspot-User-Id, X-Hubspot-Trace, X-Hubspot-Callee, X-Hubspot-Offset, X-Hubspot-No-Trace, X-HubSpot-Static-App-Info, X-HubSpot-Messages-Uri, X-HubSpot-Request-Source, X-HubSpot-Request-Reason, Subscription-Billing-Auth-Token, X-App-CSRF, X-Tools-CSRF, Online-Payment-Signing-UUID, X-Source, X-SourceId, X-Origin-UserId, X-Biden-Request-Source, X-HubSpot-CSRF-hubspotapi, X-Force-Cookie-Refresh, X-Force-Cookie-Refresh-No-Cache, X-HS-User-Request, X-Application-Id, X-HS-Referer, X-HubSpot-Correlation-Id
expires: Fri, 10 Jun 2022 01:59:53 GMT

GET
H2 200 leadflows.js Show response
js.hsleadflows.net/ 547 KB
88 KB 93ms
37ms Script
application/javascript 2606:4700::6811:eacc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hsleadflows.net/leadflows.js
Requested by: Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/252628.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:eacc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5ddf3bce83b11af6e050f824bb5e154741057fecd0d79b9e26a262755ad58be2

Request headers

Referer: https://therecord.media/
Origin: https://therecord.media
accept-language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Fri, 10 Jun 2022 01:54:53 GMT
via: 1.1 bfba2464a75a65b0c6568afe15f68b4c.cloudfront.net (CloudFront)
vary: Accept-Encoding,Origin,Access-Control-Request-Headers,Access-Control-Request-Method
cf-cache-status: HIT
age: 68238
x-amz-server-side-encryption: AES256
content-security-policy-report-only: frame-ancestors 'self'; report-uri https://exceptions.hubspot.com/csp/report?resource=lead-flows-js/static-1.1091/bundle/main/lead-flows-release.js&cfRay=7187f9550940d608-IAD
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
content-encoding: br
cf-ray: 718e7b4e69980f5a-MXP
last-modified: Thu, 02 Jun 2022 09:22:51 UTC
server: cloudflare
etag: W/"d0e7428efcc3691296896936278c2a97"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age: 3000
access-control-allow-methods: GET
x-amz-version-id: Trl1mZOSoldPXKe79dlBjPknEVROE7M_
access-control-allow-origin: *
cache-control: s-maxage=86400, max-age=0
x-hs-cache-status: MISS
x-amz-cf-pop: IAD89-P1
content-type: application/javascript; charset=utf-8
x-amz-cf-id: juTl11K8wlnryKfK2L20XXLVKOgg5ynj0gooSKAs-f33JNzPIDirYQ==
x-hs-target-asset: lead-flows-js/static-1.1091/bundle/main/lead-flows-release.js

GET
H/1.1 200
OK widget_iframe.d7fc2fc075c61f6fa34d79a0cbbf1e34.html Show response
platform.twitter.com/widgets/ Frame 7C28 319 KB
104 KB 23ms
22ms Document
text/html 2606:2800:234:59:254c:406:2366:268c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/widgets/widget_iframe.d7fc2fc075c61f6fa34d79a0cbbf1e34.html?origin=https%3A%2F%2Ftherecord.media
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (mil/6CDF) /
Resource Hash: c6d03b7a5561687268e57b13d9d4a6a4c71ee570ea74718040ce9227676e3e5e

Request headers

Referer: https://therecord.media/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
accept-language: it-IT,it;q=0.9

Response headers

Access-Control-Allow-Methods: GET
Access-Control-Allow-Origin: *
Age: 289584
Cache-Control: public, max-age=315360000
Content-Encoding: gzip
Content-Length: 105433
Content-Type: text/html; charset=utf-8
Date: Fri, 10 Jun 2022 01:54:53 GMT
Etag: "8321d7cf58d70200c1423dfa0bca40f6+gzip"
Last-Modified: Thu, 02 Jun 2022 18:01:40 GMT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server: ECS (mil/6CDF)
Server-Timing: "x-cache;desc= HIT,x-tw-cdn;desc=VZ",edge;dur=1
Vary: Accept-Encoding
X-Cache: HIT
x-tw-cdn: VZ

GET
H2 200 / Show response
therecord.media/wp-json/complianz/v1/banner/ 125 B
741 B 276ms
275ms XHR
application/json 2606:4700::6812:721
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://therecord.media/wp-json/complianz/v1/banner/?lang=en&locale=en_US&token=adqpj

Requested by

Host: therecord.media
URL: https://therecord.media/wp-content/plugins/complianz-gdpr-premium/assets/js/complianz.min.js?ver=5.2.5.1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:721 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

eb4cc9acf9651a4fe776ead01593f1f6bcbcfba7416274359ac9922450dabe4a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://therecord.media/hackers-using-follina-windows-zero-day-to-spread-qbot-malware/
accept-language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
Content-type: application/json

Response headers

date: Fri, 10 Jun 2022 01:54:54 GMT
via: 1.1 varnish, 1.1 varnish
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
age: 0
x-pantheon-styx-hostname: styx-fe2-b-57f746dddf-wp6gt
x-cache: MISS, MISS
x-cloud-trace-context: e64cf071e9ed4860aadf557c1022088f/3994853884642858119;o=0
strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: br
x-served-by: cache-mdw17347-MDW, cache-iad-kjyo7100175-IAD
access-control-allow-headers: Authorization, X-WP-Nonce, Content-Disposition, Content-MD5, Content-Type
server: cloudflare
traceparent: 00-e64cf071e9ed4860aadf557c1022088f-3770927143ba1487-00
x-timer: S1654826094.863983,VS0,VE136
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/json
x-styx-req-id: 526988a5-e860-11ec-b5f0-f63d70f14944
access-control-expose-headers: X-WP-Total, X-WP-TotalPages, Link
x-robots-tag: noindex
cf-ray: 718e7b4e3e060f76-MXP
link: <https://therecord.media/wp-json/>; rel="https://api.w.org/"
x-cache-hits: 0, 0

GET
H2 200 8dfb5b75ee7d706a760b55b313d4f564
secure.gravatar.com/avatar/ 20 KB
20 KB 73ms
22ms Image
image/png 2a04:fa87:fffe::c000:4902
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://secure.gravatar.com/avatar/8dfb5b75ee7d706a760b55b313d4f564?s=96&d=mm&r=g
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 5cf996e872e52f60fa6d956f1d7a957ff0d1c4bdcede8b795636bc0ceff91d7f

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://therecord.media/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

x-nc: HIT mxp 3
date: Fri, 10 Jun 2022 01:54:53 GMT
last-modified: Tue, 22 Mar 2022 14:38:25 GMT
server: nginx
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=300
content-disposition: inline; filename="8dfb5b75ee7d706a760b55b313d4f564.png"
accept-ranges: bytes
link: <https://www.gravatar.com/avatar/8dfb5b75ee7d706a760b55b313d4f564?s=96&d=mm&r=g>; rel="canonical"
content-length: 20493
expires: Fri, 10 Jun 2022 01:59:53 GMT

GET
H2 200 settings Show response
syndication.twitter.com/ Frame 7C28 331 B
475 B 212ms
144ms Fetch
application/json 104.244.42.72
TWITTER

General

Check archive.org

Show headers Download Go to

Full URL

https://syndication.twitter.com/settings?session_id=8052476664b15c65e1b059b9c5151d88882dc921

Requested by

Host: platform.twitter.com
URL: https://platform.twitter.com/widgets/widget_iframe.d7fc2fc075c61f6fa34d79a0cbbf1e34.html?origin=https%3A%2F%2Ftherecord.media

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.72 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

f83df770a7c9763424b29bfe7462c8f8e807d18dc0b4570f4ada501240007fda

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://platform.twitter.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

x-response-time: 112
date: Fri, 10 Jun 2022 01:54:53 GMT
content-encoding: gzip
last-modified: Fri, 10 Jun 2022 01:54:53 GMT
server: tsa_o
vary: Origin
strict-transport-security: max-age=631138519
content-type: application/json; charset=utf-8
access-control-allow-origin: https://platform.twitter.com
cache-control: must-revalidate, max-age=600
access-control-allow-credentials: true
x-connection-hash: b2893ae3710a6454d8bac6901536bbd8e87559c59ad398b0904dbc60364eac87
content-length: 193

GET
H/1.1 200
OK 6si.min.js Show response
j.6sc.co/ 31 KB
10 KB 131ms
34ms Script
application/javascript 96.16.137.162
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://j.6sc.co/6si.min.js

Requested by

Host: therecord.media
URL: https://therecord.media/hackers-using-follina-windows-zero-day-to-spread-qbot-malware/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

96.16.137.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a96-16-137-162.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

8e038b564510a45dc11799f74da367733f3db7f9c0a0434f1e90c44ec5168278

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://therecord.media/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date: Fri, 10 Jun 2022 01:54:53 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Connection: keep-alive
Vary: Accept-Encoding
Content-Length: 9715
Pragma: no-cache
Last-Modified: Thu, 05 May 2022 03:45:17 GMT
Server: nginx/1.14.0 (Ubuntu)
ETag: "6273484d-7b02"
Access-Control-Max-Age: 86400
Access-Control-Allow-Methods: GET,POST
Content-Type: application/javascript
Access-Control-Allow-Origin
Cache-Control: private, no-cache, proxy-revalidate
Access-Control-Allow-Credentials: true
Accept-Ranges: bytes
Access-Control-Allow-Headers: *
Expires: Fri, 10 Jun 2022 01:54:53 GMT

GET
H2 200 252628.js Show response
js.hs-scripts.com/ 1 KB
559 B 28ms
28ms Script
application/javascript 2606:4700::6811:d4cc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hs-scripts.com/252628.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PVJ5W86
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:d4cc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8649789c6fe95eb1f67a7b8d0f6fb53c49fe6df2dd4fb4353f77e94dd7f31f46

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://therecord.media/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Fri, 10 Jun 2022 01:54:53 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
age: 0
cf-polished: origSize=1482
x-hubspot-correlation-id: 670bf64a-fd8b-4228-81d7-109557d5ade6
last-modified: Fri, 10 Jun 2022 01:54:53 GMT
server: cloudflare
x-trace: 2B3C59E6E99ABA00ED03B6E564D5D99778969C8E93000000000000000000
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age: 3600
content-type: application/javascript;charset=utf-8
access-control-allow-origin: https://therecord.media
expires: Fri, 10 Jun 2022 01:55:53 GMT
cache-control: public, max-age=60
access-control-allow-credentials: true
cf-ray: 718e7b4ea93f375c-MXP
cf-bgj: minify

POST
H2 204 matomo.php
recordedfuture.matomo.cloud/ 0
167 B 151ms
68ms Ping
text/plain 18.195.235.189
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://recordedfuture.matomo.cloud/matomo.php?action_name=therecord.media%2FHackers%20using%20Follina%20Windows%20zero-day%20to%20spread%20Qbot%20malware%20-%20The%20Record%20by%20Recorded%20Future&idsite=2&rec=1&r=464261&h=1&m=54&s=53&url=https%3A%2F%2Ftherecord.media%2Fhackers-using-follina-windows-zero-day-to-spread-qbot-malware%2F&_id=4c267e738afcec2b&_idn=1&_refts=0&send_image=0&pdf=1&qt=0&realp=0&wma=0&fla=0&java=0&ag=0&cookie=1&res=1600x1200&pv_id=leo660&fa_pv=1&fa_fp[0][fa_vid]=wJ23oY&fa_fp[0][fa_fv]=1&fa_fp[2][fa_vid]=7zBEPF&fa_fp[2][fa_fv]=1&fa_fp[3][fa_vid]=Mruc7l&fa_fp[3][fa_fv]=1&pf_net=64&pf_srv=880&pf_tfr=117&pf_dm1=130&pf_dm2=672&pf_onl=1
Requested by: Host: cdn.matomo.cloud
URL: https://cdn.matomo.cloud/recordedfuture.matomo.cloud/matomo.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.195.235.189 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-195-235-189.eu-central-1.compute.amazonaws.com
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://therecord.media/
accept-language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=utf-8

Response headers

access-control-allow-origin: https://therecord.media
date: Fri, 10 Jun 2022 01:54:54 GMT
access-control-allow-credentials: true
server: Apache
vary: X-Forwarded-Port-Override,X-Forwarded-Proto-Override,User-Agent

POST
H3 200 collect Show response
www.google-analytics.com/j/ 1 B
21 B 106ms
40ms XHR
text/plain 2a00:1450:4001:80b::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j96&a=179619515&t=pageview&_s=1&dl=https%3A%2F%2Ftherecord.media%2Fhackers-using-follina-windows-zero-day-to-spread-qbot-malware%2F&ul=en-us&de=UTF-8&dt=Hackers%20using%20Follina%20Windows%20zero-day%20to%20spread%20Qbot%20malware%20-%20The%20Record%20by%20Recorded%20Future&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAUABAAAAAC~&jid=1004719233&gjid=1637706913&cid=573104975.1654826094&tid=UA-9153858-16&_gid=1965087744.1654826094&_r=1&gtm=2ou680&z=18309612

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://therecord.media/
accept-language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 10 Jun 2022 01:54:53 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://therecord.media
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 jquery.mCustomScrollbar.min.css Show response
cdnjs.cloudflare.com/ajax/libs/malihu-custom-scrollbar-plugin/3.1.5/ 42 KB
4 KB 52ms
28ms XHR
text/css 2606:4700::6811:190e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/malihu-custom-scrollbar-plugin/3.1.5/jquery.mCustomScrollbar.min.css?ver=2022-01-20_3

Requested by

Host: cdn.matomo.cloud
URL: https://cdn.matomo.cloud/recordedfuture.matomo.cloud/matomo.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

247184981eb6f698a94e431a83d68c6b0df623cce57b6e29dc5a6c11e23aa195

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://therecord.media/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Fri, 10 Jun 2022 01:54:53 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 710522
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 3359
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:12:04 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03ed4-a757"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=MkGRqWBxki27XxVxThOnIpXxGCei9jh4PRa73CBijEKGbMf%2Bo%2FYPzCc8t9GNFNziMb1aWBtE7cbv%2F6aBkT8mlJp5PyNJks4FutIPFpowKD2y9R79MFbNBprxBTCKdGAVCCJnlzYqb%2FrOdDSgQG%2FLTT29"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 718e7b4f1d140e26-MXP
expires: Wed, 31 May 2023 01:54:53 GMT

GET
H3 200 jquery.fancybox.min.css Show response
cdn.jsdelivr.net/gh/fancyapps/fancybox@3.5.7/dist/ 12 KB
4 KB 53ms
29ms XHR
text/css 2606:4700::6810:5514
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/gh/fancyapps/fancybox@3.5.7/dist/jquery.fancybox.min.css?ver=2022-01-20_3

Requested by

Host: cdn.matomo.cloud
URL: https://cdn.matomo.cloud/recordedfuture.matomo.cloud/matomo.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6810:5514 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5736e3eec0c34bfc288854b7b8d2a8f1e22e9e2e7dae3c8d1ad5dfb2d4734ad0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://therecord.media/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Fri, 10 Jun 2022 01:54:53 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 6971587
x-jsd-version: 3.5.7
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains; preload
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-served-by: cache-fra19177-FRA, cache-mxp6973-MXP
timing-allow-origin: *
x-jsd-version-type: version
server: cloudflare
etag: W/"31fb-G+m3m+AqHPxdlsSl4P649HK6vZU"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=wu5NrtGERzTpg5HBqM8gLnHcj0kpuTkPkfsVOJ41LAcef4dMN7Fh6988GUWReGWulvp7GLSsUQZpFlUUHyMlOZQ6rdmh5wEQ0P19mP9%2FjSPXj9EpKuWesrhb3cGMY%2B6O5bert%2BcTNBsqGlDOGdA%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
cf-ray: 718e7b4f1fbf0e12-MXP

GET
H2 200 configs.php Show response
recordedfuture.matomo.cloud/plugins/HeatmapSessionRecording/ 116 B
291 B 56ms
39ms Script
application/javascript 18.195.235.189
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://recordedfuture.matomo.cloud/plugins/HeatmapSessionRecording/configs.php?idsite=2&trackerid=yhmwZF&url=https%3A%2F%2Ftherecord.media%2Fhackers-using-follina-windows-zero-day-to-spread-qbot-malware%2F
Requested by: Host: cdn.matomo.cloud
URL: https://cdn.matomo.cloud/recordedfuture.matomo.cloud/matomo.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.195.235.189 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-195-235-189.eu-central-1.compute.amazonaws.com
Software: Apache /
Resource Hash: 11ab899a6359502c4cfe325cebe31a26e67537ed6b287e5ebea7e985de2989ef

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://therecord.media/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Fri, 10 Jun 2022 01:54:53 GMT
content-encoding: gzip
server: Apache
content-length: 119
vary: X-Forwarded-Port-Override,X-Forwarded-Proto-Override,Accept-Encoding,User-Agent
content-type: application/javascript

GET
H3 200 www-widgetapi.js Show response
www.youtube.com/s/player/23010b46/www-widgetapi.vflset/ 158 KB
51 KB 100ms
33ms Script
text/javascript 2a00:1450:4001:80b::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/s/player/23010b46/www-widgetapi.vflset/www-widgetapi.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/iframe_api

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f0bf1c54df72511eb129c54b9cbcabf1c683b65393a5886566518191f38cbe58

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://therecord.media/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Thu, 09 Jun 2022 16:03:40 GMT
content-encoding: br
x-content-type-options: nosniff
age: 35474
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 52373
x-xss-protection: 0
last-modified: Thu, 09 Jun 2022 00:16:41 GMT
server: sffe
vary: Accept-Encoding, Origin
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
expires: Fri, 09 Jun 2023 16:03:40 GMT

GET
H/1.1 200
OK getuidj Show response
secure.adnxs.com/ 11 B
705 B 118ms
37ms XHR
application/json 37.252.172.123
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/getuidj

Requested by

Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.123 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

868.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

nginx/1.21.3 /

Resource Hash

31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://therecord.media/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 10 Jun 2022 01:54:54 GMT
X-Proxy-Origin: 192.145.127.214; 192.145.127.214; 868.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 7b692da7-b4b6-45fa-9483-8fb6c129643f
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://therecord.media
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 11
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK / Show response
c.6sc.co/ 47 B
371 B 147ms
45ms XHR
text/plain 96.16.137.162
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://c.6sc.co/
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 96.16.137.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a96-16-137-162.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 2fc6266f80a8065e57439fe8d2ccba6e6edeadefe5a92d98d0111b96d0a31b88

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://therecord.media/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date: Fri, 10 Jun 2022 01:54:54 GMT
Access-Control-Max-Age: 86400
Access-Control-Allow-Methods: GET,POST
Content-Type: text/plain
Access-Control-Allow-Origin: https://therecord.media
Access-Control-Allow-Credentials: true
Connection: keep-alive
Access-Control-Allow-Headers: *
Content-Length: 47

GET
H2 200 / Show response
ipv6.6sc.co/ 18 B
251 B 117ms
36ms XHR
text/html 2a02:26f0:1700:1b1::1c91
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://ipv6.6sc.co/
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:1700:1b1::1c91 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: 5a64c92760eb1f6473da15b73c8b8c754455dc3a87cd0432c11ceb0a826f9a0d

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://therecord.media/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 10 Jun 2022 01:54:54 GMT
vary: Origin
content-type: text/html
access-control-allow-origin: https://therecord.media
cache-control: max-age=0, no-cache, no-store
6si-ipv6: 2001:ac8:24:44::19
server-timing: cdn-cache; desc=HIT, edge; dur=1
content-length: 18
expires: Fri, 10 Jun 2022 01:54:54 GMT

GET
H/1.1 200
OK tweet.45758a9d6fd14fe4ebd62b2170932592.js Show response
platform.twitter.com/js/ 8 KB
3 KB 22ms
22ms Script
application/javascript 2606:2800:234:59:254c:406:2366:268c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/js/tweet.45758a9d6fd14fe4ebd62b2170932592.js
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (mil/6CE2) /
Resource Hash: 4d64259e1efa5608b9da553ac10da15df5717d41e66fc25cada5a83697b72bed

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://therecord.media/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date: Fri, 10 Jun 2022 01:54:54 GMT
Content-Encoding: gzip
Age: 289586
X-Cache: HIT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server-Timing: "x-cache;desc= HIT,x-tw-cdn;desc=VZ",edge;dur=1
Content-Length: 2690
x-tw-cdn: VZ
Last-Modified: Thu, 02 Jun 2022 18:01:33 GMT
Server: ECS (mil/6CE2)
Etag: "e4bf092baf573285fddcbcaa6197634d+gzip"
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=315360000

GET
H/1.1 200
OK Tweet.html Show response
platform.twitter.com/embed/ Frame 3209 487 B
1 KB 23ms
22ms Document
text/html 2606:2800:234:59:254c:406:2366:268c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/embed/Tweet.html?creatorScreenName=jgreigj&dnt=true&embedId=twitter-widget-0&features=eyJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3JlZnNyY19zZXNzaW9uIjp7ImJ1Y2tldCI6Im9mZiIsInZlcnNpb24iOm51bGx9LCJ0Zndfc2Vuc2l0aXZlX21lZGlhX2ludGVyc3RpdGlhbF8xMzk2MyI6eyJidWNrZXQiOiJpbnRlcnN0aXRpYWwiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3R3ZWV0X3Jlc3VsdF9taWdyYXRpb25fMTM5NzkiOnsiYnVja2V0IjoidHdlZXRfcmVzdWx0IiwidmVyc2lvbiI6bnVsbH19&frame=false&hideCard=false&hideThread=false&id=1534227619222196224&lang=en&origin=https%3A%2F%2Ftherecord.media%2Fhackers-using-follina-windows-zero-day-to-spread-qbot-malware%2F&sessionId=8052476664b15c65e1b059b9c5151d88882dc921&siteScreenName=therecord_media&theme=light&widgetsVersion=b45a03c79d4c1%3A1654150928467&width=500px
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (mil/6CED) /
Resource Hash: c10df3d27c1d58c6f722e77696a5786542dba09ba506b09ac4e0a548106ccec6

Request headers

Referer: https://therecord.media/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
accept-language: it-IT,it;q=0.9

Response headers

Accept-Ranges: bytes
Access-Control-Allow-Methods: GET
Access-Control-Allow-Origin: *
Age: 58
Cache-Control: public, max-age=1800
Content-Length: 487
Content-Type: text/html; charset=utf-8
Date: Fri, 10 Jun 2022 01:54:54 GMT
Etag: "97e3ad2b09c08dc43cc138ec6a2da62a"
Last-Modified: Mon, 06 Jun 2022 17:12:40 GMT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server: ECS (mil/6CED)
Server-Timing: "x-cache;desc= HIT,x-tw-cdn;desc=",edge;dur=1
X-Cache: HIT
x-tw-cdn: VZ

GET
H/1.1 200
OK Tweet.html Show response
platform.twitter.com/embed/ Frame E294 487 B
1 KB 44ms
22ms Document
text/html 2606:2800:234:59:254c:406:2366:268c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/embed/Tweet.html?creatorScreenName=jgreigj&dnt=true&embedId=twitter-widget-1&features=eyJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3JlZnNyY19zZXNzaW9uIjp7ImJ1Y2tldCI6Im9mZiIsInZlcnNpb24iOm51bGx9LCJ0Zndfc2Vuc2l0aXZlX21lZGlhX2ludGVyc3RpdGlhbF8xMzk2MyI6eyJidWNrZXQiOiJpbnRlcnN0aXRpYWwiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3R3ZWV0X3Jlc3VsdF9taWdyYXRpb25fMTM5NzkiOnsiYnVja2V0IjoidHdlZXRfcmVzdWx0IiwidmVyc2lvbiI6bnVsbH19&frame=false&hideCard=false&hideThread=false&id=1534213925750841346&lang=en&origin=https%3A%2F%2Ftherecord.media%2Fhackers-using-follina-windows-zero-day-to-spread-qbot-malware%2F&sessionId=8052476664b15c65e1b059b9c5151d88882dc921&siteScreenName=therecord_media&theme=light&widgetsVersion=b45a03c79d4c1%3A1654150928467&width=500px
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (mil/6CED) /
Resource Hash: c10df3d27c1d58c6f722e77696a5786542dba09ba506b09ac4e0a548106ccec6

Request headers

Referer: https://therecord.media/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
accept-language: it-IT,it;q=0.9

Response headers

Accept-Ranges: bytes
Access-Control-Allow-Methods: GET
Access-Control-Allow-Origin: *
Age: 58
Cache-Control: public, max-age=1800
Content-Length: 487
Content-Type: text/html; charset=utf-8
Date: Fri, 10 Jun 2022 01:54:54 GMT
Etag: "97e3ad2b09c08dc43cc138ec6a2da62a"
Last-Modified: Mon, 06 Jun 2022 17:12:40 GMT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server: ECS (mil/6CED)
Server-Timing: "x-cache;desc= HIT,x-tw-cdn;desc=",edge;dur=1
X-Cache: HIT
x-tw-cdn: VZ

GET
H2 200 jot
syndication.twitter.com/i/ 43 B
380 B 154ms
153ms Image
image/gif 104.244.42.72
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://syndication.twitter.com/i/jot?dnt=1&l=%7B%22experiment_key%22%3A%22tfw_tweet_result_migration_13979%22%2C%22bucket%22%3A%22tweet_result%22%2C%22version%22%3Anull%2C%22data%22%3A%7B%22item_ids%22%3A%5B%221534227619222196224%22%5D%2C%22item_details%22%3A%7B%221534227619222196224%22%3A%7B%22item_type%22%3A0%7D%7D%7D%2C%22_category_%22%3A%22tfw_client_event%22%2C%22triggered_on%22%3A1654826094088%2C%22dnt%22%3Atrue%2C%22client_version%22%3A%22b45a03c79d4c1%3A1654150928467%22%2C%22format_version%22%3A1%2C%22widget_origin%22%3A%22%22%2C%22event_namespace%22%3A%7B%22client%22%3A%22tfw%22%2C%22page%22%3A%22ddg%22%2C%22section%22%3A%22tfw_tweet_result_migration_13979%22%2C%22action%22%3A%22experiment%22%7D%7D&session_id=8052476664b15c65e1b059b9c5151d88882dc921

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.72 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://therecord.media/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Fri, 10 Jun 2022 01:54:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 200 OK
x-twitter-response-tags: BouncerCompliant
content-length: 65
x-xss-protection: 0
x-response-time: 121
pragma: no-cache
last-modified: Fri, 10 Jun 2022 01:54:54 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=631138519
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: b2893ae3710a6454d8bac6901536bbd8e87559c59ad398b0904dbc60364eac87
x-transaction: 9a31a290ce7f6d5f
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H2 200 jot
syndication.twitter.com/i/ 43 B
124 B 155ms
154ms Image
image/gif 104.244.42.72
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://syndication.twitter.com/i/jot?dnt=1&l=%7B%22experiment_key%22%3A%22tfw_tweet_result_migration_13979%22%2C%22bucket%22%3A%22tweet_result%22%2C%22version%22%3Anull%2C%22data%22%3A%7B%22item_ids%22%3A%5B%221534213925750841346%22%5D%2C%22item_details%22%3A%7B%221534213925750841346%22%3A%7B%22item_type%22%3A0%7D%7D%7D%2C%22_category_%22%3A%22tfw_client_event%22%2C%22triggered_on%22%3A1654826094089%2C%22dnt%22%3Atrue%2C%22client_version%22%3A%22b45a03c79d4c1%3A1654150928467%22%2C%22format_version%22%3A1%2C%22widget_origin%22%3A%22%22%2C%22event_namespace%22%3A%7B%22client%22%3A%22tfw%22%2C%22page%22%3A%22ddg%22%2C%22section%22%3A%22tfw_tweet_result_migration_13979%22%2C%22action%22%3A%22experiment%22%7D%7D&session_id=8052476664b15c65e1b059b9c5151d88882dc921

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.72 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://therecord.media/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Fri, 10 Jun 2022 01:54:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 200 OK
x-twitter-response-tags: BouncerCompliant
content-length: 65
x-xss-protection: 0
x-response-time: 123
pragma: no-cache
last-modified: Fri, 10 Jun 2022 01:54:54 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=631138519
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: b2893ae3710a6454d8bac6901536bbd8e87559c59ad398b0904dbc60364eac87
x-transaction: 80203dcf8a1d8df4
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H/1.1 200
OK img.gif
b.6sc.co/v1/beacon/ 43 B
774 B 434ms
328ms Image
image/gif 96.16.137.162
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=f2675e8089b7d209a58fce8ad312f51c&svisitor=null&session=36eb704f-5002-4342-8113-a75bb3013cc7&event=ipv6&q=%7B%22address%22%3A%222001%3Aac8%3A24%3A44%3A%3A19%22%7D&isIframe=false&m=%7B%22description%22%3A%22The%20Record%20by%20Recorded%20Future%20gives%20exclusive%2C%20behind-the-scenes%20access%20to%20leaders%2C%20policymakers%2C%20researchers%2C%20and%20the%20shadows%20of%20the%20cyber%20underground.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Hackers%20using%20Follina%20Windows%20zero-day%20to%20spread%20Qbot%20malware%20-%20The%20Record%20by%20Recorded%20Future%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Ftherecord.media%2Fhackers-using-follina-windows-zero-day-to-spread-qbot-malware%2F&pageViewId=a8235557-2555-4bb2-85e0-a982aee06d52

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

96.16.137.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a96-16-137-162.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://therecord.media/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date: Fri, 10 Jun 2022 01:54:54 GMT
X-Content-Type-Options: nosniff
Connection: keep-alive
Content-Length: 43
Pragma: no-cache
Last-Modified: Sat, 05 Jun 2021 07:56:05 GMT
Server: nginx/1.14.0 (Ubuntu)
ETag: "60bb2e15-2b"
Access-Control-Max-Age: 86400
Access-Control-Allow-Methods: GET,POST
Content-Type: image/gif
Access-Control-Allow-Origin
Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Access-Control-Allow-Credentials: true
Accept-Ranges: bytes
Access-Control-Allow-Headers: *
Expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H/1.1 200
OK img.gif
b.6sc.co/v1/beacon/ 43 B
774 B 319ms
215ms Image
image/gif 96.16.137.162
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=f2675e8089b7d209a58fce8ad312f51c&svisitor=null&session=36eb704f-5002-4342-8113-a75bb3013cc7&event=a_pageload&q=%7B%22pageLoadTime%22%3A%22Fri%2C%2010%20Jun%202022%2001%3A54%3A53%20GMT%22%7D&isIframe=false&m=%7B%22description%22%3A%22The%20Record%20by%20Recorded%20Future%20gives%20exclusive%2C%20behind-the-scenes%20access%20to%20leaders%2C%20policymakers%2C%20researchers%2C%20and%20the%20shadows%20of%20the%20cyber%20underground.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Hackers%20using%20Follina%20Windows%20zero-day%20to%20spread%20Qbot%20malware%20-%20The%20Record%20by%20Recorded%20Future%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Ftherecord.media%2Fhackers-using-follina-windows-zero-day-to-spread-qbot-malware%2F&pageViewId=a8235557-2555-4bb2-85e0-a982aee06d52&an_uid=0

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

96.16.137.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a96-16-137-162.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://therecord.media/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date: Fri, 10 Jun 2022 01:54:54 GMT
X-Content-Type-Options: nosniff
Connection: keep-alive
Content-Length: 43
Pragma: no-cache
Last-Modified: Sat, 05 Jun 2021 07:56:05 GMT
Server: nginx/1.14.0 (Ubuntu)
ETag: "60bb2e15-2b"
Access-Control-Max-Age: 86400
Access-Control-Allow-Methods: GET,POST
Content-Type: image/gif
Access-Control-Allow-Origin
Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Access-Control-Allow-Credentials: true
Accept-Ranges: bytes
Access-Control-Allow-Headers: *
Expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H/1.1 200
OK embed.runtime.ff468dfcc26885f2cd74.js Show response
platform.twitter.com/embed/ Frame 3209 9 KB
5 KB 40ms
24ms Script
application/javascript 2606:2800:234:59:254c:406:2366:268c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/embed/embed.runtime.ff468dfcc26885f2cd74.js
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/embed/Tweet.html?creatorScreenName=jgreigj&dnt=true&embedId=twitter-widget-0&features=eyJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3JlZnNyY19zZXNzaW9uIjp7ImJ1Y2tldCI6Im9mZiIsInZlcnNpb24iOm51bGx9LCJ0Zndfc2Vuc2l0aXZlX21lZGlhX2ludGVyc3RpdGlhbF8xMzk2MyI6eyJidWNrZXQiOiJpbnRlcnN0aXRpYWwiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3R3ZWV0X3Jlc3VsdF9taWdyYXRpb25fMTM5NzkiOnsiYnVja2V0IjoidHdlZXRfcmVzdWx0IiwidmVyc2lvbiI6bnVsbH19&frame=false&hideCard=false&hideThread=false&id=1534227619222196224&lang=en&origin=https%3A%2F%2Ftherecord.media%2Fhackers-using-follina-windows-zero-day-to-spread-qbot-malware%2F&sessionId=8052476664b15c65e1b059b9c5151d88882dc921&siteScreenName=therecord_media&theme=light&widgetsVersion=b45a03c79d4c1%3A1654150928467&width=500px
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (mil/6CF1) /
Resource Hash: 5e153d670d4df48314dc57d6f9062a26d4bcdfdfdfc2bc2fd42f45f3215ed62a

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://platform.twitter.com/embed/Tweet.html?creatorScreenName=jgreigj&dnt=true&embedId=twitter-widget-0&features=eyJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3JlZnNyY19zZXNzaW9uIjp7ImJ1Y2tldCI6Im9mZiIsInZlcnNpb24iOm51bGx9LCJ0Zndfc2Vuc2l0aXZlX21lZGlhX2ludGVyc3RpdGlhbF8xMzk2MyI6eyJidWNrZXQiOiJpbnRlcnN0aXRpYWwiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3R3ZWV0X3Jlc3VsdF9taWdyYXRpb25fMTM5NzkiOnsiYnVja2V0IjoidHdlZXRfcmVzdWx0IiwidmVyc2lvbiI6bnVsbH19&frame=false&hideCard=false&hideThread=false&id=1534227619222196224&lang=en&origin=https%3A%2F%2Ftherecord.media%2Fhackers-using-follina-windows-zero-day-to-spread-qbot-malware%2F&sessionId=8052476664b15c65e1b059b9c5151d88882dc921&siteScreenName=therecord_media&theme=light&widgetsVersion=b45a03c79d4c1%3A1654150928467&width=500px
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date: Fri, 10 Jun 2022 01:54:54 GMT
Content-Encoding: gzip
Age: 289586
X-Cache: HIT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server-Timing: "x-cache;desc= HIT,x-tw-cdn;desc=",edge;dur=1
Content-Length: 4255
x-tw-cdn: VZ
Last-Modified: Mon, 06 Jun 2022 17:12:39 GMT
Server: ECS (mil/6CF1)
Etag: "f824375fd8f44e2e0f1fe8f4d5a6e177+gzip"
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=315360000

GET
H/1.1 200
OK embed.modules.f34a0f34273ac52f3e51.js Show response
platform.twitter.com/embed/ Frame 3209 512 KB
168 KB 65ms
23ms Script
application/javascript 2606:2800:234:59:254c:406:2366:268c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/embed/embed.modules.f34a0f34273ac52f3e51.js
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/embed/Tweet.html?creatorScreenName=jgreigj&dnt=true&embedId=twitter-widget-0&features=eyJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3JlZnNyY19zZXNzaW9uIjp7ImJ1Y2tldCI6Im9mZiIsInZlcnNpb24iOm51bGx9LCJ0Zndfc2Vuc2l0aXZlX21lZGlhX2ludGVyc3RpdGlhbF8xMzk2MyI6eyJidWNrZXQiOiJpbnRlcnN0aXRpYWwiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3R3ZWV0X3Jlc3VsdF9taWdyYXRpb25fMTM5NzkiOnsiYnVja2V0IjoidHdlZXRfcmVzdWx0IiwidmVyc2lvbiI6bnVsbH19&frame=false&hideCard=false&hideThread=false&id=1534227619222196224&lang=en&origin=https%3A%2F%2Ftherecord.media%2Fhackers-using-follina-windows-zero-day-to-spread-qbot-malware%2F&sessionId=8052476664b15c65e1b059b9c5151d88882dc921&siteScreenName=therecord_media&theme=light&widgetsVersion=b45a03c79d4c1%3A1654150928467&width=500px
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (mil/6CDF) /
Resource Hash: 5e794d4a1df5f1c1035c15d1f24e115f9fdab9be376f12754239b981f61bf887

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://platform.twitter.com/embed/Tweet.html?creatorScreenName=jgreigj&dnt=true&embedId=twitter-widget-0&features=eyJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3JlZnNyY19zZXNzaW9uIjp7ImJ1Y2tldCI6Im9mZiIsInZlcnNpb24iOm51bGx9LCJ0Zndfc2Vuc2l0aXZlX21lZGlhX2ludGVyc3RpdGlhbF8xMzk2MyI6eyJidWNrZXQiOiJpbnRlcnN0aXRpYWwiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3R3ZWV0X3Jlc3VsdF9taWdyYXRpb25fMTM5NzkiOnsiYnVja2V0IjoidHdlZXRfcmVzdWx0IiwidmVyc2lvbiI6bnVsbH19&frame=false&hideCard=false&hideThread=false&id=1534227619222196224&lang=en&origin=https%3A%2F%2Ftherecord.media%2Fhackers-using-follina-windows-zero-day-to-spread-qbot-malware%2F&sessionId=8052476664b15c65e1b059b9c5151d88882dc921&siteScreenName=therecord_media&theme=light&widgetsVersion=b45a03c79d4c1%3A1654150928467&width=500px
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date: Fri, 10 Jun 2022 01:54:54 GMT
Content-Encoding: gzip
Age: 289585
X-Cache: HIT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server-Timing: "x-cache;desc= HIT,x-tw-cdn;desc=VZ",edge;dur=1
Content-Length: 171249
x-tw-cdn: VZ
Last-Modified: Mon, 06 Jun 2022 17:12:39 GMT
Server: ECS (mil/6CDF)
Etag: "7490e7a386def1875edc794009edc560+gzip"
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=315360000

GET
H/1.1 200
OK embed.i18n.58f3645101e687f24f08.js Show response
platform.twitter.com/embed/ Frame 3209 2 KB
1 KB 67ms
24ms Script
application/javascript 2606:2800:234:59:254c:406:2366:268c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/embed/embed.i18n.58f3645101e687f24f08.js
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/embed/Tweet.html?creatorScreenName=jgreigj&dnt=true&embedId=twitter-widget-0&features=eyJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3JlZnNyY19zZXNzaW9uIjp7ImJ1Y2tldCI6Im9mZiIsInZlcnNpb24iOm51bGx9LCJ0Zndfc2Vuc2l0aXZlX21lZGlhX2ludGVyc3RpdGlhbF8xMzk2MyI6eyJidWNrZXQiOiJpbnRlcnN0aXRpYWwiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3R3ZWV0X3Jlc3VsdF9taWdyYXRpb25fMTM5NzkiOnsiYnVja2V0IjoidHdlZXRfcmVzdWx0IiwidmVyc2lvbiI6bnVsbH19&frame=false&hideCard=false&hideThread=false&id=1534227619222196224&lang=en&origin=https%3A%2F%2Ftherecord.media%2Fhackers-using-follina-windows-zero-day-to-spread-qbot-malware%2F&sessionId=8052476664b15c65e1b059b9c5151d88882dc921&siteScreenName=therecord_media&theme=light&widgetsVersion=b45a03c79d4c1%3A1654150928467&width=500px
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (mil/6CF4) /
Resource Hash: 52c19e156be623c2b03edbf619561b9ce54fef7186e33dc7152bb17b7cc2f1ec

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://platform.twitter.com/embed/Tweet.html?creatorScreenName=jgreigj&dnt=true&embedId=twitter-widget-0&features=eyJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3JlZnNyY19zZXNzaW9uIjp7ImJ1Y2tldCI6Im9mZiIsInZlcnNpb24iOm51bGx9LCJ0Zndfc2Vuc2l0aXZlX21lZGlhX2ludGVyc3RpdGlhbF8xMzk2MyI6eyJidWNrZXQiOiJpbnRlcnN0aXRpYWwiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3R3ZWV0X3Jlc3VsdF9taWdyYXRpb25fMTM5NzkiOnsiYnVja2V0IjoidHdlZXRfcmVzdWx0IiwidmVyc2lvbiI6bnVsbH19&frame=false&hideCard=false&hideThread=false&id=1534227619222196224&lang=en&origin=https%3A%2F%2Ftherecord.media%2Fhackers-using-follina-windows-zero-day-to-spread-qbot-malware%2F&sessionId=8052476664b15c65e1b059b9c5151d88882dc921&siteScreenName=therecord_media&theme=light&widgetsVersion=b45a03c79d4c1%3A1654150928467&width=500px
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date: Fri, 10 Jun 2022 01:54:54 GMT
Content-Encoding: gzip
Age: 289586
X-Cache: HIT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server-Timing: "x-cache;desc= HIT,x-tw-cdn;desc=",edge;dur=1
Content-Length: 794
x-tw-cdn: VZ
Last-Modified: Mon, 06 Jun 2022 17:12:39 GMT
Server: ECS (mil/6CF4)
Etag: "cfb405c70f2f1c1a003ec96fa540cf30+gzip"
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=315360000

GET
H/1.1 200
OK embed.Tweet.a041e79d959212ec9ef6.js Show response
platform.twitter.com/embed/ Frame 3209 14 KB
6 KB 99ms
24ms Script
application/javascript 2606:2800:234:59:254c:406:2366:268c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/embed/embed.Tweet.a041e79d959212ec9ef6.js
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/embed/Tweet.html?creatorScreenName=jgreigj&dnt=true&embedId=twitter-widget-0&features=eyJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3JlZnNyY19zZXNzaW9uIjp7ImJ1Y2tldCI6Im9mZiIsInZlcnNpb24iOm51bGx9LCJ0Zndfc2Vuc2l0aXZlX21lZGlhX2ludGVyc3RpdGlhbF8xMzk2MyI6eyJidWNrZXQiOiJpbnRlcnN0aXRpYWwiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3R3ZWV0X3Jlc3VsdF9taWdyYXRpb25fMTM5NzkiOnsiYnVja2V0IjoidHdlZXRfcmVzdWx0IiwidmVyc2lvbiI6bnVsbH19&frame=false&hideCard=false&hideThread=false&id=1534227619222196224&lang=en&origin=https%3A%2F%2Ftherecord.media%2Fhackers-using-follina-windows-zero-day-to-spread-qbot-malware%2F&sessionId=8052476664b15c65e1b059b9c5151d88882dc921&siteScreenName=therecord_media&theme=light&widgetsVersion=b45a03c79d4c1%3A1654150928467&width=500px
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (mil/6CF0) /
Resource Hash: dc9ae7c30a725e1a3e0da25b2cf138836c154b77a51decb32e2c58cdd3d48094

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://platform.twitter.com/embed/Tweet.html?creatorScreenName=jgreigj&dnt=true&embedId=twitter-widget-0&features=eyJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3JlZnNyY19zZXNzaW9uIjp7ImJ1Y2tldCI6Im9mZiIsInZlcnNpb24iOm51bGx9LCJ0Zndfc2Vuc2l0aXZlX21lZGlhX2ludGVyc3RpdGlhbF8xMzk2MyI6eyJidWNrZXQiOiJpbnRlcnN0aXRpYWwiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3R3ZWV0X3Jlc3VsdF9taWdyYXRpb25fMTM5NzkiOnsiYnVja2V0IjoidHdlZXRfcmVzdWx0IiwidmVyc2lvbiI6bnVsbH19&frame=false&hideCard=false&hideThread=false&id=1534227619222196224&lang=en&origin=https%3A%2F%2Ftherecord.media%2Fhackers-using-follina-windows-zero-day-to-spread-qbot-malware%2F&sessionId=8052476664b15c65e1b059b9c5151d88882dc921&siteScreenName=therecord_media&theme=light&widgetsVersion=b45a03c79d4c1%3A1654150928467&width=500px
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date: Fri, 10 Jun 2022 01:54:54 GMT
Content-Encoding: gzip
Age: 289586
X-Cache: HIT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server-Timing: "x-cache;desc= HIT,x-tw-cdn;desc=",edge;dur=1
Content-Length: 5636
x-tw-cdn: VZ
Last-Modified: Mon, 06 Jun 2022 17:12:39 GMT
Server: ECS (mil/6CF0)
Etag: "295df71a71f3410cbdbf6a6dbdee02c8+gzip"
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=315360000

GET
H/1.1 200
OK embed.runtime.ff468dfcc26885f2cd74.js Show response
platform.twitter.com/embed/ Frame E294 9 KB
5 KB 79ms
25ms Script
application/javascript 2606:2800:234:59:254c:406:2366:268c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/embed/embed.runtime.ff468dfcc26885f2cd74.js
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/embed/Tweet.html?creatorScreenName=jgreigj&dnt=true&embedId=twitter-widget-1&features=eyJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3JlZnNyY19zZXNzaW9uIjp7ImJ1Y2tldCI6Im9mZiIsInZlcnNpb24iOm51bGx9LCJ0Zndfc2Vuc2l0aXZlX21lZGlhX2ludGVyc3RpdGlhbF8xMzk2MyI6eyJidWNrZXQiOiJpbnRlcnN0aXRpYWwiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3R3ZWV0X3Jlc3VsdF9taWdyYXRpb25fMTM5NzkiOnsiYnVja2V0IjoidHdlZXRfcmVzdWx0IiwidmVyc2lvbiI6bnVsbH19&frame=false&hideCard=false&hideThread=false&id=1534213925750841346&lang=en&origin=https%3A%2F%2Ftherecord.media%2Fhackers-using-follina-windows-zero-day-to-spread-qbot-malware%2F&sessionId=8052476664b15c65e1b059b9c5151d88882dc921&siteScreenName=therecord_media&theme=light&widgetsVersion=b45a03c79d4c1%3A1654150928467&width=500px
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (mil/6CF1) /
Resource Hash: 5e153d670d4df48314dc57d6f9062a26d4bcdfdfdfc2bc2fd42f45f3215ed62a

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://platform.twitter.com/embed/Tweet.html?creatorScreenName=jgreigj&dnt=true&embedId=twitter-widget-1&features=eyJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3JlZnNyY19zZXNzaW9uIjp7ImJ1Y2tldCI6Im9mZiIsInZlcnNpb24iOm51bGx9LCJ0Zndfc2Vuc2l0aXZlX21lZGlhX2ludGVyc3RpdGlhbF8xMzk2MyI6eyJidWNrZXQiOiJpbnRlcnN0aXRpYWwiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3R3ZWV0X3Jlc3VsdF9taWdyYXRpb25fMTM5NzkiOnsiYnVja2V0IjoidHdlZXRfcmVzdWx0IiwidmVyc2lvbiI6bnVsbH19&frame=false&hideCard=false&hideThread=false&id=1534213925750841346&lang=en&origin=https%3A%2F%2Ftherecord.media%2Fhackers-using-follina-windows-zero-day-to-spread-qbot-malware%2F&sessionId=8052476664b15c65e1b059b9c5151d88882dc921&siteScreenName=therecord_media&theme=light&widgetsVersion=b45a03c79d4c1%3A1654150928467&width=500px
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date: Fri, 10 Jun 2022 01:54:54 GMT
Content-Encoding: gzip
Age: 289586
X-Cache: HIT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server-Timing: "x-cache;desc= HIT,x-tw-cdn;desc=",edge;dur=1
Content-Length: 4255
x-tw-cdn: VZ
Last-Modified: Mon, 06 Jun 2022 17:12:39 GMT
Server: ECS (mil/6CF1)
Etag: "f824375fd8f44e2e0f1fe8f4d5a6e177+gzip"
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=315360000

GET
H/1.1 200
OK embed.modules.f34a0f34273ac52f3e51.js Show response
platform.twitter.com/embed/ Frame E294 512 KB
168 KB 80ms
26ms Script
application/javascript 2606:2800:234:59:254c:406:2366:268c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/embed/embed.modules.f34a0f34273ac52f3e51.js
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/embed/Tweet.html?creatorScreenName=jgreigj&dnt=true&embedId=twitter-widget-1&features=eyJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3JlZnNyY19zZXNzaW9uIjp7ImJ1Y2tldCI6Im9mZiIsInZlcnNpb24iOm51bGx9LCJ0Zndfc2Vuc2l0aXZlX21lZGlhX2ludGVyc3RpdGlhbF8xMzk2MyI6eyJidWNrZXQiOiJpbnRlcnN0aXRpYWwiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3R3ZWV0X3Jlc3VsdF9taWdyYXRpb25fMTM5NzkiOnsiYnVja2V0IjoidHdlZXRfcmVzdWx0IiwidmVyc2lvbiI6bnVsbH19&frame=false&hideCard=false&hideThread=false&id=1534213925750841346&lang=en&origin=https%3A%2F%2Ftherecord.media%2Fhackers-using-follina-windows-zero-day-to-spread-qbot-malware%2F&sessionId=8052476664b15c65e1b059b9c5151d88882dc921&siteScreenName=therecord_media&theme=light&widgetsVersion=b45a03c79d4c1%3A1654150928467&width=500px
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (mil/6CDF) /
Resource Hash: 5e794d4a1df5f1c1035c15d1f24e115f9fdab9be376f12754239b981f61bf887

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://platform.twitter.com/embed/Tweet.html?creatorScreenName=jgreigj&dnt=true&embedId=twitter-widget-1&features=eyJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3JlZnNyY19zZXNzaW9uIjp7ImJ1Y2tldCI6Im9mZiIsInZlcnNpb24iOm51bGx9LCJ0Zndfc2Vuc2l0aXZlX21lZGlhX2ludGVyc3RpdGlhbF8xMzk2MyI6eyJidWNrZXQiOiJpbnRlcnN0aXRpYWwiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3R3ZWV0X3Jlc3VsdF9taWdyYXRpb25fMTM5NzkiOnsiYnVja2V0IjoidHdlZXRfcmVzdWx0IiwidmVyc2lvbiI6bnVsbH19&frame=false&hideCard=false&hideThread=false&id=1534213925750841346&lang=en&origin=https%3A%2F%2Ftherecord.media%2Fhackers-using-follina-windows-zero-day-to-spread-qbot-malware%2F&sessionId=8052476664b15c65e1b059b9c5151d88882dc921&siteScreenName=therecord_media&theme=light&widgetsVersion=b45a03c79d4c1%3A1654150928467&width=500px
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date: Fri, 10 Jun 2022 01:54:54 GMT
Content-Encoding: gzip
Age: 289585
X-Cache: HIT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server-Timing: "x-cache;desc= HIT,x-tw-cdn;desc=VZ",edge;dur=1
Content-Length: 171249
x-tw-cdn: VZ
Last-Modified: Mon, 06 Jun 2022 17:12:39 GMT
Server: ECS (mil/6CDF)
Etag: "7490e7a386def1875edc794009edc560+gzip"
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=315360000

GET
H/1.1 200
OK embed.i18n.58f3645101e687f24f08.js Show response
platform.twitter.com/embed/ Frame E294 2 KB
1 KB 80ms
27ms Script
application/javascript 2606:2800:234:59:254c:406:2366:268c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/embed/embed.i18n.58f3645101e687f24f08.js
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/embed/Tweet.html?creatorScreenName=jgreigj&dnt=true&embedId=twitter-widget-1&features=eyJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3JlZnNyY19zZXNzaW9uIjp7ImJ1Y2tldCI6Im9mZiIsInZlcnNpb24iOm51bGx9LCJ0Zndfc2Vuc2l0aXZlX21lZGlhX2ludGVyc3RpdGlhbF8xMzk2MyI6eyJidWNrZXQiOiJpbnRlcnN0aXRpYWwiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3R3ZWV0X3Jlc3VsdF9taWdyYXRpb25fMTM5NzkiOnsiYnVja2V0IjoidHdlZXRfcmVzdWx0IiwidmVyc2lvbiI6bnVsbH19&frame=false&hideCard=false&hideThread=false&id=1534213925750841346&lang=en&origin=https%3A%2F%2Ftherecord.media%2Fhackers-using-follina-windows-zero-day-to-spread-qbot-malware%2F&sessionId=8052476664b15c65e1b059b9c5151d88882dc921&siteScreenName=therecord_media&theme=light&widgetsVersion=b45a03c79d4c1%3A1654150928467&width=500px
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (mil/6CF4) /
Resource Hash: 52c19e156be623c2b03edbf619561b9ce54fef7186e33dc7152bb17b7cc2f1ec

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://platform.twitter.com/embed/Tweet.html?creatorScreenName=jgreigj&dnt=true&embedId=twitter-widget-1&features=eyJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3JlZnNyY19zZXNzaW9uIjp7ImJ1Y2tldCI6Im9mZiIsInZlcnNpb24iOm51bGx9LCJ0Zndfc2Vuc2l0aXZlX21lZGlhX2ludGVyc3RpdGlhbF8xMzk2MyI6eyJidWNrZXQiOiJpbnRlcnN0aXRpYWwiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3R3ZWV0X3Jlc3VsdF9taWdyYXRpb25fMTM5NzkiOnsiYnVja2V0IjoidHdlZXRfcmVzdWx0IiwidmVyc2lvbiI6bnVsbH19&frame=false&hideCard=false&hideThread=false&id=1534213925750841346&lang=en&origin=https%3A%2F%2Ftherecord.media%2Fhackers-using-follina-windows-zero-day-to-spread-qbot-malware%2F&sessionId=8052476664b15c65e1b059b9c5151d88882dc921&siteScreenName=therecord_media&theme=light&widgetsVersion=b45a03c79d4c1%3A1654150928467&width=500px
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date: Fri, 10 Jun 2022 01:54:54 GMT
Content-Encoding: gzip
Age: 289586
X-Cache: HIT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server-Timing: "x-cache;desc= HIT,x-tw-cdn;desc=",edge;dur=1
Content-Length: 794
x-tw-cdn: VZ
Last-Modified: Mon, 06 Jun 2022 17:12:39 GMT
Server: ECS (mil/6CF4)
Etag: "cfb405c70f2f1c1a003ec96fa540cf30+gzip"
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=315360000

GET
H/1.1 200
OK embed.Tweet.a041e79d959212ec9ef6.js Show response
platform.twitter.com/embed/ Frame E294 14 KB
6 KB 81ms
28ms Script
application/javascript 2606:2800:234:59:254c:406:2366:268c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/embed/embed.Tweet.a041e79d959212ec9ef6.js
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/embed/Tweet.html?creatorScreenName=jgreigj&dnt=true&embedId=twitter-widget-1&features=eyJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3JlZnNyY19zZXNzaW9uIjp7ImJ1Y2tldCI6Im9mZiIsInZlcnNpb24iOm51bGx9LCJ0Zndfc2Vuc2l0aXZlX21lZGlhX2ludGVyc3RpdGlhbF8xMzk2MyI6eyJidWNrZXQiOiJpbnRlcnN0aXRpYWwiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3R3ZWV0X3Jlc3VsdF9taWdyYXRpb25fMTM5NzkiOnsiYnVja2V0IjoidHdlZXRfcmVzdWx0IiwidmVyc2lvbiI6bnVsbH19&frame=false&hideCard=false&hideThread=false&id=1534213925750841346&lang=en&origin=https%3A%2F%2Ftherecord.media%2Fhackers-using-follina-windows-zero-day-to-spread-qbot-malware%2F&sessionId=8052476664b15c65e1b059b9c5151d88882dc921&siteScreenName=therecord_media&theme=light&widgetsVersion=b45a03c79d4c1%3A1654150928467&width=500px
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (mil/6CF0) /
Resource Hash: dc9ae7c30a725e1a3e0da25b2cf138836c154b77a51decb32e2c58cdd3d48094

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://platform.twitter.com/embed/Tweet.html?creatorScreenName=jgreigj&dnt=true&embedId=twitter-widget-1&features=eyJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3JlZnNyY19zZXNzaW9uIjp7ImJ1Y2tldCI6Im9mZiIsInZlcnNpb24iOm51bGx9LCJ0Zndfc2Vuc2l0aXZlX21lZGlhX2ludGVyc3RpdGlhbF8xMzk2MyI6eyJidWNrZXQiOiJpbnRlcnN0aXRpYWwiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3R3ZWV0X3Jlc3VsdF9taWdyYXRpb25fMTM5NzkiOnsiYnVja2V0IjoidHdlZXRfcmVzdWx0IiwidmVyc2lvbiI6bnVsbH19&frame=false&hideCard=false&hideThread=false&id=1534213925750841346&lang=en&origin=https%3A%2F%2Ftherecord.media%2Fhackers-using-follina-windows-zero-day-to-spread-qbot-malware%2F&sessionId=8052476664b15c65e1b059b9c5151d88882dc921&siteScreenName=therecord_media&theme=light&widgetsVersion=b45a03c79d4c1%3A1654150928467&width=500px
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date: Fri, 10 Jun 2022 01:54:54 GMT
Content-Encoding: gzip
Age: 289586
X-Cache: HIT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server-Timing: "x-cache;desc= HIT,x-tw-cdn;desc=",edge;dur=1
Content-Length: 5636
x-tw-cdn: VZ
Last-Modified: Mon, 06 Jun 2022 17:12:39 GMT
Server: ECS (mil/6CF0)
Etag: "295df71a71f3410cbdbf6a6dbdee02c8+gzip"
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=315360000

GET
H/1.1 200
OK embed.vendors~ondemand.en-js.acec6ae280b2e2f6ef87.js Show response
platform.twitter.com/embed/ Frame 3209 39 KB
13 KB 23ms
22ms Script
application/javascript 2606:2800:234:59:254c:406:2366:268c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/embed/embed.vendors~ondemand.en-js.acec6ae280b2e2f6ef87.js
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/embed/embed.runtime.ff468dfcc26885f2cd74.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (mil/6CF2) /
Resource Hash: 931750573d4728b1437a7a6769a62596c3f1f011554e2e3f401c7dfd9fb18d16

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://platform.twitter.com/embed/Tweet.html?creatorScreenName=jgreigj&dnt=true&embedId=twitter-widget-0&features=eyJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3JlZnNyY19zZXNzaW9uIjp7ImJ1Y2tldCI6Im9mZiIsInZlcnNpb24iOm51bGx9LCJ0Zndfc2Vuc2l0aXZlX21lZGlhX2ludGVyc3RpdGlhbF8xMzk2MyI6eyJidWNrZXQiOiJpbnRlcnN0aXRpYWwiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3R3ZWV0X3Jlc3VsdF9taWdyYXRpb25fMTM5NzkiOnsiYnVja2V0IjoidHdlZXRfcmVzdWx0IiwidmVyc2lvbiI6bnVsbH19&frame=false&hideCard=false&hideThread=false&id=1534227619222196224&lang=en&origin=https%3A%2F%2Ftherecord.media%2Fhackers-using-follina-windows-zero-day-to-spread-qbot-malware%2F&sessionId=8052476664b15c65e1b059b9c5151d88882dc921&siteScreenName=therecord_media&theme=light&widgetsVersion=b45a03c79d4c1%3A1654150928467&width=500px
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date: Fri, 10 Jun 2022 01:54:54 GMT
Content-Encoding: gzip
Age: 289586
X-Cache: HIT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server-Timing: "x-cache;desc= HIT,x-tw-cdn;desc=VZ",edge;dur=1
Content-Length: 13145
x-tw-cdn: VZ
Last-Modified: Mon, 06 Jun 2022 17:12:39 GMT
Server: ECS (mil/6CF2)
Etag: "d2f883c771ed4b1c0f62ad00c6ca3a69+gzip"
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=315360000

GET
H/1.1 200
OK embed.ondemand.en-js.5ab403453815af8885c8.js Show response
platform.twitter.com/embed/ Frame 3209 3 KB
2 KB 23ms
23ms Script
application/javascript 2606:2800:234:59:254c:406:2366:268c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/embed/embed.ondemand.en-js.5ab403453815af8885c8.js
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/embed/embed.runtime.ff468dfcc26885f2cd74.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (mil/6CED) /
Resource Hash: 735f1abaa77b0fb510261c9e7aa05ad695af92b888f85b6604f44d8653ce79dd

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://platform.twitter.com/embed/Tweet.html?creatorScreenName=jgreigj&dnt=true&embedId=twitter-widget-0&features=eyJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3JlZnNyY19zZXNzaW9uIjp7ImJ1Y2tldCI6Im9mZiIsInZlcnNpb24iOm51bGx9LCJ0Zndfc2Vuc2l0aXZlX21lZGlhX2ludGVyc3RpdGlhbF8xMzk2MyI6eyJidWNrZXQiOiJpbnRlcnN0aXRpYWwiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3R3ZWV0X3Jlc3VsdF9taWdyYXRpb25fMTM5NzkiOnsiYnVja2V0IjoidHdlZXRfcmVzdWx0IiwidmVyc2lvbiI6bnVsbH19&frame=false&hideCard=false&hideThread=false&id=1534227619222196224&lang=en&origin=https%3A%2F%2Ftherecord.media%2Fhackers-using-follina-windows-zero-day-to-spread-qbot-malware%2F&sessionId=8052476664b15c65e1b059b9c5151d88882dc921&siteScreenName=therecord_media&theme=light&widgetsVersion=b45a03c79d4c1%3A1654150928467&width=500px
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date: Fri, 10 Jun 2022 01:54:54 GMT
Content-Encoding: gzip
Age: 289586
X-Cache: HIT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server-Timing: "x-cache;desc= HIT,x-tw-cdn;desc=",edge;dur=1
Content-Length: 1293
x-tw-cdn: VZ
Last-Modified: Mon, 06 Jun 2022 17:12:39 GMT
Server: ECS (mil/6CED)
Etag: "06f8c27a0df1bb9d1d88f152801cdda4+gzip"
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=315360000

GET
H/1.1 200
OK embed.ondemand.i18n.en-js.1e1be839d2d2b69bdf78.js Show response
platform.twitter.com/embed/ Frame 3209 3 KB
2 KB 22ms
22ms Script
application/javascript 2606:2800:234:59:254c:406:2366:268c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/embed/embed.ondemand.i18n.en-js.1e1be839d2d2b69bdf78.js
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/embed/embed.runtime.ff468dfcc26885f2cd74.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (mil/6CEC) /
Resource Hash: 7a4645fb7bd66c6fa3088677ee1a517deea83df27006a147e3dcd64387761ba1

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://platform.twitter.com/embed/Tweet.html?creatorScreenName=jgreigj&dnt=true&embedId=twitter-widget-0&features=eyJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3JlZnNyY19zZXNzaW9uIjp7ImJ1Y2tldCI6Im9mZiIsInZlcnNpb24iOm51bGx9LCJ0Zndfc2Vuc2l0aXZlX21lZGlhX2ludGVyc3RpdGlhbF8xMzk2MyI6eyJidWNrZXQiOiJpbnRlcnN0aXRpYWwiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3R3ZWV0X3Jlc3VsdF9taWdyYXRpb25fMTM5NzkiOnsiYnVja2V0IjoidHdlZXRfcmVzdWx0IiwidmVyc2lvbiI6bnVsbH19&frame=false&hideCard=false&hideThread=false&id=1534227619222196224&lang=en&origin=https%3A%2F%2Ftherecord.media%2Fhackers-using-follina-windows-zero-day-to-spread-qbot-malware%2F&sessionId=8052476664b15c65e1b059b9c5151d88882dc921&siteScreenName=therecord_media&theme=light&widgetsVersion=b45a03c79d4c1%3A1654150928467&width=500px
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date: Fri, 10 Jun 2022 01:54:54 GMT
Content-Encoding: gzip
Age: 289585
X-Cache: HIT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server-Timing: "x-cache;desc= HIT,x-tw-cdn;desc=VZ",edge;dur=1
Content-Length: 1294
x-tw-cdn: VZ
Last-Modified: Mon, 06 Jun 2022 17:12:39 GMT
Server: ECS (mil/6CEC)
Etag: "152e5ac13ebd99eabd94a11d7061d9ff+gzip"
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=315360000

GET
H/1.1 200
OK embed.vendors~ondemand.en-js.acec6ae280b2e2f6ef87.js Show response
platform.twitter.com/embed/ Frame E294 39 KB
13 KB 23ms
22ms Script
application/javascript 2606:2800:234:59:254c:406:2366:268c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/embed/embed.vendors~ondemand.en-js.acec6ae280b2e2f6ef87.js
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/embed/embed.runtime.ff468dfcc26885f2cd74.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (mil/6CF2) /
Resource Hash: 931750573d4728b1437a7a6769a62596c3f1f011554e2e3f401c7dfd9fb18d16

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://platform.twitter.com/embed/Tweet.html?creatorScreenName=jgreigj&dnt=true&embedId=twitter-widget-1&features=eyJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3JlZnNyY19zZXNzaW9uIjp7ImJ1Y2tldCI6Im9mZiIsInZlcnNpb24iOm51bGx9LCJ0Zndfc2Vuc2l0aXZlX21lZGlhX2ludGVyc3RpdGlhbF8xMzk2MyI6eyJidWNrZXQiOiJpbnRlcnN0aXRpYWwiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3R3ZWV0X3Jlc3VsdF9taWdyYXRpb25fMTM5NzkiOnsiYnVja2V0IjoidHdlZXRfcmVzdWx0IiwidmVyc2lvbiI6bnVsbH19&frame=false&hideCard=false&hideThread=false&id=1534213925750841346&lang=en&origin=https%3A%2F%2Ftherecord.media%2Fhackers-using-follina-windows-zero-day-to-spread-qbot-malware%2F&sessionId=8052476664b15c65e1b059b9c5151d88882dc921&siteScreenName=therecord_media&theme=light&widgetsVersion=b45a03c79d4c1%3A1654150928467&width=500px
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date: Fri, 10 Jun 2022 01:54:54 GMT
Content-Encoding: gzip
Age: 289586
X-Cache: HIT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server-Timing: "x-cache;desc= HIT,x-tw-cdn;desc=VZ",edge;dur=1
Content-Length: 13145
x-tw-cdn: VZ
Last-Modified: Mon, 06 Jun 2022 17:12:39 GMT
Server: ECS (mil/6CF2)
Etag: "d2f883c771ed4b1c0f62ad00c6ca3a69+gzip"
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=315360000

GET
H/1.1 200
OK embed.ondemand.en-js.5ab403453815af8885c8.js Show response
platform.twitter.com/embed/ Frame E294 3 KB
2 KB 23ms
23ms Script
application/javascript 2606:2800:234:59:254c:406:2366:268c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/embed/embed.ondemand.en-js.5ab403453815af8885c8.js
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/embed/embed.runtime.ff468dfcc26885f2cd74.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (mil/6CED) /
Resource Hash: 735f1abaa77b0fb510261c9e7aa05ad695af92b888f85b6604f44d8653ce79dd

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://platform.twitter.com/embed/Tweet.html?creatorScreenName=jgreigj&dnt=true&embedId=twitter-widget-1&features=eyJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3JlZnNyY19zZXNzaW9uIjp7ImJ1Y2tldCI6Im9mZiIsInZlcnNpb24iOm51bGx9LCJ0Zndfc2Vuc2l0aXZlX21lZGlhX2ludGVyc3RpdGlhbF8xMzk2MyI6eyJidWNrZXQiOiJpbnRlcnN0aXRpYWwiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3R3ZWV0X3Jlc3VsdF9taWdyYXRpb25fMTM5NzkiOnsiYnVja2V0IjoidHdlZXRfcmVzdWx0IiwidmVyc2lvbiI6bnVsbH19&frame=false&hideCard=false&hideThread=false&id=1534213925750841346&lang=en&origin=https%3A%2F%2Ftherecord.media%2Fhackers-using-follina-windows-zero-day-to-spread-qbot-malware%2F&sessionId=8052476664b15c65e1b059b9c5151d88882dc921&siteScreenName=therecord_media&theme=light&widgetsVersion=b45a03c79d4c1%3A1654150928467&width=500px
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date: Fri, 10 Jun 2022 01:54:54 GMT
Content-Encoding: gzip
Age: 289586
X-Cache: HIT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server-Timing: "x-cache;desc= HIT,x-tw-cdn;desc=",edge;dur=1
Content-Length: 1293
x-tw-cdn: VZ
Last-Modified: Mon, 06 Jun 2022 17:12:39 GMT
Server: ECS (mil/6CED)
Etag: "06f8c27a0df1bb9d1d88f152801cdda4+gzip"
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=315360000

GET
H/1.1 200
OK embed.ondemand.i18n.en-js.1e1be839d2d2b69bdf78.js Show response
platform.twitter.com/embed/ Frame E294 3 KB
2 KB 22ms
22ms Script
application/javascript 2606:2800:234:59:254c:406:2366:268c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/embed/embed.ondemand.i18n.en-js.1e1be839d2d2b69bdf78.js
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/embed/embed.runtime.ff468dfcc26885f2cd74.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (mil/6CEC) /
Resource Hash: 7a4645fb7bd66c6fa3088677ee1a517deea83df27006a147e3dcd64387761ba1

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://platform.twitter.com/embed/Tweet.html?creatorScreenName=jgreigj&dnt=true&embedId=twitter-widget-1&features=eyJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3JlZnNyY19zZXNzaW9uIjp7ImJ1Y2tldCI6Im9mZiIsInZlcnNpb24iOm51bGx9LCJ0Zndfc2Vuc2l0aXZlX21lZGlhX2ludGVyc3RpdGlhbF8xMzk2MyI6eyJidWNrZXQiOiJpbnRlcnN0aXRpYWwiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3R3ZWV0X3Jlc3VsdF9taWdyYXRpb25fMTM5NzkiOnsiYnVja2V0IjoidHdlZXRfcmVzdWx0IiwidmVyc2lvbiI6bnVsbH19&frame=false&hideCard=false&hideThread=false&id=1534213925750841346&lang=en&origin=https%3A%2F%2Ftherecord.media%2Fhackers-using-follina-windows-zero-day-to-spread-qbot-malware%2F&sessionId=8052476664b15c65e1b059b9c5151d88882dc921&siteScreenName=therecord_media&theme=light&widgetsVersion=b45a03c79d4c1%3A1654150928467&width=500px
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date: Fri, 10 Jun 2022 01:54:54 GMT
Content-Encoding: gzip
Age: 289585
X-Cache: HIT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server-Timing: "x-cache;desc= HIT,x-tw-cdn;desc=VZ",edge;dur=1
Content-Length: 1294
x-tw-cdn: VZ
Last-Modified: Mon, 06 Jun 2022 17:12:39 GMT
Server: ECS (mil/6CEC)
Etag: "152e5ac13ebd99eabd94a11d7061d9ff+gzip"
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=315360000

GET
H/1.1 200
OK embed.vendors~ondemand.Tweet.064ef547621667f0c5ed.js Show response
platform.twitter.com/embed/ Frame 3209 450 KB
126 KB 23ms
23ms Script
application/javascript 2606:2800:234:59:254c:406:2366:268c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/embed/embed.vendors~ondemand.Tweet.064ef547621667f0c5ed.js
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/embed/embed.runtime.ff468dfcc26885f2cd74.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (mil/6CF3) /
Resource Hash: 2dd03edf39ceb2293a5942ee1925932d1efc47ac74080ca2e2ddd0fd2d35741c

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://platform.twitter.com/embed/Tweet.html?creatorScreenName=jgreigj&dnt=true&embedId=twitter-widget-0&features=eyJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3JlZnNyY19zZXNzaW9uIjp7ImJ1Y2tldCI6Im9mZiIsInZlcnNpb24iOm51bGx9LCJ0Zndfc2Vuc2l0aXZlX21lZGlhX2ludGVyc3RpdGlhbF8xMzk2MyI6eyJidWNrZXQiOiJpbnRlcnN0aXRpYWwiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3R3ZWV0X3Jlc3VsdF9taWdyYXRpb25fMTM5NzkiOnsiYnVja2V0IjoidHdlZXRfcmVzdWx0IiwidmVyc2lvbiI6bnVsbH19&frame=false&hideCard=false&hideThread=false&id=1534227619222196224&lang=en&origin=https%3A%2F%2Ftherecord.media%2Fhackers-using-follina-windows-zero-day-to-spread-qbot-malware%2F&sessionId=8052476664b15c65e1b059b9c5151d88882dc921&siteScreenName=therecord_media&theme=light&widgetsVersion=b45a03c79d4c1%3A1654150928467&width=500px
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date: Fri, 10 Jun 2022 01:54:54 GMT
Content-Encoding: gzip
Age: 289585
X-Cache: HIT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server-Timing: "x-cache;desc= HIT,x-tw-cdn;desc=VZ",edge;dur=1
Content-Length: 128827
x-tw-cdn: VZ
Last-Modified: Mon, 06 Jun 2022 17:12:39 GMT
Server: ECS (mil/6CF3)
Etag: "b9859d36946babed962152b2268dec32+gzip"
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=315360000

GET
H/1.1 200
OK embed.ondemand.Tweet.eade9895e746f8baccf8.js Show response
platform.twitter.com/embed/ Frame 3209 78 KB
18 KB 23ms
23ms Script
application/javascript 2606:2800:234:59:254c:406:2366:268c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/embed/embed.ondemand.Tweet.eade9895e746f8baccf8.js
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/embed/embed.runtime.ff468dfcc26885f2cd74.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (mil/6CE6) /
Resource Hash: 2e4143a492ff81253dbd0125e3aa4007120beeb3106ab4a5da9296a6aa435474

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://platform.twitter.com/embed/Tweet.html?creatorScreenName=jgreigj&dnt=true&embedId=twitter-widget-0&features=eyJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3JlZnNyY19zZXNzaW9uIjp7ImJ1Y2tldCI6Im9mZiIsInZlcnNpb24iOm51bGx9LCJ0Zndfc2Vuc2l0aXZlX21lZGlhX2ludGVyc3RpdGlhbF8xMzk2MyI6eyJidWNrZXQiOiJpbnRlcnN0aXRpYWwiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3R3ZWV0X3Jlc3VsdF9taWdyYXRpb25fMTM5NzkiOnsiYnVja2V0IjoidHdlZXRfcmVzdWx0IiwidmVyc2lvbiI6bnVsbH19&frame=false&hideCard=false&hideThread=false&id=1534227619222196224&lang=en&origin=https%3A%2F%2Ftherecord.media%2Fhackers-using-follina-windows-zero-day-to-spread-qbot-malware%2F&sessionId=8052476664b15c65e1b059b9c5151d88882dc921&siteScreenName=therecord_media&theme=light&widgetsVersion=b45a03c79d4c1%3A1654150928467&width=500px
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date: Fri, 10 Jun 2022 01:54:54 GMT
Content-Encoding: gzip
Age: 289585
X-Cache: HIT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server-Timing: "x-cache;desc= HIT,x-tw-cdn;desc=VZ",edge;dur=1
Content-Length: 17437
x-tw-cdn: VZ
Last-Modified: Mon, 06 Jun 2022 17:12:39 GMT
Server: ECS (mil/6CE6)
Etag: "d21c5e201276e207bbf916f5758a8634+gzip"
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=315360000

GET
H/1.1 200
OK embed.vendors~ondemand.Tweet.064ef547621667f0c5ed.js Show response
platform.twitter.com/embed/ Frame E294 450 KB
126 KB 24ms
23ms Script
application/javascript 2606:2800:234:59:254c:406:2366:268c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/embed/embed.vendors~ondemand.Tweet.064ef547621667f0c5ed.js
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/embed/embed.runtime.ff468dfcc26885f2cd74.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (mil/6CF3) /
Resource Hash: 2dd03edf39ceb2293a5942ee1925932d1efc47ac74080ca2e2ddd0fd2d35741c

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://platform.twitter.com/embed/Tweet.html?creatorScreenName=jgreigj&dnt=true&embedId=twitter-widget-1&features=eyJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3JlZnNyY19zZXNzaW9uIjp7ImJ1Y2tldCI6Im9mZiIsInZlcnNpb24iOm51bGx9LCJ0Zndfc2Vuc2l0aXZlX21lZGlhX2ludGVyc3RpdGlhbF8xMzk2MyI6eyJidWNrZXQiOiJpbnRlcnN0aXRpYWwiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3R3ZWV0X3Jlc3VsdF9taWdyYXRpb25fMTM5NzkiOnsiYnVja2V0IjoidHdlZXRfcmVzdWx0IiwidmVyc2lvbiI6bnVsbH19&frame=false&hideCard=false&hideThread=false&id=1534213925750841346&lang=en&origin=https%3A%2F%2Ftherecord.media%2Fhackers-using-follina-windows-zero-day-to-spread-qbot-malware%2F&sessionId=8052476664b15c65e1b059b9c5151d88882dc921&siteScreenName=therecord_media&theme=light&widgetsVersion=b45a03c79d4c1%3A1654150928467&width=500px
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date: Fri, 10 Jun 2022 01:54:54 GMT
Content-Encoding: gzip
Age: 289585
X-Cache: HIT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server-Timing: "x-cache;desc= HIT,x-tw-cdn;desc=VZ",edge;dur=1
Content-Length: 128827
x-tw-cdn: VZ
Last-Modified: Mon, 06 Jun 2022 17:12:39 GMT
Server: ECS (mil/6CF3)
Etag: "b9859d36946babed962152b2268dec32+gzip"
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=315360000

GET
H/1.1 200
OK embed.ondemand.Tweet.eade9895e746f8baccf8.js Show response
platform.twitter.com/embed/ Frame E294 78 KB
18 KB 24ms
24ms Script
application/javascript 2606:2800:234:59:254c:406:2366:268c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/embed/embed.ondemand.Tweet.eade9895e746f8baccf8.js
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/embed/embed.runtime.ff468dfcc26885f2cd74.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (mil/6CE6) /
Resource Hash: 2e4143a492ff81253dbd0125e3aa4007120beeb3106ab4a5da9296a6aa435474

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://platform.twitter.com/embed/Tweet.html?creatorScreenName=jgreigj&dnt=true&embedId=twitter-widget-1&features=eyJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3JlZnNyY19zZXNzaW9uIjp7ImJ1Y2tldCI6Im9mZiIsInZlcnNpb24iOm51bGx9LCJ0Zndfc2Vuc2l0aXZlX21lZGlhX2ludGVyc3RpdGlhbF8xMzk2MyI6eyJidWNrZXQiOiJpbnRlcnN0aXRpYWwiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3R3ZWV0X3Jlc3VsdF9taWdyYXRpb25fMTM5NzkiOnsiYnVja2V0IjoidHdlZXRfcmVzdWx0IiwidmVyc2lvbiI6bnVsbH19&frame=false&hideCard=false&hideThread=false&id=1534213925750841346&lang=en&origin=https%3A%2F%2Ftherecord.media%2Fhackers-using-follina-windows-zero-day-to-spread-qbot-malware%2F&sessionId=8052476664b15c65e1b059b9c5151d88882dc921&siteScreenName=therecord_media&theme=light&widgetsVersion=b45a03c79d4c1%3A1654150928467&width=500px
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date: Fri, 10 Jun 2022 01:54:54 GMT
Content-Encoding: gzip
Age: 289585
X-Cache: HIT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server-Timing: "x-cache;desc= HIT,x-tw-cdn;desc=VZ",edge;dur=1
Content-Length: 17437
x-tw-cdn: VZ
Last-Modified: Mon, 06 Jun 2022 17:12:39 GMT
Server: ECS (mil/6CE6)
Etag: "d21c5e201276e207bbf916f5758a8634+gzip"
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=315360000

GET
H2 200 tweet-result Show response
cdn.syndication.twimg.com/ Frame E294 2 KB
2 KB 269ms
179ms XHR
application/json 2606:2800:134:fa2:1627:1fe:edb:1665
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.syndication.twimg.com/tweet-result?features=tfw_experiments_cookie_expiration%3A1209600%3Btfw_refsrc_session%3Aoff%3Btfw_sensitive_media_interstitial_13963%3Ainterstitial%3Btfw_tweet_result_migration_13979%3Atweet_result&id=1534213925750841346&lang=en

Requested by

Host: platform.twitter.com
URL: https://platform.twitter.com/embed/embed.modules.f34a0f34273ac52f3e51.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2606:2800:134:fa2:1627:1fe:edb:1665 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

tsa_f / Express

Resource Hash

0dd620a941d112d6f3fd5e4fea30b59123adc42010908f520258ff76c71aaf29

Security Headers

Name	Value
Content-Security-Policy	connect-src 'self'; default-src 'self'; frame-src 'self'; font-src 'self'; form-action 'self'; img-src 'self'; media-src 'self'; object-src 'none'; script-src 'self'; style-src 'self'; report-uri https://twitter.com/i/csp_report?a=O5RXE%3D%3D%3D&ro=false
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://platform.twitter.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

content-security-policy: connect-src 'self'; default-src 'self'; frame-src 'self'; font-src 'self'; form-action 'self'; img-src 'self'; media-src 'self'; object-src 'none'; script-src 'self'; style-src 'self'; report-uri https://twitter.com/i/csp_report?a=O5RXE%3D%3D%3D&ro=false
content-encoding: gzip
etag: W/"696-xpVKJYARclyd31UZKabHznVi5gI"
x-powered-by: Express
access-control-allow-methods: GET
server-timing: "x-cache;desc= ,x-tw-cdn;desc=VZ,edge;dur=157
strict-transport-security: max-age=631138519
x-xss-protection: 0
x-response-time: 133
server: tsa_f
x-frame-options: SAMEORIGIN
date: Fri, 10 Jun 2022 01:54:54 GMT
vary: Origin, Accept-Encoding
x-tw-cdn: VZ", VZ, VZ
content-type: application/json; charset=utf-8
access-control-allow-origin: https://platform.twitter.com
cache-control: must-revalidate, max-age=60
access-control-allow-credentials: true
x-connection-hash: dd50ea2ce31244414f74dfca48e0f95b01349041735e7c0bfc23571a1d774294
x-content-type-options: nosniff
access-contol-allow-origin: platform.twitter.com

GET
H2 200 __ptq.gif
track.hubspot.com/ 45 B
962 B 202ms
146ms Image
image/gif 2606:4700::6813:9b53
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://track.hubspot.com/__ptq.gif?k=1&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=2389647166&v=1.1&a=252628&rcu=https%3A%2F%2Ftherecord.media%2Fhackers-using-follina-windows-zero-day-to-spread-qbot-malware%2F&pu=https%3A%2F%2Ftherecord.media%2Fhackers-using-follina-windows-zero-day-to-spread-qbot-malware%2F&t=Hackers+using+Follina+Windows+zero-day+to+spread+Qbot+malware+-+The+Record+by+Recorded+Future&cts=1654826094422&vi=fc2d1c43bfd46df00838aa51fb26a347&nc=true&u=156209188.fc2d1c43bfd46df00838aa51fb26a347.1654826094419.1654826094419.1654826094419.1&b=156209188.1.1654826094419&pt=0&cc=15

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6813:9b53 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://therecord.media/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Fri, 10 Jun 2022 01:54:54 GMT
vary: Accept-Encoding
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-hubspot-correlation-id: 18123c2e-fa85-4237-8884-d85901d03da5
cf-ray: 718e7b529d46374c-MXP
p3p: CP="NOI CUR ADM OUR NOR STA NID"
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 45
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=l8ypqin3fgNovvoOs%2FTNGu6%2BOYIpfdI6PHNi7l2rxDBb4935BJULiU4WiAyp0FkgsHudx4x0sT7UI66Xh0AqQd0GE35GG%2FikG%2BD2JEcliPFvMakUbMoOhvqn3N0hEwA%2BhXK0dzZbX6R6Cfef4ZDh"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
cache-control: no-cache, no-store, no-transform
access-control-allow-credentials: false
x-robots-tag: none

GET
H2 200 tweet-result Show response
cdn.syndication.twimg.com/ Frame 3209 2 KB
867 B 263ms
196ms XHR
application/json 2606:2800:134:fa2:1627:1fe:edb:1665
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: platform.twitter.com
URL: https://platform.twitter.com/embed/embed.modules.f34a0f34273ac52f3e51.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2606:2800:134:fa2:1627:1fe:edb:1665 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

tsa_f / Express

Resource Hash

8490bb193d06ff7710cdd4c1ecce1a017ee547dfc8179193dd3302ab9256c49c

Security Headers

Name	Value
Content-Security-Policy	connect-src 'self'; default-src 'self'; frame-src 'self'; font-src 'self'; form-action 'self'; img-src 'self'; media-src 'self'; object-src 'none'; script-src 'self'; style-src 'self'; report-uri https://twitter.com/i/csp_report?a=O5RXE%3D%3D%3D&ro=false
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://platform.twitter.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

content-security-policy: connect-src 'self'; default-src 'self'; frame-src 'self'; font-src 'self'; form-action 'self'; img-src 'self'; media-src 'self'; object-src 'none'; script-src 'self'; style-src 'self'; report-uri https://twitter.com/i/csp_report?a=O5RXE%3D%3D%3D&ro=false
content-encoding: gzip
etag: W/"675-3rHOgdjhdUiPEc29OYDIXiI0RVk"
x-powered-by: Express
access-control-allow-methods: GET
server-timing: "x-cache;desc= ,x-tw-cdn;desc=VZ,edge;dur=174
strict-transport-security: max-age=631138519
x-xss-protection: 0
x-response-time: 150
server: tsa_f
x-frame-options: SAMEORIGIN
date: Fri, 10 Jun 2022 01:54:54 GMT
vary: Origin, Accept-Encoding
x-tw-cdn: VZ", VZ, VZ
content-type: application/json; charset=utf-8
access-control-allow-origin: https://platform.twitter.com
cache-control: must-revalidate, max-age=60
access-control-allow-credentials: true
x-connection-hash: ce739a766fd903f930cead4771ba8bccc8b1101f947199aea6759a2b9bfdc174
x-content-type-options: nosniff
access-contol-allow-origin: platform.twitter.com

GET
H2 200 json Show response
forms.hubspot.com/lead-flows-config/v1/config/ 2 KB
2 KB 225ms
169ms XHR
application/json 2606:4700::6813:9b53
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://forms.hubspot.com/lead-flows-config/v1/config/json?portalId=252628&utk=fc2d1c43bfd46df00838aa51fb26a347&__hstc=156209188.fc2d1c43bfd46df00838aa51fb26a347.1654826094419.1654826094419.1654826094419.1&__hssc=156209188.1.1654826094419&currentUrl=https%3A%2F%2Ftherecord.media%2Fhackers-using-follina-windows-zero-day-to-spread-qbot-malware%2F

Requested by

Host: js.hsleadflows.net
URL: https://js.hsleadflows.net/leadflows.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6813:9b53 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0fbc135fa4c043ec5b8b7bbfe9a99611f83a5e4d19d2878dd2b1fb70d8f57b12

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://therecord.media/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Fri, 10 Jun 2022 01:54:54 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-hubspot-correlation-id: de746a90-3049-47ac-986a-a48bedee9565
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
strict-transport-security: max-age=31536000; includeSubDomains; preload
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-robots-tag: none
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age: 180
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2BUuJ5l3gz5zR9lT3bV0nYJ3iinJ%2FfcvW2XDNjZy5xJKyiFiCr1xaBNzG%2Bpu3jTgfV3Yi2LKE%2BPQ6pyimHAptC6vTc60rGmBKnAv27cpyaoN6C8iOK1HQf7LSEivl6D7mjmuXp%2FA%2F9sK%2BzfN9zyPv"}],"group":"cf-nel","max_age":604800}
content-type: application/json;charset=utf-8
access-control-allow-origin: https://therecord.media
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: false
cf-ray: 718e7b52b8400f7a-MXP
access-control-allow-headers: Accept, Accept-Charset, Accept-Encoding, Accept-Language, Content-Type, Host, Origin, Referer, User-Agent

GET
H3 200 __ptq.gif
track.hubspot.com/ 45 B
740 B 177ms
152ms Image
image/gif 2606:4700::6813:9b53
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://track.hubspot.com/__ptq.gif?k=16&fi=1b047a85-2db0-47ce-a965-8fa2de5a991b&lfi=2694169&ft=1&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=2389647166&v=1.1&a=252628&rcu=https%3A%2F%2Ftherecord.media%2Fhackers-using-follina-windows-zero-day-to-spread-qbot-malware%2F&pu=https%3A%2F%2Ftherecord.media%2Fhackers-using-follina-windows-zero-day-to-spread-qbot-malware%2F&t=Hackers+using+Follina+Windows+zero-day+to+spread+Qbot+malware+-+The+Record+by+Recorded+Future&cts=1654826094674&vi=fc2d1c43bfd46df00838aa51fb26a347&nc=true&u=156209188.fc2d1c43bfd46df00838aa51fb26a347.1654826094419.1654826094419.1654826094419.1&b=156209188.1.1654826094419&pt=0&cc=15

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6813:9b53 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://therecord.media/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Fri, 10 Jun 2022 01:54:54 GMT
vary: Accept-Encoding
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-hubspot-correlation-id: dc8a6489-6613-4e2e-a345-d573b239b1cc
cf-ray: 718e7b53f8eb5a13-MXP
p3p: CP="NOI CUR ADM OUR NOR STA NID"
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 45
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VlnMm6JdktwLs0Mv8w2D%2Fp2tyFg4uMexIdlkIO2LBpSZK158IQQfHJNvTxgZhAd7z46%2F1LljyZHxL3hCDZveI4%2FnhzMYGpSIXzuQxCQLL01AsO2Y6qZcHBb47nKhvhPjgI7JEE8uiDf%2FUtDOGGpN"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
cache-control: no-cache, no-store, no-transform
access-control-allow-credentials: false
x-robots-tag: none

GET
H2 200 jot
syndication.twitter.com/i/ Frame E294 43 B
124 B 147ms
146ms Image
image/gif 104.244.42.72
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://syndication.twitter.com/i/jot?l=%7B%22_category_%22%3A%22tfw_client_event%22%2C%22triggered_on%22%3A1654826094734%2C%22event_namespace%22%3A%7B%22client%22%3A%22tfw%22%2C%22page%22%3A%22tweet%22%2C%22action%22%3A%22results%22%2C%22section%22%3A%22main%22%7D%2C%22context%22%3A%22horizon%22%2C%22client_version%22%3A%22b45a03c79d4c1%3A1654150928467%22%2C%22dnt%22%3Atrue%2C%22widget_id%22%3A%22twitter-widget-1%22%2C%22widget_origin%22%3A%22https%3A%2F%2Ftherecord.media%2Fhackers-using-follina-windows-zero-day-to-spread-qbot-malware%2F%22%2C%22widget_frame%22%3A%22false%22%2C%22widget_partner%22%3A%22%22%2C%22widget_site_screen_name%22%3A%22therecord_media%22%2C%22widget_site_user_id%22%3A%22%22%2C%22widget_creator_screen_name%22%3A%22jgreigj%22%2C%22widget_creator_user_id%22%3A%22%22%2C%22widget_iframe_version%22%3A%22ef52da62d3cad%3A1654213426913%22%2C%22item_ids%22%3A%5B%221534213925750841346%22%5D%2C%22item_details%22%3A%7B%221534213925750841346%22%3A%7B%22item_type%22%3A0%7D%7D%7D&dnt=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.72 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://platform.twitter.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Fri, 10 Jun 2022 01:54:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 200 OK
x-twitter-response-tags: BouncerCompliant
content-length: 65
x-xss-protection: 0
x-response-time: 115
pragma: no-cache
last-modified: Fri, 10 Jun 2022 01:54:54 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=631138519
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: b2893ae3710a6454d8bac6901536bbd8e87559c59ad398b0904dbc60364eac87
x-transaction: e3b4fcd646c8ba0e
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H2 200 jot
syndication.twitter.com/i/ Frame 3209 43 B
124 B 142ms
142ms Image
image/gif 104.244.42.72
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://syndication.twitter.com/i/jot?l=%7B%22_category_%22%3A%22tfw_client_event%22%2C%22triggered_on%22%3A1654826094779%2C%22event_namespace%22%3A%7B%22client%22%3A%22tfw%22%2C%22page%22%3A%22tweet%22%2C%22action%22%3A%22results%22%2C%22section%22%3A%22main%22%7D%2C%22context%22%3A%22horizon%22%2C%22client_version%22%3A%22b45a03c79d4c1%3A1654150928467%22%2C%22dnt%22%3Atrue%2C%22widget_id%22%3A%22twitter-widget-0%22%2C%22widget_origin%22%3A%22https%3A%2F%2Ftherecord.media%2Fhackers-using-follina-windows-zero-day-to-spread-qbot-malware%2F%22%2C%22widget_frame%22%3A%22false%22%2C%22widget_partner%22%3A%22%22%2C%22widget_site_screen_name%22%3A%22therecord_media%22%2C%22widget_site_user_id%22%3A%22%22%2C%22widget_creator_screen_name%22%3A%22jgreigj%22%2C%22widget_creator_user_id%22%3A%22%22%2C%22widget_iframe_version%22%3A%22ef52da62d3cad%3A1654213426913%22%2C%22item_ids%22%3A%5B%221534227619222196224%22%5D%2C%22item_details%22%3A%7B%221534227619222196224%22%3A%7B%22item_type%22%3A0%7D%7D%7D&dnt=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.72 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://platform.twitter.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Fri, 10 Jun 2022 01:54:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 200 OK
x-twitter-response-tags: BouncerCompliant
content-length: 65
x-xss-protection: 0
x-response-time: 110
pragma: no-cache
last-modified: Fri, 10 Jun 2022 01:54:54 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=631138519
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: b2893ae3710a6454d8bac6901536bbd8e87559c59ad398b0904dbc60364eac87
x-transaction: dbb7c50f3b2ab6b3
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H2 200 rPJA0GdC_normal.png
pbs.twimg.com/profile_images/1500797191081926660/ Frame E294 2 KB
3 KB 51ms
45ms Image
image/png 2606:2800:134:fa2:1627:1fe:edb:1665
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pbs.twimg.com/profile_images/1500797191081926660/rPJA0GdC_normal.png

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2606:2800:134:fa2:1627:1fe:edb:1665 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (mil/6CE8) /

Resource Hash

cdbfd247ae45f4a12a00c99cb057c7ce703c8036a35bb6a79ff76d267edb0e16

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://platform.twitter.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Fri, 10 Jun 2022 01:54:54 GMT
x-content-type-options: nosniff
age: 307866
x-cache: HIT
server-timing: "x-cache;desc= HIT,x-tw-cdn;desc=VZ,edge;dur=1
content-length: 2339
x-response-time: 114
surrogate-key: profile_images profile_images/bucket/8 profile_images/1500797191081926660
last-modified: Mon, 07 Mar 2022 11:33:08 GMT
server: ECS (mil/6CE8)
strict-transport-security: max-age=631138519
x-tw-cdn: VZ, VZ, VZ"
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: max-age=604800, must-revalidate
x-connection-hash: 8b40e3a4399983d8a7e149c48ea475985393c2c68e8f3a93d74614ee12bb29c3
accept-ranges: bytes
timing-allow-origin: https://twitter.com, https://mobile.twitter.com

GET
H2 200 FUqerQOXsAEszha
pbs.twimg.com/media/ Frame E294 355 KB
356 KB 27ms
23ms Image
image/png 2606:2800:134:fa2:1627:1fe:edb:1665
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pbs.twimg.com/media/FUqerQOXsAEszha?format=png&name=small

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2606:2800:134:fa2:1627:1fe:edb:1665 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (mil/6CF1) /

Resource Hash

437d2b1cf494c6613f40092add5ef74971a45c44509c8023a9748ee9d21e8bfb

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://platform.twitter.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Fri, 10 Jun 2022 01:54:54 GMT
x-content-type-options: nosniff
age: 205993
x-cache: HIT
server-timing: "x-cache;desc= HIT,x-tw-cdn;desc=VZ",edge;dur=1
content-length: 363595
x-response-time: 220
surrogate-key: media media/bucket/3 media/1534213088999878657
last-modified: Tue, 07 Jun 2022 16:35:59 GMT
server: ECS (mil/6CF1)
strict-transport-security: max-age=631138519
x-tw-cdn: VZ, VZ
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: max-age=604800, must-revalidate
x-connection-hash: 3c317e879c1c11b56932a20a503794f9dd365453e8b68b1b8a15c99321b8a4a0
accept-ranges: bytes
timing-allow-origin: https://twitter.com, https://mobile.twitter.com

GET
H2 200 btq24XAn_normal.png
pbs.twimg.com/profile_images/1532170191760596992/ Frame 3209 2 KB
2 KB 55ms
55ms Image
image/png 2606:2800:134:fa2:1627:1fe:edb:1665
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pbs.twimg.com/profile_images/1532170191760596992/btq24XAn_normal.png

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2606:2800:134:fa2:1627:1fe:edb:1665 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (mil/6CE7) /

Resource Hash

aab8bb6742699b557a5dc896158ecc21fdb307525b691fb61a177a19ce22be49

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://platform.twitter.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Fri, 10 Jun 2022 01:54:54 GMT
x-content-type-options: nosniff
age: 86941
x-cache: HIT
server-timing: "x-cache;desc= HIT,x-tw-cdn;desc=VZ,edge;dur=1
content-length: 2035
x-response-time: 109
surrogate-key: profile_images profile_images/bucket/3 profile_images/1532170191760596992
last-modified: Thu, 02 Jun 2022 01:18:14 GMT
server: ECS (mil/6CE7)
strict-transport-security: max-age=631138519
x-tw-cdn: VZ, VZ, VZ", VZ, VZ, VZ""
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: max-age=604800, must-revalidate
x-connection-hash: debb9ad876d4a761bef5c647caec78ad681d58997187615298e4e8ecd55d1995
accept-ranges: bytes
timing-allow-origin: https://twitter.com, https://mobile.twitter.com

GET
H2 200 jot
syndication.twitter.com/i/ Frame 3209 43 B
120 B 147ms
147ms Image
image/gif 104.244.42.72
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://syndication.twitter.com/i/jot?l=%7B%22_category_%22%3A%22tfw_client_event%22%2C%22triggered_on%22%3A1654826094970%2C%22event_namespace%22%3A%7B%22client%22%3A%22tfw%22%2C%22page%22%3A%22tweet%22%2C%22action%22%3A%22FCP%22%2C%22component%22%3A%22performance%22%2C%22section%22%3A%22main%22%7D%2C%22context%22%3A%22horizon%22%2C%22client_version%22%3A%22b45a03c79d4c1%3A1654150928467%22%2C%22dnt%22%3Atrue%2C%22widget_id%22%3A%22twitter-widget-0%22%2C%22widget_origin%22%3A%22https%3A%2F%2Ftherecord.media%2Fhackers-using-follina-windows-zero-day-to-spread-qbot-malware%2F%22%2C%22widget_frame%22%3A%22false%22%2C%22widget_partner%22%3A%22%22%2C%22widget_site_screen_name%22%3A%22therecord_media%22%2C%22widget_site_user_id%22%3A%22%22%2C%22widget_creator_screen_name%22%3A%22jgreigj%22%2C%22widget_creator_user_id%22%3A%22%22%2C%22widget_iframe_version%22%3A%22ef52da62d3cad%3A1654213426913%22%2C%22item_ids%22%3A%5B%221534227619222196224%22%5D%2C%22item_details%22%3A%7B%221534227619222196224%22%3A%7B%22item_type%22%3A0%7D%7D%2C%22duration_ms%22%3A863.6999998092651%7D&dnt=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.72 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://platform.twitter.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Fri, 10 Jun 2022 01:54:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 200 OK
x-twitter-response-tags: BouncerCompliant
content-length: 65
x-xss-protection: 0
x-response-time: 115
pragma: no-cache
last-modified: Fri, 10 Jun 2022 01:54:55 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=631138519
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: b2893ae3710a6454d8bac6901536bbd8e87559c59ad398b0904dbc60364eac87
x-transaction: c6a0b726b5a36bcb
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H2 200 jot
syndication.twitter.com/i/ Frame E294 43 B
170 B 143ms
142ms Image
image/gif 104.244.42.72
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://syndication.twitter.com/i/jot?l=%7B%22_category_%22%3A%22tfw_client_event%22%2C%22triggered_on%22%3A1654826094971%2C%22event_namespace%22%3A%7B%22client%22%3A%22tfw%22%2C%22page%22%3A%22tweet%22%2C%22action%22%3A%22FCP%22%2C%22component%22%3A%22performance%22%2C%22section%22%3A%22main%22%7D%2C%22context%22%3A%22horizon%22%2C%22client_version%22%3A%22b45a03c79d4c1%3A1654150928467%22%2C%22dnt%22%3Atrue%2C%22widget_id%22%3A%22twitter-widget-1%22%2C%22widget_origin%22%3A%22https%3A%2F%2Ftherecord.media%2Fhackers-using-follina-windows-zero-day-to-spread-qbot-malware%2F%22%2C%22widget_frame%22%3A%22false%22%2C%22widget_partner%22%3A%22%22%2C%22widget_site_screen_name%22%3A%22therecord_media%22%2C%22widget_site_user_id%22%3A%22%22%2C%22widget_creator_screen_name%22%3A%22jgreigj%22%2C%22widget_creator_user_id%22%3A%22%22%2C%22widget_iframe_version%22%3A%22ef52da62d3cad%3A1654213426913%22%2C%22item_ids%22%3A%5B%221534213925750841346%22%5D%2C%22item_details%22%3A%7B%221534213925750841346%22%3A%7B%22item_type%22%3A0%7D%7D%2C%22duration_ms%22%3A862.5999999046326%7D&dnt=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.72 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://platform.twitter.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Fri, 10 Jun 2022 01:54:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 200 OK
x-twitter-response-tags: BouncerCompliant
content-length: 65
x-xss-protection: 0
x-response-time: 111
pragma: no-cache
last-modified: Fri, 10 Jun 2022 01:54:55 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=631138519
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: b2893ae3710a6454d8bac6901536bbd8e87559c59ad398b0904dbc60364eac87
x-transaction: 0795bb6545b933fa
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H/1.1 200
OK img.gif
b.6sc.co/v1/beacon/ 43 B
774 B 213ms
213ms Image
image/gif 96.16.137.162
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=f2675e8089b7d209a58fce8ad312f51c&svisitor=cbd5ce17997700006da4a262c50300009de91a00&session=36eb704f-5002-4342-8113-a75bb3013cc7&event=active_time_track&q=%7B%22currentTime%22%3A%22Fri%2C%2010%20Jun%202022%2001%3A54%3A54%20GMT%22%2C%22lastTrackTime%22%3A%22Fri%2C%2010%20Jun%202022%2001%3A54%3A53%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%221001%22%7D&isIframe=false&m=%7B%22description%22%3A%22The%20Record%20by%20Recorded%20Future%20gives%20exclusive%2C%20behind-the-scenes%20access%20to%20leaders%2C%20policymakers%2C%20researchers%2C%20and%20the%20shadows%20of%20the%20cyber%20underground.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Hackers%20using%20Follina%20Windows%20zero-day%20to%20spread%20Qbot%20malware%20-%20The%20Record%20by%20Recorded%20Future%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Ftherecord.media%2Fhackers-using-follina-windows-zero-day-to-spread-qbot-malware%2F&pageViewId=a8235557-2555-4bb2-85e0-a982aee06d52&an_uid=0

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

96.16.137.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a96-16-137-162.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://therecord.media/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date: Fri, 10 Jun 2022 01:54:55 GMT
X-Content-Type-Options: nosniff
Connection: keep-alive
Content-Length: 43
Pragma: no-cache
Last-Modified: Tue, 05 Oct 2021 22:17:52 GMT
Server: nginx/1.14.0 (Ubuntu)
ETag: "615ccf10-2b"
Access-Control-Max-Age: 86400
Access-Control-Allow-Methods: GET,POST
Content-Type: image/gif
Access-Control-Allow-Origin
Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Access-Control-Allow-Credentials: true
Accept-Ranges: bytes
Access-Control-Allow-Headers: *
Expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H2 200 iphonex_mockup.png
go.recordedfuture.com/hubfs/ 190 KB
192 KB 178ms
62ms Image
image/webp 2606:2c40::c73c:6702
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://go.recordedfuture.com/hubfs/iphonex_mockup.png
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:2c40::c73c:6702 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9f5a9ec8652b839da4c94dadcf813b464f836d80d6083989853f1033957acc60

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://therecord.media/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

x-amz-meta-cache-tag: F-38679274737,P-252628,FLS-ALL
age: 99626
x-amz-server-side-encryption: AES256
edge-cache-tag: F-38679274737,P-252628,FLS-ALL
x-amz-replication-status: COMPLETED
content-disposition: inline; filename="iphonex_mockup.webp"
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 15
x-amz-request-id: KY8JYBWWK30ED4FY
cf-bgj: imgq:85,h2pri
etag: "8e4a9a910444dc630d9dde1cc3bd77f7"
vary: Accept, Accept-Encoding
access-control-allow-methods: GET
content-type: image/webp
access-control-allow-origin: *
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
x-robots-tag: all
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 15
x-amz-meta-created-unix-time-millis: 1607733110293
date: Fri, 10 Jun 2022 01:54:55 GMT
via: 1.1 9a3c643f228eb943137621235dabf790.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop: MXP64-P1
x-hs-alternate-content-type: text/plain
cf-polished: origFmt=png, origSize=331559
x-cache: RefreshHit from cloudfront
x-amz-meta-index-tag: all
content-length: 194832
x-amz-id-2: qNGNeiXU8MXUfwt+QNLGdvm21wqPfOXLOmYQEJ0iccDK+4EhY9nWIxkEj6mSXP77V3tJWO7krEw=
last-modified: Thu, 09 Dec 2021 17:00:15 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7BV2hv2%2By3yBD7OKBjsIAM3kw7hemCCjxE%2F%2FmibI1Sey0L7x08SGKfIiD3ByQDxlnxrcAnnlPdSHz8LMj9NBcugRcVYb3iCBoXHqbVnqkUG6kKC5TMcf8uenEjFwu03BeB3F2EBIysjONqCol1zV7P2DcA%3D%3D"}],"group":"cf-nel","max_age":604800}
x-amz-version-id: r9ZOT95rdFsvuhynefdRWZgkO0lzhV1L
accept-ranges: bytes
cf-ray: 718e7b5aca2e59fb-MXP
x-amz-cf-id: 8rnXdpQvnOFIw4XT2D1w9a-V8YUZEEe5uSthEa2V5Ia2Rxd8y5UjBg==

GET
H/1.1 200
OK img.gif
b.6sc.co/v1/beacon/ 43 B
774 B 212ms
212ms Image
image/gif 96.16.137.162
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=f2675e8089b7d209a58fce8ad312f51c&svisitor=cbd5ce17997700006da4a262c50300009de91a00&session=36eb704f-5002-4342-8113-a75bb3013cc7&event=active_time_track&q=%7B%22currentTime%22%3A%22Fri%2C%2010%20Jun%202022%2001%3A54%3A55%20GMT%22%2C%22lastTrackTime%22%3A%22Fri%2C%2010%20Jun%202022%2001%3A54%3A54%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%222002%22%7D&isIframe=false&m=%7B%22description%22%3A%22The%20Record%20by%20Recorded%20Future%20gives%20exclusive%2C%20behind-the-scenes%20access%20to%20leaders%2C%20policymakers%2C%20researchers%2C%20and%20the%20shadows%20of%20the%20cyber%20underground.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Hackers%20using%20Follina%20Windows%20zero-day%20to%20spread%20Qbot%20malware%20-%20The%20Record%20by%20Recorded%20Future%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Ftherecord.media%2Fhackers-using-follina-windows-zero-day-to-spread-qbot-malware%2F&pageViewId=a8235557-2555-4bb2-85e0-a982aee06d52&an_uid=0

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

96.16.137.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a96-16-137-162.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://therecord.media/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date: Fri, 10 Jun 2022 01:54:56 GMT
X-Content-Type-Options: nosniff
Connection: keep-alive
Content-Length: 43
Pragma: no-cache
Last-Modified: Sat, 05 Jun 2021 07:56:05 GMT
Server: nginx/1.14.0 (Ubuntu)
ETag: "60bb2e15-2b"
Access-Control-Max-Age: 86400
Access-Control-Allow-Methods: GET,POST
Content-Type: image/gif
Access-Control-Allow-Origin
Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Access-Control-Allow-Credentials: true
Accept-Ranges: bytes
Access-Control-Allow-Headers: *
Expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H/1.1 200
OK Tweet.html Show response
platform.twitter.com/embed/ Frame 8E4A 487 B
1 KB 22ms
22ms Document
text/html 2606:2800:234:59:254c:406:2366:268c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/embed/Tweet.html?creatorScreenName=jgreigj&dnt=true&embedId=twitter-widget-0&features=eyJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3JlZnNyY19zZXNzaW9uIjp7ImJ1Y2tldCI6Im9mZiIsInZlcnNpb24iOm51bGx9LCJ0Zndfc2Vuc2l0aXZlX21lZGlhX2ludGVyc3RpdGlhbF8xMzk2MyI6eyJidWNrZXQiOiJpbnRlcnN0aXRpYWwiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3R3ZWV0X3Jlc3VsdF9taWdyYXRpb25fMTM5NzkiOnsiYnVja2V0IjoidHdlZXRfcmVzdWx0IiwidmVyc2lvbiI6bnVsbH19&frame=false&hideCard=false&hideThread=false&id=1534227619222196224&lang=en&origin=https%3A%2F%2Ftherecord.media%2Fhackers-using-follina-windows-zero-day-to-spread-qbot-malware%2F&sessionId=8052476664b15c65e1b059b9c5151d88882dc921&siteScreenName=therecord_media&theme=light&widgetsVersion=b45a03c79d4c1%3A1654150928467&width=500px
Requested by: Host: therecord.media
URL: https://therecord.media/wp-content/themes/therecordmedia/assets/js/bundle.js?ver=2022-01-20_3
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (mil/6CED) /
Resource Hash: c10df3d27c1d58c6f722e77696a5786542dba09ba506b09ac4e0a548106ccec6

Request headers

Referer: https://therecord.media/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
accept-language: it-IT,it;q=0.9

Response headers

Accept-Ranges: bytes
Access-Control-Allow-Methods: GET
Access-Control-Allow-Origin: *
Age: 60
Cache-Control: public, max-age=1800
Content-Length: 487
Content-Type: text/html; charset=utf-8
Date: Fri, 10 Jun 2022 01:54:56 GMT
Etag: "97e3ad2b09c08dc43cc138ec6a2da62a"
Last-Modified: Mon, 06 Jun 2022 17:12:40 GMT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server: ECS (mil/6CED)
Server-Timing: "x-cache;desc= HIT,x-tw-cdn;desc=",edge;dur=1
X-Cache: HIT
x-tw-cdn: VZ

GET
H/1.1 200
OK Tweet.html Show response
platform.twitter.com/embed/ Frame 68C2 487 B
1 KB 22ms
22ms Document
text/html 2606:2800:234:59:254c:406:2366:268c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/embed/Tweet.html?creatorScreenName=jgreigj&dnt=true&embedId=twitter-widget-1&features=eyJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3JlZnNyY19zZXNzaW9uIjp7ImJ1Y2tldCI6Im9mZiIsInZlcnNpb24iOm51bGx9LCJ0Zndfc2Vuc2l0aXZlX21lZGlhX2ludGVyc3RpdGlhbF8xMzk2MyI6eyJidWNrZXQiOiJpbnRlcnN0aXRpYWwiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3R3ZWV0X3Jlc3VsdF9taWdyYXRpb25fMTM5NzkiOnsiYnVja2V0IjoidHdlZXRfcmVzdWx0IiwidmVyc2lvbiI6bnVsbH19&frame=false&hideCard=false&hideThread=false&id=1534213925750841346&lang=en&origin=https%3A%2F%2Ftherecord.media%2Fhackers-using-follina-windows-zero-day-to-spread-qbot-malware%2F&sessionId=8052476664b15c65e1b059b9c5151d88882dc921&siteScreenName=therecord_media&theme=light&widgetsVersion=b45a03c79d4c1%3A1654150928467&width=500px
Requested by: Host: therecord.media
URL: https://therecord.media/wp-content/themes/therecordmedia/assets/js/bundle.js?ver=2022-01-20_3
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (mil/6CED) /
Resource Hash: c10df3d27c1d58c6f722e77696a5786542dba09ba506b09ac4e0a548106ccec6

Request headers

Referer: https://therecord.media/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
accept-language: it-IT,it;q=0.9

Response headers

Accept-Ranges: bytes
Access-Control-Allow-Methods: GET
Access-Control-Allow-Origin: *
Age: 60
Cache-Control: public, max-age=1800
Content-Length: 487
Content-Type: text/html; charset=utf-8
Date: Fri, 10 Jun 2022 01:54:56 GMT
Etag: "97e3ad2b09c08dc43cc138ec6a2da62a"
Last-Modified: Mon, 06 Jun 2022 17:12:40 GMT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server: ECS (mil/6CED)
Server-Timing: "x-cache;desc= HIT,x-tw-cdn;desc=",edge;dur=1
X-Cache: HIT
x-tw-cdn: VZ

GET
H/1.1 200
OK widgets.js Show response
platform.twitter.com/ 97 KB
29 KB 22ms
22ms Script
application/javascript 2606:2800:234:59:254c:406:2366:268c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/widgets.js
Requested by: Host: therecord.media
URL: https://therecord.media/wp-content/themes/therecordmedia/assets/js/bundle.js?ver=2022-01-20_3
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (mil/6CF3) /
Resource Hash: dccafac57a7fcedce0d95d35007b502104f45b82f43f052159c370258ef13a53

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://therecord.media/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date: Fri, 10 Jun 2022 01:54:56 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Age: 1478
X-Cache: HIT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server-Timing: "x-cache;desc= HIT,x-tw-cdn;desc=VZ",edge;dur=1
Content-Length: 29459
x-tw-cdn: VZ
Last-Modified: Thu, 02 Jun 2022 18:12:37 GMT
Server: ECS (mil/6CF3)
Etag: "5d21dece96ce474f5f1ac122cbdef6eb+gzip"
Access-Control-Max-Age: 3000
Access-Control-Allow-Methods: GET
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=1800

GET
H2 200 8dfb5b75ee7d706a760b55b313d4f564
secure.gravatar.com/avatar/ 20 KB
20 KB 23ms
23ms Image
image/png 2a04:fa87:fffe::c000:4902
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://secure.gravatar.com/avatar/8dfb5b75ee7d706a760b55b313d4f564?s=96&d=mm&r=g
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 5cf996e872e52f60fa6d956f1d7a957ff0d1c4bdcede8b795636bc0ceff91d7f

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://therecord.media/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

x-nc: HIT mxp 3
date: Fri, 10 Jun 2022 01:54:56 GMT
last-modified: Tue, 22 Mar 2022 14:38:25 GMT
server: nginx
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=300
content-disposition: inline; filename="8dfb5b75ee7d706a760b55b313d4f564.png"
accept-ranges: bytes
link: <https://www.gravatar.com/avatar/8dfb5b75ee7d706a760b55b313d4f564?s=96&d=mm&r=g>; rel="canonical"
content-length: 20493
expires: Fri, 10 Jun 2022 01:59:56 GMT

GET
H/1.1 200
OK embed.runtime.ff468dfcc26885f2cd74.js Show response
platform.twitter.com/embed/ Frame 8E4A 9 KB
5 KB 23ms
22ms Script
application/javascript 2606:2800:234:59:254c:406:2366:268c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/embed/embed.runtime.ff468dfcc26885f2cd74.js
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/embed/Tweet.html?creatorScreenName=jgreigj&dnt=true&embedId=twitter-widget-0&features=eyJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3JlZnNyY19zZXNzaW9uIjp7ImJ1Y2tldCI6Im9mZiIsInZlcnNpb24iOm51bGx9LCJ0Zndfc2Vuc2l0aXZlX21lZGlhX2ludGVyc3RpdGlhbF8xMzk2MyI6eyJidWNrZXQiOiJpbnRlcnN0aXRpYWwiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3R3ZWV0X3Jlc3VsdF9taWdyYXRpb25fMTM5NzkiOnsiYnVja2V0IjoidHdlZXRfcmVzdWx0IiwidmVyc2lvbiI6bnVsbH19&frame=false&hideCard=false&hideThread=false&id=1534227619222196224&lang=en&origin=https%3A%2F%2Ftherecord.media%2Fhackers-using-follina-windows-zero-day-to-spread-qbot-malware%2F&sessionId=8052476664b15c65e1b059b9c5151d88882dc921&siteScreenName=therecord_media&theme=light&widgetsVersion=b45a03c79d4c1%3A1654150928467&width=500px
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (mil/6CF1) /
Resource Hash: 5e153d670d4df48314dc57d6f9062a26d4bcdfdfdfc2bc2fd42f45f3215ed62a

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://platform.twitter.com/embed/Tweet.html?creatorScreenName=jgreigj&dnt=true&embedId=twitter-widget-0&features=eyJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3JlZnNyY19zZXNzaW9uIjp7ImJ1Y2tldCI6Im9mZiIsInZlcnNpb24iOm51bGx9LCJ0Zndfc2Vuc2l0aXZlX21lZGlhX2ludGVyc3RpdGlhbF8xMzk2MyI6eyJidWNrZXQiOiJpbnRlcnN0aXRpYWwiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3R3ZWV0X3Jlc3VsdF9taWdyYXRpb25fMTM5NzkiOnsiYnVja2V0IjoidHdlZXRfcmVzdWx0IiwidmVyc2lvbiI6bnVsbH19&frame=false&hideCard=false&hideThread=false&id=1534227619222196224&lang=en&origin=https%3A%2F%2Ftherecord.media%2Fhackers-using-follina-windows-zero-day-to-spread-qbot-malware%2F&sessionId=8052476664b15c65e1b059b9c5151d88882dc921&siteScreenName=therecord_media&theme=light&widgetsVersion=b45a03c79d4c1%3A1654150928467&width=500px
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date: Fri, 10 Jun 2022 01:54:56 GMT
Content-Encoding: gzip
Age: 289588
X-Cache: HIT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server-Timing: "x-cache;desc= HIT,x-tw-cdn;desc=",edge;dur=1
Content-Length: 4255
x-tw-cdn: VZ
Last-Modified: Mon, 06 Jun 2022 17:12:39 GMT
Server: ECS (mil/6CF1)
Etag: "f824375fd8f44e2e0f1fe8f4d5a6e177+gzip"
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=315360000

GET
H/1.1 200
OK embed.modules.f34a0f34273ac52f3e51.js Show response
platform.twitter.com/embed/ Frame 8E4A 512 KB
168 KB 23ms
23ms Script
application/javascript 2606:2800:234:59:254c:406:2366:268c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/embed/embed.modules.f34a0f34273ac52f3e51.js
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/embed/Tweet.html?creatorScreenName=jgreigj&dnt=true&embedId=twitter-widget-0&features=eyJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3JlZnNyY19zZXNzaW9uIjp7ImJ1Y2tldCI6Im9mZiIsInZlcnNpb24iOm51bGx9LCJ0Zndfc2Vuc2l0aXZlX21lZGlhX2ludGVyc3RpdGlhbF8xMzk2MyI6eyJidWNrZXQiOiJpbnRlcnN0aXRpYWwiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3R3ZWV0X3Jlc3VsdF9taWdyYXRpb25fMTM5NzkiOnsiYnVja2V0IjoidHdlZXRfcmVzdWx0IiwidmVyc2lvbiI6bnVsbH19&frame=false&hideCard=false&hideThread=false&id=1534227619222196224&lang=en&origin=https%3A%2F%2Ftherecord.media%2Fhackers-using-follina-windows-zero-day-to-spread-qbot-malware%2F&sessionId=8052476664b15c65e1b059b9c5151d88882dc921&siteScreenName=therecord_media&theme=light&widgetsVersion=b45a03c79d4c1%3A1654150928467&width=500px
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (mil/6CDF) /
Resource Hash: 5e794d4a1df5f1c1035c15d1f24e115f9fdab9be376f12754239b981f61bf887

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://platform.twitter.com/embed/Tweet.html?creatorScreenName=jgreigj&dnt=true&embedId=twitter-widget-0&features=eyJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3JlZnNyY19zZXNzaW9uIjp7ImJ1Y2tldCI6Im9mZiIsInZlcnNpb24iOm51bGx9LCJ0Zndfc2Vuc2l0aXZlX21lZGlhX2ludGVyc3RpdGlhbF8xMzk2MyI6eyJidWNrZXQiOiJpbnRlcnN0aXRpYWwiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3R3ZWV0X3Jlc3VsdF9taWdyYXRpb25fMTM5NzkiOnsiYnVja2V0IjoidHdlZXRfcmVzdWx0IiwidmVyc2lvbiI6bnVsbH19&frame=false&hideCard=false&hideThread=false&id=1534227619222196224&lang=en&origin=https%3A%2F%2Ftherecord.media%2Fhackers-using-follina-windows-zero-day-to-spread-qbot-malware%2F&sessionId=8052476664b15c65e1b059b9c5151d88882dc921&siteScreenName=therecord_media&theme=light&widgetsVersion=b45a03c79d4c1%3A1654150928467&width=500px
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date: Fri, 10 Jun 2022 01:54:56 GMT
Content-Encoding: gzip
Age: 289587
X-Cache: HIT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server-Timing: "x-cache;desc= HIT,x-tw-cdn;desc=VZ",edge;dur=1
Content-Length: 171249
x-tw-cdn: VZ
Last-Modified: Mon, 06 Jun 2022 17:12:39 GMT
Server: ECS (mil/6CDF)
Etag: "7490e7a386def1875edc794009edc560+gzip"
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=315360000

GET
H/1.1 200
OK embed.i18n.58f3645101e687f24f08.js Show response
platform.twitter.com/embed/ Frame 8E4A 2 KB
1 KB 23ms
23ms Script
application/javascript 2606:2800:234:59:254c:406:2366:268c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/embed/embed.i18n.58f3645101e687f24f08.js
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/embed/Tweet.html?creatorScreenName=jgreigj&dnt=true&embedId=twitter-widget-0&features=eyJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3JlZnNyY19zZXNzaW9uIjp7ImJ1Y2tldCI6Im9mZiIsInZlcnNpb24iOm51bGx9LCJ0Zndfc2Vuc2l0aXZlX21lZGlhX2ludGVyc3RpdGlhbF8xMzk2MyI6eyJidWNrZXQiOiJpbnRlcnN0aXRpYWwiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3R3ZWV0X3Jlc3VsdF9taWdyYXRpb25fMTM5NzkiOnsiYnVja2V0IjoidHdlZXRfcmVzdWx0IiwidmVyc2lvbiI6bnVsbH19&frame=false&hideCard=false&hideThread=false&id=1534227619222196224&lang=en&origin=https%3A%2F%2Ftherecord.media%2Fhackers-using-follina-windows-zero-day-to-spread-qbot-malware%2F&sessionId=8052476664b15c65e1b059b9c5151d88882dc921&siteScreenName=therecord_media&theme=light&widgetsVersion=b45a03c79d4c1%3A1654150928467&width=500px
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (mil/6CF4) /
Resource Hash: 52c19e156be623c2b03edbf619561b9ce54fef7186e33dc7152bb17b7cc2f1ec

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://platform.twitter.com/embed/Tweet.html?creatorScreenName=jgreigj&dnt=true&embedId=twitter-widget-0&features=eyJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3JlZnNyY19zZXNzaW9uIjp7ImJ1Y2tldCI6Im9mZiIsInZlcnNpb24iOm51bGx9LCJ0Zndfc2Vuc2l0aXZlX21lZGlhX2ludGVyc3RpdGlhbF8xMzk2MyI6eyJidWNrZXQiOiJpbnRlcnN0aXRpYWwiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3R3ZWV0X3Jlc3VsdF9taWdyYXRpb25fMTM5NzkiOnsiYnVja2V0IjoidHdlZXRfcmVzdWx0IiwidmVyc2lvbiI6bnVsbH19&frame=false&hideCard=false&hideThread=false&id=1534227619222196224&lang=en&origin=https%3A%2F%2Ftherecord.media%2Fhackers-using-follina-windows-zero-day-to-spread-qbot-malware%2F&sessionId=8052476664b15c65e1b059b9c5151d88882dc921&siteScreenName=therecord_media&theme=light&widgetsVersion=b45a03c79d4c1%3A1654150928467&width=500px
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date: Fri, 10 Jun 2022 01:54:56 GMT
Content-Encoding: gzip
Age: 289588
X-Cache: HIT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server-Timing: "x-cache;desc= HIT,x-tw-cdn;desc=",edge;dur=1
Content-Length: 794
x-tw-cdn: VZ
Last-Modified: Mon, 06 Jun 2022 17:12:39 GMT
Server: ECS (mil/6CF4)
Etag: "cfb405c70f2f1c1a003ec96fa540cf30+gzip"
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=315360000

GET
H/1.1 200
OK embed.Tweet.a041e79d959212ec9ef6.js Show response
platform.twitter.com/embed/ Frame 8E4A 14 KB
6 KB 24ms
23ms Script
application/javascript 2606:2800:234:59:254c:406:2366:268c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/embed/embed.Tweet.a041e79d959212ec9ef6.js
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/embed/Tweet.html?creatorScreenName=jgreigj&dnt=true&embedId=twitter-widget-0&features=eyJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3JlZnNyY19zZXNzaW9uIjp7ImJ1Y2tldCI6Im9mZiIsInZlcnNpb24iOm51bGx9LCJ0Zndfc2Vuc2l0aXZlX21lZGlhX2ludGVyc3RpdGlhbF8xMzk2MyI6eyJidWNrZXQiOiJpbnRlcnN0aXRpYWwiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3R3ZWV0X3Jlc3VsdF9taWdyYXRpb25fMTM5NzkiOnsiYnVja2V0IjoidHdlZXRfcmVzdWx0IiwidmVyc2lvbiI6bnVsbH19&frame=false&hideCard=false&hideThread=false&id=1534227619222196224&lang=en&origin=https%3A%2F%2Ftherecord.media%2Fhackers-using-follina-windows-zero-day-to-spread-qbot-malware%2F&sessionId=8052476664b15c65e1b059b9c5151d88882dc921&siteScreenName=therecord_media&theme=light&widgetsVersion=b45a03c79d4c1%3A1654150928467&width=500px
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (mil/6CF0) /
Resource Hash: dc9ae7c30a725e1a3e0da25b2cf138836c154b77a51decb32e2c58cdd3d48094

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://platform.twitter.com/embed/Tweet.html?creatorScreenName=jgreigj&dnt=true&embedId=twitter-widget-0&features=eyJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3JlZnNyY19zZXNzaW9uIjp7ImJ1Y2tldCI6Im9mZiIsInZlcnNpb24iOm51bGx9LCJ0Zndfc2Vuc2l0aXZlX21lZGlhX2ludGVyc3RpdGlhbF8xMzk2MyI6eyJidWNrZXQiOiJpbnRlcnN0aXRpYWwiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3R3ZWV0X3Jlc3VsdF9taWdyYXRpb25fMTM5NzkiOnsiYnVja2V0IjoidHdlZXRfcmVzdWx0IiwidmVyc2lvbiI6bnVsbH19&frame=false&hideCard=false&hideThread=false&id=1534227619222196224&lang=en&origin=https%3A%2F%2Ftherecord.media%2Fhackers-using-follina-windows-zero-day-to-spread-qbot-malware%2F&sessionId=8052476664b15c65e1b059b9c5151d88882dc921&siteScreenName=therecord_media&theme=light&widgetsVersion=b45a03c79d4c1%3A1654150928467&width=500px
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date: Fri, 10 Jun 2022 01:54:56 GMT
Content-Encoding: gzip
Age: 289588
X-Cache: HIT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server-Timing: "x-cache;desc= HIT,x-tw-cdn;desc=",edge;dur=1
Content-Length: 5636
x-tw-cdn: VZ
Last-Modified: Mon, 06 Jun 2022 17:12:39 GMT
Server: ECS (mil/6CF0)
Etag: "295df71a71f3410cbdbf6a6dbdee02c8+gzip"
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=315360000

GET
H/1.1 200
OK embed.runtime.ff468dfcc26885f2cd74.js Show response
platform.twitter.com/embed/ Frame 68C2 9 KB
5 KB 25ms
25ms Script
application/javascript 2606:2800:234:59:254c:406:2366:268c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/embed/embed.runtime.ff468dfcc26885f2cd74.js
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/embed/Tweet.html?creatorScreenName=jgreigj&dnt=true&embedId=twitter-widget-1&features=eyJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3JlZnNyY19zZXNzaW9uIjp7ImJ1Y2tldCI6Im9mZiIsInZlcnNpb24iOm51bGx9LCJ0Zndfc2Vuc2l0aXZlX21lZGlhX2ludGVyc3RpdGlhbF8xMzk2MyI6eyJidWNrZXQiOiJpbnRlcnN0aXRpYWwiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3R3ZWV0X3Jlc3VsdF9taWdyYXRpb25fMTM5NzkiOnsiYnVja2V0IjoidHdlZXRfcmVzdWx0IiwidmVyc2lvbiI6bnVsbH19&frame=false&hideCard=false&hideThread=false&id=1534213925750841346&lang=en&origin=https%3A%2F%2Ftherecord.media%2Fhackers-using-follina-windows-zero-day-to-spread-qbot-malware%2F&sessionId=8052476664b15c65e1b059b9c5151d88882dc921&siteScreenName=therecord_media&theme=light&widgetsVersion=b45a03c79d4c1%3A1654150928467&width=500px
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (mil/6CF1) /
Resource Hash: 5e153d670d4df48314dc57d6f9062a26d4bcdfdfdfc2bc2fd42f45f3215ed62a

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://platform.twitter.com/embed/Tweet.html?creatorScreenName=jgreigj&dnt=true&embedId=twitter-widget-1&features=eyJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3JlZnNyY19zZXNzaW9uIjp7ImJ1Y2tldCI6Im9mZiIsInZlcnNpb24iOm51bGx9LCJ0Zndfc2Vuc2l0aXZlX21lZGlhX2ludGVyc3RpdGlhbF8xMzk2MyI6eyJidWNrZXQiOiJpbnRlcnN0aXRpYWwiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3R3ZWV0X3Jlc3VsdF9taWdyYXRpb25fMTM5NzkiOnsiYnVja2V0IjoidHdlZXRfcmVzdWx0IiwidmVyc2lvbiI6bnVsbH19&frame=false&hideCard=false&hideThread=false&id=1534213925750841346&lang=en&origin=https%3A%2F%2Ftherecord.media%2Fhackers-using-follina-windows-zero-day-to-spread-qbot-malware%2F&sessionId=8052476664b15c65e1b059b9c5151d88882dc921&siteScreenName=therecord_media&theme=light&widgetsVersion=b45a03c79d4c1%3A1654150928467&width=500px
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date: Fri, 10 Jun 2022 01:54:56 GMT
Content-Encoding: gzip
Age: 289588
X-Cache: HIT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server-Timing: "x-cache;desc= HIT,x-tw-cdn;desc=",edge;dur=1
Content-Length: 4255
x-tw-cdn: VZ
Last-Modified: Mon, 06 Jun 2022 17:12:39 GMT
Server: ECS (mil/6CF1)
Etag: "f824375fd8f44e2e0f1fe8f4d5a6e177+gzip"
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=315360000

GET
H/1.1 200
OK embed.modules.f34a0f34273ac52f3e51.js Show response
platform.twitter.com/embed/ Frame 68C2 512 KB
168 KB 26ms
26ms Script
application/javascript 2606:2800:234:59:254c:406:2366:268c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/embed/embed.modules.f34a0f34273ac52f3e51.js
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/embed/Tweet.html?creatorScreenName=jgreigj&dnt=true&embedId=twitter-widget-1&features=eyJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3JlZnNyY19zZXNzaW9uIjp7ImJ1Y2tldCI6Im9mZiIsInZlcnNpb24iOm51bGx9LCJ0Zndfc2Vuc2l0aXZlX21lZGlhX2ludGVyc3RpdGlhbF8xMzk2MyI6eyJidWNrZXQiOiJpbnRlcnN0aXRpYWwiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3R3ZWV0X3Jlc3VsdF9taWdyYXRpb25fMTM5NzkiOnsiYnVja2V0IjoidHdlZXRfcmVzdWx0IiwidmVyc2lvbiI6bnVsbH19&frame=false&hideCard=false&hideThread=false&id=1534213925750841346&lang=en&origin=https%3A%2F%2Ftherecord.media%2Fhackers-using-follina-windows-zero-day-to-spread-qbot-malware%2F&sessionId=8052476664b15c65e1b059b9c5151d88882dc921&siteScreenName=therecord_media&theme=light&widgetsVersion=b45a03c79d4c1%3A1654150928467&width=500px
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (mil/6CDF) /
Resource Hash: 5e794d4a1df5f1c1035c15d1f24e115f9fdab9be376f12754239b981f61bf887

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://platform.twitter.com/embed/Tweet.html?creatorScreenName=jgreigj&dnt=true&embedId=twitter-widget-1&features=eyJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3JlZnNyY19zZXNzaW9uIjp7ImJ1Y2tldCI6Im9mZiIsInZlcnNpb24iOm51bGx9LCJ0Zndfc2Vuc2l0aXZlX21lZGlhX2ludGVyc3RpdGlhbF8xMzk2MyI6eyJidWNrZXQiOiJpbnRlcnN0aXRpYWwiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3R3ZWV0X3Jlc3VsdF9taWdyYXRpb25fMTM5NzkiOnsiYnVja2V0IjoidHdlZXRfcmVzdWx0IiwidmVyc2lvbiI6bnVsbH19&frame=false&hideCard=false&hideThread=false&id=1534213925750841346&lang=en&origin=https%3A%2F%2Ftherecord.media%2Fhackers-using-follina-windows-zero-day-to-spread-qbot-malware%2F&sessionId=8052476664b15c65e1b059b9c5151d88882dc921&siteScreenName=therecord_media&theme=light&widgetsVersion=b45a03c79d4c1%3A1654150928467&width=500px
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date: Fri, 10 Jun 2022 01:54:56 GMT
Content-Encoding: gzip
Age: 289587
X-Cache: HIT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server-Timing: "x-cache;desc= HIT,x-tw-cdn;desc=VZ",edge;dur=1
Content-Length: 171249
x-tw-cdn: VZ
Last-Modified: Mon, 06 Jun 2022 17:12:39 GMT
Server: ECS (mil/6CDF)
Etag: "7490e7a386def1875edc794009edc560+gzip"
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=315360000

GET
H/1.1 200
OK embed.i18n.58f3645101e687f24f08.js Show response
platform.twitter.com/embed/ Frame 68C2 2 KB
1 KB 45ms
22ms Script
application/javascript 2606:2800:234:59:254c:406:2366:268c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/embed/embed.i18n.58f3645101e687f24f08.js
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/embed/Tweet.html?creatorScreenName=jgreigj&dnt=true&embedId=twitter-widget-1&features=eyJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3JlZnNyY19zZXNzaW9uIjp7ImJ1Y2tldCI6Im9mZiIsInZlcnNpb24iOm51bGx9LCJ0Zndfc2Vuc2l0aXZlX21lZGlhX2ludGVyc3RpdGlhbF8xMzk2MyI6eyJidWNrZXQiOiJpbnRlcnN0aXRpYWwiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3R3ZWV0X3Jlc3VsdF9taWdyYXRpb25fMTM5NzkiOnsiYnVja2V0IjoidHdlZXRfcmVzdWx0IiwidmVyc2lvbiI6bnVsbH19&frame=false&hideCard=false&hideThread=false&id=1534213925750841346&lang=en&origin=https%3A%2F%2Ftherecord.media%2Fhackers-using-follina-windows-zero-day-to-spread-qbot-malware%2F&sessionId=8052476664b15c65e1b059b9c5151d88882dc921&siteScreenName=therecord_media&theme=light&widgetsVersion=b45a03c79d4c1%3A1654150928467&width=500px
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (mil/6CF4) /
Resource Hash: 52c19e156be623c2b03edbf619561b9ce54fef7186e33dc7152bb17b7cc2f1ec

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://platform.twitter.com/embed/Tweet.html?creatorScreenName=jgreigj&dnt=true&embedId=twitter-widget-1&features=eyJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3JlZnNyY19zZXNzaW9uIjp7ImJ1Y2tldCI6Im9mZiIsInZlcnNpb24iOm51bGx9LCJ0Zndfc2Vuc2l0aXZlX21lZGlhX2ludGVyc3RpdGlhbF8xMzk2MyI6eyJidWNrZXQiOiJpbnRlcnN0aXRpYWwiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3R3ZWV0X3Jlc3VsdF9taWdyYXRpb25fMTM5NzkiOnsiYnVja2V0IjoidHdlZXRfcmVzdWx0IiwidmVyc2lvbiI6bnVsbH19&frame=false&hideCard=false&hideThread=false&id=1534213925750841346&lang=en&origin=https%3A%2F%2Ftherecord.media%2Fhackers-using-follina-windows-zero-day-to-spread-qbot-malware%2F&sessionId=8052476664b15c65e1b059b9c5151d88882dc921&siteScreenName=therecord_media&theme=light&widgetsVersion=b45a03c79d4c1%3A1654150928467&width=500px
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date: Fri, 10 Jun 2022 01:54:56 GMT
Content-Encoding: gzip
Age: 289588
X-Cache: HIT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server-Timing: "x-cache;desc= HIT,x-tw-cdn;desc=",edge;dur=1
Content-Length: 794
x-tw-cdn: VZ
Last-Modified: Mon, 06 Jun 2022 17:12:39 GMT
Server: ECS (mil/6CF4)
Etag: "cfb405c70f2f1c1a003ec96fa540cf30+gzip"
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=315360000

GET
H/1.1 200
OK embed.Tweet.a041e79d959212ec9ef6.js Show response
platform.twitter.com/embed/ Frame 68C2 14 KB
6 KB 46ms
22ms Script
application/javascript 2606:2800:234:59:254c:406:2366:268c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/embed/embed.Tweet.a041e79d959212ec9ef6.js
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/embed/Tweet.html?creatorScreenName=jgreigj&dnt=true&embedId=twitter-widget-1&features=eyJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3JlZnNyY19zZXNzaW9uIjp7ImJ1Y2tldCI6Im9mZiIsInZlcnNpb24iOm51bGx9LCJ0Zndfc2Vuc2l0aXZlX21lZGlhX2ludGVyc3RpdGlhbF8xMzk2MyI6eyJidWNrZXQiOiJpbnRlcnN0aXRpYWwiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3R3ZWV0X3Jlc3VsdF9taWdyYXRpb25fMTM5NzkiOnsiYnVja2V0IjoidHdlZXRfcmVzdWx0IiwidmVyc2lvbiI6bnVsbH19&frame=false&hideCard=false&hideThread=false&id=1534213925750841346&lang=en&origin=https%3A%2F%2Ftherecord.media%2Fhackers-using-follina-windows-zero-day-to-spread-qbot-malware%2F&sessionId=8052476664b15c65e1b059b9c5151d88882dc921&siteScreenName=therecord_media&theme=light&widgetsVersion=b45a03c79d4c1%3A1654150928467&width=500px
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (mil/6CF0) /
Resource Hash: dc9ae7c30a725e1a3e0da25b2cf138836c154b77a51decb32e2c58cdd3d48094

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://platform.twitter.com/embed/Tweet.html?creatorScreenName=jgreigj&dnt=true&embedId=twitter-widget-1&features=eyJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3JlZnNyY19zZXNzaW9uIjp7ImJ1Y2tldCI6Im9mZiIsInZlcnNpb24iOm51bGx9LCJ0Zndfc2Vuc2l0aXZlX21lZGlhX2ludGVyc3RpdGlhbF8xMzk2MyI6eyJidWNrZXQiOiJpbnRlcnN0aXRpYWwiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3R3ZWV0X3Jlc3VsdF9taWdyYXRpb25fMTM5NzkiOnsiYnVja2V0IjoidHdlZXRfcmVzdWx0IiwidmVyc2lvbiI6bnVsbH19&frame=false&hideCard=false&hideThread=false&id=1534213925750841346&lang=en&origin=https%3A%2F%2Ftherecord.media%2Fhackers-using-follina-windows-zero-day-to-spread-qbot-malware%2F&sessionId=8052476664b15c65e1b059b9c5151d88882dc921&siteScreenName=therecord_media&theme=light&widgetsVersion=b45a03c79d4c1%3A1654150928467&width=500px
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date: Fri, 10 Jun 2022 01:54:56 GMT
Content-Encoding: gzip
Age: 289588
X-Cache: HIT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server-Timing: "x-cache;desc= HIT,x-tw-cdn;desc=",edge;dur=1
Content-Length: 5636
x-tw-cdn: VZ
Last-Modified: Mon, 06 Jun 2022 17:12:39 GMT
Server: ECS (mil/6CF0)
Etag: "295df71a71f3410cbdbf6a6dbdee02c8+gzip"
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=315360000

GET
H/1.1 200
OK embed.vendors~ondemand.en-js.acec6ae280b2e2f6ef87.js Show response
platform.twitter.com/embed/ Frame 8E4A 39 KB
13 KB 23ms
22ms Script
application/javascript 2606:2800:234:59:254c:406:2366:268c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/embed/embed.vendors~ondemand.en-js.acec6ae280b2e2f6ef87.js
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/embed/embed.runtime.ff468dfcc26885f2cd74.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (mil/6CF2) /
Resource Hash: 931750573d4728b1437a7a6769a62596c3f1f011554e2e3f401c7dfd9fb18d16

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://platform.twitter.com/embed/Tweet.html?creatorScreenName=jgreigj&dnt=true&embedId=twitter-widget-0&features=eyJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3JlZnNyY19zZXNzaW9uIjp7ImJ1Y2tldCI6Im9mZiIsInZlcnNpb24iOm51bGx9LCJ0Zndfc2Vuc2l0aXZlX21lZGlhX2ludGVyc3RpdGlhbF8xMzk2MyI6eyJidWNrZXQiOiJpbnRlcnN0aXRpYWwiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3R3ZWV0X3Jlc3VsdF9taWdyYXRpb25fMTM5NzkiOnsiYnVja2V0IjoidHdlZXRfcmVzdWx0IiwidmVyc2lvbiI6bnVsbH19&frame=false&hideCard=false&hideThread=false&id=1534227619222196224&lang=en&origin=https%3A%2F%2Ftherecord.media%2Fhackers-using-follina-windows-zero-day-to-spread-qbot-malware%2F&sessionId=8052476664b15c65e1b059b9c5151d88882dc921&siteScreenName=therecord_media&theme=light&widgetsVersion=b45a03c79d4c1%3A1654150928467&width=500px
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date: Fri, 10 Jun 2022 01:54:56 GMT
Content-Encoding: gzip
Age: 289588
X-Cache: HIT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server-Timing: "x-cache;desc= HIT,x-tw-cdn;desc=VZ",edge;dur=1
Content-Length: 13145
x-tw-cdn: VZ
Last-Modified: Mon, 06 Jun 2022 17:12:39 GMT
Server: ECS (mil/6CF2)
Etag: "d2f883c771ed4b1c0f62ad00c6ca3a69+gzip"
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=315360000

GET
H/1.1 200
OK embed.ondemand.en-js.5ab403453815af8885c8.js Show response
platform.twitter.com/embed/ Frame 8E4A 3 KB
2 KB 23ms
23ms Script
application/javascript 2606:2800:234:59:254c:406:2366:268c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/embed/embed.ondemand.en-js.5ab403453815af8885c8.js
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/embed/embed.runtime.ff468dfcc26885f2cd74.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (mil/6CED) /
Resource Hash: 735f1abaa77b0fb510261c9e7aa05ad695af92b888f85b6604f44d8653ce79dd

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://platform.twitter.com/embed/Tweet.html?creatorScreenName=jgreigj&dnt=true&embedId=twitter-widget-0&features=eyJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3JlZnNyY19zZXNzaW9uIjp7ImJ1Y2tldCI6Im9mZiIsInZlcnNpb24iOm51bGx9LCJ0Zndfc2Vuc2l0aXZlX21lZGlhX2ludGVyc3RpdGlhbF8xMzk2MyI6eyJidWNrZXQiOiJpbnRlcnN0aXRpYWwiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3R3ZWV0X3Jlc3VsdF9taWdyYXRpb25fMTM5NzkiOnsiYnVja2V0IjoidHdlZXRfcmVzdWx0IiwidmVyc2lvbiI6bnVsbH19&frame=false&hideCard=false&hideThread=false&id=1534227619222196224&lang=en&origin=https%3A%2F%2Ftherecord.media%2Fhackers-using-follina-windows-zero-day-to-spread-qbot-malware%2F&sessionId=8052476664b15c65e1b059b9c5151d88882dc921&siteScreenName=therecord_media&theme=light&widgetsVersion=b45a03c79d4c1%3A1654150928467&width=500px
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date: Fri, 10 Jun 2022 01:54:56 GMT
Content-Encoding: gzip
Age: 289588
X-Cache: HIT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server-Timing: "x-cache;desc= HIT,x-tw-cdn;desc=",edge;dur=1
Content-Length: 1293
x-tw-cdn: VZ
Last-Modified: Mon, 06 Jun 2022 17:12:39 GMT
Server: ECS (mil/6CED)
Etag: "06f8c27a0df1bb9d1d88f152801cdda4+gzip"
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=315360000

GET
H/1.1 200
OK embed.ondemand.i18n.en-js.1e1be839d2d2b69bdf78.js Show response
platform.twitter.com/embed/ Frame 8E4A 3 KB
2 KB 22ms
22ms Script
application/javascript 2606:2800:234:59:254c:406:2366:268c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/embed/embed.ondemand.i18n.en-js.1e1be839d2d2b69bdf78.js
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/embed/embed.runtime.ff468dfcc26885f2cd74.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (mil/6CEC) /
Resource Hash: 7a4645fb7bd66c6fa3088677ee1a517deea83df27006a147e3dcd64387761ba1

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://platform.twitter.com/embed/Tweet.html?creatorScreenName=jgreigj&dnt=true&embedId=twitter-widget-0&features=eyJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3JlZnNyY19zZXNzaW9uIjp7ImJ1Y2tldCI6Im9mZiIsInZlcnNpb24iOm51bGx9LCJ0Zndfc2Vuc2l0aXZlX21lZGlhX2ludGVyc3RpdGlhbF8xMzk2MyI6eyJidWNrZXQiOiJpbnRlcnN0aXRpYWwiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3R3ZWV0X3Jlc3VsdF9taWdyYXRpb25fMTM5NzkiOnsiYnVja2V0IjoidHdlZXRfcmVzdWx0IiwidmVyc2lvbiI6bnVsbH19&frame=false&hideCard=false&hideThread=false&id=1534227619222196224&lang=en&origin=https%3A%2F%2Ftherecord.media%2Fhackers-using-follina-windows-zero-day-to-spread-qbot-malware%2F&sessionId=8052476664b15c65e1b059b9c5151d88882dc921&siteScreenName=therecord_media&theme=light&widgetsVersion=b45a03c79d4c1%3A1654150928467&width=500px
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date: Fri, 10 Jun 2022 01:54:56 GMT
Content-Encoding: gzip
Age: 289587
X-Cache: HIT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server-Timing: "x-cache;desc= HIT,x-tw-cdn;desc=VZ",edge;dur=1
Content-Length: 1294
x-tw-cdn: VZ
Last-Modified: Mon, 06 Jun 2022 17:12:39 GMT
Server: ECS (mil/6CEC)
Etag: "152e5ac13ebd99eabd94a11d7061d9ff+gzip"
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=315360000

GET
H/1.1 200
OK embed.vendors~ondemand.en-js.acec6ae280b2e2f6ef87.js Show response
platform.twitter.com/embed/ Frame 68C2 39 KB
13 KB 22ms
22ms Script
application/javascript 2606:2800:234:59:254c:406:2366:268c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/embed/embed.vendors~ondemand.en-js.acec6ae280b2e2f6ef87.js
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/embed/embed.runtime.ff468dfcc26885f2cd74.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (mil/6CF2) /
Resource Hash: 931750573d4728b1437a7a6769a62596c3f1f011554e2e3f401c7dfd9fb18d16

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://platform.twitter.com/embed/Tweet.html?creatorScreenName=jgreigj&dnt=true&embedId=twitter-widget-1&features=eyJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3JlZnNyY19zZXNzaW9uIjp7ImJ1Y2tldCI6Im9mZiIsInZlcnNpb24iOm51bGx9LCJ0Zndfc2Vuc2l0aXZlX21lZGlhX2ludGVyc3RpdGlhbF8xMzk2MyI6eyJidWNrZXQiOiJpbnRlcnN0aXRpYWwiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3R3ZWV0X3Jlc3VsdF9taWdyYXRpb25fMTM5NzkiOnsiYnVja2V0IjoidHdlZXRfcmVzdWx0IiwidmVyc2lvbiI6bnVsbH19&frame=false&hideCard=false&hideThread=false&id=1534213925750841346&lang=en&origin=https%3A%2F%2Ftherecord.media%2Fhackers-using-follina-windows-zero-day-to-spread-qbot-malware%2F&sessionId=8052476664b15c65e1b059b9c5151d88882dc921&siteScreenName=therecord_media&theme=light&widgetsVersion=b45a03c79d4c1%3A1654150928467&width=500px
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date: Fri, 10 Jun 2022 01:54:56 GMT
Content-Encoding: gzip
Age: 289588
X-Cache: HIT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server-Timing: "x-cache;desc= HIT,x-tw-cdn;desc=VZ",edge;dur=1
Content-Length: 13145
x-tw-cdn: VZ
Last-Modified: Mon, 06 Jun 2022 17:12:39 GMT
Server: ECS (mil/6CF2)
Etag: "d2f883c771ed4b1c0f62ad00c6ca3a69+gzip"
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=315360000

GET
H/1.1 200
OK embed.ondemand.en-js.5ab403453815af8885c8.js Show response
platform.twitter.com/embed/ Frame 68C2 3 KB
2 KB 23ms
23ms Script
application/javascript 2606:2800:234:59:254c:406:2366:268c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/embed/embed.ondemand.en-js.5ab403453815af8885c8.js
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/embed/embed.runtime.ff468dfcc26885f2cd74.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (mil/6CED) /
Resource Hash: 735f1abaa77b0fb510261c9e7aa05ad695af92b888f85b6604f44d8653ce79dd

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://platform.twitter.com/embed/Tweet.html?creatorScreenName=jgreigj&dnt=true&embedId=twitter-widget-1&features=eyJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3JlZnNyY19zZXNzaW9uIjp7ImJ1Y2tldCI6Im9mZiIsInZlcnNpb24iOm51bGx9LCJ0Zndfc2Vuc2l0aXZlX21lZGlhX2ludGVyc3RpdGlhbF8xMzk2MyI6eyJidWNrZXQiOiJpbnRlcnN0aXRpYWwiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3R3ZWV0X3Jlc3VsdF9taWdyYXRpb25fMTM5NzkiOnsiYnVja2V0IjoidHdlZXRfcmVzdWx0IiwidmVyc2lvbiI6bnVsbH19&frame=false&hideCard=false&hideThread=false&id=1534213925750841346&lang=en&origin=https%3A%2F%2Ftherecord.media%2Fhackers-using-follina-windows-zero-day-to-spread-qbot-malware%2F&sessionId=8052476664b15c65e1b059b9c5151d88882dc921&siteScreenName=therecord_media&theme=light&widgetsVersion=b45a03c79d4c1%3A1654150928467&width=500px
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date: Fri, 10 Jun 2022 01:54:56 GMT
Content-Encoding: gzip
Age: 289588
X-Cache: HIT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server-Timing: "x-cache;desc= HIT,x-tw-cdn;desc=",edge;dur=1
Content-Length: 1293
x-tw-cdn: VZ
Last-Modified: Mon, 06 Jun 2022 17:12:39 GMT
Server: ECS (mil/6CED)
Etag: "06f8c27a0df1bb9d1d88f152801cdda4+gzip"
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=315360000

GET
H/1.1 200
OK embed.ondemand.i18n.en-js.1e1be839d2d2b69bdf78.js Show response
platform.twitter.com/embed/ Frame 68C2 3 KB
2 KB 22ms
22ms Script
application/javascript 2606:2800:234:59:254c:406:2366:268c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/embed/embed.ondemand.i18n.en-js.1e1be839d2d2b69bdf78.js
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/embed/embed.runtime.ff468dfcc26885f2cd74.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (mil/6CEC) /
Resource Hash: 7a4645fb7bd66c6fa3088677ee1a517deea83df27006a147e3dcd64387761ba1

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://platform.twitter.com/embed/Tweet.html?creatorScreenName=jgreigj&dnt=true&embedId=twitter-widget-1&features=eyJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3JlZnNyY19zZXNzaW9uIjp7ImJ1Y2tldCI6Im9mZiIsInZlcnNpb24iOm51bGx9LCJ0Zndfc2Vuc2l0aXZlX21lZGlhX2ludGVyc3RpdGlhbF8xMzk2MyI6eyJidWNrZXQiOiJpbnRlcnN0aXRpYWwiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3R3ZWV0X3Jlc3VsdF9taWdyYXRpb25fMTM5NzkiOnsiYnVja2V0IjoidHdlZXRfcmVzdWx0IiwidmVyc2lvbiI6bnVsbH19&frame=false&hideCard=false&hideThread=false&id=1534213925750841346&lang=en&origin=https%3A%2F%2Ftherecord.media%2Fhackers-using-follina-windows-zero-day-to-spread-qbot-malware%2F&sessionId=8052476664b15c65e1b059b9c5151d88882dc921&siteScreenName=therecord_media&theme=light&widgetsVersion=b45a03c79d4c1%3A1654150928467&width=500px
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date: Fri, 10 Jun 2022 01:54:56 GMT
Content-Encoding: gzip
Age: 289587
X-Cache: HIT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server-Timing: "x-cache;desc= HIT,x-tw-cdn;desc=VZ",edge;dur=1
Content-Length: 1294
x-tw-cdn: VZ
Last-Modified: Mon, 06 Jun 2022 17:12:39 GMT
Server: ECS (mil/6CEC)
Etag: "152e5ac13ebd99eabd94a11d7061d9ff+gzip"
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=315360000

GET
H/1.1 200
OK embed.vendors~ondemand.Tweet.064ef547621667f0c5ed.js Show response
platform.twitter.com/embed/ Frame 8E4A 450 KB
126 KB 23ms
23ms Script
application/javascript 2606:2800:234:59:254c:406:2366:268c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/embed/embed.vendors~ondemand.Tweet.064ef547621667f0c5ed.js
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/embed/embed.runtime.ff468dfcc26885f2cd74.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (mil/6CF3) /
Resource Hash: 2dd03edf39ceb2293a5942ee1925932d1efc47ac74080ca2e2ddd0fd2d35741c

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://platform.twitter.com/embed/Tweet.html?creatorScreenName=jgreigj&dnt=true&embedId=twitter-widget-0&features=eyJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3JlZnNyY19zZXNzaW9uIjp7ImJ1Y2tldCI6Im9mZiIsInZlcnNpb24iOm51bGx9LCJ0Zndfc2Vuc2l0aXZlX21lZGlhX2ludGVyc3RpdGlhbF8xMzk2MyI6eyJidWNrZXQiOiJpbnRlcnN0aXRpYWwiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3R3ZWV0X3Jlc3VsdF9taWdyYXRpb25fMTM5NzkiOnsiYnVja2V0IjoidHdlZXRfcmVzdWx0IiwidmVyc2lvbiI6bnVsbH19&frame=false&hideCard=false&hideThread=false&id=1534227619222196224&lang=en&origin=https%3A%2F%2Ftherecord.media%2Fhackers-using-follina-windows-zero-day-to-spread-qbot-malware%2F&sessionId=8052476664b15c65e1b059b9c5151d88882dc921&siteScreenName=therecord_media&theme=light&widgetsVersion=b45a03c79d4c1%3A1654150928467&width=500px
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date: Fri, 10 Jun 2022 01:54:56 GMT
Content-Encoding: gzip
Age: 289587
X-Cache: HIT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server-Timing: "x-cache;desc= HIT,x-tw-cdn;desc=VZ",edge;dur=1
Content-Length: 128827
x-tw-cdn: VZ
Last-Modified: Mon, 06 Jun 2022 17:12:39 GMT
Server: ECS (mil/6CF3)
Etag: "b9859d36946babed962152b2268dec32+gzip"
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=315360000

GET
H/1.1 200
OK embed.ondemand.Tweet.eade9895e746f8baccf8.js Show response
platform.twitter.com/embed/ Frame 8E4A 78 KB
18 KB 23ms
22ms Script
application/javascript 2606:2800:234:59:254c:406:2366:268c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/embed/embed.ondemand.Tweet.eade9895e746f8baccf8.js
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/embed/embed.runtime.ff468dfcc26885f2cd74.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (mil/6CE6) /
Resource Hash: 2e4143a492ff81253dbd0125e3aa4007120beeb3106ab4a5da9296a6aa435474

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://platform.twitter.com/embed/Tweet.html?creatorScreenName=jgreigj&dnt=true&embedId=twitter-widget-0&features=eyJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3JlZnNyY19zZXNzaW9uIjp7ImJ1Y2tldCI6Im9mZiIsInZlcnNpb24iOm51bGx9LCJ0Zndfc2Vuc2l0aXZlX21lZGlhX2ludGVyc3RpdGlhbF8xMzk2MyI6eyJidWNrZXQiOiJpbnRlcnN0aXRpYWwiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3R3ZWV0X3Jlc3VsdF9taWdyYXRpb25fMTM5NzkiOnsiYnVja2V0IjoidHdlZXRfcmVzdWx0IiwidmVyc2lvbiI6bnVsbH19&frame=false&hideCard=false&hideThread=false&id=1534227619222196224&lang=en&origin=https%3A%2F%2Ftherecord.media%2Fhackers-using-follina-windows-zero-day-to-spread-qbot-malware%2F&sessionId=8052476664b15c65e1b059b9c5151d88882dc921&siteScreenName=therecord_media&theme=light&widgetsVersion=b45a03c79d4c1%3A1654150928467&width=500px
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date: Fri, 10 Jun 2022 01:54:56 GMT
Content-Encoding: gzip
Age: 289587
X-Cache: HIT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server-Timing: "x-cache;desc= HIT,x-tw-cdn;desc=VZ",edge;dur=1
Content-Length: 17437
x-tw-cdn: VZ
Last-Modified: Mon, 06 Jun 2022 17:12:39 GMT
Server: ECS (mil/6CE6)
Etag: "d21c5e201276e207bbf916f5758a8634+gzip"
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=315360000

GET
H/1.1 200
OK embed.vendors~ondemand.Tweet.064ef547621667f0c5ed.js Show response
platform.twitter.com/embed/ Frame 68C2 450 KB
126 KB 23ms
23ms Script
application/javascript 2606:2800:234:59:254c:406:2366:268c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/embed/embed.vendors~ondemand.Tweet.064ef547621667f0c5ed.js
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/embed/embed.runtime.ff468dfcc26885f2cd74.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (mil/6CF3) /
Resource Hash: 2dd03edf39ceb2293a5942ee1925932d1efc47ac74080ca2e2ddd0fd2d35741c

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://platform.twitter.com/embed/Tweet.html?creatorScreenName=jgreigj&dnt=true&embedId=twitter-widget-1&features=eyJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3JlZnNyY19zZXNzaW9uIjp7ImJ1Y2tldCI6Im9mZiIsInZlcnNpb24iOm51bGx9LCJ0Zndfc2Vuc2l0aXZlX21lZGlhX2ludGVyc3RpdGlhbF8xMzk2MyI6eyJidWNrZXQiOiJpbnRlcnN0aXRpYWwiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3R3ZWV0X3Jlc3VsdF9taWdyYXRpb25fMTM5NzkiOnsiYnVja2V0IjoidHdlZXRfcmVzdWx0IiwidmVyc2lvbiI6bnVsbH19&frame=false&hideCard=false&hideThread=false&id=1534213925750841346&lang=en&origin=https%3A%2F%2Ftherecord.media%2Fhackers-using-follina-windows-zero-day-to-spread-qbot-malware%2F&sessionId=8052476664b15c65e1b059b9c5151d88882dc921&siteScreenName=therecord_media&theme=light&widgetsVersion=b45a03c79d4c1%3A1654150928467&width=500px
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date: Fri, 10 Jun 2022 01:54:56 GMT
Content-Encoding: gzip
Age: 289587
X-Cache: HIT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server-Timing: "x-cache;desc= HIT,x-tw-cdn;desc=VZ",edge;dur=1
Content-Length: 128827
x-tw-cdn: VZ
Last-Modified: Mon, 06 Jun 2022 17:12:39 GMT
Server: ECS (mil/6CF3)
Etag: "b9859d36946babed962152b2268dec32+gzip"
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=315360000

GET
H/1.1 200
OK embed.ondemand.Tweet.eade9895e746f8baccf8.js Show response
platform.twitter.com/embed/ Frame 68C2 78 KB
18 KB 23ms
22ms Script
application/javascript 2606:2800:234:59:254c:406:2366:268c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/embed/embed.ondemand.Tweet.eade9895e746f8baccf8.js
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/embed/embed.runtime.ff468dfcc26885f2cd74.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (mil/6CE6) /
Resource Hash: 2e4143a492ff81253dbd0125e3aa4007120beeb3106ab4a5da9296a6aa435474

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://platform.twitter.com/embed/Tweet.html?creatorScreenName=jgreigj&dnt=true&embedId=twitter-widget-1&features=eyJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3JlZnNyY19zZXNzaW9uIjp7ImJ1Y2tldCI6Im9mZiIsInZlcnNpb24iOm51bGx9LCJ0Zndfc2Vuc2l0aXZlX21lZGlhX2ludGVyc3RpdGlhbF8xMzk2MyI6eyJidWNrZXQiOiJpbnRlcnN0aXRpYWwiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3R3ZWV0X3Jlc3VsdF9taWdyYXRpb25fMTM5NzkiOnsiYnVja2V0IjoidHdlZXRfcmVzdWx0IiwidmVyc2lvbiI6bnVsbH19&frame=false&hideCard=false&hideThread=false&id=1534213925750841346&lang=en&origin=https%3A%2F%2Ftherecord.media%2Fhackers-using-follina-windows-zero-day-to-spread-qbot-malware%2F&sessionId=8052476664b15c65e1b059b9c5151d88882dc921&siteScreenName=therecord_media&theme=light&widgetsVersion=b45a03c79d4c1%3A1654150928467&width=500px
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date: Fri, 10 Jun 2022 01:54:56 GMT
Content-Encoding: gzip
Age: 289587
X-Cache: HIT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server-Timing: "x-cache;desc= HIT,x-tw-cdn;desc=VZ",edge;dur=1
Content-Length: 17437
x-tw-cdn: VZ
Last-Modified: Mon, 06 Jun 2022 17:12:39 GMT
Server: ECS (mil/6CE6)
Etag: "d21c5e201276e207bbf916f5758a8634+gzip"
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=315360000

GET
H2 200 tweet-result Show response
cdn.syndication.twimg.com/ Frame 8E4A 2 KB
903 B 44ms
44ms XHR
application/json 2606:2800:134:fa2:1627:1fe:edb:1665
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: platform.twitter.com
URL: https://platform.twitter.com/embed/embed.modules.f34a0f34273ac52f3e51.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2606:2800:134:fa2:1627:1fe:edb:1665 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (lhb/63FE) / Express

Resource Hash

8490bb193d06ff7710cdd4c1ecce1a017ee547dfc8179193dd3302ab9256c49c

Security Headers

Name	Value
Content-Security-Policy	connect-src 'self'; default-src 'self'; frame-src 'self'; font-src 'self'; form-action 'self'; img-src 'self'; media-src 'self'; object-src 'none'; script-src 'self'; style-src 'self'; report-uri https://twitter.com/i/csp_report?a=O5RXE%3D%3D%3D&ro=false
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://platform.twitter.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

content-security-policy: connect-src 'self'; default-src 'self'; frame-src 'self'; font-src 'self'; form-action 'self'; img-src 'self'; media-src 'self'; object-src 'none'; script-src 'self'; style-src 'self'; report-uri https://twitter.com/i/csp_report?a=O5RXE%3D%3D%3D&ro=false
content-encoding: gzip
etag: W/"675-3rHOgdjhdUiPEc29OYDIXiI0RVk"
age: 2
x-powered-by: Express
x-cache: HIT
access-control-allow-methods: GET
server-timing: "x-cache;desc= HIT,x-tw-cdn;desc=VZ,edge;dur=23
strict-transport-security: max-age=631138519
content-length: 706
x-xss-protection: 0
x-response-time: 150
last-modified: Fri, 10 Jun 2022 01:54:54 GMT
server: ECS (lhb/63FE)
x-frame-options: SAMEORIGIN
date: Fri, 10 Jun 2022 01:54:56 GMT
vary: Accept-Encoding
x-tw-cdn: VZ", VZ, VZ
content-type: application/json; charset=utf-8
access-control-allow-origin: https://platform.twitter.com
cache-control: must-revalidate, max-age=60
access-control-allow-credentials: true
x-connection-hash: ce739a766fd903f930cead4771ba8bccc8b1101f947199aea6759a2b9bfdc174
accept-ranges: bytes
x-content-type-options: nosniff
access-contol-allow-origin: platform.twitter.com

GET
H2 200 tweet-result Show response
cdn.syndication.twimg.com/ Frame 68C2 2 KB
974 B 23ms
23ms XHR
application/json 2606:2800:134:fa2:1627:1fe:edb:1665
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: platform.twitter.com
URL: https://platform.twitter.com/embed/embed.modules.f34a0f34273ac52f3e51.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2606:2800:134:fa2:1627:1fe:edb:1665 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (mil/6CE9) / Express

Resource Hash

0dd620a941d112d6f3fd5e4fea30b59123adc42010908f520258ff76c71aaf29

Security Headers

Name	Value
Content-Security-Policy	connect-src 'self'; default-src 'self'; frame-src 'self'; font-src 'self'; form-action 'self'; img-src 'self'; media-src 'self'; object-src 'none'; script-src 'self'; style-src 'self'; report-uri https://twitter.com/i/csp_report?a=O5RXE%3D%3D%3D&ro=false
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://platform.twitter.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

content-security-policy: connect-src 'self'; default-src 'self'; frame-src 'self'; font-src 'self'; form-action 'self'; img-src 'self'; media-src 'self'; object-src 'none'; script-src 'self'; style-src 'self'; report-uri https://twitter.com/i/csp_report?a=O5RXE%3D%3D%3D&ro=false
content-encoding: gzip
etag: W/"696-xpVKJYARclyd31UZKabHznVi5gI"
age: 2
x-powered-by: Express
x-cache: HIT
access-control-allow-methods: GET
server-timing: "x-cache;desc= HIT,x-tw-cdn;desc=VZ,edge;dur=1
strict-transport-security: max-age=631138519
content-length: 875
x-xss-protection: 0
x-response-time: 133
last-modified: Fri, 10 Jun 2022 01:54:54 GMT
server: ECS (mil/6CE9)
x-frame-options: SAMEORIGIN
date: Fri, 10 Jun 2022 01:54:56 GMT
vary: Accept-Encoding
x-tw-cdn: VZ, VZ, VZ"
content-type: application/json; charset=utf-8
access-control-allow-origin: https://platform.twitter.com
cache-control: must-revalidate, max-age=60
access-control-allow-credentials: true
x-connection-hash: dd50ea2ce31244414f74dfca48e0f95b01349041735e7c0bfc23571a1d774294
accept-ranges: bytes
x-content-type-options: nosniff
access-contol-allow-origin: platform.twitter.com

GET
H/1.1 200
OK img.gif
b.6sc.co/v1/beacon/ 43 B
774 B 212ms
212ms Image
image/gif 96.16.137.162
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=f2675e8089b7d209a58fce8ad312f51c&svisitor=cbd5ce17997700006da4a262c50300009de91a00&session=36eb704f-5002-4342-8113-a75bb3013cc7&event=active_time_track&q=%7B%22currentTime%22%3A%22Fri%2C%2010%20Jun%202022%2001%3A54%3A56%20GMT%22%2C%22lastTrackTime%22%3A%22Fri%2C%2010%20Jun%202022%2001%3A54%3A55%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%223003%22%7D&isIframe=false&m=%7B%22description%22%3A%22The%20Record%20by%20Recorded%20Future%20gives%20exclusive%2C%20behind-the-scenes%20access%20to%20leaders%2C%20policymakers%2C%20researchers%2C%20and%20the%20shadows%20of%20the%20cyber%20underground.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Hackers%20using%20Follina%20Windows%20zero-day%20to%20spread%20Qbot%20malware%20-%20The%20Record%20by%20Recorded%20Future%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Ftherecord.media%2Fhackers-using-follina-windows-zero-day-to-spread-qbot-malware%2F&pageViewId=a8235557-2555-4bb2-85e0-a982aee06d52&an_uid=0

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

96.16.137.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a96-16-137-162.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://therecord.media/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date: Fri, 10 Jun 2022 01:54:57 GMT
X-Content-Type-Options: nosniff
Connection: keep-alive
Content-Length: 43
Pragma: no-cache
Last-Modified: Sat, 05 Jun 2021 07:56:05 GMT
Server: nginx/1.14.0 (Ubuntu)
ETag: "60bb2e15-2b"
Access-Control-Max-Age: 86400
Access-Control-Allow-Methods: GET,POST
Content-Type: image/gif
Access-Control-Allow-Origin
Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Access-Control-Allow-Credentials: true
Accept-Ranges: bytes
Access-Control-Allow-Headers: *
Expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H2 200 jot
syndication.twitter.com/i/ Frame 8E4A 43 B
170 B 151ms
150ms Image
image/gif 104.244.42.72
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://syndication.twitter.com/i/jot?l=%7B%22_category_%22%3A%22tfw_client_event%22%2C%22triggered_on%22%3A1654826097021%2C%22event_namespace%22%3A%7B%22client%22%3A%22tfw%22%2C%22page%22%3A%22tweet%22%2C%22action%22%3A%22results%22%2C%22section%22%3A%22main%22%7D%2C%22context%22%3A%22horizon%22%2C%22client_version%22%3A%22b45a03c79d4c1%3A1654150928467%22%2C%22dnt%22%3Atrue%2C%22widget_id%22%3A%22twitter-widget-0%22%2C%22widget_origin%22%3A%22https%3A%2F%2Ftherecord.media%2Fhackers-using-follina-windows-zero-day-to-spread-qbot-malware%2F%22%2C%22widget_frame%22%3A%22false%22%2C%22widget_partner%22%3A%22%22%2C%22widget_site_screen_name%22%3A%22therecord_media%22%2C%22widget_site_user_id%22%3A%22%22%2C%22widget_creator_screen_name%22%3A%22jgreigj%22%2C%22widget_creator_user_id%22%3A%22%22%2C%22widget_iframe_version%22%3A%22ef52da62d3cad%3A1654213426913%22%2C%22item_ids%22%3A%5B%221534227619222196224%22%5D%2C%22item_details%22%3A%7B%221534227619222196224%22%3A%7B%22item_type%22%3A0%7D%7D%7D&dnt=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.72 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://platform.twitter.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Fri, 10 Jun 2022 01:54:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 200 OK
x-twitter-response-tags: BouncerCompliant
content-length: 65
x-xss-protection: 0
x-response-time: 119
pragma: no-cache
last-modified: Fri, 10 Jun 2022 01:54:57 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=631138519
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: b2893ae3710a6454d8bac6901536bbd8e87559c59ad398b0904dbc60364eac87
x-transaction: 32f0314fe5df254e
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H2 200 jot
syndication.twitter.com/i/ Frame 68C2 43 B
120 B 151ms
150ms Image
image/gif 104.244.42.72
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://syndication.twitter.com/i/jot?l=%7B%22_category_%22%3A%22tfw_client_event%22%2C%22triggered_on%22%3A1654826097058%2C%22event_namespace%22%3A%7B%22client%22%3A%22tfw%22%2C%22page%22%3A%22tweet%22%2C%22action%22%3A%22results%22%2C%22section%22%3A%22main%22%7D%2C%22context%22%3A%22horizon%22%2C%22client_version%22%3A%22b45a03c79d4c1%3A1654150928467%22%2C%22dnt%22%3Atrue%2C%22widget_id%22%3A%22twitter-widget-1%22%2C%22widget_origin%22%3A%22https%3A%2F%2Ftherecord.media%2Fhackers-using-follina-windows-zero-day-to-spread-qbot-malware%2F%22%2C%22widget_frame%22%3A%22false%22%2C%22widget_partner%22%3A%22%22%2C%22widget_site_screen_name%22%3A%22therecord_media%22%2C%22widget_site_user_id%22%3A%22%22%2C%22widget_creator_screen_name%22%3A%22jgreigj%22%2C%22widget_creator_user_id%22%3A%22%22%2C%22widget_iframe_version%22%3A%22ef52da62d3cad%3A1654213426913%22%2C%22item_ids%22%3A%5B%221534213925750841346%22%5D%2C%22item_details%22%3A%7B%221534213925750841346%22%3A%7B%22item_type%22%3A0%7D%7D%7D&dnt=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.72 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://platform.twitter.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Fri, 10 Jun 2022 01:54:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 200 OK
x-twitter-response-tags: BouncerCompliant
content-length: 65
x-xss-protection: 0
x-response-time: 119
pragma: no-cache
last-modified: Fri, 10 Jun 2022 01:54:57 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=631138519
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: b2893ae3710a6454d8bac6901536bbd8e87559c59ad398b0904dbc60364eac87
x-transaction: 276baade7b9475c9
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H/1.1 200
OK img.gif
b.6sc.co/v1/beacon/ 43 B
774 B 213ms
212ms Image
image/gif 96.16.137.162
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=f2675e8089b7d209a58fce8ad312f51c&svisitor=cbd5ce17997700006da4a262c50300009de91a00&session=36eb704f-5002-4342-8113-a75bb3013cc7&event=active_time_track&q=%7B%22currentTime%22%3A%22Fri%2C%2010%20Jun%202022%2001%3A54%3A57%20GMT%22%2C%22lastTrackTime%22%3A%22Fri%2C%2010%20Jun%202022%2001%3A54%3A56%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%224004%22%7D&isIframe=false&m=%7B%22description%22%3A%22The%20Record%20by%20Recorded%20Future%20gives%20exclusive%2C%20behind-the-scenes%20access%20to%20leaders%2C%20policymakers%2C%20researchers%2C%20and%20the%20shadows%20of%20the%20cyber%20underground.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Hackers%20using%20Follina%20Windows%20zero-day%20to%20spread%20Qbot%20malware%20-%20The%20Record%20by%20Recorded%20Future%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Ftherecord.media%2Fhackers-using-follina-windows-zero-day-to-spread-qbot-malware%2F&pageViewId=a8235557-2555-4bb2-85e0-a982aee06d52&an_uid=0

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

96.16.137.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a96-16-137-162.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://therecord.media/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date: Fri, 10 Jun 2022 01:54:58 GMT
X-Content-Type-Options: nosniff
Connection: keep-alive
Content-Length: 43
Pragma: no-cache
Last-Modified: Tue, 05 Oct 2021 22:17:52 GMT
Server: nginx/1.14.0 (Ubuntu)
ETag: "615ccf10-2b"
Access-Control-Max-Age: 86400
Access-Control-Allow-Methods: GET,POST
Content-Type: image/gif
Access-Control-Allow-Origin
Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Access-Control-Allow-Credentials: true
Accept-Ranges: bytes
Access-Control-Allow-Headers: *
Expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H/1.1 200
OK img.gif
b.6sc.co/v1/beacon/ 43 B
774 B 248ms
247ms Image
image/gif 96.16.137.162
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=f2675e8089b7d209a58fce8ad312f51c&svisitor=cbd5ce17997700006da4a262c50300009de91a00&session=36eb704f-5002-4342-8113-a75bb3013cc7&event=active_time_track&q=%7B%22currentTime%22%3A%22Fri%2C%2010%20Jun%202022%2001%3A54%3A58%20GMT%22%2C%22lastTrackTime%22%3A%22Fri%2C%2010%20Jun%202022%2001%3A54%3A57%20GMT%22%2C%22timeSpent%22%3A%221004%22%2C%22totalTimeSpent%22%3A%225008%22%7D&isIframe=false&m=%7B%22description%22%3A%22The%20Record%20by%20Recorded%20Future%20gives%20exclusive%2C%20behind-the-scenes%20access%20to%20leaders%2C%20policymakers%2C%20researchers%2C%20and%20the%20shadows%20of%20the%20cyber%20underground.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Hackers%20using%20Follina%20Windows%20zero-day%20to%20spread%20Qbot%20malware%20-%20The%20Record%20by%20Recorded%20Future%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Ftherecord.media%2Fhackers-using-follina-windows-zero-day-to-spread-qbot-malware%2F&pageViewId=a8235557-2555-4bb2-85e0-a982aee06d52&an_uid=0

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

96.16.137.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a96-16-137-162.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://therecord.media/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date: Fri, 10 Jun 2022 01:54:59 GMT
X-Content-Type-Options: nosniff
Connection: keep-alive
Content-Length: 43
Pragma: no-cache
Last-Modified: Fri, 21 Feb 2020 18:57:20 GMT
Server: nginx/1.14.0 (Ubuntu)
ETag: "5e502810-2b"
Access-Control-Max-Age: 86400
Access-Control-Allow-Methods: GET,POST
Content-Type: image/gif
Access-Control-Allow-Origin
Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Access-Control-Allow-Credentials: true
Accept-Ranges: bytes
Access-Control-Allow-Headers: *
Expires: Wed, 19 Apr 2000 11:43:00 GMT

Verdicts & Comments Add Verdict or Comment

111 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

22 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
therecord.media/	1969-12-31 23:59:59	Name: wordpress_google_apps_login Value: 33765391d7c427b6a530f5f4268783a7
.therecord.media/	1970-01-20 13:06:21	Name: _pk_id.2.de70 Value: 4c267e738afcec2b.1654826094.
.therecord.media/	1970-01-20 03:40:27	Name: _pk_ses.2.de70 Value: 1
.therecord.media/	1970-01-20 21:11:38	Name: _ga Value: GA1.2.573104975.1654826094
.therecord.media/	1970-01-20 03:41:52	Name: _gid Value: GA1.2.1965087744.1654826094
.therecord.media/	1970-01-20 03:40:26	Name: _gat_gtag_UA_9153858_16 Value: 1
.youtube.com/	1969-12-31 23:59:59	Name: YSC Value: ArO9r3kLxog
.youtube.com/	1970-01-20 07:59:38	Name: VISITOR_INFO1_LIVE Value: dG686AcPEeQ
.6sc.co/	1970-01-20 21:11:38	Name: 6suuid Value: cbd5ce17997700006da4a262c50300009de91a00
therecord.media/	1970-01-20 12:26:02	Name: cmplz_policy_id Value: 19
therecord.media/	1970-01-20 12:26:02	Name: cmplz_functional Value: allow
therecord.media/	1970-01-20 12:26:02	Name: cmplz_statistics-anonymous Value: allow
therecord.media/	1970-01-20 21:11:38	Name: _gd_visitor Value: 7411a5c5-bc5c-4340-8946-885340a087d2
therecord.media/	1970-01-20 03:40:40	Name: _gd_session Value: 36eb704f-5002-4342-8113-a75bb3013cc7
therecord.media/	1970-01-20 03:50:30	Name: _an_uid Value: 0
therecord.media/	1970-01-20 21:11:38	Name: _gd_svisitor Value: cbd5ce17997700006da4a262c50300009de91a00
.therecord.media/	1970-01-20 07:59:38	Name: __hstc Value: 156209188.fc2d1c43bfd46df00838aa51fb26a347.1654826094419.1654826094419.1654826094419.1
.therecord.media/	1970-01-20 07:59:38	Name: hubspotutk Value: fc2d1c43bfd46df00838aa51fb26a347
.therecord.media/	1969-12-31 23:59:59	Name: __hssrc Value: 1
.therecord.media/	1970-01-20 03:40:27	Name: __hssc Value: 156209188.1.1654826094419
.hubspot.com/	1970-01-20 03:40:27	Name: __cf_bm Value: OOwufMCNY0ZfStlm4Zd.cEpJm3xqvCNAxlM3ZIt0Caw-1654826094-0-ATZG1SarW9n91dmK2A7DFP2LWq80FNZsbUsWEfhdi/8MLe/e2AuhZifPJXSo1NZOBinyljSDL4947PL5I/BJYEo=
.go.recordedfuture.com/	1969-12-31 23:59:59	Name: __cfruid Value: 99d67d8daf8e058ad732f18af5fbdad8959edbbe-1654826095

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

b.6sc.co
c.6sc.co
cdn.jsdelivr.net
cdn.matomo.cloud
cdn.syndication.twimg.com
cdnjs.cloudflare.com
cms.recordedfuture.com
forms.hubspot.com
go.recordedfuture.com
ipv6.6sc.co
j.6sc.co
js.hs-analytics.net
js.hs-banner.com
js.hs-scripts.com
js.hsleadflows.net
pbs.twimg.com
platform.twitter.com
recordedfuture.matomo.cloud
secure.adnxs.com
secure.gravatar.com
syndication.twitter.com
therecord.media
track.hubspot.com
www.google-analytics.com
www.googletagmanager.com
www.youtube.com
104.244.42.72
151.101.194.216
18.195.235.189
2600:9000:2057:4400:c:7d55:b3c0:93a1
2606:2800:134:fa2:1627:1fe:edb:1665
2606:2800:234:59:254c:406:2366:268c
2606:2c40::c73c:6702
2606:4700:4400::6812:21ab
2606:4700::6810:5514
2606:4700::6811:190e
2606:4700::6811:46b0
2606:4700::6811:d4cc
2606:4700::6811:eacc
2606:4700::6812:721
2606:4700::6813:9b53
2a00:1450:4001:80b::200e
2a00:1450:4001:82a::2008
2a02:26f0:1700:1b1::1c91
2a04:fa87:fffe::c000:4902
37.252.172.123
96.16.137.162
00a1230e22b6af3f9df1348f2cd54dc9dbe026f3a41b9bde3009dcefd1648ae1
029e0a2e809fd6b5dbe76abe8b7a74936be306c9a8c27c814c4d44aa54623300
0c1a8712c3329cb66f31c312bb7d8c86ec03fb2ee2fcf76dea25b5af4fa69c93
0dd620a941d112d6f3fd5e4fea30b59123adc42010908f520258ff76c71aaf29
0fbc135fa4c043ec5b8b7bbfe9a99611f83a5e4d19d2878dd2b1fb70d8f57b12
11ab899a6359502c4cfe325cebe31a26e67537ed6b287e5ebea7e985de2989ef
13a5d6deee5c86d1c86f8ab010b3dfcab1b0b500590024d8c7a44c279c96d443
1fdd7e24f137d4adb881e20c9fd09448ea82acb4909fccb59c575648550b5bdc
247184981eb6f698a94e431a83d68c6b0df623cce57b6e29dc5a6c11e23aa195
2dd03edf39ceb2293a5942ee1925932d1efc47ac74080ca2e2ddd0fd2d35741c
2e4143a492ff81253dbd0125e3aa4007120beeb3106ab4a5da9296a6aa435474
2fc6266f80a8065e57439fe8d2ccba6e6edeadefe5a92d98d0111b96d0a31b88
31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d
326d6c39524da9a4b3d35286c798b93738a4665b29ce498d5b5df959a3a19012
368b1c951cdaeec5da3bcbb94ba7e9857eab072c81170c1f40b21e21e2e84f4e
3e76f6eb7177b6265e04001fc393c14a138f6dec73fced2ff447f115287909a3
437d2b1cf494c6613f40092add5ef74971a45c44509c8023a9748ee9d21e8bfb
44a9331e991ab7a492e95f1d5f8295a63676a35ce1bf998400a3042e2a75c521
4a6db13132ef5e4dc98723529dedf677f84b4993b7db70339cb1de93a910ffce
4d64259e1efa5608b9da553ac10da15df5717d41e66fc25cada5a83697b72bed
52c19e156be623c2b03edbf619561b9ce54fef7186e33dc7152bb17b7cc2f1ec
5736e3eec0c34bfc288854b7b8d2a8f1e22e9e2e7dae3c8d1ad5dfb2d4734ad0
5a64c92760eb1f6473da15b73c8b8c754455dc3a87cd0432c11ceb0a826f9a0d
5cf996e872e52f60fa6d956f1d7a957ff0d1c4bdcede8b795636bc0ceff91d7f
5ddf3bce83b11af6e050f824bb5e154741057fecd0d79b9e26a262755ad58be2
5e153d670d4df48314dc57d6f9062a26d4bcdfdfdfc2bc2fd42f45f3215ed62a
5e794d4a1df5f1c1035c15d1f24e115f9fdab9be376f12754239b981f61bf887
62395d926b25ea273b4f45626005c84bc919c4099006f3f3032f6d92b3be219a
6429c09d26d4abed1c51691f17eb89c9c1fedf440964890e2a0fe9801e93e653
66ddc36b286dc2588bac8e45fdbfa6134f21938d71ade0497276c263fee05372
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
735f1abaa77b0fb510261c9e7aa05ad695af92b888f85b6604f44d8653ce79dd
77e8232dee29ca904e5726f29b02f784c6155de5e388e61570a74aedf61b69de
7a4645fb7bd66c6fa3088677ee1a517deea83df27006a147e3dcd64387761ba1
7b6fef0a63424245b31b293b1a3bfd074c9da482e28fb9e920e1cf306e54e8a2
80036d26afc2e4804105573de106ca7cdccf739f5ec9e71728da83404fd97105
81dbdd695385ce9e3065e0cf1d8f058169de79244b1d1be4059b527e31d23c77
82bfc506040c981ec142b63ec85a43e603310d9b5fac6598c5664a144f3c4e3e
8490bb193d06ff7710cdd4c1ecce1a017ee547dfc8179193dd3302ab9256c49c
8649789c6fe95eb1f67a7b8d0f6fb53c49fe6df2dd4fb4353f77e94dd7f31f46
8df981a2e0d74a44530cfe140f2ce72ad4cb7be724706b7a3cfcb160bd06590f
8e038b564510a45dc11799f74da367733f3db7f9c0a0434f1e90c44ec5168278
8e73a30d35c83ea6a597c3343324d2b7df097ad26e67b62efb5266ee12d317b5
931750573d4728b1437a7a6769a62596c3f1f011554e2e3f401c7dfd9fb18d16
982b571ec32f7957a421f8c8c5328ea3e03e0e1da66106fd466417d22a82a962
9f5a9ec8652b839da4c94dadcf813b464f836d80d6083989853f1033957acc60
a01127152b090004aa159e0d56664e2268a1de5334ba6d9d6515388a0f53a3b9
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
aa131d8e527f225fd8fb8e4d1844562d128263f09c0e649363987bba2857a7d5
aab8bb6742699b557a5dc896158ecc21fdb307525b691fb61a177a19ce22be49
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
bd4de6a3fc0fb68d6f76ba7b93514b96a92e585c295b5351c31ad92a4b0777ea
bec29820bbf127195176a43bcc12f19d5b9f2707a4b65c15799debcf5606858a
c10df3d27c1d58c6f722e77696a5786542dba09ba506b09ac4e0a548106ccec6
c21f3f80c9adfdf9070c994d881f2069818a2d409b62834c805a7f17f08c91ef
c4e20f53f5ef0ed44b783437aa3f4638a9a56cc4aa29ae83ed9212eb2807052a
c6d03b7a5561687268e57b13d9d4a6a4c71ee570ea74718040ce9227676e3e5e
cadda460ccb4c3c01bb45f3d5976f63f5adf8dc3ff1d31cb4fbd3ded4f18e5bf
ccf00d1923b0131a10e0c6d26f95e5dee6ebf8621a27e83c5a2f68a2e0093142
cdbfd247ae45f4a12a00c99cb057c7ce703c8036a35bb6a79ff76d267edb0e16
d8be3a402a3b2ad808402cea111ba3d286239d88e06c8e2969c84f46050dc88a
d9697e2769a5484e3d9086c6f3c97746dff2d88d5c0bd7c5367a020dd5d097ce
dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4
dc9ae7c30a725e1a3e0da25b2cf138836c154b77a51decb32e2c58cdd3d48094
dccafac57a7fcedce0d95d35007b502104f45b82f43f052159c370258ef13a53
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e3d3367b895674ec706b02be65ae0ee7416f158836f88ddc1d3e469e3bdd6cd4
eb4cc9acf9651a4fe776ead01593f1f6bcbcfba7416274359ac9922450dabe4a
ebbf76aa03394da0ae0eb13d70f24860fbc9c20fb4f3641a6ba9cc46be464511
ec64e8bf74d64b707cd6de6fb37c0953911a1b054b9a1736086ece17a200f2b3
eeed30be41165ff65cb948a306a545dfafc224b8ae24558cc4d145c8bd5ce65b
f0bf1c54df72511eb129c54b9cbcabf1c683b65393a5886566518191f38cbe58
f1010cf08825a41c768a117755a496da61a306c41b83c383ea66f1bb3334bb14
f23ec5c633f64e45cdb8119ea2bd55f81bd2bf4a46131cc6e7aa415024db18f1
f83df770a7c9763424b29bfe7462c8f8e807d18dc0b4570f4ada501240007fda
f9d488df78ccf25073da6dacead57f6ea162df7d0633409529e49d1c953f9808
fd70985405d6434c27e69458ef268e95cea31329039be3a4111d7ebf83cb5ce6
fe6fb394ee0ca825d246e96f55680f2c732a677e8720d4d02bf2bc2ae256c58c

therecord.media Open in urlscan Pro 2606:4700::6812:721 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

131 Requests

100 %HTTPS

76 %IPv6

18 Domains

26 Subdomains

21 IPs

3 Countries

3549 kBTransfer

8997 kBSize

22 Cookies

23 Outgoing links

Redirected requests

131 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

therecord.media Open in urlscan Pro
2606:4700::6812:721 Public Scan

Screenshot
Live screenshot

Full Image

131
Requests

100 %
HTTPS

76 %
IPv6

18
Domains

26
Subdomains

21
IPs

3
Countries

3549 kB
Transfer

8997 kB
Size

22
Cookies

131 HTTP transactions
0 data transactions