thehackernews.com Open in urlscan Pro
2606:4700:20::681a:61 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://thehackernews.com/2023/01/chinese-hackers-utilize-golang-malware.html
Submission: On January 31 via manual (January 31st 2023, 11:41:42 am UTC) from IN — Scanned from DE

Summary HTTP 48 Redirects Links 34 Behaviour Indicators

Summary

This website contacted 19 IPs in 5 countries across 15 domains to perform 48 HTTP transactions. The main IP is 2606:4700:20::681a:61, located in United States and belongs to CLOUDFLARENET, US. The main domain is thehackernews.com. The Cisco Umbrella rank of the primary domain is 153604.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on May 1st 2022. Valid for: a year.

This is the only time thehackernews.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
10	2606:4700:20:... 2606:4700:20::681a:61	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6810:3965	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	2a02:26f0:11a... 2a02:26f0:11a::217:9a40	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	2001:4de0:ac1... 2001:4de0:ac18::1:a:3a	20446 (STACKPATH...) (STACKPATH-CDN)
3	2a00:1450:400... 2a00:1450:4001:803::2002	15169 (GOOGLE) (GOOGLE)
3	13.32.28.197 13.32.28.197	16509 (AMAZON-02) (AMAZON-02)
6	23.97.225.52 23.97.225.52	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
7	2a00:1450:400... 2a00:1450:4001:82a::200e	15169 (GOOGLE) (GOOGLE)
2	2620:116:800d... 2620:116:800d:21:7eb1:3826:be7e:d981	16509 (AMAZON-02) (AMAZON-02)
1	2600:9000:211... 2600:9000:211e:4e00:6:44e3:f8c0:93a1	16509 (AMAZON-02) (AMAZON-02)
1	52.222.139.35 52.222.139.35	16509 (AMAZON-02) (AMAZON-02)
1	54.171.141.116 54.171.141.116	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:828::200a	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:831::2003	15169 (GOOGLE) (GOOGLE)
1	2606:4700::68... 2606:4700::6811:180e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	2a00:1450:400... 2a00:1450:4001:811::2002	15169 (GOOGLE) (GOOGLE)
1	13.227.198.171 13.227.198.171	16509 (AMAZON-02) (AMAZON-02)
1	2606:4700::68... 2606:4700::6810:5814	13335 (CLOUDFLAR...) (CLOUDFLARENET)
48	19

10 2606:4700:20::681a:61 (United States)

ASN13335 (CLOUDFLARENET, US)

thehackernews.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:3965 (United States)

ASN13335 (CLOUDFLARENET, US)

static.cloudflareinsights.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a02:26f0:11a::217:9a40 (Vienna, Austria)

ASN20940 (AKAMAI-ASN1, NL)

cdn.adpushup.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4de0:ac18::1:a:3a (Netherlands)

ASN20446 (STACKPATH-CDN, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:803::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 13.32.28.197 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-32-28-197.fra56.r.cloudfront.net

c.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 23.97.225.52 (Amsterdam, Netherlands)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

e3.adpushup.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2a00:1450:4001:82a::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fundingchoicesmessages.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2620:116:800d:21:7eb1:3826:be7e:d981 (United States)

ASN16509 (AMAZON-02, US)

secure.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pixel.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:211e:4e00:6:44e3:f8c0:93a1 (United States)

ASN16509 (AMAZON-02, US)

rules.quantcount.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.222.139.35 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-222-139-35.ams50.r.cloudfront.net

tags.crwdcntrl.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.171.141.116 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-171-141-116.eu-west-1.compute.amazonaws.com

bcp.crwdcntrl.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:828::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:831::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:180e (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:811::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.227.198.171 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-227-198-171.ams54.r.cloudfront.net

aax-dtb-cf.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:5814 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
10	thehackernews.com thehackernews.com — Cisco Umbrella Rank: 153604	572 KB
9	adpushup.com cdn.adpushup.com — Cisco Umbrella Rank: 16754 e3.adpushup.com — Cisco Umbrella Rank: 18340	204 KB
7	google.com fundingchoicesmessages.google.com — Cisco Umbrella Rank: 1957	102 KB
4	amazon-adsystem.com c.amazon-adsystem.com — Cisco Umbrella Rank: 291 aax-dtb-cf.amazon-adsystem.com — Cisco Umbrella Rank: 488	51 KB
4	doubleclick.net securepubads.g.doubleclick.net — Cisco Umbrella Rank: 190 googleads.g.doubleclick.net — Cisco Umbrella Rank: 29	163 KB
2	googlesyndication.com pagead2.googlesyndication.com — Cisco Umbrella Rank: 104	168 KB
2	gstatic.com fonts.gstatic.com	170 KB
2	crwdcntrl.net tags.crwdcntrl.net — Cisco Umbrella Rank: 1156 bcp.crwdcntrl.net — Cisco Umbrella Rank: 885	10 KB
2	quantserve.com secure.quantserve.com — Cisco Umbrella Rank: 979 pixel.quantserve.com — Cisco Umbrella Rank: 676	10 KB
1	jsdelivr.net cdn.jsdelivr.net — Cisco Umbrella Rank: 359	2 KB
1	cloudflare.com cdnjs.cloudflare.com — Cisco Umbrella Rank: 198	28 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 34	4 KB
1	quantcount.com rules.quantcount.com — Cisco Umbrella Rank: 904	634 B
1	jquery.com code.jquery.com — Cisco Umbrella Rank: 673	31 KB
1	cloudflareinsights.com static.cloudflareinsights.com — Cisco Umbrella Rank: 958	6 KB
48	15

	Domain	Requested by
10	thehackernews.com	thehackernews.com static.cloudflareinsights.com
7	fundingchoicesmessages.google.com	cdn.adpushup.com
6	e3.adpushup.com	thehackernews.com
3	c.amazon-adsystem.com	cdn.adpushup.com c.amazon-adsystem.com
3	securepubads.g.doubleclick.net	cdn.adpushup.com securepubads.g.doubleclick.net
3	cdn.adpushup.com	thehackernews.com cdn.adpushup.com
2	pagead2.googlesyndication.com	thehackernews.com pagead2.googlesyndication.com
2	fonts.gstatic.com	fonts.googleapis.com
1	googleads.g.doubleclick.net	pagead2.googlesyndication.com
1	cdn.jsdelivr.net	cdn.adpushup.com
1	aax-dtb-cf.amazon-adsystem.com	c.amazon-adsystem.com
1	cdnjs.cloudflare.com	thehackernews.com
1	fonts.googleapis.com
1	bcp.crwdcntrl.net	tags.crwdcntrl.net
1	tags.crwdcntrl.net	thehackernews.com
1	pixel.quantserve.com	thehackernews.com
1	rules.quantcount.com	secure.quantserve.com
1	secure.quantserve.com	cdn.adpushup.com
1	code.jquery.com	cdn.adpushup.com
1	static.cloudflareinsights.com	thehackernews.com
48	20

This site contains links to these domains. Also see Links.

Domain
twitter.com
www.linkedin.com
www.facebook.com
deals.thehackernews.com
thehackernews.tradepub.com
www.youtube.com
www.instagram.com
feeds.feedburner.com
t.me
www.sentinelone.com
github.com
gotohttp.com
www.reddit.com
news.ycombinator.com
api.whatsapp.com
telegram.me
go.thn.li

Subject Issuer	Validity	Valid
thehackernews.com Cloudflare Inc ECC CA-3	`2022-05-01` - `2023-05-01`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2022-05-11` - `2023-05-10`	a year	crt.sh
cdn.adpushup.com R3	`2022-11-16` - `2023-02-14`	3 months	crt.sh
*.jquery.com Sectigo RSA Domain Validation Secure Server CA	`2022-08-03` - `2023-07-14`	a year	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2023-01-09` - `2023-04-03`	3 months	crt.sh
c.amazon-adsystem.com Amazon	`2022-05-09` - `2023-04-18`	a year	crt.sh
*.adpushup.com Sectigo ECC Domain Validation Secure Server CA	`2022-08-02` - `2023-09-02`	a year	crt.sh
*.google.com GTS CA 1C3	`2023-01-09` - `2023-04-03`	3 months	crt.sh
*.quantserve.com DigiCert TLS RSA SHA256 2020 CA1	`2022-08-09` - `2023-09-09`	a year	crt.sh
quantserve.com R3	`2023-01-10` - `2023-04-10`	3 months	crt.sh
*.crwdcntrl.net Go Daddy Secure Certificate Authority - G2	`2022-05-01` - `2023-06-02`	a year	crt.sh
upload.video.google.com GTS CA 1C3	`2023-01-09` - `2023-04-03`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2023-01-09` - `2023-04-03`	3 months	crt.sh
aax-dtb-mobile-cf.amazon-adsystem.com Amazon	`2022-06-15` - `2023-06-15`	a year	crt.sh

This page contains 2 frames:

Primary Page: https://thehackernews.com/2023/01/chinese-hackers-utilize-golang-malware.html
Frame ID: F6F4A110CBEEA6C99D7EAFEBBFA877F0
Requests: 55 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20230125/r20190131/zrt_lookup.html
Frame ID: 2626124230C393916D4B5AA743FE715D
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Chinese Hackers Utilize Golang Malware in DragonSpark Attacks to Evade Detection

Detected technologies

Cloudflare Browser Insights (Analytics) Expand

Overall confidence: 100%
Detected patterns

static\.cloudflareinsights\.com/beacon(?:\.min)?\.js

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Quantcast Measure (Analytics) Expand

Overall confidence: 100%
Detected patterns

\.quantserve\.com/quant\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jsDelivr (CDN) Expand

Overall confidence: 100%
Detected patterns

//cdn\.jsdelivr\.net/

Page Statistics

48
Requests

100 %
HTTPS

72 %
IPv6

15
Domains

20
Subdomains

19
IPs

5
Countries

1528 kB
Transfer

3764 kB
Size

7
Cookies

34 Outgoing links

These are links going to different origins than the main page.

URL: https://twitter.com/thehackersnews
Title: 

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/thehackernews/
Title: 

Search URL Search Domain Scan URL

URL: https://www.facebook.com/thehackernews
Title: 

Search URL Search Domain Scan URL

URL: https://deals.thehackernews.com/search?query=cybersecurity%2Bhacking%2BVPN%2Bsoftware
Title:  Store

Search URL Search Domain Scan URL

URL: https://thehackernews.tradepub.com/
Title: Free eBooks

Search URL Search Domain Scan URL

URL: https://deals.thehackernews.com/free
Title: Freebies

Search URL Search Domain Scan URL

URL: https://www.youtube.com/c/thehackernews?sub_confirmation=1
Title: 

Search URL Search Domain Scan URL

URL: https://www.instagram.com/thehackernews/
Title: 

Search URL Search Domain Scan URL

URL: https://feeds.feedburner.com/TheHackersNews
Title:  RSS Feeds

Search URL Search Domain Scan URL

URL: https://t.me/joinchat/AAAAADwuDObFWF60CiR-HQ
Title:  Telegram Channel

Search URL Search Domain Scan URL

URL: https://www.sentinelone.com/labs/dragonspark-attacks-evade-detection-with-sparkrat-and-golang-source-code-interpretation/
Title: said

Search URL Search Domain Scan URL

URL: https://github.com/BeichenDream/SharpToken
Title: SharpToken

Search URL Search Domain Scan URL

URL: https://github.com/BeichenDream/BadPotato
Title: BadPotato

Search URL Search Domain Scan URL

URL: https://gotohttp.com/
Title: GotoHTTP

Search URL Search Domain Scan URL

URL: https://github.com/XZB-1248/Spark
Title: SparkRAT

Search URL Search Domain Scan URL

URL: https://www.facebook.com/sharer.php?u=https%3A%2F%2Fthehackernews.com%2F2023%2F01%2Fchinese-hackers-utilize-golang-malware.html
Title: 

Search URL Search Domain Scan URL

URL: https://twitter.com/intent/tweet?url=https%3A%2F%2Fthehackernews.com%2F2023%2F01%2Fchinese-hackers-utilize-golang-malware.html&text=Chinese%20Hackers%20Utilize%20Golang%20Malware%20in%20DragonSpark%20Attacks%20to%20Evade%20Detection&via=TheHackersNews
Title: 

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fthehackernews.com%2F2023%2F01%2Fchinese-hackers-utilize-golang-malware.html
Title: 

Search URL Search Domain Scan URL

URL: https://www.reddit.com/submit?url=https%3A%2F%2Fthehackernews.com%2F2023%2F01%2Fchinese-hackers-utilize-golang-malware.html
Title: Share on Reddit

Search URL Search Domain Scan URL

URL: https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fthehackernews.com%2F2023%2F01%2Fchinese-hackers-utilize-golang-malware.html&t=Chinese%20Hackers%20Utilize%20Golang%20Malware%20in%20DragonSpark%20Attacks%20to%20Evade%20Detection
Title: Share on Hacker News

Search URL Search Domain Scan URL

URL: https://api.whatsapp.com/send?text=Chinese%20Hackers%20Utilize%20Golang%20Malware%20in%20DragonSpark%20Attacks%20to%20Evade%20Detection%20%E2%80%94%20https%3A%2F%2Fthehackernews.com%2F2023%2F01%2Fchinese-hackers-utilize-golang-malware.html
Title: Share on WhatsApp

Search URL Search Domain Scan URL

URL: https://telegram.me/share/url?url=https%3A%2F%2Fthehackernews.com%2F2023%2F01%2Fchinese-hackers-utilize-golang-malware.html&text=Chinese%20Hackers%20Utilize%20Golang%20Malware%20in%20DragonSpark%20Attacks%20to%20Evade%20Detection
Title: Share on Telegram

Search URL Search Domain Scan URL

URL: https://go.thn.li/anyrun-s-1
Title: Any.run - Interactive Malware Sandbox and Analysis Service

Search URL Search Domain Scan URL

URL: https://go.thn.li/outpost-s-1
Title: How to improve application security with Pentesting-as-a-Service

Search URL Search Domain Scan URL

URL: https://go.thn.li/as-product-1
Title: Adaptive Shield SaaS Security Platform

Search URL Search Domain Scan URL

URL: https://go.thn.li/as-product-2
Title: Download SSPM Checklist

Search URL Search Domain Scan URL

URL: https://go.thn.li/silver-n
Title: Cyber Insurance 101: Must-Read Book for Business OwnersDon't let a cyber attack ruin your business! Get the ultimate guide to new cyber insurance requirements

Search URL Search Domain Scan URL

URL: https://deals.thehackernews.com/sales/the-a-to-z-cyber-security-it-certification-training-bundle
Title: <img alt='Learn Ethical Hacking Online' class='deal-link' src='https://thehackernews.com/new-images/img/b/R29vZ2xl/AVvXsEiI35PZGxaHZD68Ea5xegPuLeSWEhyoS4eYqzEECWzt64wQRQ7MCPbeGR4qIhBAGbt1XdJ6USs2yeFxr0bqF3mtE9Is_pMyL9cSPtiJtbRAxj3lLfSGBcNqegKYr63rMaD8uJtLT8mHEk4EAaq-AUAxDkfdf42CZfEHUtv_M928jHKaXI2EpWSb-0ti9A/s260-e100/hack.jpg'/> A to Z Cybersecurity Certification Training Get Paid to Hack Computer Networks When You Become a Certified Ethical Hacker.

Search URL Search Domain Scan URL

URL: https://deals.thehackernews.com/sales/comptia-campus-premium-1-year-subscription
Title: <img alt='CompTIA Campus Premium' class='deal-link' src='https://thehackernews.com/new-images/img/b/R29vZ2xl/AVvXsEgCP8LsHMCGJ66Sw30XA6l8p0tga-FYZWWXB8yocCCp12NHG1f0ovIFBY5RjuRuiExwLNq8RrXKHLyL5bFXjBb8QUPfLlRKO5bGWKYBcmNM1qUYVAik8mXDEw5gW3jc8tkV8z18vbKFDWb9hnXuPnQINmyfPCn_TAp9v_KHdzVwjfgzTBy-sPkglYelYg/s260-e100/comptia.jpg'/> CompTIA Campus Premium One-Stop-Shop for All CompTIA Certifications! Get 1-Yr Access to Courses, Live Hands-On Labs, Practice Exams and Updated Content

Search URL Search Domain Scan URL

URL: https://deals.thehackernews.com/sales/ultimate-network-and-security-course-bundle
Title: <img alt='Ethical Hacking' class='deal-link' src='https://thehackernews.com/new-images/img/b/R29vZ2xl/AVvXsEimmKZ26nPjNl2ZjmIlqVtP9X1SaF-1z_fMwY1oRIFZVKV8k9SXIxpo5tWyLQkQ79I4hXOhE3fe5H5SgoANx2zIC6PeOeh-wFumVXXq8GtMF-AhCLTI8TlQ5MEBV9UZAs4mfxcgKn_ZaynBDg3JwJK3dCFewhjYJx3Hd2TK_w8r-lirYQj8yeTWnPyYIA/s260-e100/hacking.jpg'/> Network, Security and Ethical Hacking Your 28-Hour Roadmap as an Ultimate Security Professional — Master Network Monitoring, PenTesting, and Routing Techniques and Vulnerabilities

Search URL Search Domain Scan URL

URL: https://deals.thehackernews.com/sales/the-complete-2022-linux-certification-training-bundle
Title: <img alt='Linux Certification Courses' class='deal-link' src='https://thehackernews.com/new-images/img/b/R29vZ2xl/AVvXsEhtIq4lKc2RybeE8fg8x1hvFqh2nr1cx6Hy0sQaXshQQ1CjwhceehW_AWliIuIzdpv8niYskXwOh4SmHiT5n_eE-ngP90BcTwZMzJClByVrQdc1ZhfQREek1l4sx7_bFDZgEqc1gFjYKxSOVD5KToTX8UMTyVH9_CPQejpwEzizqO4MUisPIS76OsJnxA/s260-e100/linux.jpg'/> Complete Linux Certification Training Know Your Way Around Networks and Client-Server Linux Systems — Techniques, Command Line, Shell Scripting, and More

Search URL Search Domain Scan URL

URL: https://deals.thehackernews.com/collections/hacking
Title: Hacking

Search URL Search Domain Scan URL

URL: https://deals.thehackernews.com/collections/shop-by-specialization-developer
Title: Development

Search URL Search Domain Scan URL

URL: https://deals.thehackernews.com/collections/shop-by-interest-android
Title: Android

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

48 HTTP transactions
8 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request chinese-hackers-utilize-golang-malware.html Show response
thehackernews.com/2023/01/ 198 KB
99 KB 71ms
43ms Document
text/html 2606:4700:20::681a:61
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://thehackernews.com/2023/01/chinese-hackers-utilize-golang-malware.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:61 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / WordPress VIP

Resource Hash

430cce5a9d85d245f88003e6b6f2156280cbc6c844498c3f9c8d36ca0b1c7750

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 4285
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: public, s-maxage=604800, max-age=0
cf-cache-status: HIT
cf-ray: 79222ddf2c0a2bba-FRA
content-encoding: br
content-security-policy: upgrade-insecure-requests
content-type: text/html; charset=UTF-8
date: Tue, 31 Jan 2023 11:41:36 GMT
expires: Tue, 31 Jan 2023 10:30:11 GMT
last-modified: Tue, 31 Jan 2023 10:20:09 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy: no-referrer-when-downgrade
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Ui5i0s96uqSGrr%2ByLJUG7jb0hbaZd9MOdXzX5%2FQB9NWYRDPXFYNhyvDDACxD%2FeSd8W%2F3Ldas77AvZ2eJF4tyaDDYLS2bC%2BNBU6phKu2yf13LBDsNKNQPlZyuMbSWWXtdRSRShSnHepA5xbw7cuh%2F"}],"group":"cf-nel","max_age":604800}
server: cloudflare
strict-transport-security: max-age=15552000; includeSubDomains; preload
vary: Accept-Encoding
x-content-type-options: nosniff
x-forwarded-for: 2a03:1b20:6:f011::9e
x-frame-options: DENY
x-powered-by: WordPress VIP
x-xss-protection: 1; mode=block

GET
H2 200 as.png
thehackernews.com/new-images/img/b/R29vZ2xl/AVvXsEhTXXLFAmjmqx-Ix3nqsxl7CNvnXKgjbPicx1otQuvJkymQFUCUJY6RYCWT6bLlYvXMwkTCAMxMYbS2DH8WVg12cPPYCp0ZsuYwm5jTYKAsAC5khZuJDgu8FRmCOayoRSyYZQi3BeRERHZpe6MD5... 4 KB
4 KB 22ms
21ms Image
image/webp 2606:4700:20::681a:61
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://thehackernews.com/new-images/img/b/R29vZ2xl/AVvXsEhTXXLFAmjmqx-Ix3nqsxl7CNvnXKgjbPicx1otQuvJkymQFUCUJY6RYCWT6bLlYvXMwkTCAMxMYbS2DH8WVg12cPPYCp0ZsuYwm5jTYKAsAC5khZuJDgu8FRmCOayoRSyYZQi3BeRERHZpe6MD5kGZsOuQ-o3J1BiMkEYkCMInsXCzMPLoX9-YRUL6Cg/s100-e365/as.png

Requested by

Host: thehackernews.com
URL: https://thehackernews.com/2023/01/chinese-hackers-utilize-golang-malware.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:61 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ff4f481e4ba71da819f424515ef3d2dc4eb8c7f6377fbf2873e448461981f76c

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://thehackernews.com/2023/01/chinese-hackers-utilize-golang-malware.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Tue, 31 Jan 2023 11:41:36 GMT
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 78647
cf-polished: origFmt=png, origSize=5624
content-disposition: inline; filename="as.webp"
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 3648
x-xss-protection: 0
cf-bgj: imgq:100,h2pri
server: cloudflare
etag: "ve671"
vary: Accept, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=QNNAaumhlkEKlbuNfxTsovL0pDnI1C7ggoVudZ9vqxV7Ol1pn7DRfvLuw9e3lTzVD%2BRF0Z3%2B8WJ%2BqjHPL5Zi%2FAgkvEo2g9JzjmEXXQoj7G0K0lQZt1SVgoraFFRoxaMm79JNMOEFLN04QCdgeUBA"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
access-control-expose-headers: Content-Length
cache-control: public, max-age=31536000, immutable, s-maxage=31536000
accept-ranges: bytes
cf-ray: 79222ddf8ca52bba-FRA
expires: Tue, 30 Jan 2024 13:50:49 GMT

GET
H2 200 rocket-loader.min.js Show response
thehackernews.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/ 12 KB
4 KB 11ms
10ms Script
application/javascript 2606:4700:20::681a:61
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://thehackernews.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Requested by

Host: thehackernews.com
URL: https://thehackernews.com/2023/01/chinese-hackers-utilize-golang-malware.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:61 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ccf00d1923b0131a10e0c6d26f95e5dee6ebf8621a27e83c5a2f68a2e0093142

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://thehackernews.com/2023/01/chinese-hackers-utilize-golang-malware.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Tue, 31 Jan 2023 11:41:36 GMT
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Mon, 23 Jan 2023 11:05:52 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
content-encoding: gzip
etag: W/"63ce6a10-302c"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8nmYv%2FDX03kjTcscsAU8jaEyUPJszrXuAZLdjNPF4d2zfiRoIaxl%2BTFIcBFEwayJwApom2R6UPgsJk3g7uPYHmg4cvRvC%2BT8IjMxd2rA5jtj7gCpLIyOwW8RVuBuUimZsp%2BZMSzMZaA1q6x0IoAa"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
x-frame-options: DENY
cache-control: max-age=172800, public
cf-ray: 79222ddf8ca62bba-FRA
expires: Thu, 02 Feb 2023 11:41:36 GMT

GET
H2 200 vaafb692b2aea4879b33c060e79fe94621666317369993 Show response
static.cloudflareinsights.com/beacon.min.js/ 17 KB
6 KB 94ms
51ms Script
text/javascript 2606:4700::6810:3965
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://static.cloudflareinsights.com/beacon.min.js/vaafb692b2aea4879b33c060e79fe94621666317369993
Requested by: Host: thehackernews.com
URL: https://thehackernews.com/2023/01/chinese-hackers-utilize-golang-malware.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:3965 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0f48c5678ce459a596423b0e55344e7ad8eb3d3b1b27c54cd76a9d4cee7dd6c3

Request headers

Referer: https://thehackernews.com/2023/01/chinese-hackers-utilize-golang-malware.html
Origin: https://thehackernews.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Tue, 31 Jan 2023 11:41:36 GMT
content-encoding: gzip
last-modified: Fri, 21 Oct 2022 01:56:09 GMT
server: cloudflare
etag: W/2022.10.1
vary: Accept-Encoding
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
cf-ray: 79222ddfdff590dd-FRA

GET
H2 200 adpushup.js Show response
cdn.adpushup.com/37020/ 473 KB
107 KB 108ms
19ms Script
application/javascript 2a02:26f0:11a::217:9a40
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.adpushup.com/37020/adpushup.js
Requested by: Host: thehackernews.com
URL: https://thehackernews.com/2023/01/chinese-hackers-utilize-golang-malware.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:11a::217:9a40 Vienna, Austria, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: nginx/1.18.0 /
Resource Hash: 6dbd2193bad8bb7f69008f50e6163330a084363c8803f2be5a711d9ff08c8acf

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://thehackernews.com/2023/01/chinese-hackers-utilize-golang-malware.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

x-akamai-country: DE
date: Tue, 31 Jan 2023 11:41:36 GMT
content-encoding: br
last-modified: Wed, 25 Jan 2023 09:47:34 GMT
server: nginx/1.18.0
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-akamai-device: mobile:false&tablet:false
cache-control: max-age=3600
server-timing: cdn-cache; desc=HIT, edge; dur=1
x-cf-geodata: AT
content-length: 109198
expires: Tue, 31 Jan 2023 12:41:36 GMT

GET
DATA 200
OK truncated
/ 5 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c6a9d65e5bd6eb2447ea57e398e1d30f3c6e2d022ecf195933d161ffed964690

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 7 KB
7 KB Font
application/font-woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a71328300f380217ae0abf7f805052a10a0c196cb241eb97adf9b905e4a48c8a

Request headers

Referer
Origin: https://thehackernews.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

Content-Type: application/font-woff

GET
DATA 200
OK truncated
/ 68 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 2de33ca2d2cfb7f437aa190ecdd4b3991ff2879604c0e24aaf02849ae1f360b3

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 442 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6795c5c8b9b0aeb87d6663ccd7a71fb9d2f2817fe9b5c2e67bce0d5a5e1309a1

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 288 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: dbf4fa73ce4f2bd113dde31b7f7eff7bfd3a1271f30ababad320f07033408f06

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 296 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 0c6c51dafc8bdf4ef6841da2faf4d5d7555393739fd7577d931b0268fe3060a9

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 194 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f88754ecdaeedbf69845f3cb4015909beff31f92b173185c075ff8ab40ae3d02

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 malware.jpg
thehackernews.com/new-images/img/b/R29vZ2xl/AVvXsEh7Q7QlBDQ1nLtXnHkOa2WzRpHaS9ZLzjzQRQD0ewVOmNwNM9dFhfqzQ2xyvKOfN4sLymk00xkbYAVIZkU0SQN17FG86sb4W2gEjHMbKLaHpIsVfEoicW89kb6V3E36zfpCOr5m3TQ_ZZiYL4KQs... 68 KB
69 KB 48ms
47ms Image
image/jpeg 2606:4700:20::681a:61
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://thehackernews.com/new-images/img/b/R29vZ2xl/AVvXsEh7Q7QlBDQ1nLtXnHkOa2WzRpHaS9ZLzjzQRQD0ewVOmNwNM9dFhfqzQ2xyvKOfN4sLymk00xkbYAVIZkU0SQN17FG86sb4W2gEjHMbKLaHpIsVfEoicW89kb6V3E36zfpCOr5m3TQ_ZZiYL4KQsoX50eZD3M1B_I7Zye_LCEt8ROa5ckjDpMK1Tyko/s728-e3650/malware.jpg

Requested by

Host: thehackernews.com
URL: https://thehackernews.com/2023/01/chinese-hackers-utilize-golang-malware.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:20::681a:61 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b56f167e2e50aa15cfa537bae7f947e27dcdcbef3eac95bb48720539fc442d56

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://thehackernews.com/2023/01/chinese-hackers-utilize-golang-malware.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Tue, 31 Jan 2023 11:41:36 GMT
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 62484
cf-polished: origSize=72683, status=webp_bigger
content-disposition: inline;filename="malware.jpg"
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 69817
x-xss-protection: 0
cf-bgj: imgq:100,h2pri
server: cloudflare
etag: "v2601"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=YMbft50HfqJydDTRDKuxJBAXWFy1HseeVlHQiG3RY%2Fhwp1AXanvTypbeLkte69lcoqoJNBn7skdk8LlCDJVQTSZbwpgnDiRwgc4aS6tbtPssMosMBqrEEGXwbNF6Un91iJ1RyJsHPTZSyPfSqFH2"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-expose-headers: Content-Length
cache-control: public, max-age=31536000, immutable, s-maxage=31536000
accept-ranges: bytes
cf-ray: 79222de00be4bbd4-FRA
expires: Thu, 27 Jan 2033 18:20:12 GMT

GET
H3 200 malware.png
thehackernews.com/new-images/img/b/R29vZ2xl/AVvXsEhh9q47zTSd38z5XUAl02M-c_nKm3J2AZWFL41lwWIggtuxM4cucm8ds4Xqig0TR_HnpAbmrF_1SA4npjvr7EJoy7hH-eiRh8dYPajuUWuvtpw1sAV5LoQDObmMsr5khETlvlKw-MeZ7NndjGFx_... 377 KB
378 KB 529ms
528ms Image
image/png 2606:4700:20::681a:61
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://thehackernews.com/new-images/img/b/R29vZ2xl/AVvXsEhh9q47zTSd38z5XUAl02M-c_nKm3J2AZWFL41lwWIggtuxM4cucm8ds4Xqig0TR_HnpAbmrF_1SA4npjvr7EJoy7hH-eiRh8dYPajuUWuvtpw1sAV5LoQDObmMsr5khETlvlKw-MeZ7NndjGFx_IV_TuyjcHTbNwEw8m6IVvVkj4vZArc-njA5JbRc/s728-e3650/malware.png

Requested by

Host: thehackernews.com
URL: https://thehackernews.com/2023/01/chinese-hackers-utilize-golang-malware.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:20::681a:61 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

47cb6302630c986c566319344bbaa135b42fa084ce0e86a90da432dba9c02ed7

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://thehackernews.com/2023/01/chinese-hackers-utilize-golang-malware.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Tue, 31 Jan 2023 11:41:37 GMT
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-disposition: inline;filename="malware.png"
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 386036
x-xss-protection: 0
server: cloudflare
etag: "v25ff"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=wnRIPXWGe9Vvp4oPhVS0%2FPRJQdYjR6cJVfU8wQPOLKOev7el2VQ9DE1Fymk6zFIPD6jnRCb7MrS5QPKX%2FRoia8nyF0YmwJHBR4bvgXEBtQKb%2BsnuyXp%2FuK2%2Bh2luLITu8xrOwY1QRILaNLtTjmyj"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-expose-headers: Content-Length
cache-control: public, max-age=31536000, immutable, s-maxage=31536000
accept-ranges: bytes
cf-ray: 79222de00be9bbd4-FRA
expires: Fri, 28 Jan 2033 11:41:37 GMT

GET
H3 200 ms.jpg
thehackernews.com/new-images/img/b/R29vZ2xl/AVvXsEjtCvtIFlhsusZcNAmW8l0YPhLzOTXV5itAxHswUMuEyBXhYO4TJ_njWK-eDWGv57Ac6xiHmGOW2Ocx4OpRCPi3e31H1gQTR3tUMVUHdAZ8HPRmysVg60Ulqhc-E1cNzex1ICFiXldin4GddrvfA... 2 KB
3 KB 34ms
33ms Image
image/webp 2606:4700:20::681a:61
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://thehackernews.com/new-images/img/b/R29vZ2xl/AVvXsEjtCvtIFlhsusZcNAmW8l0YPhLzOTXV5itAxHswUMuEyBXhYO4TJ_njWK-eDWGv57Ac6xiHmGOW2Ocx4OpRCPi3e31H1gQTR3tUMVUHdAZ8HPRmysVg60Ulqhc-E1cNzex1ICFiXldin4GddrvfACcD4IvtpvfB-f_pJIlSIrooBM6Dzdl2yy0_WSVP/w72-h72-p-k-no-nu/ms.jpg

Requested by

Host: thehackernews.com
URL: https://thehackernews.com/2023/01/chinese-hackers-utilize-golang-malware.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:20::681a:61 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

431ffcb61dcfa6c9e6bdfdb957e8c96d72e26da9336749d63925f655324fa707

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://thehackernews.com/2023/01/chinese-hackers-utilize-golang-malware.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Tue, 31 Jan 2023 11:41:36 GMT
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 78672
cf-polished: origFmt=jpeg, origSize=2084
content-disposition: inline; filename="ms.webp"
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 1962
x-xss-protection: 0
cf-bgj: imgq:100,h2pri
server: cloudflare
etag: "v2635"
vary: Accept, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8x%2F6d0t8mhN4fZSJEYMrLyoFdTJlYR%2F4kcjfOiOXmS5k8bCNNMY5QbmhwMaEjcbFfIXjZf7xL%2FyfqZ4uSfE4RJjRlJXcaLCgkOiDFK3xgcGLX%2F0R%2BQsLJISu%2FTiAceVld2EQjnmK0AkatjBdm1cw"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
access-control-expose-headers: Content-Length
cache-control: public, max-age=31536000, immutable, s-maxage=31536000
accept-ranges: bytes
cf-ray: 79222de00beebbd4-FRA
expires: Tue, 31 Jan 2023 13:50:24 GMT

GET
H3 200 poc-exploit.png
thehackernews.com/new-images/img/b/R29vZ2xl/AVvXsEgcCIe1V0XFCm5Bcxm4oxeESEi7u-U52a_r1gvOT1QWGgTGPz-7Ap6qFHJU_aV6-S0Gg0l9Cd1648pkwizssbGHB82JaNxi0t8qfAoqjDkfqZgQW7r7udl0MPOhFBB9CJ8EI0cdUV0uW7OSFXH99... 7 KB
7 KB 35ms
35ms Image
image/webp 2606:4700:20::681a:61
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://thehackernews.com/new-images/img/b/R29vZ2xl/AVvXsEgcCIe1V0XFCm5Bcxm4oxeESEi7u-U52a_r1gvOT1QWGgTGPz-7Ap6qFHJU_aV6-S0Gg0l9Cd1648pkwizssbGHB82JaNxi0t8qfAoqjDkfqZgQW7r7udl0MPOhFBB9CJ8EI0cdUV0uW7OSFXH999jj1SG4oolZJyGXVnFi45vRhNS0dKUVJNN0CYD4/w72-h72-p-k-no-nu/poc-exploit.png

Requested by

Host: thehackernews.com
URL: https://thehackernews.com/2023/01/chinese-hackers-utilize-golang-malware.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:20::681a:61 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3f3d6d1b8de33535664e0e287bd8f446877b071ae9f76d442425bd8fb90b11e1

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://thehackernews.com/2023/01/chinese-hackers-utilize-golang-malware.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Tue, 31 Jan 2023 11:41:36 GMT
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 78672
cf-polished: origFmt=png, origSize=10328
content-disposition: inline; filename="poc-exploit.webp"
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 6732
x-xss-protection: 0
cf-bgj: imgq:100,h2pri
server: cloudflare
etag: "v261d"
vary: Accept, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=OzZa5cpv%2FN3XMfIwUe3ngCTmdYtQE4NU3d1pXTYHWwVlDUUTygKC0yq8KuGFaafOkSuwSPDQLz%2F%2FZwG0JAgnjy%2BZeZPR6AtF7GBZXbTTR1MIwlf0NXkZBf4d%2FTjQloHVkDykkTPZ2GcXdDmIXi8k"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
access-control-expose-headers: Content-Length
cache-control: public, max-age=31536000, immutable, s-maxage=31536000
accept-ranges: bytes
cf-ray: 79222de00bf2bbd4-FRA
expires: Tue, 31 Jan 2023 13:50:24 GMT

GET
H3 200 goto.png
thehackernews.com/new-images/img/b/R29vZ2xl/AVvXsEhmccXNxrknznSE3svudW4CaKeF9errtzKFlTPh34o35JOuOG9zdw0moDvIALsXGpSlWGihCdoObBfS5jFFaV4gl7uZlDyo32RaNPpMBJCdMBuTFZhCwhwRTN_KafTZFms8zhWOuIEdQERdLQBi_... 5 KB
5 KB 35ms
34ms Image
image/webp 2606:4700:20::681a:61
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://thehackernews.com/new-images/img/b/R29vZ2xl/AVvXsEhmccXNxrknznSE3svudW4CaKeF9errtzKFlTPh34o35JOuOG9zdw0moDvIALsXGpSlWGihCdoObBfS5jFFaV4gl7uZlDyo32RaNPpMBJCdMBuTFZhCwhwRTN_KafTZFms8zhWOuIEdQERdLQBi_YVAgaOO7RWVMr-jHQ7Y6WvMLpyBtpydziok2r3x/w72-h72-p-k-no-nu/goto.png

Requested by

Host: thehackernews.com
URL: https://thehackernews.com/2023/01/chinese-hackers-utilize-golang-malware.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:20::681a:61 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f7569411b16c508800fe89f2218058236881c325d2cb79f6c47edd0a62299f68

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://thehackernews.com/2023/01/chinese-hackers-utilize-golang-malware.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Tue, 31 Jan 2023 11:41:36 GMT
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 78672
cf-polished: origFmt=png, origSize=6780
content-disposition: inline; filename="goto.webp"
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 4916
x-xss-protection: 0
cf-bgj: imgq:100,h2pri
server: cloudflare
etag: "v2607"
vary: Accept, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=SwlozsgV%2F6TAYSNcAuIKujX8P44uNpY4RPYjwDx%2FtECtxsuGtOUcOePXc93Ym8YW6ky%2BsBR6KuKkUscaesWIsDdo9GuXTXvzKqLBq%2BCER1elVr79H5EAt%2BIGiOYhM%2FFH4%2BEfScfVhS32WIsdk0IT"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
access-control-expose-headers: Content-Length
cache-control: public, max-age=31536000, immutable, s-maxage=31536000
accept-ranges: bytes
cf-ray: 79222de00bf7bbd4-FRA
expires: Tue, 31 Jan 2023 13:50:24 GMT

GET
H3 200 s.js Show response
thehackernews.com/cdn-cgi/zaraz/ 6 KB
3 KB 42ms
42ms Script
text/javascript 2606:4700:20::681a:61
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://thehackernews.com/cdn-cgi/zaraz/s.js?z=JTdCJTIyZXhlY3V0ZWQlMjIlM0ElNUIlNUQlMkMlMjJ0JTIyJTNBJTIyQ2hpbmVzZSUyMEhhY2tlcnMlMjBVdGlsaXplJTIwR29sYW5nJTIwTWFsd2FyZSUyMGluJTIwRHJhZ29uU3BhcmslMjBBdHRhY2tzJTIwdG8lMjBFdmFkZSUyMERldGVjdGlvbiUyMiUyQyUyMnglMjIlM0EwLjM0MTY5MjQ3MzgyNjgxNTY3JTJDJTIydyUyMiUzQTE2MDAlMkMlMjJoJTIyJTNBMTIwMCUyQyUyMmolMjIlM0ExMjAwJTJDJTIyZSUyMiUzQTE2MDAlMkMlMjJsJTIyJTNBJTIyaHR0cHMlM0ElMkYlMkZ0aGVoYWNrZXJuZXdzLmNvbSUyRjIwMjMlMkYwMSUyRmNoaW5lc2UtaGFja2Vycy11dGlsaXplLWdvbGFuZy1tYWx3YXJlLmh0bWwlMjIlMkMlMjJyJTIyJTNBJTIyJTIyJTJDJTIyayUyMiUzQTI0JTJDJTIybiUyMiUzQSUyMlVURi04JTIyJTJDJTIybyUyMiUzQTAlMkMlMjJxJTIyJTNBJTVCJTVEJTdE

Requested by

Host: thehackernews.com
URL: https://thehackernews.com/2023/01/chinese-hackers-utilize-golang-malware.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:20::681a:61 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d53dd17c93276038e11218bba27e6c991fe612e78651e4e23b7385f4d84caa2f

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://thehackernews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Tue, 31 Jan 2023 11:41:36 GMT
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-content-type-options: nosniff
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
server: cloudflare
access-control-max-age: 600
vary: Origin, Accept-Encoding
access-control-allow-methods: GET, HEAD, POST, OPTIONS
access-control-allow-origin: https://thehackernews.com
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=t94M1QsLfMcRGEyfMDbqEpNyO%2BL29bc%2F6MC3PNFmSB3cizc3kT7cpcs2GCfgDvIgUcrhWRMHb8uzOSCA9S54jC9q81dfBfh%2FaX5asAR27vQ5xUrUlXDST%2FzkFndhekwrP55MTI72nNJmIjYaDJok"}],"group":"cf-nel","max_age":604800}
content-type: text/javascript
access-control-allow-credentials: true
cf-ray: 79222de03c8abbd4-FRA
access-control-allow-headers: Content-Type, Set-Cookie, Cache-Control

GET
H2 200 jquery-3.6.0.min.js Show response
code.jquery.com/ 87 KB
31 KB 75ms
20ms Script
application/javascript 2001:4de0:ac18::1:a:3a
STACKPATH-CDN

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-3.6.0.min.js
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/37020/adpushup.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4de0:ac18::1:a:3a , Netherlands, ASN20446 (STACKPATH-CDN, US),
Reverse DNS
Software: nginx /
Resource Hash: ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://thehackernews.com/2023/01/chinese-hackers-utilize-golang-malware.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Tue, 31 Jan 2023 11:41:36 GMT
content-encoding: gzip
x-sp-metadata: HS256.CICZ5J4GEo8BCiRhN2E0NGY2ZS00NzQzLTRkNzEtOTYyMC1kNTVhOGJjZDkzNTIQ+OiCoKvU+wIaBgjw/OOeBiIUMmEwMzoxYjIwOjY6ZjAxMTo6OWUo2ocCMAM4BEIWVExTX0FFU18xMjhfR0NNX1NIQTI1NlogM2U5YjIwNjEwMDk4YjZjOWJmZjk1Mzg1NmU1ODAxNmEaLAgBEiRhZmYxMzJhYi00MGRmLTRlZTMtYWEzZS01N2U3Yzg3MDU0YTQYm/EBIhgIAhIUY2RzMjEwLmFtNS5od2Nkbi5uZXQ=.soSFSCN2IuDwHWJAIFAyi7pFlffQmuyS+GDNP03dO/8=
last-modified: Fri, 18 Oct 1991 12:00:00 GMT
server: nginx
etag: W/"28feccc0-15d9d"
vary: Accept-Encoding
x-hw: 1675165296.dop227.am5.t,1675165296.cds010.am5.hn,1675165296.cds210.am5.c
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=315360000, public
accept-ranges: bytes
content-length: 30875

GET
H2 200 pb.37020.1664558804419.js Show response
cdn.adpushup.com/prebid/ 355 KB
94 KB 19ms
19ms Script
application/javascript 2a02:26f0:11a::217:9a40
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.adpushup.com/prebid/pb.37020.1664558804419.js
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/37020/adpushup.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:11a::217:9a40 Vienna, Austria, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: nginx/1.18.0 /
Resource Hash: d5ef141c8649172cc921e50e9b28d5deb2cabfeda102a9c40ef5cf39daf2aaa1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://thehackernews.com/2023/01/chinese-hackers-utilize-golang-malware.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

x-akamai-country: DE
date: Tue, 31 Jan 2023 11:41:36 GMT
content-encoding: br
last-modified: Fri, 30 Sep 2022 17:26:56 GMT
server: nginx/1.18.0
etag: W/"633726e0-58d15"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-akamai-device: mobile:false&tablet:false
cache-control: max-age=31536000
server-timing: cdn-cache; desc=HIT, edge; dur=1
content-length: 96224
expires: Wed, 31 Jan 2024 11:41:36 GMT

GET
H2 200 quantcast.js Show response
cdn.adpushup.com/pbuseridscripts/ 450 B
505 B 18ms
18ms Script
application/javascript 2a02:26f0:11a::217:9a40
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.adpushup.com/pbuseridscripts/quantcast.js
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/37020/adpushup.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:11a::217:9a40 Vienna, Austria, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: nginx/1.18.0 /
Resource Hash: 26914004d3a8d5ddde2202b642d7936eb61c9f195b5cd3c87e44ef8ad4d57c16

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://thehackernews.com/2023/01/chinese-hackers-utilize-golang-malware.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

x-akamai-country: DE
date: Tue, 31 Jan 2023 11:41:36 GMT
content-encoding: br
last-modified: Mon, 28 Jun 2021 04:15:23 GMT
server: nginx/1.18.0
etag: W/"60d94cdb-1c2"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-akamai-device: mobile:false&tablet:false
cache-control: max-age=31536000
server-timing: cdn-cache; desc=HIT, edge; dur=1
content-length: 211
expires: Wed, 31 Jan 2024 11:41:36 GMT

GET
H2 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 80 KB
27 KB 191ms
78ms Script
text/javascript 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/37020/adpushup.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9b18bec31059414dc8a734c92aaa74c699b957f4ebc98612b43a42a63c1fd7ee

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://thehackernews.com/2023/01/chinese-hackers-utilize-golang-malware.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Tue, 31 Jan 2023 11:41:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 27560
x-xss-protection: 0
server: sffe
etag: "1468 / 350 of 1000 / last-modified: 1675158331"
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Tue, 31 Jan 2023 11:41:37 GMT

GET
H2 200 apstag.js Show response
c.amazon-adsystem.com/aax2/ 191 KB
46 KB 57ms
8ms Script
application/javascript 13.32.28.197
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/aax2/apstag.js
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/37020/adpushup.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.28.197 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-28-197.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: c0d19353c945d66184d063ccb4c33fa2e2014c35b8a7a8a56416e34531f90e92

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://thehackernews.com/2023/01/chinese-hackers-utilize-golang-malware.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Tue, 31 Jan 2023 11:02:40 GMT
content-encoding: gzip
via: 1.1 ed4565467c6c9847b6a3fcb6cec799e4.cloudfront.net (CloudFront), 1.1 aff6ac5c98fa897349204752e5877c80.cloudfront.net (CloudFront)
last-modified: Wed, 25 Jan 2023 21:28:24 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P1, FRA56-C2
age: 2337
x-amz-server-side-encryption: AES256
etag: W/"676ff20d9a1610954eca1e1b18855dbf"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: public, max-age=3600
x-amz-cf-id: MvT0mxVBTmo1w100R1itOrlqRs7WndRO4_meR8fqDMGoW7jaiR7ztw==

GET
H2 200 sync
e3.adpushup.com/AdPushupFeedbackWebService/user/ 70 B
368 B 59ms
14ms Image
image/png 23.97.225.52
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://e3.adpushup.com/AdPushupFeedbackWebService/user/sync
Requested by: Host: thehackernews.com
URL: https://thehackernews.com/2023/01/chinese-hackers-utilize-golang-malware.html
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 23.97.225.52 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: nginx/1.10.3 (Ubuntu) /
Resource Hash: e3849fdc1eab88579b20b1b56875d6ef8299c4ad165e03921400ccae69149861

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://thehackernews.com/2023/01/chinese-hackers-utilize-golang-malware.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 31 Jan 2023 11:41:36 GMT
server: nginx/1.10.3 (Ubuntu)
ap-cookie-status: cookies ap_uid and ap_usid not set due to GDPR
access-control-allow-methods: GET, POST
content-type: image/png
access-control-allow-origin: https://thehackernews.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
x-robots-tag: noindex
content-length: 70
expires: 0

GET
H2 200 AGSKWxWGtL7zuZ1y1IcNdDu97XV3A1nSFYlAxzUsMF11iBnZwCEpDsaZDLJvauA2_Cx3VImW-PkAxWSsA1Yld5y1tqA= Show response
fundingchoicesmessages.google.com/f/ 122 KB
42 KB 182ms
83ms Script
application/javascript 2a00:1450:4001:82a::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxWGtL7zuZ1y1IcNdDu97XV3A1nSFYlAxzUsMF11iBnZwCEpDsaZDLJvauA2_Cx3VImW-PkAxWSsA1Yld5y1tqA=

Requested by

Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/37020/adpushup.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

a720cc75bfc1b9709d43f04591ba6779a63466b2156e656dc0f717fdfdc76238

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-JMlB3s6XnFyvt09xN9quzw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://thehackernews.com/2023/01/chinese-hackers-utilize-golang-malware.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Tue, 31 Jan 2023 11:41:37 GMT
content-security-policy: script-src 'report-sample' 'nonce-JMlB3s6XnFyvt09xN9quzw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-platform=*, ch-ua-platform-version=*
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 quant.js Show response
secure.quantserve.com/ 26 KB
10 KB 48ms
8ms Script
application/javascript 2620:116:800d:21:7eb1:3826:be7e:d981
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.quantserve.com/quant.js
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/pbuseridscripts/quantcast.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2620:116:800d:21:7eb1:3826:be7e:d981 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 8c979ed3785f184174cba3c38dd0ebbd5b244add676982d9aeafb57b3e53b1a4

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://thehackernews.com/2023/01/chinese-hackers-utilize-golang-malware.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Tue, 31 Jan 2023 11:41:37 GMT
content-encoding: gzip
etag: "j4o3/UzQJzEULY/aoGayAw=="
vary: Accept-Encoding
content-type: application/javascript
cache-control: private, max-age=604800
accept-ranges: bytes
expires: Tue, 07 Feb 2023 11:41:37 GMT

GET
H2 200 config Show response
c.amazon-adsystem.com/cdn/prod/ 699 B
1 KB 103ms
102ms XHR
application/json 13.32.28.197
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/cdn/prod/config?src=600&u=https%3A%2F%2Fthehackernews.com&pubid=2e7e1587-d92f-46dd-8721-80b53eccb87e
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.28.197 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-28-197.fra56.r.cloudfront.net
Software: Server /
Resource Hash: 6d54aecd2bd9fef0d74763ef48135aded46f2a190546075cf9466b9e5296c8a9

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://thehackernews.com/2023/01/chinese-hackers-utilize-golang-malware.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Tue, 31 Jan 2023 11:41:36 GMT
via: 1.1 aff6ac5c98fa897349204752e5877c80.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: FRA56-C2
x-cache: Miss from cloudfront
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://thehackernews.com
cache-control: max-age=21550, s-maxage=21600
access-control-allow-credentials: true
content-length: 699
x-amz-cf-id: h88ndL4Gdtw53NxKSS1IdZNMrP5M8xkvAhLA_DkJOKO5-T7Ozjfycw==

GET
H2 200 aps_csm.js Show response
c.amazon-adsystem.com/bao-csm/aps-comm/ 6 KB
3 KB 24ms
8ms XHR
application/javascript 13.32.28.197
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.28.197 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-28-197.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://thehackernews.com/2023/01/chinese-hackers-utilize-golang-malware.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

x-amz-version-id: 1R3b4YI9dI20q9Y7Gq1DHxVUnq3Fp2gn
content-encoding: gzip
via: 1.1 f891d17fa862cc74a05434e03fa58dca.cloudfront.net (CloudFront)
date: Tue, 31 Jan 2023 07:17:57 GMT
x-amz-cf-pop: FRA56-C2
age: 15820
x-cache: Hit from cloudfront
last-modified: Fri, 23 Dec 2022 01:05:48 GMT
server: AmazonS3
etag: W/"a4d296427fc806b21335359e398c025c"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
vary: Accept-Encoding,Origin
x-amz-cf-id: i3gXRrnz67H7NqpTxaHRVzXGYxwhuHle2TfhS-AnLAHKhWV8456LxQ==

GET
H2 200 rules-p-54Nt-1NAaEEe0.js Show response
rules.quantcount.com/ 160 B
634 B 39ms
7ms Script
application/javascript 2600:9000:211e:4e00:6:44e3:f8c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rules.quantcount.com/rules-p-54Nt-1NAaEEe0.js
Requested by: Host: secure.quantserve.com
URL: https://secure.quantserve.com/quant.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:211e:4e00:6:44e3:f8c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: edc30a0e05622f71d52d07a0b7b5e94e654ee06854f893be1954336730eb0db6

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://thehackernews.com/2023/01/chinese-hackers-utilize-golang-malware.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Tue, 31 Jan 2023 11:37:23 GMT
via: 1.1 ef4ff53b101ef123a46ec560b6c94cb8.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-C2
age: 255
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 160
last-modified: Thu, 13 Oct 2022 15:29:19 GMT
server: AmazonS3
etag: "05b131079c67d484167fd1b1f6c79577"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=3600
accept-ranges: bytes
x-amz-cf-id: SmHY-uLoGUoS_LaUQogv1dnmbWSGjOQ41X3uJ8hYXdQiSnu8kz6Efw==

GET
H2 200 pixel;r=1497059716;rf=0;a=p-54Nt-1NAaEEe0;url=https%3A%2F%2Fthehackernews.com%2F2023%2F01%2Fchinese-hackers-utilize-golang-malware.html;uh=e51ed67dfb8d91dc24b15e2ace0c3bc33bc53c3e1dfb09200d6c2f8387...
pixel.quantserve.com/ 35 B
371 B 56ms
12ms Image
image/gif 2620:116:800d:21:7eb1:3826:be7e:d981
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.quantserve.com/pixel;r=1497059716;rf=0;a=p-54Nt-1NAaEEe0;url=https%3A%2F%2Fthehackernews.com%2F2023%2F01%2Fchinese-hackers-utilize-golang-malware.html;uh=e51ed67dfb8d91dc24b15e2ace0c3bc33bc53c3e1dfb09200d6c2f8387d67ea6;uht=2;fpan=1;fpa=P0-1696536700-1675165297021;pbc=;ns=0;ce=1;qjs=1;qv=c1229512-20230130173030;cm=;gdpr=0;ref=;d=thehackernews.com;dst=0;et=1675165297063;tzo=0;ogl=site_name.The%20Hacker%20News%2Clocale.en_US%2Ctype.article%2Ctitle.Chinese%20Hackers%20Utilize%20Golang%20Malware%20in%20DragonSpark%20Attacks%20to%20Evade%20Detection%2Cimage.https%3A%2F%2Fthehackernews%252Ecom%2Fnew-images%2Fimg%2Fb%2FR29vZ2xl%2FAVvXsEh7Q7QlBDQ1nLtXnHkOa2Wz%2Cdescription.Chinese-speaking%20actor%20behind%20DragonSpark%20attacks%20targeting%20organizations%20in%20Eas%2Curl.https%3A%2F%2Fthehackernews%252Ecom%2F2023%2F01%2Fchinese-hackers-utilize-golang-malware%252Ehtml;ses=463b733a-fa98-4790-a96b-0c6359c2624f

Requested by

Host: thehackernews.com
URL: https://thehackernews.com/2023/01/chinese-hackers-utilize-golang-malware.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:116:800d:21:7eb1:3826:be7e:d981 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://thehackernews.com/2023/01/chinese-hackers-utilize-golang-malware.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 31 Jan 2023 11:41:37 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
content-type: image/gif
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H2 200 sync.min.js Show response
tags.crwdcntrl.net/lt/c/16576/ 32 KB
10 KB 67ms
17ms Script
text/javascript 52.222.139.35
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.crwdcntrl.net/lt/c/16576/sync.min.js
Requested by: Host: thehackernews.com
URL: https://thehackernews.com/2023/01/chinese-hackers-utilize-golang-malware.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.222.139.35 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-139-35.ams50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 1b9bc9c5d136e5e10a89c8902b5c6540cd738265af675ed3e3984e28c0c14f02

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://thehackernews.com/2023/01/chinese-hackers-utilize-golang-malware.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Mon, 30 Jan 2023 17:40:14 GMT
content-encoding: gzip
via: 1.1 b2bc712713f500af8be071fa65fa924c.cloudfront.net (CloudFront)
last-modified: Thu, 05 Jan 2023 20:07:47 GMT
server: AmazonS3
x-amz-cf-pop: AMS50-C1
age: 64884
etag: W/"322a4a4dadec5839e9040f77edf9282d"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript
cache-control: max-age: 86400
x-amz-cf-id: B2Y-FomnYThZIk68QId7YWmpJFxe1V-nnjxZuGFcxiYscK1bRNslyw==

GET
H2 200 pubads_impl_2023012601.js Show response
securepubads.g.doubleclick.net/gpt/ 386 KB
131 KB 39ms
39ms Script
text/javascript 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2023012601.js?cb=31072017

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5634160b5779452c237d49e24be812637f98f9d7f64b1f4115e3ad786cacf48c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://thehackernews.com/2023/01/chinese-hackers-utilize-golang-malware.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Mon, 30 Jan 2023 16:02:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 70728
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 133524
x-xss-protection: 0
last-modified: Thu, 26 Jan 2023 09:36:55 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Tue, 30 Jan 2024 16:02:49 GMT

GET
H3 200 ppub_config Show response
securepubads.g.doubleclick.net/pagead/ 164 B
123 B 153ms
75ms XHR
application/json 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=thehackernews.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

019d22d3e70ec460a085db138f131a9d77cb25175dd7eecb155305c270ed221c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://thehackernews.com/2023/01/chinese-hackers-utilize-golang-malware.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Tue, 31 Jan 2023 11:41:37 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private, max-age=3600, stale-while-revalidate=3600
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 98
x-xss-protection: 0
expires: Tue, 31 Jan 2023 11:41:37 GMT

POST
H2 200 map Show response
bcp.crwdcntrl.net/6/ 60 B
336 B 109ms
31ms XHR
application/json 54.171.141.116
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://bcp.crwdcntrl.net/6/map
Requested by: Host: tags.crwdcntrl.net
URL: https://tags.crwdcntrl.net/lt/c/16576/sync.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.171.141.116 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-171-141-116.eu-west-1.compute.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: 1d3962c97209d13388c23f4d5c6205f4d83212a4c2f995c70dc0dccb6da68dbb

Request headers

Referer: https://thehackernews.com/2023/01/chinese-hackers-utilize-golang-malware.html
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Tue, 31 Jan 2023 11:41:37 GMT
server: Jetty(9.4.38.v20210224)
content-type: application/json;charset=utf-8
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin: https://thehackernews.com
cache-control: no-cache
x-server: 10.45.15.247
access-control-allow-credentials: true
content-length: 60
expires: 0

POST
H3 204 AGSKWxVsq9WdU3rKeSXgFJg67gVM0uPH7ZWep4YQR9zdbSvgUJkCqozS0jF0jdZke57ZvV1Wf6Yc5xQE7wtATHJu27s= Show response
fundingchoicesmessages.google.com/el/ 0
28 B 131ms
53ms XHR
text/html 2a00:1450:4001:82a::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxVsq9WdU3rKeSXgFJg67gVM0uPH7ZWep4YQR9zdbSvgUJkCqozS0jF0jdZke57ZvV1Wf6Yc5xQE7wtATHJu27s=?pvid=462A50D0-9F37-4824-AA63-9859C579C502

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.de.sSCZcaeTmvA.es5.O/d=1/rs=AJlcJMw7s6xHsWo5c9R2Eh5QHPDV6JqnEw/m=kernel_loader,loader_js_executable

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-3j0vmurrDyM9qC6AYg7PTQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://thehackernews.com/2023/01/chinese-hackers-utilize-golang-malware.html
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 31 Jan 2023 11:41:37 GMT
content-security-policy: script-src 'report-sample' 'nonce-3j0vmurrDyM9qC6AYg7PTQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
access-control-max-age: 86400
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
content-type: text/html; charset=utf-8
access-control-allow-origin: https://thehackernews.com
access-control-allow-methods: POST, GET, OPTIONS
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options: SAMEORIGIN
expires: Mon, 01 Jan 1990 00:00:00 GMT

POST
H3 204 AGSKWxVsq9WdU3rKeSXgFJg67gVM0uPH7ZWep4YQR9zdbSvgUJkCqozS0jF0jdZke57ZvV1Wf6Yc5xQE7wtATHJu27s= Show response
fundingchoicesmessages.google.com/el/ 0
28 B 135ms
57ms XHR
text/html 2a00:1450:4001:82a::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxVsq9WdU3rKeSXgFJg67gVM0uPH7ZWep4YQR9zdbSvgUJkCqozS0jF0jdZke57ZvV1Wf6Yc5xQE7wtATHJu27s=?pvid=462A50D0-9F37-4824-AA63-9859C579C502

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-EMjLsaEksZvEGBEYBllY2g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://thehackernews.com/2023/01/chinese-hackers-utilize-golang-malware.html
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 31 Jan 2023 11:41:37 GMT
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-EMjLsaEksZvEGBEYBllY2g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://thehackernews.com
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options: SAMEORIGIN
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 testmode
e3.adpushup.com/AdPushupFeedbackWebService/feedback/ 70 B
321 B 18ms
17ms Image
image/png 23.97.225.52
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://e3.adpushup.com/AdPushupFeedbackWebService/feedback/testmode?data=eyJjcmVhdGVkVFMiOjE2NzUxNjUyOTcxOTcsInBhY2tldElkIjoiMDAwMDkwOUMtYWE5YWE4MmEtMDdlMS00M2MyLTgzMGMtYjVmZTY1ZGZmNTVjIiwic2l0ZUlkIjozNzAyMCwic2l0ZURvbWFpbiI6Imh0dHBzOi8vdGhlaGFja2VybmV3cy5jb20vIiwidXJsIjoiaHR0cHM6Ly90aGVoYWNrZXJuZXdzLmNvbS8yMDIzLzAxL2NoaW5lc2UtaGFja2Vycy11dGlsaXplLWdvbGFuZy1tYWx3YXJlLmh0bWwiLCJtb2RlIjo0LCJlcnJvckNvZGUiOjAsInJlZmVycmVyIjoiIiwicGxhdGZvcm0iOiJERVNLVE9QIiwiaXNHZW5pZWUiOmZhbHNlLCJzZWN0aW9ucyI6bnVsbCwicGFnZUdyb3VwIjoiUE9TVCJ9&c_b=722
Requested by: Host: thehackernews.com
URL: https://thehackernews.com/2023/01/chinese-hackers-utilize-golang-malware.html
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 23.97.225.52 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: nginx/1.10.3 (Ubuntu) /
Resource Hash: e3849fdc1eab88579b20b1b56875d6ef8299c4ad165e03921400ccae69149861

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://thehackernews.com/2023/01/chinese-hackers-utilize-golang-malware.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 31 Jan 2023 11:41:37 GMT
server: nginx/1.10.3 (Ubuntu)
access-control-allow-methods: GET, POST
content-type: image/png
access-control-allow-origin: https://thehackernews.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
x-robots-tag: noindex
content-length: 70
expires: 0

GET
H2 200 feedback
e3.adpushup.com/AdPushupFeedbackWebService/ 70 B
321 B 18ms
18ms Image
image/png 23.97.225.52
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://e3.adpushup.com/AdPushupFeedbackWebService/feedback?data=eyJjcmVhdGVkVFMiOjE2NzUxNjUyOTcxOTcsInBhY2tldElkIjoiMDAwMDkwOUMtYWE5YWE4MmEtMDdlMS00M2MyLTgzMGMtYjVmZTY1ZGZmNTVjIiwic2l0ZUlkIjozNzAyMCwic2l0ZURvbWFpbiI6Imh0dHBzOi8vdGhlaGFja2VybmV3cy5jb20vIiwidXJsIjoiaHR0cHM6Ly90aGVoYWNrZXJuZXdzLmNvbS8yMDIzLzAxL2NoaW5lc2UtaGFja2Vycy11dGlsaXplLWdvbGFuZy1tYWx3YXJlLmh0bWwiLCJtb2RlIjoyLCJlcnJvckNvZGUiOjcsInJlZmVycmVyIjoiIiwicGxhdGZvcm0iOiJERVNLVE9QIiwiaXNHZW5pZWUiOmZhbHNlLCJzZWN0aW9ucyI6bnVsbCwicGFnZUdyb3VwIjoiUE9TVCJ9&c_b=722.3000011444092
Requested by: Host: thehackernews.com
URL: https://thehackernews.com/2023/01/chinese-hackers-utilize-golang-malware.html
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 23.97.225.52 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: nginx/1.10.3 (Ubuntu) /
Resource Hash: e3849fdc1eab88579b20b1b56875d6ef8299c4ad165e03921400ccae69149861

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://thehackernews.com/2023/01/chinese-hackers-utilize-golang-malware.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 31 Jan 2023 11:41:37 GMT
server: nginx/1.10.3 (Ubuntu)
access-control-allow-methods: GET, POST
content-type: image/png
access-control-allow-origin: https://thehackernews.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
x-robots-tag: noindex
content-length: 70
expires: 0

GET
H2 200 AGSKWxXMOr9ZpnjJRBZW8i5isZ7NTvjJ34JT5PReAUDZtYKIg7EChpuHuWmDiZ9pq2JnrKkRUfPZeYtDz3gbld0MMpA= Show response
fundingchoicesmessages.google.com/f/ 459 KB
60 KB 179ms
178ms Script
application/javascript 2a00:1450:4001:82a::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxXMOr9ZpnjJRBZW8i5isZ7NTvjJ34JT5PReAUDZtYKIg7EChpuHuWmDiZ9pq2JnrKkRUfPZeYtDz3gbld0MMpA=?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNjc1MTY1Mjk3LDIyMDAwMDAwMF0sIjQ2MkE1MEQwLTlGMzctNDgyNC1BQTYzLTk4NTlDNTc5QzUwMiIsbnVsbCxudWxsLFtudWxsLFs3XV0sImh0dHBzOi8vdGhlaGFja2VybmV3cy5jb20vMjAyMy8wMS9jaGluZXNlLWhhY2tlcnMtdXRpbGl6ZS1nb2xhbmctbWFsd2FyZS5odG1sIixudWxsLFtbOCwic1NDWmNhZVRtdkEiXSxbOSwiZGUiXV1d

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

825362d8d38474fdd0f0397302f6ca0cfc10d3b33183335e526e56e6d537280d

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-t5dkvFN4VHAGX_dK_4Kurw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://thehackernews.com/2023/01/chinese-hackers-utilize-golang-malware.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Tue, 31 Jan 2023 11:41:37 GMT
content-security-policy: script-src 'report-sample' 'nonce-t5dkvFN4VHAGX_dK_4Kurw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-platform=*, ch-ua-platform-version=*
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
DATA 200
OK truncated
/ 1 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: eae76cb616003cb3e918dfd9f58d63cc8e832aa9d11a9eda64b1476af57e746a

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

Content-Type: image/jpeg

POST
H3 204 AGSKWxUs6kPni_5fBGlgHpRIo2pJweMTKXGHm9zf7b45B9-Tqs5x7wOC0juipfYwomgoCcCjZ0jlWB3vod8dG4qVSz5wIVVDem85HV5vw9EDM2itpY7KvDrCBUsi7JupiWJizVA49GglBw== Show response
fundingchoicesmessages.google.com/el/ 0
29 B 63ms
63ms XHR
text/html 2a00:1450:4001:82a::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxUs6kPni_5fBGlgHpRIo2pJweMTKXGHm9zf7b45B9-Tqs5x7wOC0juipfYwomgoCcCjZ0jlWB3vod8dG4qVSz5wIVVDem85HV5vw9EDM2itpY7KvDrCBUsi7JupiWJizVA49GglBw==?pvid=462A50D0-9F37-4824-AA63-9859C579C502

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-6GvGO9jyLDxvb_DRRtrJ3Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://thehackernews.com/2023/01/chinese-hackers-utilize-golang-malware.html
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 31 Jan 2023 11:41:37 GMT
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-6GvGO9jyLDxvb_DRRtrJ3Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin; report-to="ContributorLoggingHttp"
server: ESF
access-control-max-age: 86400
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
content-type: text/html; charset=utf-8
access-control-allow-origin: https://thehackernews.com
access-control-allow-methods: POST, GET, OPTIONS
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options: SAMEORIGIN
report-to: {"group":"ContributorLoggingHttp","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ContributorLoggingHttp/external"}]}
expires: Mon, 01 Jan 1990 00:00:00 GMT

POST
H3 204 AGSKWxUs6kPni_5fBGlgHpRIo2pJweMTKXGHm9zf7b45B9-Tqs5x7wOC0juipfYwomgoCcCjZ0jlWB3vod8dG4qVSz5wIVVDem85HV5vw9EDM2itpY7KvDrCBUsi7JupiWJizVA49GglBw== Show response
fundingchoicesmessages.google.com/el/ 0
29 B 56ms
56ms XHR
text/html 2a00:1450:4001:82a::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-a6e9rrdVd_2sx7Ug67c27g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://thehackernews.com/2023/01/chinese-hackers-utilize-golang-malware.html
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 31 Jan 2023 11:41:37 GMT
content-security-policy: script-src 'report-sample' 'nonce-a6e9rrdVd_2sx7Ug67c27g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin; report-to="ContributorLoggingHttp"
server: ESF
access-control-max-age: 86400
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
content-type: text/html; charset=utf-8
access-control-allow-origin: https://thehackernews.com
access-control-allow-methods: POST, GET, OPTIONS
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options: SAMEORIGIN
report-to: {"group":"ContributorLoggingHttp","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ContributorLoggingHttp/external"}]}
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 css
fonts.googleapis.com/ 60 KB
4 KB 142ms
55ms Stylesheet
text/css 2a00:1450:4001:828::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.de.sSCZcaeTmvA.es5.O/d=1/exm=kernel_loader,loader_js_executable/ed=1/rs=AJlcJMw7s6xHsWo5c9R2Eh5QHPDV6JqnEw/m=web_iab_tcf_v2_wall_executable

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

a80933c717cce51df2b59fc76f4f3e81892fd743f4bff7945e8ec353ed32c649

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://thehackernews.com/2023/01/chinese-hackers-utilize-golang-malware.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Tue, 31 Jan 2023 11:41:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Tue, 31 Jan 2023 11:41:37 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 31 Jan 2023 11:41:37 GMT

POST
H3 204 AGSKWxUeBypEy5a-leCTTqK356wfQPJZDvJqz_Q8oER7ikwNMGvkklZwJZF_-Uog79ZjCTfTRgQuI-1HKwelGvxJ4Q-gf5G9ND-TR3ziOqT7F15Gmd-5XwOuHSEcIERc1k_HrHdJ3tfdyQ== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 65ms
65ms XHR
text/html 2a00:1450:4001:82a::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxUeBypEy5a-leCTTqK356wfQPJZDvJqz_Q8oER7ikwNMGvkklZwJZF_-Uog79ZjCTfTRgQuI-1HKwelGvxJ4Q-gf5G9ND-TR3ziOqT7F15Gmd-5XwOuHSEcIERc1k_HrHdJ3tfdyQ==?dmid=970e7566fd7b1e49

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-sODqrhjnvIrGVHHVFic2LQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://thehackernews.com/2023/01/chinese-hackers-utilize-golang-malware.html
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 31 Jan 2023 11:41:37 GMT
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-sODqrhjnvIrGVHHVFic2LQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://thehackernews.com
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options: SAMEORIGIN
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 flUhRq6tzZclQEJ-Vdg-IuiaDsNc.woff2
fonts.gstatic.com/s/materialicons/v139/ 125 KB
126 KB 179ms
93ms Font
font/woff2 2a00:1450:4001:831::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/materialicons/v139/flUhRq6tzZclQEJ-Vdg-IuiaDsNc.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8265f64786397d6b832d1ca0aafdf149ad84e72759fffa9f7272e91a0fb015d1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://thehackernews.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Thu, 26 Jan 2023 12:50:37 GMT
x-content-type-options: nosniff
age: 427860
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 128352
x-xss-protection: 0
last-modified: Thu, 25 Aug 2022 00:26:06 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 26 Jan 2024 12:50:37 GMT

GET
H2 200 memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v34/ 44 KB
44 KB 115ms
38ms Font
font/woff2 2a00:1450:4001:831::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v34/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8778e9af2422858d7052ff9a0f3c12c08ae976bdd6e0316db144cd5579cd97db

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://thehackernews.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Sat, 28 Jan 2023 04:22:26 GMT
x-content-type-options: nosniff
age: 285551
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 44856
x-xss-protection: 0
last-modified: Mon, 15 Aug 2022 18:20:18 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 28 Jan 2024 04:22:26 GMT

GET
H2 200 jquery.min.js Show response
cdnjs.cloudflare.com/ajax/libs/jquery/3.6.1/ 88 KB
28 KB 69ms
20ms Script
application/javascript 2606:4700::6811:180e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/jquery/3.6.1/jquery.min.js

Requested by

Host: thehackernews.com
URL: https://thehackernews.com/2023/01/chinese-hackers-utilize-golang-malware.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a3cf00c109d907e543bc4f6dbc85eb31068f94515251347e9e57509b52ee3d74

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://thehackernews.com/2023/01/chinese-hackers-utilize-golang-malware.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Tue, 31 Jan 2023 11:41:37 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 393962
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 27990
last-modified: Fri, 26 Aug 2022 18:34:13 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "63091225-6d56"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=NPGpuK3ptcAo5Xfw%2FOlQK1240KtRIbRPnpWaMOa8aQsp%2BLjCOEaZYPZlKrBJPpo4QpBfC4flFSroyI8ITufyP1VW9f7LGUk5ucIWYvHmyeh%2BJBS9wj0b2UZQV08N2kRVF1TGEtmEoawN6T0dYaG5PYC7"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 79222de68fee913c-FRA
expires: Sun, 21 Jan 2024 11:41:37 GMT

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 148 KB
49 KB 187ms
94ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-7983783048239650

Requested by

Host: thehackernews.com
URL: https://thehackernews.com/2023/01/chinese-hackers-utilize-golang-malware.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6df66c7e49ece8df34e7c56316af78d64d3ce6adba9c49f3391cc96a26c88a90

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://thehackernews.com/2023/01/chinese-hackers-utilize-golang-malware.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Tue, 31 Jan 2023 11:41:37 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 50063
x-xss-protection: 0
server: cafe
etag: 14444253007199204185
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Tue, 31 Jan 2023 11:41:37 GMT

GET
H2 200 feedback
e3.adpushup.com/AdPushupFeedbackWebService/ 70 B
321 B 15ms
15ms Image
image/png 23.97.225.52
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://e3.adpushup.com/AdPushupFeedbackWebService/feedback?data=eyJjcmVhdGVkVFMiOjE2NzUxNjUyOTc2MjYsInBhY2tldElkIjoiMDAwMDkwOUMtYWE5YWE4MmEtMDdlMS00M2MyLTgzMGMtYjVmZTY1ZGZmNTVjIiwic2l0ZUlkIjozNzAyMCwic2l0ZURvbWFpbiI6Imh0dHBzOi8vdGhlaGFja2VybmV3cy5jb20vIiwidXJsIjoiaHR0cHM6Ly90aGVoYWNrZXJuZXdzLmNvbS8yMDIzLzAxL2NoaW5lc2UtaGFja2Vycy11dGlsaXplLWdvbGFuZy1tYWx3YXJlLmh0bWwiLCJtb2RlIjoxLCJlcnJvckNvZGUiOjEsInJlZmVycmVyIjoiIiwicGxhdGZvcm0iOiJERVNLVE9QIiwiaXNHZW5pZWUiOmZhbHNlLCJzZWN0aW9ucyI6W3sic2VjdGlvbklkIjoiNGM3NmJiMDUtYjk1OS00ZjhhLTllOTAtZjhjMTI4ZDFkZGQ2Iiwic2VjdGlvbk5hbWUiOiJBUF9UX1JfcmVzcG9uc2l2ZVhyZXNwb25zaXZlXzRjNzZiIiwic3RhdHVzIjoxLCJuZXR3b3JrIjoiYWRwVGFncyIsIm5ldHdvcmtBZFVuaXRJZCI6IkFEUF8zNzAyMF9yZXNwb25zaXZlWHJlc3BvbnNpdmVfNGM3NmJiMDUtYjk1OS00ZjhhLTllOTAtZjhjMTI4ZDFkZGQ2Iiwic2VydmljZXMiOlsyLDNdLCJhZFVuaXRUeXBlIjoxfV19&c_b=1151.6000003814697
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 23.97.225.52 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: nginx/1.10.3 (Ubuntu) /
Resource Hash: e3849fdc1eab88579b20b1b56875d6ef8299c4ad165e03921400ccae69149861

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://thehackernews.com/2023/01/chinese-hackers-utilize-golang-malware.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 31 Jan 2023 11:41:37 GMT
server: nginx/1.10.3 (Ubuntu)
access-control-allow-methods: GET, POST
content-type: image/png
access-control-allow-origin: https://thehackernews.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
x-robots-tag: noindex
content-length: 70
expires: 0

GET
H2 200 feedback
e3.adpushup.com/AdPushupFeedbackWebService/ 70 B
321 B 16ms
16ms Image
image/png 23.97.225.52
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://e3.adpushup.com/AdPushupFeedbackWebService/feedback?data=eyJjcmVhdGVkVFMiOjE2NzUxNjUyOTc2MzYsInBhY2tldElkIjoiMDAwMDkwOUMtYWE5YWE4MmEtMDdlMS00M2MyLTgzMGMtYjVmZTY1ZGZmNTVjIiwic2l0ZUlkIjozNzAyMCwic2l0ZURvbWFpbiI6Imh0dHBzOi8vdGhlaGFja2VybmV3cy5jb20vIiwidXJsIjoiaHR0cHM6Ly90aGVoYWNrZXJuZXdzLmNvbS8yMDIzLzAxL2NoaW5lc2UtaGFja2Vycy11dGlsaXplLWdvbGFuZy1tYWx3YXJlLmh0bWwiLCJtb2RlIjoxLCJlcnJvckNvZGUiOjEsInJlZmVycmVyIjoiIiwicGxhdGZvcm0iOiJERVNLVE9QIiwiaXNHZW5pZWUiOmZhbHNlLCJzZWN0aW9ucyI6W3sic2VjdGlvbklkIjoiZTg1ODlmZTUtZGQ1NC00NWU4LWIxMzctYWM3ZmIxMGE2MTMwIiwic2VjdGlvbk5hbWUiOiJBUF9UX1JfcmVzcG9uc2l2ZVhyZXNwb25zaXZlX2U4NTg5Iiwic3RhdHVzIjoxLCJuZXR3b3JrIjoiYWRwVGFncyIsIm5ldHdvcmtBZFVuaXRJZCI6IkFEUF8zNzAyMF9yZXNwb25zaXZlWHJlc3BvbnNpdmVfZTg1ODlmZTUtZGQ1NC00NWU4LWIxMzctYWM3ZmIxMGE2MTMwIiwic2VydmljZXMiOlsyLDNdLCJhZFVuaXRUeXBlIjoxfV19&c_b=1161.3000011444092
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 23.97.225.52 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: nginx/1.10.3 (Ubuntu) /
Resource Hash: e3849fdc1eab88579b20b1b56875d6ef8299c4ad165e03921400ccae69149861

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://thehackernews.com/2023/01/chinese-hackers-utilize-golang-malware.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 31 Jan 2023 11:41:37 GMT
server: nginx/1.10.3 (Ubuntu)
access-control-allow-methods: GET, POST
content-type: image/png
access-control-allow-origin: https://thehackernews.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
x-robots-tag: noindex
content-length: 70
expires: 0

GET
H2 200 testmode
e3.adpushup.com/AdPushupFeedbackWebService/feedback/ 70 B
321 B 15ms
14ms Image
image/png 23.97.225.52
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://e3.adpushup.com/AdPushupFeedbackWebService/feedback/testmode?data=eyJjcmVhdGVkVFMiOjE2NzUxNjUyOTc2MjYsInBhY2tldElkIjoiMDAwMDkwOUMtYWE5YWE4MmEtMDdlMS00M2MyLTgzMGMtYjVmZTY1ZGZmNTVjIiwic2l0ZUlkIjozNzAyMCwic2l0ZURvbWFpbiI6Imh0dHBzOi8vdGhlaGFja2VybmV3cy5jb20vIiwidXJsIjoiaHR0cHM6Ly90aGVoYWNrZXJuZXdzLmNvbS8yMDIzLzAxL2NoaW5lc2UtaGFja2Vycy11dGlsaXplLWdvbGFuZy1tYWx3YXJlLmh0bWwiLCJtb2RlIjo1LCJlcnJvckNvZGUiOjEsInJlZmVycmVyIjoiIiwicGxhdGZvcm0iOiJERVNLVE9QIiwiaXNHZW5pZWUiOmZhbHNlLCJzZWN0aW9ucyI6bnVsbCwicGFnZUdyb3VwIjoiUE9TVCJ9&c_b=1171.5
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 23.97.225.52 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: nginx/1.10.3 (Ubuntu) /
Resource Hash: e3849fdc1eab88579b20b1b56875d6ef8299c4ad165e03921400ccae69149861

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://thehackernews.com/2023/01/chinese-hackers-utilize-golang-malware.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 31 Jan 2023 11:41:37 GMT
server: nginx/1.10.3 (Ubuntu)
access-control-allow-methods: GET, POST
content-type: image/png
access-control-allow-origin: https://thehackernews.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
x-robots-tag: noindex
content-length: 70
expires: 0

POST
H3 204 rum Show response
thehackernews.com/cdn-cgi/ 0
142 B 17ms
17ms XHR
text/plain 2606:4700:20::681a:61
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://thehackernews.com/cdn-cgi/rum?

Requested by

Host: static.cloudflareinsights.com
URL: https://static.cloudflareinsights.com/beacon.min.js/vaafb692b2aea4879b33c060e79fe94621666317369993

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:20::681a:61 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://thehackernews.com/2023/01/chinese-hackers-utilize-golang-malware.html
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36
content-type: application/json

Response headers

date: Tue, 31 Jan 2023 11:41:37 GMT
x-content-type-options: nosniff
server: cloudflare
vary: Origin
access-control-max-age: 86400
access-control-allow-methods: POST,OPTIONS
access-control-allow-origin: https://thehackernews.com
x-frame-options: DENY
access-control-allow-credentials: true
cf-ray: 79222de65821bbd4-FRA

GET
H2 200 bid Show response
aax-dtb-cf.amazon-adsystem.com/e/dtb/ 23 B
464 B 116ms
44ms XHR
text/javascript 13.227.198.171
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://aax-dtb-cf.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fthehackernews.com%2F2023%2F01%2Fchinese-hackers-utilize-golang-malware.html&pid=YqEnFhVdp8C9q&cb=0&ws=1600x1200&v=23.123.1617&t=3000&slots=%5B%7B%22sd%22%3A%22ADP_37020_responsivexresponsive_00000001-9e1ed279-3d6d-4abf-a91b-7320d2b57f20%22%2C%22s%22%3A%5B%22300x50%22%2C%22300x100%22%2C%22300x75%22%2C%22300x250%22%2C%22250x250%22%2C%22200x200%22%5D%2C%22sn%22%3A%22%2F103512698%2F22055889224%22%7D%2C%7B%22sd%22%3A%22ADP_37020_responsivexresponsive_00000001-8f5cf522-86f1-4c8d-86c5-e2f53682b6e8%22%2C%22s%22%3A%5B%22300x50%22%2C%22300x100%22%2C%22300x75%22%2C%22300x250%22%2C%22250x250%22%2C%22200x200%22%5D%2C%22sn%22%3A%22%2F103512698%2F22055889209%22%7D%5D&schain=1.0%2C1!adpushup.com%2Caeb138a66c47c1d438a8907993e81712%2C1%2C%2C%2C&pubid=2e7e1587-d92f-46dd-8721-80b53eccb87e&gdpre=1&gdprl=%7B%22status%22%3A%22tcfv2-success%22%7D

Requested by

Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.227.198.171 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-227-198-171.ams54.r.cloudfront.net

Software

Server /

Resource Hash

745a085b52b8371ec6705413fca70a28c6d8bff0db480e6b124bd08c54e95ef8

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://thehackernews.com/2023/01/chinese-hackers-utilize-golang-malware.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Tue, 31 Jan 2023 11:41:37 GMT
strict-transport-security: max-age=47474747; includeSubDomains; preload
via: 1.1 1396f0307ab4835adf6e4163507d4c8a.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: AMS54-C1
x-amz-rid: QPMNF0S4KZT55AZ4CH39
vary: Accept-Encoding,User-Agent
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://thehackernews.com
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 23
x-amz-cf-id: rG3CsG8LGUk3vspfFFdtjYklrByJgO6jnzGrfHu074azltBKRXRglg==

GET
H2 200 latest.json Show response
cdn.jsdelivr.net/gh/prebid/currency-file@1/ 2 KB
2 KB 70ms
40ms XHR
application/json 2606:4700::6810:5814
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/gh/prebid/currency-file@1/latest.json?date=20230131

Requested by

Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.37020.1664558804419.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:5814 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1558d2199ce0f5f8aab91962e3e11802025c7a7130c0ab2f23fa3a3fb7bf103c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://thehackernews.com/2023/01/chinese-hackers-utilize-golang-malware.html
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 31 Jan 2023 11:41:37 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 27640
x-jsd-version: 1.0.1603
content-encoding: br
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-served-by: cache-fra-eddf8230021-FRA, cache-jnb7023-JNB
x-jsd-version-type: version
server: cloudflare
etag: W/"636-rGI5GXUwS8QGlu72wUTtK21TlME"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=oNIVHsNyOC7%2FVj418kOXNObHYvKsSWhwd6YbBqqJ%2Bs0v%2BQgPM0v4gEcOzWhV3MdxqHm%2FuBMJWlvft7gxAMj%2B0YYcLtk8yZYx1YUNqIrskQqs5GdL3WzEMCyCrZTJsnYzAUvifhiKNAF0PHm1WV0%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/json; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=604800, s-maxage=43200
timing-allow-origin: *
cf-ray: 79222de6d9c7bbd7-FRA

GET
H2 200 show_ads_impl_with_ama_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202301230101/ 361 KB
119 KB 111ms
110ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202301230101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-7983783048239650&plah=thehackernews.com&bust=31071854

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-7983783048239650

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

873733d14d67f03dabe1250b2da0fe9f6f2c0486c1123e83d1484f0a894f9c2c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://thehackernews.com/2023/01/chinese-hackers-utilize-golang-malware.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Tue, 31 Jan 2023 11:41:37 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 121171
x-xss-protection: 0
server: cafe
etag: 10846077195810063297
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Tue, 31 Jan 2023 11:41:37 GMT

GET
H2 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20230125/r20190131/ Frame 2626 10 KB
4 KB 38ms
37ms Document
text/html 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20230125/r20190131/zrt_lookup.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-7983783048239650

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9da238ca619f3bf71312de3c9c913c653941ada56cb5e1601aafb6094ae51cdc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://thehackernews.com/2023/01/chinese-hackers-utilize-golang-malware.html
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 60453
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4242
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 30 Jan 2023 18:54:04 GMT
etag: 10353107486223812946
expires: Mon, 13 Feb 2023 18:54:04 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

Verdicts & Comments Add Verdict or Comment

179 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

7 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
thehackernews.com/2023/01	1969-12-31 23:59:59	Name: _ga4s Value: 1
thehackernews.com/2023/01	1969-12-31 23:59:59	Name: _ga4sid Value: 1227804384
.thehackernews.com/	1970-01-20 18:55:25	Name: _ga4 Value: 49cad941-cf75-4044-970b-60f92832bdc6
.quantserve.com/	1970-01-20 18:49:39	Name: mc Value: 63d8fe71-1c28a-3cdd9-2c43b
.thehackernews.com/	1970-01-20 18:43:54	Name: __qca Value: P0-1696536700-1675165297021
thehackernews.com/	1970-01-20 10:02:37	Name: _pbjs_userid_consent_data Value: 3524755945110770
.thehackernews.com/	1970-01-20 10:02:37	Name: _pubcid Value: f4072d68-40c2-48a8-a5a4-871e858a863f

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

aax-dtb-cf.amazon-adsystem.com
bcp.crwdcntrl.net
c.amazon-adsystem.com
cdn.adpushup.com
cdn.jsdelivr.net
cdnjs.cloudflare.com
code.jquery.com
e3.adpushup.com
fonts.googleapis.com
fonts.gstatic.com
fundingchoicesmessages.google.com
googleads.g.doubleclick.net
pagead2.googlesyndication.com
pixel.quantserve.com
rules.quantcount.com
secure.quantserve.com
securepubads.g.doubleclick.net
static.cloudflareinsights.com
tags.crwdcntrl.net
thehackernews.com
13.227.198.171
13.32.28.197
2001:4de0:ac18::1:a:3a
23.97.225.52
2600:9000:211e:4e00:6:44e3:f8c0:93a1
2606:4700:20::681a:61
2606:4700::6810:3965
2606:4700::6810:5814
2606:4700::6811:180e
2620:116:800d:21:7eb1:3826:be7e:d981
2a00:1450:4001:803::2002
2a00:1450:4001:811::2002
2a00:1450:4001:828::200a
2a00:1450:4001:82a::200e
2a00:1450:4001:831::2003
2a02:26f0:11a::217:9a40
52.222.139.35
54.171.141.116
019d22d3e70ec460a085db138f131a9d77cb25175dd7eecb155305c270ed221c
06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844
0c6c51dafc8bdf4ef6841da2faf4d5d7555393739fd7577d931b0268fe3060a9
0f48c5678ce459a596423b0e55344e7ad8eb3d3b1b27c54cd76a9d4cee7dd6c3
1558d2199ce0f5f8aab91962e3e11802025c7a7130c0ab2f23fa3a3fb7bf103c
1b9bc9c5d136e5e10a89c8902b5c6540cd738265af675ed3e3984e28c0c14f02
1d3962c97209d13388c23f4d5c6205f4d83212a4c2f995c70dc0dccb6da68dbb
26914004d3a8d5ddde2202b642d7936eb61c9f195b5cd3c87e44ef8ad4d57c16
2de33ca2d2cfb7f437aa190ecdd4b3991ff2879604c0e24aaf02849ae1f360b3
3f3d6d1b8de33535664e0e287bd8f446877b071ae9f76d442425bd8fb90b11e1
430cce5a9d85d245f88003e6b6f2156280cbc6c844498c3f9c8d36ca0b1c7750
431ffcb61dcfa6c9e6bdfdb957e8c96d72e26da9336749d63925f655324fa707
47cb6302630c986c566319344bbaa135b42fa084ce0e86a90da432dba9c02ed7
5634160b5779452c237d49e24be812637f98f9d7f64b1f4115e3ad786cacf48c
6795c5c8b9b0aeb87d6663ccd7a71fb9d2f2817fe9b5c2e67bce0d5a5e1309a1
6d54aecd2bd9fef0d74763ef48135aded46f2a190546075cf9466b9e5296c8a9
6dbd2193bad8bb7f69008f50e6163330a084363c8803f2be5a711d9ff08c8acf
6df66c7e49ece8df34e7c56316af78d64d3ce6adba9c49f3391cc96a26c88a90
745a085b52b8371ec6705413fca70a28c6d8bff0db480e6b124bd08c54e95ef8
825362d8d38474fdd0f0397302f6ca0cfc10d3b33183335e526e56e6d537280d
8265f64786397d6b832d1ca0aafdf149ad84e72759fffa9f7272e91a0fb015d1
873733d14d67f03dabe1250b2da0fe9f6f2c0486c1123e83d1484f0a894f9c2c
8778e9af2422858d7052ff9a0f3c12c08ae976bdd6e0316db144cd5579cd97db
8c979ed3785f184174cba3c38dd0ebbd5b244add676982d9aeafb57b3e53b1a4
9b18bec31059414dc8a734c92aaa74c699b957f4ebc98612b43a42a63c1fd7ee
9da238ca619f3bf71312de3c9c913c653941ada56cb5e1601aafb6094ae51cdc
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
a3cf00c109d907e543bc4f6dbc85eb31068f94515251347e9e57509b52ee3d74
a71328300f380217ae0abf7f805052a10a0c196cb241eb97adf9b905e4a48c8a
a720cc75bfc1b9709d43f04591ba6779a63466b2156e656dc0f717fdfdc76238
a80933c717cce51df2b59fc76f4f3e81892fd743f4bff7945e8ec353ed32c649
b56f167e2e50aa15cfa537bae7f947e27dcdcbef3eac95bb48720539fc442d56
c0d19353c945d66184d063ccb4c33fa2e2014c35b8a7a8a56416e34531f90e92
c6a9d65e5bd6eb2447ea57e398e1d30f3c6e2d022ecf195933d161ffed964690
ccf00d1923b0131a10e0c6d26f95e5dee6ebf8621a27e83c5a2f68a2e0093142
d53dd17c93276038e11218bba27e6c991fe612e78651e4e23b7385f4d84caa2f
d5ef141c8649172cc921e50e9b28d5deb2cabfeda102a9c40ef5cf39daf2aaa1
dbf4fa73ce4f2bd113dde31b7f7eff7bfd3a1271f30ababad320f07033408f06
e3849fdc1eab88579b20b1b56875d6ef8299c4ad165e03921400ccae69149861
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
eae76cb616003cb3e918dfd9f58d63cc8e832aa9d11a9eda64b1476af57e746a
edc30a0e05622f71d52d07a0b7b5e94e654ee06854f893be1954336730eb0db6
f7569411b16c508800fe89f2218058236881c325d2cb79f6c47edd0a62299f68
f88754ecdaeedbf69845f3cb4015909beff31f92b173185c075ff8ab40ae3d02
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e
ff4f481e4ba71da819f424515ef3d2dc4eb8c7f6377fbf2873e448461981f76c

thehackernews.com Open in urlscan Pro 2606:4700:20::681a:61 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

48 Requests

100 %HTTPS

72 %IPv6

15 Domains

20 Subdomains

19 IPs

5 Countries

1528 kBTransfer

3764 kBSize

7 Cookies

34 Outgoing links

Redirected requests

48 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 8 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

thehackernews.com Open in urlscan Pro
2606:4700:20::681a:61 Public Scan

Screenshot
Live screenshot

Full Image

48
Requests

100 %
HTTPS

72 %
IPv6

15
Domains

20
Subdomains

19
IPs

5
Countries

1528 kB
Transfer

3764 kB
Size

7
Cookies

48 HTTP transactions
8 data transactions