cyware.com Open in urlscan Pro
54.68.234.114 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a
Submission: On April 12 via manual (April 12th 2019, 4:00:32 pm UTC) from BR

Summary HTTP 77 Redirects Links 19 Behaviour Indicators

Summary

This website contacted 14 IPs in 2 countries across 10 domains to perform 77 HTTP transactions. The main IP is 54.68.234.114, located in Boardman, United States and belongs to AMAZON-02 - Amazon.com, Inc., US. The main domain is cyware.com.
TLS certificate: Issued by Go Daddy Secure Certificate Authority... on August 5th 2018. Valid for: a year.

This is the only time cyware.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
59	54.68.234.114 54.68.234.114	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
4	2606:4700::68... 2606:4700::6810:cea5	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
1	2a00:1450:400... 2a00:1450:4001:80b::200a	15169 (GOOGLE) (GOOGLE - Google LLC)
1	2606:4700::68... 2606:4700::6813:c397	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
1	172.217.18.98 172.217.18.98	15169 (GOOGLE) (GOOGLE - Google LLC)
1 2	2a00:1450:400... 2a00:1450:4001:81f::200e	15169 (GOOGLE) (GOOGLE - Google LLC)
2	2a00:1450:400... 2a00:1450:4001:808::2003	15169 (GOOGLE) (GOOGLE - Google LLC)
1	2a00:1450:400... 2a00:1450:400c:c07::9a	15169 (GOOGLE) (GOOGLE - Google LLC)
2	2a00:1450:400... 2a00:1450:4001:824::200e	15169 (GOOGLE) (GOOGLE - Google LLC)
1	2a00:1450:400... 2a00:1450:4001:808::2002	15169 (GOOGLE) (GOOGLE - Google LLC)
1	2a00:1450:400... 2a00:1450:4001:815::2004	15169 (GOOGLE) (GOOGLE - Google LLC)
1	2a00:1450:400... 2a00:1450:4001:806::2003	15169 (GOOGLE) (GOOGLE - Google LLC)
1	2a00:1450:401... 2a00:1450:4016:800::200d	15169 (GOOGLE) (GOOGLE - Google LLC)
1	2606:4700::68... 2606:4700::6813:c497	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
77	14

59 54.68.234.114 (Boardman, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-54-68-234-114.us-west-2.compute.amazonaws.com

cyware.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2606:4700::6810:cea5 (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

cdn.onesignal.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
onesignal.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80b::200a (Ireland)

ASN15169 (GOOGLE - Google LLC, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6813:c397 (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.217.18.98 (Mountain View, United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: zrh04s05-in-f98.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:81f::200e (Ireland) 1 redirects

ASN15169 (GOOGLE - Google LLC, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:808::2003 (Ireland)

ASN15169 (GOOGLE - Google LLC, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c07::9a (Ireland)

ASN15169 (GOOGLE - Google LLC, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:824::200e (Ireland)

ASN15169 (GOOGLE - Google LLC, US)

apis.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:808::2002 (Ireland)

ASN15169 (GOOGLE - Google LLC, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:815::2004 (Ireland)

ASN15169 (GOOGLE - Google LLC, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:806::2003 (Ireland)

ASN15169 (GOOGLE - Google LLC, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4016:800::200d (Ireland)

ASN15169 (GOOGLE - Google LLC, US)

accounts.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6813:c497 (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
59	cyware.com cyware.com	2 MB
4	google.com apis.google.com www.google.com accounts.google.com	40 KB
4	onesignal.com cdn.onesignal.com onesignal.com	59 KB
2	doubleclick.net stats.g.doubleclick.net googleads.g.doubleclick.net	1 KB
2	gstatic.com fonts.gstatic.com	28 KB
2	google-analytics.com 1 redirects www.google-analytics.com	17 KB
2	cloudflare.com cdnjs.cloudflare.com	77 KB
1	google.de www.google.de	109 B
1	googleadservices.com www.googleadservices.com	9 KB
1	googleapis.com fonts.googleapis.com	963 B
77	10

	Domain	Requested by
59	cyware.com	cyware.com
2	onesignal.com	cdn.onesignal.com
2	apis.google.com	cyware.com apis.google.com
2	fonts.gstatic.com	cyware.com
2	www.google-analytics.com	1 redirects cyware.com
2	cdnjs.cloudflare.com	cyware.com
2	cdn.onesignal.com	cyware.com cdn.onesignal.com
1	accounts.google.com	apis.google.com
1	www.google.de	cyware.com
1	www.google.com	cyware.com
1	googleads.g.doubleclick.net	www.googleadservices.com
1	stats.g.doubleclick.net	cyware.com
1	www.googleadservices.com	cyware.com
1	fonts.googleapis.com	cyware.com
77	14

This site contains links to these domains. Also see Links.

Domain
www.linkedin.com
twitter.com
www.facebook.com
itunes.apple.com
play.google.com
news.drweb.com
www.bleepingcomputer.com
www.google.com

Subject Issuer	Validity	Valid
*.cyware.com Go Daddy Secure Certificate Authority - G2	`2018-08-05` - `2019-10-04`	a year	crt.sh
ssl473492.cloudflaressl.com COMODO ECC Domain Validation Secure Server CA 2	`2019-01-22` - `2019-07-31`	6 months	crt.sh
*.googleapis.com Google Internet Authority G3	`2019-03-01` - `2019-05-24`	3 months	crt.sh
ssl412106.cloudflaressl.com COMODO ECC Domain Validation Secure Server CA 2	`2019-03-02` - `2019-09-08`	6 months	crt.sh
www.googleadservices.com Google Internet Authority G3	`2019-03-01` - `2019-05-24`	3 months	crt.sh
*.google-analytics.com Google Internet Authority G3	`2019-03-01` - `2019-05-24`	3 months	crt.sh
*.google.com Google Internet Authority G3	`2019-03-01` - `2019-05-24`	3 months	crt.sh
*.g.doubleclick.net Google Internet Authority G3	`2019-03-26` - `2019-06-18`	3 months	crt.sh
*.apis.google.com Google Internet Authority G3	`2019-03-01` - `2019-05-24`	3 months	crt.sh
www.google.com Google Internet Authority G3	`2019-03-01` - `2019-05-24`	3 months	crt.sh
www.google.de Google Internet Authority G3	`2019-03-01` - `2019-05-24`	3 months	crt.sh
accounts.google.com Google Internet Authority G3	`2019-03-01` - `2019-05-24`	3 months	crt.sh

This page contains 3 frames:

Primary Page: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a
Frame ID: F1BE643E2361D299067072E5178792DD
Requests: 75 HTTP requests in this frame

Frame: https://accounts.google.com/o/oauth2/iframe
Frame ID: A4BE3A64DB73DD37425262DA01E74BD3
Requests: 1 HTTP requests in this frame

Frame: https://onesignal.com/webPushAnalytics
Frame ID: A256512C5401B8BF5BB8B627269B162B
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]* href=[^>]+font-awesome(?:\.min)?\.css/i

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /google-analytics\.com\/(?:ga|urchin|(analytics))\.js/i
env /^gaGlobal$/i

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i

Google Plus (Widgets) Expand

Overall confidence: 100%
Detected patterns

script /apis\.google\.com\/js\/[a-z]*\.js/i

Modernizr (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

env /^Modernizr$/i

Moment.js (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

env /^moment$/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

env /^jQuery$/i

Page Statistics

77
Requests

100 %
HTTPS

86 %
IPv6

10
Domains

14
Subdomains

14
IPs

2
Countries

1935 kB
Transfer

3154 kB
Size

0
Cookies

19 Outgoing links

These are links going to different origins than the main page.

URL: https://www.linkedin.com/company/cyware
Title: Linkedin

Search URL Search Domain Scan URL

URL: https://twitter.com/cywareco
Title: Twitter

Search URL Search Domain Scan URL

URL: https://www.facebook.com/Cywareco/
Title: Facebook

Search URL Search Domain Scan URL

URL: https://itunes.apple.com/us/app/apple-store/id1082345915?pt=118099902&ct=cyweb_mMenu&mt=8

Search URL Search Domain Scan URL

URL: https://play.google.com/store/apps/details?id=co.cyware&referrer=utm_source%3Dcyweb_mMenu

Search URL Search Domain Scan URL

URL: https://itunes.apple.com/us/app/apple-store/id1082345915?pt=118099902&ct=cyweb_topNav&mt=8

Search URL Search Domain Scan URL

URL: https://play.google.com/store/apps/details?id=co.cyware&referrer=utm_source%3Dcyweb_topNav

Search URL Search Domain Scan URL

URL: http://www.linkedin.com/shareArticle?mini=true&url=https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a
Title: Share on LinkedIn

Search URL Search Domain Scan URL

URL: https://twitter.com/share?url=https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a&text=VSDC%20website%20gets%20infected%20with%20a%20banking%20trojan%20and%20an%20info-stealer
Title: Share on Twitter

Search URL Search Domain Scan URL

URL: http://www.facebook.com/sharer.php?u=https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a
Title: Share on Facebook

Search URL Search Domain Scan URL

URL: https://news.drweb.com/show/?i=13242&c=23&lng=en&p=0
Title: blog

Search URL Search Domain Scan URL

URL: https://www.bleepingcomputer.com/news/security/vsdc-site-hacked-again-to-spread-password-stealing-malware/
Title: spokesperson for VSDC

Search URL Search Domain Scan URL

URL: https://www.google.com/maps/place/Cyware+Labs/@40.7559136,-73.9881915,17z/data=!3m1!4b1!4m5!3m4!1s0x0:0xc1e4c88980c6b2fe!8m2!3d40.7559136!4d-73.9860028?hl=en
Title: Get Direction

Search URL Search Domain Scan URL

URL: https://itunes.apple.com/in/app/cyware-pro-for-organizations/id1193942672?mt=8
Title: Pro

Search URL Search Domain Scan URL

URL: https://itunes.apple.com/in/app/cyware-cyber-security-news/id1082345915?mt=8
Title: Social

Search URL Search Domain Scan URL

URL: https://play.google.com/store/apps/details?id=com.cyware.enterprise.android&hl=en
Title: Pro

Search URL Search Domain Scan URL

URL: https://play.google.com/store/apps/details?id=co.cyware&hl=en
Title: Social

Search URL Search Domain Scan URL

URL: https://twitter.com/CywareCo
Title:

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/10407612/
Title:

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 63

https://www.google-analytics.com/r/collect?v=1&_v=j73&a=956014898&t=pageview&_s=1&dl=https%3A%2F%2Fcyware.com%2Fnews%2Fvsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a&ul=en-us&de=UTF-8&dt=VSDC%20website%20gets%20infected%20with%20a%20banking%20trojan%20and%20a%20info-stealer%20%7C%20Cyware%20Hacker%20News&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&_u=IEBAAEAB~&jid=38822657&gjid=1474631386&cid=287711179.1555084811&tid=UA-74369186-1&_gid=820223684.1555084811&_r=1&z=1335799128 HTTP 302
https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-74369186-1&cid=287711179.1555084811&jid=38822657&_gid=820223684.1555084811&gjid=1474631386&_v=j73&z=1335799128

77 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a Show response
cyware.com/news/ 106 KB
21 KB 1168ms
749ms Document
text/html 54.68.234.114
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL

https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.68.234.114 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

ec2-54-68-234-114.us-west-2.compute.amazonaws.com

Software

nginx /

Resource Hash

6103097e7a7c38345608a2084025a92b068a5acf4977e9c29ea5662943f77594

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	nosniff
X-Frame-Options	allow-from https://lynxgrc.com https://www.incidentresponse.com https://cyware.com https://consortiam.net https://securitycurrent.com
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: cyware.com
:scheme: https
:path: /news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

status: 200
date: Fri, 12 Apr 2019 16:00:09 GMT
content-type: text/html; charset=UTF-8
server: nginx
cache-control: no-cache max-age=86400, no-cache, public
set-cookie: XSRF-TOKEN=eyJpdiI6IitFaGZGZHV0VEI5blRiS2VTMjlVRGc9PSIsInZhbHVlIjoiUXAzd3pzdEtXbVN1SGJxWDlDNTc2cEcrWXNuZllEalVKNjh0T21Sc01IWnVJWktvb3VPaUlJZ1UxWGNqWjlxYlhOSmkzU1VJcU9DczE3TGpMRlp3NkE9PSIsIm1hYyI6IjI0NTM4MjJlNWYyNTdmNjc2ZDI3N2M2ODllYjIzOTA5YzU5Y2QxNzYyOTdmZTRlOGFjMTU3MWE3NmIxOWQxYzkifQ%3D%3D; expires=Fri, 12-Apr-2019 18:00:09 GMT; Max-Age=7200; path=/ laravel_session=eyJpdiI6ImtGYzlTR0JUU0FwaTJIcTdZUDZlTlE9PSIsInZhbHVlIjoiRndIVzdsZGJcL0daenVsUWtKeXlsZ2t3SjdLY0VNdHBpZytTVzVrSXNnd2Nrb0tva2grWlhURlFHb1VXYnVFWkhKcWpLXC83V1RQaGFWUlFGOTJhT0UrZz09IiwibWFjIjoiMzIyMjY3YTc4ZGZkMWQyNTk4N2M2ZGY3MjMwNTY2ZDQzOGY3ZWJmOGViM2EwYjY1OTExNjhiZTAxZWFmMjQ2MyJ9; expires=Fri, 12-Apr-2019 18:00:09 GMT; Max-Age=7200; path=/; httponly
x-frame-options: allow-from https://lynxgrc.com https://www.incidentresponse.com https://cyware.com https://consortiam.net https://securitycurrent.com
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
strict-transport-security: max-age=31536000; includeSubDomains; preload;
content-encoding: gzip

GET
H2 200 OneSignalSDK.js Show response
cdn.onesignal.com/sdks/ 17 KB
6 KB 20ms
8ms Script
application/javascript 2606:4700::6810:cea5
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.onesignal.com/sdks/OneSignalSDK.js
Requested by: Host: cyware.com
URL: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:cea5 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 63a23cb228a3b6e6a33e3a12e6c5bcdf13fe0b28346ccdadca36097a4b13ac50

Request headers

Referer: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Fri, 12 Apr 2019 16:00:09 GMT
content-encoding: gzip
cf-cache-status: HIT
server: cloudflare
etag: W/"a5067802576549b3e0627521f03ee508"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: public, max-age=43200
cf-ray: 4c66695d6adec28d-FRA
expires: Sat, 13 Apr 2019 04:00:09 GMT

GET
H2 200 all-3631104474.css
cyware.com/build/assets/css/ 269 KB
56 KB 202ms
191ms Stylesheet
text/css 54.68.234.114
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL

https://cyware.com/build/assets/css/all-3631104474.css

Requested by

Host: cyware.com
URL: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.68.234.114 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

ec2-54-68-234-114.us-west-2.compute.amazonaws.com

Software

nginx /

Resource Hash

3ff9045847adfe2ae953ccf7e895122bb3f596dee094bf54aa1080dabe946592

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	nosniff
X-Frame-Options	allow-from https://lynxgrc.com https://www.incidentresponse.com https://cyware.com https://consortiam.net https://securitycurrent.com
X-Xss-Protection	1; mode=block

Request headers

:path: /build/assets/css/all-3631104474.css
pragma: no-cache
cookie: XSRF-TOKEN=eyJpdiI6IitFaGZGZHV0VEI5blRiS2VTMjlVRGc9PSIsInZhbHVlIjoiUXAzd3pzdEtXbVN1SGJxWDlDNTc2cEcrWXNuZllEalVKNjh0T21Sc01IWnVJWktvb3VPaUlJZ1UxWGNqWjlxYlhOSmkzU1VJcU9DczE3TGpMRlp3NkE9PSIsIm1hYyI6IjI0NTM4MjJlNWYyNTdmNjc2ZDI3N2M2ODllYjIzOTA5YzU5Y2QxNzYyOTdmZTRlOGFjMTU3MWE3NmIxOWQxYzkifQ%3D%3D; laravel_session=eyJpdiI6ImtGYzlTR0JUU0FwaTJIcTdZUDZlTlE9PSIsInZhbHVlIjoiRndIVzdsZGJcL0daenVsUWtKeXlsZ2t3SjdLY0VNdHBpZytTVzVrSXNnd2Nrb0tva2grWlhURlFHb1VXYnVFWkhKcWpLXC83V1RQaGFWUlFGOTJhT0UrZz09IiwibWFjIjoiMzIyMjY3YTc4ZGZkMWQyNTk4N2M2ZGY3MjMwNTY2ZDQzOGY3ZWJmOGViM2EwYjY1OTExNjhiZTAxZWFmMjQ2MyJ9
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: text/css,*/*;q=0.1
cache-control: no-cache
:authority: cyware.com
referer: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a
:scheme: https
:method: GET
Referer: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Fri, 12 Apr 2019 16:00:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 23 Apr 2018 14:15:02 GMT
server: nginx
etag: W/"5addea66-43269"
x-frame-options: allow-from https://lynxgrc.com https://www.incidentresponse.com https://cyware.com https://consortiam.net https://securitycurrent.com
content-type: text/css
status: 200
cache-control: max-age=315360000 max-age=86400, no-cache, public
strict-transport-security: max-age=31536000; includeSubDomains; preload;
x-xss-protection: 1; mode=block
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 design-v2.css
cyware.com/assets/css/ 37 KB
10 KB 394ms
382ms Stylesheet
text/css 54.68.234.114
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL

https://cyware.com/assets/css/design-v2.css?v=1492506833

Requested by

Host: cyware.com
URL: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.68.234.114 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

ec2-54-68-234-114.us-west-2.compute.amazonaws.com

Software

nginx /

Resource Hash

af3b2be48ab334e0cacd5dd12cad15bffb16a624cb8669bdf0ff65a6f3df5059

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	nosniff
X-Frame-Options	allow-from https://lynxgrc.com https://www.incidentresponse.com https://cyware.com https://consortiam.net https://securitycurrent.com
X-Xss-Protection	1; mode=block

Request headers

:path: /assets/css/design-v2.css?v=1492506833
pragma: no-cache
cookie: XSRF-TOKEN=eyJpdiI6IitFaGZGZHV0VEI5blRiS2VTMjlVRGc9PSIsInZhbHVlIjoiUXAzd3pzdEtXbVN1SGJxWDlDNTc2cEcrWXNuZllEalVKNjh0T21Sc01IWnVJWktvb3VPaUlJZ1UxWGNqWjlxYlhOSmkzU1VJcU9DczE3TGpMRlp3NkE9PSIsIm1hYyI6IjI0NTM4MjJlNWYyNTdmNjc2ZDI3N2M2ODllYjIzOTA5YzU5Y2QxNzYyOTdmZTRlOGFjMTU3MWE3NmIxOWQxYzkifQ%3D%3D; laravel_session=eyJpdiI6ImtGYzlTR0JUU0FwaTJIcTdZUDZlTlE9PSIsInZhbHVlIjoiRndIVzdsZGJcL0daenVsUWtKeXlsZ2t3SjdLY0VNdHBpZytTVzVrSXNnd2Nrb0tva2grWlhURlFHb1VXYnVFWkhKcWpLXC83V1RQaGFWUlFGOTJhT0UrZz09IiwibWFjIjoiMzIyMjY3YTc4ZGZkMWQyNTk4N2M2ZGY3MjMwNTY2ZDQzOGY3ZWJmOGViM2EwYjY1OTExNjhiZTAxZWFmMjQ2MyJ9
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: text/css,*/*;q=0.1
cache-control: no-cache
:authority: cyware.com
referer: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a
:scheme: https
:method: GET
Referer: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Fri, 12 Apr 2019 16:00:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 21 May 2018 14:58:03 GMT
server: nginx
etag: W/"5b02de7b-9362"
x-frame-options: allow-from https://lynxgrc.com https://www.incidentresponse.com https://cyware.com https://consortiam.net https://securitycurrent.com
content-type: text/css
status: 200
cache-control: max-age=315360000 max-age=86400, no-cache, public
strict-transport-security: max-age=31536000; includeSubDomains; preload;
x-xss-protection: 1; mode=block
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 style.css
cyware.com/enterprise-cdn/css/ 70 KB
14 KB 397ms
386ms Stylesheet
text/css 54.68.234.114
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL

https://cyware.com/enterprise-cdn/css/style.css

Requested by

Host: cyware.com
URL: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.68.234.114 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

ec2-54-68-234-114.us-west-2.compute.amazonaws.com

Software

nginx /

Resource Hash

4f4767b497a8593857a7bd4bee7ef3878f6af9f64f14e9e8ebea1437332dc0ee

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	nosniff
X-Frame-Options	allow-from https://lynxgrc.com https://www.incidentresponse.com https://cyware.com https://consortiam.net https://securitycurrent.com
X-Xss-Protection	1; mode=block

Request headers

:path: /enterprise-cdn/css/style.css
pragma: no-cache
cookie: XSRF-TOKEN=eyJpdiI6IitFaGZGZHV0VEI5blRiS2VTMjlVRGc9PSIsInZhbHVlIjoiUXAzd3pzdEtXbVN1SGJxWDlDNTc2cEcrWXNuZllEalVKNjh0T21Sc01IWnVJWktvb3VPaUlJZ1UxWGNqWjlxYlhOSmkzU1VJcU9DczE3TGpMRlp3NkE9PSIsIm1hYyI6IjI0NTM4MjJlNWYyNTdmNjc2ZDI3N2M2ODllYjIzOTA5YzU5Y2QxNzYyOTdmZTRlOGFjMTU3MWE3NmIxOWQxYzkifQ%3D%3D; laravel_session=eyJpdiI6ImtGYzlTR0JUU0FwaTJIcTdZUDZlTlE9PSIsInZhbHVlIjoiRndIVzdsZGJcL0daenVsUWtKeXlsZ2t3SjdLY0VNdHBpZytTVzVrSXNnd2Nrb0tva2grWlhURlFHb1VXYnVFWkhKcWpLXC83V1RQaGFWUlFGOTJhT0UrZz09IiwibWFjIjoiMzIyMjY3YTc4ZGZkMWQyNTk4N2M2ZGY3MjMwNTY2ZDQzOGY3ZWJmOGViM2EwYjY1OTExNjhiZTAxZWFmMjQ2MyJ9
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: text/css,*/*;q=0.1
cache-control: no-cache
:authority: cyware.com
referer: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a
:scheme: https
:method: GET
Referer: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Fri, 12 Apr 2019 16:00:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 11 Jul 2018 09:15:02 GMT
server: nginx
etag: W/"5b45ca96-11828"
x-frame-options: allow-from https://lynxgrc.com https://www.incidentresponse.com https://cyware.com https://consortiam.net https://securitycurrent.com
content-type: text/css
status: 200
cache-control: max-age=315360000 max-age=86400, no-cache, public
strict-transport-security: max-age=31536000; includeSubDomains; preload;
x-xss-protection: 1; mode=block
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 custom.css
cyware.com/assets/css/ 5 KB
2 KB 198ms
188ms Stylesheet
text/css 54.68.234.114
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL

https://cyware.com/assets/css/custom.css?v=1507027840

Requested by

Host: cyware.com
URL: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.68.234.114 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

ec2-54-68-234-114.us-west-2.compute.amazonaws.com

Software

nginx /

Resource Hash

bac26b9fa83e0b210044bfed0de04b57f842f458476da8260d1556ede6542912

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	nosniff
X-Frame-Options	allow-from https://lynxgrc.com https://www.incidentresponse.com https://cyware.com https://consortiam.net https://securitycurrent.com
X-Xss-Protection	1; mode=block

Request headers

:path: /assets/css/custom.css?v=1507027840
pragma: no-cache
cookie: XSRF-TOKEN=eyJpdiI6IitFaGZGZHV0VEI5blRiS2VTMjlVRGc9PSIsInZhbHVlIjoiUXAzd3pzdEtXbVN1SGJxWDlDNTc2cEcrWXNuZllEalVKNjh0T21Sc01IWnVJWktvb3VPaUlJZ1UxWGNqWjlxYlhOSmkzU1VJcU9DczE3TGpMRlp3NkE9PSIsIm1hYyI6IjI0NTM4MjJlNWYyNTdmNjc2ZDI3N2M2ODllYjIzOTA5YzU5Y2QxNzYyOTdmZTRlOGFjMTU3MWE3NmIxOWQxYzkifQ%3D%3D; laravel_session=eyJpdiI6ImtGYzlTR0JUU0FwaTJIcTdZUDZlTlE9PSIsInZhbHVlIjoiRndIVzdsZGJcL0daenVsUWtKeXlsZ2t3SjdLY0VNdHBpZytTVzVrSXNnd2Nrb0tva2grWlhURlFHb1VXYnVFWkhKcWpLXC83V1RQaGFWUlFGOTJhT0UrZz09IiwibWFjIjoiMzIyMjY3YTc4ZGZkMWQyNTk4N2M2ZGY3MjMwNTY2ZDQzOGY3ZWJmOGViM2EwYjY1OTExNjhiZTAxZWFmMjQ2MyJ9
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: text/css,*/*;q=0.1
cache-control: no-cache
:authority: cyware.com
referer: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a
:scheme: https
:method: GET
Referer: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Fri, 12 Apr 2019 16:00:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 06 Nov 2018 09:40:02 GMT
server: nginx
etag: W/"5be16172-1276"
x-frame-options: allow-from https://lynxgrc.com https://www.incidentresponse.com https://cyware.com https://consortiam.net https://securitycurrent.com
content-type: text/css
status: 200
cache-control: max-age=315360000 max-age=86400, no-cache, public
strict-transport-security: max-age=31536000; includeSubDomains; preload;
x-xss-protection: 1; mode=block
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 css
fonts.googleapis.com/ 13 KB
963 B 26ms
18ms Stylesheet
text/css 2a00:1450:4001:80b::200a
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Lato:400,900,300,700|Source+Sans+Pro:400,700,400italic,700italic

Requested by

Host: cyware.com
URL: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:4001:80b::200a , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

ESF /

Resource Hash

50421864373726117671113bda485e50036446bf071e2e1e78bba9a4ca568e35

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: br
last-modified: Fri, 12 Apr 2019 16:00:09 GMT
server: ESF
access-control-allow-origin: *
date: Fri, 12 Apr 2019 16:00:09 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,44,43,39"
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
x-xss-protection: 1; mode=block
expires: Fri, 12 Apr 2019 16:00:09 GMT

GET
H2 200 fontello.css
cyware.com/assets/fonts/ 29 KB
6 KB 196ms
189ms Stylesheet
text/css 54.68.234.114
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL

https://cyware.com/assets/fonts/fontello.css

Requested by

Host: cyware.com
URL: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.68.234.114 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

ec2-54-68-234-114.us-west-2.compute.amazonaws.com

Software

nginx /

Resource Hash

90bb48597c7b717d6f39368bbd81d16e2d4cd17293ff2e854ec6199ceab1808b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	nosniff
X-Frame-Options	allow-from https://lynxgrc.com https://www.incidentresponse.com https://cyware.com https://consortiam.net https://securitycurrent.com
X-Xss-Protection	1; mode=block

Request headers

:path: /assets/fonts/fontello.css
pragma: no-cache
cookie: XSRF-TOKEN=eyJpdiI6IitFaGZGZHV0VEI5blRiS2VTMjlVRGc9PSIsInZhbHVlIjoiUXAzd3pzdEtXbVN1SGJxWDlDNTc2cEcrWXNuZllEalVKNjh0T21Sc01IWnVJWktvb3VPaUlJZ1UxWGNqWjlxYlhOSmkzU1VJcU9DczE3TGpMRlp3NkE9PSIsIm1hYyI6IjI0NTM4MjJlNWYyNTdmNjc2ZDI3N2M2ODllYjIzOTA5YzU5Y2QxNzYyOTdmZTRlOGFjMTU3MWE3NmIxOWQxYzkifQ%3D%3D; laravel_session=eyJpdiI6ImtGYzlTR0JUU0FwaTJIcTdZUDZlTlE9PSIsInZhbHVlIjoiRndIVzdsZGJcL0daenVsUWtKeXlsZ2t3SjdLY0VNdHBpZytTVzVrSXNnd2Nrb0tva2grWlhURlFHb1VXYnVFWkhKcWpLXC83V1RQaGFWUlFGOTJhT0UrZz09IiwibWFjIjoiMzIyMjY3YTc4ZGZkMWQyNTk4N2M2ZGY3MjMwNTY2ZDQzOGY3ZWJmOGViM2EwYjY1OTExNjhiZTAxZWFmMjQ2MyJ9
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: text/css,*/*;q=0.1
cache-control: no-cache
:authority: cyware.com
referer: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a
:scheme: https
:method: GET
Referer: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Fri, 12 Apr 2019 16:00:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 23 Apr 2018 14:15:02 GMT
server: nginx
etag: W/"5addea66-75ac"
x-frame-options: allow-from https://lynxgrc.com https://www.incidentresponse.com https://cyware.com https://consortiam.net https://securitycurrent.com
content-type: text/css
status: 200
cache-control: max-age=315360000 max-age=86400, no-cache, public
strict-transport-security: max-age=31536000; includeSubDomains; preload;
x-xss-protection: 1; mode=block
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 single.css
cyware.com/assets/css/ 6 KB
3 KB 384ms
376ms Stylesheet
text/css 54.68.234.114
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL

https://cyware.com/assets/css/single.css?v=1490109300

Requested by

Host: cyware.com
URL: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.68.234.114 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

ec2-54-68-234-114.us-west-2.compute.amazonaws.com

Software

nginx /

Resource Hash

7dcd5262ac1d4da9d9b3bddb7104f7b3fd8d3d85a4c8495f5d9a4d7a5837bd9f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	nosniff
X-Frame-Options	allow-from https://lynxgrc.com https://www.incidentresponse.com https://cyware.com https://consortiam.net https://securitycurrent.com
X-Xss-Protection	1; mode=block

Request headers

:path: /assets/css/single.css?v=1490109300
pragma: no-cache
cookie: XSRF-TOKEN=eyJpdiI6IitFaGZGZHV0VEI5blRiS2VTMjlVRGc9PSIsInZhbHVlIjoiUXAzd3pzdEtXbVN1SGJxWDlDNTc2cEcrWXNuZllEalVKNjh0T21Sc01IWnVJWktvb3VPaUlJZ1UxWGNqWjlxYlhOSmkzU1VJcU9DczE3TGpMRlp3NkE9PSIsIm1hYyI6IjI0NTM4MjJlNWYyNTdmNjc2ZDI3N2M2ODllYjIzOTA5YzU5Y2QxNzYyOTdmZTRlOGFjMTU3MWE3NmIxOWQxYzkifQ%3D%3D; laravel_session=eyJpdiI6ImtGYzlTR0JUU0FwaTJIcTdZUDZlTlE9PSIsInZhbHVlIjoiRndIVzdsZGJcL0daenVsUWtKeXlsZ2t3SjdLY0VNdHBpZytTVzVrSXNnd2Nrb0tva2grWlhURlFHb1VXYnVFWkhKcWpLXC83V1RQaGFWUlFGOTJhT0UrZz09IiwibWFjIjoiMzIyMjY3YTc4ZGZkMWQyNTk4N2M2ZGY3MjMwNTY2ZDQzOGY3ZWJmOGViM2EwYjY1OTExNjhiZTAxZWFmMjQ2MyJ9
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: text/css,*/*;q=0.1
cache-control: no-cache
:authority: cyware.com
referer: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a
:scheme: https
:method: GET
Referer: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Fri, 12 Apr 2019 16:00:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 23 Apr 2018 14:15:02 GMT
server: nginx
etag: W/"5addea66-1983"
x-frame-options: allow-from https://lynxgrc.com https://www.incidentresponse.com https://cyware.com https://consortiam.net https://securitycurrent.com
content-type: text/css
status: 200
cache-control: max-age=315360000 max-age=86400, no-cache, public
strict-transport-security: max-age=31536000; includeSubDomains; preload;
x-xss-protection: 1; mode=block
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 jquery-comments.css
cyware.com/assets/css/ 14 KB
4 KB 384ms
377ms Stylesheet
text/css 54.68.234.114
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL

https://cyware.com/assets/css/jquery-comments.css

Requested by

Host: cyware.com
URL: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.68.234.114 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

ec2-54-68-234-114.us-west-2.compute.amazonaws.com

Software

nginx /

Resource Hash

cdf908d3e04492b9bee1a4184686b545c5896b326136ce1c056232c99d23c97d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	nosniff
X-Frame-Options	allow-from https://lynxgrc.com https://www.incidentresponse.com https://cyware.com https://consortiam.net https://securitycurrent.com
X-Xss-Protection	1; mode=block

Request headers

:path: /assets/css/jquery-comments.css
pragma: no-cache
cookie: XSRF-TOKEN=eyJpdiI6IitFaGZGZHV0VEI5blRiS2VTMjlVRGc9PSIsInZhbHVlIjoiUXAzd3pzdEtXbVN1SGJxWDlDNTc2cEcrWXNuZllEalVKNjh0T21Sc01IWnVJWktvb3VPaUlJZ1UxWGNqWjlxYlhOSmkzU1VJcU9DczE3TGpMRlp3NkE9PSIsIm1hYyI6IjI0NTM4MjJlNWYyNTdmNjc2ZDI3N2M2ODllYjIzOTA5YzU5Y2QxNzYyOTdmZTRlOGFjMTU3MWE3NmIxOWQxYzkifQ%3D%3D; laravel_session=eyJpdiI6ImtGYzlTR0JUU0FwaTJIcTdZUDZlTlE9PSIsInZhbHVlIjoiRndIVzdsZGJcL0daenVsUWtKeXlsZ2t3SjdLY0VNdHBpZytTVzVrSXNnd2Nrb0tva2grWlhURlFHb1VXYnVFWkhKcWpLXC83V1RQaGFWUlFGOTJhT0UrZz09IiwibWFjIjoiMzIyMjY3YTc4ZGZkMWQyNTk4N2M2ZGY3MjMwNTY2ZDQzOGY3ZWJmOGViM2EwYjY1OTExNjhiZTAxZWFmMjQ2MyJ9
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: text/css,*/*;q=0.1
cache-control: no-cache
:authority: cyware.com
referer: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a
:scheme: https
:method: GET
Referer: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Fri, 12 Apr 2019 16:00:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 23 Apr 2018 14:15:02 GMT
server: nginx
etag: W/"5addea66-38b8"
x-frame-options: allow-from https://lynxgrc.com https://www.incidentresponse.com https://cyware.com https://consortiam.net https://securitycurrent.com
content-type: text/css
status: 200
cache-control: max-age=315360000 max-age=86400, no-cache, public
strict-transport-security: max-age=31536000; includeSubDomains; preload;
x-xss-protection: 1; mode=block
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 font-awesome.min.css
cdnjs.cloudflare.com/ajax/libs/font-awesome/4.6.3/css/ 28 KB
6 KB 19ms
12ms Stylesheet
text/css 2606:4700::6813:c397
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.6.3/css/font-awesome.min.css

Requested by

Host: cyware.com
URL: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6813:c397 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

008a1d103902f15fdb1c191fcb1ce8954330e7b8de43d09abb08555ba609f420

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000; includeSubDomains

Request headers

Referer: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Fri, 12 Apr 2019 16:00:09 GMT
content-encoding: br
cf-cache-status: HIT
status: 200
strict-transport-security: max-age=15780000; includeSubDomains
last-modified: Thu, 17 May 2018 09:19:12 GMT
server: cloudflare
etag: W/"5afd4910-7187"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
expires: Wed, 01 Apr 2020 16:00:09 GMT
cache-control: public, max-age=30672000
cf-ray: 4c66695d7ae3c28d-FRA
served-in-seconds: 0.007

GET
H2 200 point1.svg
cyware.com/assets/images/popup/ 59 KB
19 KB 503ms
462ms Image
image/svg+xml 54.68.234.114
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cyware.com/assets/images/popup/point1.svg

Requested by

Host: cyware.com
URL: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.68.234.114 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

ec2-54-68-234-114.us-west-2.compute.amazonaws.com

Software

nginx /

Resource Hash

873a77dc58b11c7a41902e597a40feaa2e4a44cba62e59f36156703c437c9e87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	nosniff
X-Frame-Options	allow-from https://lynxgrc.com https://www.incidentresponse.com https://cyware.com https://consortiam.net https://securitycurrent.com
X-Xss-Protection	1; mode=block

Request headers

:path: /assets/images/popup/point1.svg
pragma: no-cache
cookie: XSRF-TOKEN=eyJpdiI6IitFaGZGZHV0VEI5blRiS2VTMjlVRGc9PSIsInZhbHVlIjoiUXAzd3pzdEtXbVN1SGJxWDlDNTc2cEcrWXNuZllEalVKNjh0T21Sc01IWnVJWktvb3VPaUlJZ1UxWGNqWjlxYlhOSmkzU1VJcU9DczE3TGpMRlp3NkE9PSIsIm1hYyI6IjI0NTM4MjJlNWYyNTdmNjc2ZDI3N2M2ODllYjIzOTA5YzU5Y2QxNzYyOTdmZTRlOGFjMTU3MWE3NmIxOWQxYzkifQ%3D%3D; laravel_session=eyJpdiI6ImtGYzlTR0JUU0FwaTJIcTdZUDZlTlE9PSIsInZhbHVlIjoiRndIVzdsZGJcL0daenVsUWtKeXlsZ2t3SjdLY0VNdHBpZytTVzVrSXNnd2Nrb0tva2grWlhURlFHb1VXYnVFWkhKcWpLXC83V1RQaGFWUlFGOTJhT0UrZz09IiwibWFjIjoiMzIyMjY3YTc4ZGZkMWQyNTk4N2M2ZGY3MjMwNTY2ZDQzOGY3ZWJmOGViM2EwYjY1OTExNjhiZTAxZWFmMjQ2MyJ9
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: cyware.com
referer: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a
:scheme: https
:method: GET
Referer: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Fri, 12 Apr 2019 16:00:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 23 Apr 2018 14:15:02 GMT
server: nginx
etag: W/"5addea66-ed19"
x-frame-options: allow-from https://lynxgrc.com https://www.incidentresponse.com https://cyware.com https://consortiam.net https://securitycurrent.com
content-type: image/svg+xml
status: 200
cache-control: max-age=315360000 max-age=86400, no-cache, public
strict-transport-security: max-age=31536000; includeSubDomains; preload;
x-xss-protection: 1; mode=block
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 point2.svg
cyware.com/assets/images/popup/ 31 KB
13 KB 177ms
177ms Image
image/svg+xml 54.68.234.114
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cyware.com/assets/images/popup/point2.svg

Requested by

Host: cyware.com
URL: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.68.234.114 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

ec2-54-68-234-114.us-west-2.compute.amazonaws.com

Software

nginx /

Resource Hash

9b003dbc18a1bb2188353f0f9a67ba45f113901a28b5a27f0e5cb4501475a9fc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	nosniff
X-Frame-Options	allow-from https://lynxgrc.com https://www.incidentresponse.com https://cyware.com https://consortiam.net https://securitycurrent.com
X-Xss-Protection	1; mode=block

Request headers

:path: /assets/images/popup/point2.svg
pragma: no-cache
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: cyware.com
referer: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a
:scheme: https
:method: GET
Referer: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Fri, 12 Apr 2019 16:00:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 23 Apr 2018 14:15:02 GMT
server: nginx
etag: W/"5addea66-7c25"
x-frame-options: allow-from https://lynxgrc.com https://www.incidentresponse.com https://cyware.com https://consortiam.net https://securitycurrent.com
content-type: image/svg+xml
status: 200
cache-control: max-age=315360000 max-age=86400, no-cache, public
strict-transport-security: max-age=31536000; includeSubDomains; preload;
x-xss-protection: 1; mode=block
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 point3.svg
cyware.com/assets/images/popup/ 18 KB
7 KB 176ms
175ms Image
image/svg+xml 54.68.234.114
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cyware.com/assets/images/popup/point3.svg

Requested by

Host: cyware.com
URL: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.68.234.114 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

ec2-54-68-234-114.us-west-2.compute.amazonaws.com

Software

nginx /

Resource Hash

04a5268eb8af9144e7b5d40ac54677c1c8f73d30385229e8e6bf96e4ca014b5c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	nosniff
X-Frame-Options	allow-from https://lynxgrc.com https://www.incidentresponse.com https://cyware.com https://consortiam.net https://securitycurrent.com
X-Xss-Protection	1; mode=block

Request headers

:path: /assets/images/popup/point3.svg
pragma: no-cache
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: cyware.com
referer: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a
:scheme: https
:method: GET
Referer: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Fri, 12 Apr 2019 16:00:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 23 Apr 2018 14:15:02 GMT
server: nginx
etag: W/"5addea66-4935"
x-frame-options: allow-from https://lynxgrc.com https://www.incidentresponse.com https://cyware.com https://consortiam.net https://securitycurrent.com
content-type: image/svg+xml
status: 200
cache-control: max-age=315360000 max-age=86400, no-cache, public
strict-transport-security: max-age=31536000; includeSubDomains; preload;
x-xss-protection: 1; mode=block
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 point4.svg
cyware.com/assets/images/popup/ 39 KB
11 KB 175ms
175ms Image
image/svg+xml 54.68.234.114
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cyware.com/assets/images/popup/point4.svg

Requested by

Host: cyware.com
URL: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.68.234.114 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

ec2-54-68-234-114.us-west-2.compute.amazonaws.com

Software

nginx /

Resource Hash

ecb2b44000c52e31f735ec551a34feb4420ecd41473ad1317bafabc957b9e4ec

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	nosniff
X-Frame-Options	allow-from https://lynxgrc.com https://www.incidentresponse.com https://cyware.com https://consortiam.net https://securitycurrent.com
X-Xss-Protection	1; mode=block

Request headers

:path: /assets/images/popup/point4.svg
pragma: no-cache
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: cyware.com
referer: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a
:scheme: https
:method: GET
Referer: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Fri, 12 Apr 2019 16:00:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 23 Apr 2018 14:15:02 GMT
server: nginx
etag: W/"5addea66-9c3a"
x-frame-options: allow-from https://lynxgrc.com https://www.incidentresponse.com https://cyware.com https://consortiam.net https://securitycurrent.com
content-type: image/svg+xml
status: 200
cache-control: max-age=315360000 max-age=86400, no-cache, public
strict-transport-security: max-age=31536000; includeSubDomains; preload;
x-xss-protection: 1; mode=block
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 point5.svg
cyware.com/assets/images/popup/ 31 KB
10 KB 176ms
175ms Image
image/svg+xml 54.68.234.114
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cyware.com/assets/images/popup/point5.svg

Requested by

Host: cyware.com
URL: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.68.234.114 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

ec2-54-68-234-114.us-west-2.compute.amazonaws.com

Software

nginx /

Resource Hash

63514f4ff2a9e50d3a42cb866816043754b390ea84351545ea04fbc9495707be

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	nosniff
X-Frame-Options	allow-from https://lynxgrc.com https://www.incidentresponse.com https://cyware.com https://consortiam.net https://securitycurrent.com
X-Xss-Protection	1; mode=block

Request headers

:path: /assets/images/popup/point5.svg
pragma: no-cache
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: cyware.com
referer: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a
:scheme: https
:method: GET
Referer: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Fri, 12 Apr 2019 16:00:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 23 Apr 2018 14:15:02 GMT
server: nginx
etag: W/"5addea66-7cd1"
x-frame-options: allow-from https://lynxgrc.com https://www.incidentresponse.com https://cyware.com https://consortiam.net https://securitycurrent.com
content-type: image/svg+xml
status: 200
cache-control: max-age=315360000 max-age=86400, no-cache, public
strict-transport-security: max-age=31536000; includeSubDomains; preload;
x-xss-protection: 1; mode=block
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 login-google-small.png
cyware.com/assets/images/ 6 KB
7 KB 176ms
174ms Image
image/png 54.68.234.114
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cyware.com/assets/images/login-google-small.png

Requested by

Host: cyware.com
URL: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.68.234.114 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

ec2-54-68-234-114.us-west-2.compute.amazonaws.com

Software

nginx /

Resource Hash

920712ec1a6003b2511b5b540a602a51be63aaccaf86049c540a34f9e9799686

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	nosniff
X-Frame-Options	allow-from https://lynxgrc.com https://www.incidentresponse.com https://cyware.com https://consortiam.net https://securitycurrent.com
X-Xss-Protection	1; mode=block

Request headers

:path: /assets/images/login-google-small.png
pragma: no-cache
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: cyware.com
referer: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a
:scheme: https
:method: GET
Referer: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Fri, 12 Apr 2019 16:00:13 GMT
x-content-type-options: nosniff
last-modified: Mon, 23 Apr 2018 14:15:02 GMT
server: nginx
etag: "5addea66-1969"
x-frame-options: allow-from https://lynxgrc.com https://www.incidentresponse.com https://cyware.com https://consortiam.net https://securitycurrent.com
content-type: image/png
status: 200
cache-control: max-age=315360000 max-age=86400, no-cache, public
strict-transport-security: max-age=31536000; includeSubDomains; preload;
accept-ranges: bytes
content-length: 6505
x-xss-protection: 1; mode=block
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 login-google.png
cyware.com/assets/images/ 11 KB
11 KB 176ms
175ms Image
image/png 54.68.234.114
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cyware.com/assets/images/login-google.png

Requested by

Host: cyware.com
URL: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.68.234.114 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

ec2-54-68-234-114.us-west-2.compute.amazonaws.com

Software

nginx /

Resource Hash

8404ea0d5375cd8990d5ed08d692ba6eb56fbba33498c202cf652d4e321cc055

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	nosniff
X-Frame-Options	allow-from https://lynxgrc.com https://www.incidentresponse.com https://cyware.com https://consortiam.net https://securitycurrent.com
X-Xss-Protection	1; mode=block

Request headers

:path: /assets/images/login-google.png
pragma: no-cache
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: cyware.com
referer: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a
:scheme: https
:method: GET
Referer: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Fri, 12 Apr 2019 16:00:13 GMT
x-content-type-options: nosniff
last-modified: Mon, 23 Apr 2018 14:15:02 GMT
server: nginx
etag: "5addea66-2a2a"
x-frame-options: allow-from https://lynxgrc.com https://www.incidentresponse.com https://cyware.com https://consortiam.net https://securitycurrent.com
content-type: image/png
status: 200
cache-control: max-age=315360000 max-age=86400, no-cache, public
strict-transport-security: max-age=31536000; includeSubDomains; preload;
accept-ranges: bytes
content-length: 10794
x-xss-protection: 1; mode=block
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 cylogo-white.png
cyware.com/enterprise-cdn/images/ 1 KB
2 KB 465ms
421ms Image
image/png 54.68.234.114
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cyware.com/enterprise-cdn/images/cylogo-white.png

Requested by

Host: cyware.com
URL: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.68.234.114 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

ec2-54-68-234-114.us-west-2.compute.amazonaws.com

Software

nginx /

Resource Hash

6a2550a485a9327f07f42f27f3fdf29fe3d7e47fb337e4ca0df3f4b503547893

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	nosniff
X-Frame-Options	allow-from https://lynxgrc.com https://www.incidentresponse.com https://cyware.com https://consortiam.net https://securitycurrent.com
X-Xss-Protection	1; mode=block

Request headers

:path: /enterprise-cdn/images/cylogo-white.png
pragma: no-cache
cookie: XSRF-TOKEN=eyJpdiI6IitFaGZGZHV0VEI5blRiS2VTMjlVRGc9PSIsInZhbHVlIjoiUXAzd3pzdEtXbVN1SGJxWDlDNTc2cEcrWXNuZllEalVKNjh0T21Sc01IWnVJWktvb3VPaUlJZ1UxWGNqWjlxYlhOSmkzU1VJcU9DczE3TGpMRlp3NkE9PSIsIm1hYyI6IjI0NTM4MjJlNWYyNTdmNjc2ZDI3N2M2ODllYjIzOTA5YzU5Y2QxNzYyOTdmZTRlOGFjMTU3MWE3NmIxOWQxYzkifQ%3D%3D; laravel_session=eyJpdiI6ImtGYzlTR0JUU0FwaTJIcTdZUDZlTlE9PSIsInZhbHVlIjoiRndIVzdsZGJcL0daenVsUWtKeXlsZ2t3SjdLY0VNdHBpZytTVzVrSXNnd2Nrb0tva2grWlhURlFHb1VXYnVFWkhKcWpLXC83V1RQaGFWUlFGOTJhT0UrZz09IiwibWFjIjoiMzIyMjY3YTc4ZGZkMWQyNTk4N2M2ZGY3MjMwNTY2ZDQzOGY3ZWJmOGViM2EwYjY1OTExNjhiZTAxZWFmMjQ2MyJ9
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: cyware.com
referer: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a
:scheme: https
:method: GET
Referer: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Fri, 12 Apr 2019 16:00:11 GMT
x-content-type-options: nosniff
last-modified: Mon, 23 Apr 2018 14:15:02 GMT
server: nginx
etag: "5addea66-56f"
x-frame-options: allow-from https://lynxgrc.com https://www.incidentresponse.com https://cyware.com https://consortiam.net https://securitycurrent.com
content-type: image/png
status: 200
cache-control: max-age=315360000 max-age=86400, no-cache, public
strict-transport-security: max-age=31536000; includeSubDomains; preload;
accept-ranges: bytes
content-length: 1391
x-xss-protection: 1; mode=block
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 categories.svg
cyware.com/assets/images/ 2 KB
1 KB 175ms
175ms Image
image/svg+xml 54.68.234.114
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cyware.com/assets/images/categories.svg

Requested by

Host: cyware.com
URL: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.68.234.114 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

ec2-54-68-234-114.us-west-2.compute.amazonaws.com

Software

nginx /

Resource Hash

006f4b582b277a087453c2a96da3cd05a2f14f133ab835cfc09f36e779c0aa48

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	nosniff
X-Frame-Options	allow-from https://lynxgrc.com https://www.incidentresponse.com https://cyware.com https://consortiam.net https://securitycurrent.com
X-Xss-Protection	1; mode=block

Request headers

:path: /assets/images/categories.svg
pragma: no-cache
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: cyware.com
referer: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a
:scheme: https
:method: GET
Referer: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Fri, 12 Apr 2019 16:00:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 23 Apr 2018 14:15:02 GMT
server: nginx
etag: W/"5addea66-892"
x-frame-options: allow-from https://lynxgrc.com https://www.incidentresponse.com https://cyware.com https://consortiam.net https://securitycurrent.com
content-type: image/svg+xml
status: 200
cache-control: max-age=315360000 max-age=86400, no-cache, public
strict-transport-security: max-age=31536000; includeSubDomains; preload;
x-xss-protection: 1; mode=block
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 calendar.svg
cyware.com/assets/images/ 2 KB
2 KB 176ms
175ms Image
image/svg+xml 54.68.234.114
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cyware.com/assets/images/calendar.svg

Requested by

Host: cyware.com
URL: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.68.234.114 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

ec2-54-68-234-114.us-west-2.compute.amazonaws.com

Software

nginx /

Resource Hash

4a3952caa0dc47a55f58f2373590368376c7505826ecc6d141e3dd54deab118e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	nosniff
X-Frame-Options	allow-from https://lynxgrc.com https://www.incidentresponse.com https://cyware.com https://consortiam.net https://securitycurrent.com
X-Xss-Protection	1; mode=block

Request headers

:path: /assets/images/calendar.svg
pragma: no-cache
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: cyware.com
referer: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a
:scheme: https
:method: GET
Referer: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Fri, 12 Apr 2019 16:00:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 23 Apr 2018 14:15:02 GMT
server: nginx
etag: W/"5addea66-96f"
x-frame-options: allow-from https://lynxgrc.com https://www.incidentresponse.com https://cyware.com https://consortiam.net https://securitycurrent.com
content-type: image/svg+xml
status: 200
cache-control: max-age=315360000 max-age=86400, no-cache, public
strict-transport-security: max-age=31536000; includeSubDomains; preload;
x-xss-protection: 1; mode=block
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 source_list.svg
cyware.com/assets/images/ 868 B
873 B 198ms
198ms Image
image/svg+xml 54.68.234.114
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cyware.com/assets/images/source_list.svg

Requested by

Host: cyware.com
URL: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.68.234.114 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

ec2-54-68-234-114.us-west-2.compute.amazonaws.com

Software

nginx /

Resource Hash

92626e3aef4197dfd4ec2ffe0ed25bf50fecb5e7e088bf9b583d40c87a2c723c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	nosniff
X-Frame-Options	allow-from https://lynxgrc.com https://www.incidentresponse.com https://cyware.com https://consortiam.net https://securitycurrent.com
X-Xss-Protection	1; mode=block

Request headers

:path: /assets/images/source_list.svg
pragma: no-cache
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: cyware.com
referer: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a
:scheme: https
:method: GET
Referer: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Fri, 12 Apr 2019 16:00:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 23 Apr 2018 14:15:02 GMT
server: nginx
etag: W/"5addea66-364"
x-frame-options: allow-from https://lynxgrc.com https://www.incidentresponse.com https://cyware.com https://consortiam.net https://securitycurrent.com
content-type: image/svg+xml
status: 200
cache-control: max-age=315360000 max-age=86400, no-cache, public
strict-transport-security: max-age=31536000; includeSubDomains; preload;
x-xss-protection: 1; mode=block
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 ring.gif
cyware.com/assets/images/ 30 KB
30 KB 424ms
422ms Image
image/gif 54.68.234.114
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cyware.com/assets/images/ring.gif

Requested by

Host: cyware.com
URL: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.68.234.114 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

ec2-54-68-234-114.us-west-2.compute.amazonaws.com

Software

nginx /

Resource Hash

6e64c633fbebe6ad2558e6d164a7cc8828ae2217b8f5b1d01ed1bf4059702951

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	nosniff
X-Frame-Options	allow-from https://lynxgrc.com https://www.incidentresponse.com https://cyware.com https://consortiam.net https://securitycurrent.com
X-Xss-Protection	1; mode=block

Request headers

:path: /assets/images/ring.gif
pragma: no-cache
cookie: XSRF-TOKEN=eyJpdiI6IitFaGZGZHV0VEI5blRiS2VTMjlVRGc9PSIsInZhbHVlIjoiUXAzd3pzdEtXbVN1SGJxWDlDNTc2cEcrWXNuZllEalVKNjh0T21Sc01IWnVJWktvb3VPaUlJZ1UxWGNqWjlxYlhOSmkzU1VJcU9DczE3TGpMRlp3NkE9PSIsIm1hYyI6IjI0NTM4MjJlNWYyNTdmNjc2ZDI3N2M2ODllYjIzOTA5YzU5Y2QxNzYyOTdmZTRlOGFjMTU3MWE3NmIxOWQxYzkifQ%3D%3D; laravel_session=eyJpdiI6ImtGYzlTR0JUU0FwaTJIcTdZUDZlTlE9PSIsInZhbHVlIjoiRndIVzdsZGJcL0daenVsUWtKeXlsZ2t3SjdLY0VNdHBpZytTVzVrSXNnd2Nrb0tva2grWlhURlFHb1VXYnVFWkhKcWpLXC83V1RQaGFWUlFGOTJhT0UrZz09IiwibWFjIjoiMzIyMjY3YTc4ZGZkMWQyNTk4N2M2ZGY3MjMwNTY2ZDQzOGY3ZWJmOGViM2EwYjY1OTExNjhiZTAxZWFmMjQ2MyJ9
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: cyware.com
referer: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a
:scheme: https
:method: GET
Referer: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Fri, 12 Apr 2019 16:00:11 GMT
x-content-type-options: nosniff
last-modified: Mon, 23 Apr 2018 14:15:02 GMT
server: nginx
etag: "5addea66-763d"
x-frame-options: allow-from https://lynxgrc.com https://www.incidentresponse.com https://cyware.com https://consortiam.net https://securitycurrent.com
content-type: image/gif
status: 200
cache-control: max-age=315360000 max-age=86400, no-cache, public
strict-transport-security: max-age=31536000; includeSubDomains; preload;
accept-ranges: bytes
content-length: 30269
x-xss-protection: 1; mode=block
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 shutterstock_407112565.jpg
cyware.com/smart/unsafe/785x390/smart/filters:quality(80)/https://cystory-images.s3.amazonaws.com/ 51 KB
51 KB 473ms
473ms Image
image/jpeg 54.68.234.114
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cyware.com/smart/unsafe/785x390/smart/filters:quality(80)/https://cystory-images.s3.amazonaws.com/shutterstock_407112565.jpg

Requested by

Host: cyware.com
URL: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.68.234.114 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

ec2-54-68-234-114.us-west-2.compute.amazonaws.com

Software

nginx /

Resource Hash

96696e91e54716b8bc6e223cbea1dcea3cddd6b47dfc94d8d9f0b67a8b1456f9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	nosniff
X-Frame-Options	allow-from https://lynxgrc.com https://www.incidentresponse.com https://cyware.com https://consortiam.net https://securitycurrent.com
X-Xss-Protection	1; mode=block

Request headers

:path: /smart/unsafe/785x390/smart/filters:quality(80)/https://cystory-images.s3.amazonaws.com/shutterstock_407112565.jpg
pragma: no-cache
cookie: XSRF-TOKEN=eyJpdiI6IitFaGZGZHV0VEI5blRiS2VTMjlVRGc9PSIsInZhbHVlIjoiUXAzd3pzdEtXbVN1SGJxWDlDNTc2cEcrWXNuZllEalVKNjh0T21Sc01IWnVJWktvb3VPaUlJZ1UxWGNqWjlxYlhOSmkzU1VJcU9DczE3TGpMRlp3NkE9PSIsIm1hYyI6IjI0NTM4MjJlNWYyNTdmNjc2ZDI3N2M2ODllYjIzOTA5YzU5Y2QxNzYyOTdmZTRlOGFjMTU3MWE3NmIxOWQxYzkifQ%3D%3D; laravel_session=eyJpdiI6ImtGYzlTR0JUU0FwaTJIcTdZUDZlTlE9PSIsInZhbHVlIjoiRndIVzdsZGJcL0daenVsUWtKeXlsZ2t3SjdLY0VNdHBpZytTVzVrSXNnd2Nrb0tva2grWlhURlFHb1VXYnVFWkhKcWpLXC83V1RQaGFWUlFGOTJhT0UrZz09IiwibWFjIjoiMzIyMjY3YTc4ZGZkMWQyNTk4N2M2ZGY3MjMwNTY2ZDQzOGY3ZWJmOGViM2EwYjY1OTExNjhiZTAxZWFmMjQ2MyJ9
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: cyware.com
referer: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a
:scheme: https
:method: GET
Referer: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Fri, 12 Apr 2019 16:00:11 GMT
x-content-type-options: nosniff
server: nginx
etag: "cf6936b4c2752c4c37d8b3e9db32c9eeb0bb417d"
x-frame-options: allow-from https://lynxgrc.com https://www.incidentresponse.com https://cyware.com https://consortiam.net https://securitycurrent.com
content-type: image/jpeg
status: 200
cache-control: max-age=315360000 max-age=86400, no-cache, public
strict-transport-security: max-age=31536000; includeSubDomains; preload;
content-length: 52021
x-xss-protection: 1; mode=block
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 iStock_000051438424_Medium.jpg
cyware.com/smart/unsafe/60x60/smart/filters:quality(80)/https://cystory-images.s3.amazonaws.com/ 2 KB
2 KB 632ms
603ms Image
image/jpeg 54.68.234.114
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cyware.com/smart/unsafe/60x60/smart/filters:quality(80)/https://cystory-images.s3.amazonaws.com/iStock_000051438424_Medium.jpg

Requested by

Host: cyware.com
URL: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.68.234.114 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

ec2-54-68-234-114.us-west-2.compute.amazonaws.com

Software

nginx /

Resource Hash

57e6d7c1ef764bafd0badfd7a0c6fc423d770b35d562f46131a6c61f7b5083ea

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	nosniff
X-Frame-Options	allow-from https://lynxgrc.com https://www.incidentresponse.com https://cyware.com https://consortiam.net https://securitycurrent.com
X-Xss-Protection	1; mode=block

Request headers

:path: /smart/unsafe/60x60/smart/filters:quality(80)/https://cystory-images.s3.amazonaws.com/iStock_000051438424_Medium.jpg
pragma: no-cache
cookie: XSRF-TOKEN=eyJpdiI6IitFaGZGZHV0VEI5blRiS2VTMjlVRGc9PSIsInZhbHVlIjoiUXAzd3pzdEtXbVN1SGJxWDlDNTc2cEcrWXNuZllEalVKNjh0T21Sc01IWnVJWktvb3VPaUlJZ1UxWGNqWjlxYlhOSmkzU1VJcU9DczE3TGpMRlp3NkE9PSIsIm1hYyI6IjI0NTM4MjJlNWYyNTdmNjc2ZDI3N2M2ODllYjIzOTA5YzU5Y2QxNzYyOTdmZTRlOGFjMTU3MWE3NmIxOWQxYzkifQ%3D%3D; laravel_session=eyJpdiI6ImtGYzlTR0JUU0FwaTJIcTdZUDZlTlE9PSIsInZhbHVlIjoiRndIVzdsZGJcL0daenVsUWtKeXlsZ2t3SjdLY0VNdHBpZytTVzVrSXNnd2Nrb0tva2grWlhURlFHb1VXYnVFWkhKcWpLXC83V1RQaGFWUlFGOTJhT0UrZz09IiwibWFjIjoiMzIyMjY3YTc4ZGZkMWQyNTk4N2M2ZGY3MjMwNTY2ZDQzOGY3ZWJmOGViM2EwYjY1OTExNjhiZTAxZWFmMjQ2MyJ9
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: cyware.com
referer: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a
:scheme: https
:method: GET
Referer: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Fri, 12 Apr 2019 16:00:11 GMT
x-content-type-options: nosniff
server: nginx
etag: "18ec737c427c9999c9c3c8741f0606cc34e0b264"
x-frame-options: allow-from https://lynxgrc.com https://www.incidentresponse.com https://cyware.com https://consortiam.net https://securitycurrent.com
content-type: image/jpeg
status: 200
cache-control: max-age=315360000 max-age=86400, no-cache, public
strict-transport-security: max-age=31536000; includeSubDomains; preload;
content-length: 2099
x-xss-protection: 1; mode=block
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 shutterstock_127762841.jpg
cyware.com/smart/unsafe/60x60/smart/filters:quality(80)/https://cystory-images.s3.amazonaws.com/ 2 KB
2 KB 462ms
422ms Image
image/jpeg 54.68.234.114
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cyware.com/smart/unsafe/60x60/smart/filters:quality(80)/https://cystory-images.s3.amazonaws.com/shutterstock_127762841.jpg

Requested by

Host: cyware.com
URL: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.68.234.114 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

ec2-54-68-234-114.us-west-2.compute.amazonaws.com

Software

nginx /

Resource Hash

114e0fbd8281bc352242b55aca9e63593486e044405c8fdf233e4b0f0a97b230

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	nosniff
X-Frame-Options	allow-from https://lynxgrc.com https://www.incidentresponse.com https://cyware.com https://consortiam.net https://securitycurrent.com
X-Xss-Protection	1; mode=block

Request headers

:path: /smart/unsafe/60x60/smart/filters:quality(80)/https://cystory-images.s3.amazonaws.com/shutterstock_127762841.jpg
pragma: no-cache
cookie: XSRF-TOKEN=eyJpdiI6IitFaGZGZHV0VEI5blRiS2VTMjlVRGc9PSIsInZhbHVlIjoiUXAzd3pzdEtXbVN1SGJxWDlDNTc2cEcrWXNuZllEalVKNjh0T21Sc01IWnVJWktvb3VPaUlJZ1UxWGNqWjlxYlhOSmkzU1VJcU9DczE3TGpMRlp3NkE9PSIsIm1hYyI6IjI0NTM4MjJlNWYyNTdmNjc2ZDI3N2M2ODllYjIzOTA5YzU5Y2QxNzYyOTdmZTRlOGFjMTU3MWE3NmIxOWQxYzkifQ%3D%3D; laravel_session=eyJpdiI6ImtGYzlTR0JUU0FwaTJIcTdZUDZlTlE9PSIsInZhbHVlIjoiRndIVzdsZGJcL0daenVsUWtKeXlsZ2t3SjdLY0VNdHBpZytTVzVrSXNnd2Nrb0tva2grWlhURlFHb1VXYnVFWkhKcWpLXC83V1RQaGFWUlFGOTJhT0UrZz09IiwibWFjIjoiMzIyMjY3YTc4ZGZkMWQyNTk4N2M2ZGY3MjMwNTY2ZDQzOGY3ZWJmOGViM2EwYjY1OTExNjhiZTAxZWFmMjQ2MyJ9
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: cyware.com
referer: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a
:scheme: https
:method: GET
Referer: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Fri, 12 Apr 2019 16:00:11 GMT
x-content-type-options: nosniff
server: nginx
etag: "712cb375b0658a56c04340143820a97400bee7bc"
x-frame-options: allow-from https://lynxgrc.com https://www.incidentresponse.com https://cyware.com https://consortiam.net https://securitycurrent.com
content-type: image/jpeg
status: 200
cache-control: max-age=315360000 max-age=86400, no-cache, public
strict-transport-security: max-age=31536000; includeSubDomains; preload;
content-length: 1793
x-xss-protection: 1; mode=block
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 shutterstock_202780831.jpg
cyware.com/smart/unsafe/60x60/smart/filters:quality(80)/https://cystory-images.s3.amazonaws.com/ 2 KB
2 KB 632ms
602ms Image
image/jpeg 54.68.234.114
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cyware.com/smart/unsafe/60x60/smart/filters:quality(80)/https://cystory-images.s3.amazonaws.com/shutterstock_202780831.jpg

Requested by

Host: cyware.com
URL: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.68.234.114 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

ec2-54-68-234-114.us-west-2.compute.amazonaws.com

Software

nginx /

Resource Hash

ef73ce9ddc8cf4f4d45f6d02b3f6090150fcfe1c4555c1a99304bbd092de792e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	nosniff
X-Frame-Options	allow-from https://lynxgrc.com https://www.incidentresponse.com https://cyware.com https://consortiam.net https://securitycurrent.com
X-Xss-Protection	1; mode=block

Request headers

:path: /smart/unsafe/60x60/smart/filters:quality(80)/https://cystory-images.s3.amazonaws.com/shutterstock_202780831.jpg
pragma: no-cache
cookie: XSRF-TOKEN=eyJpdiI6IitFaGZGZHV0VEI5blRiS2VTMjlVRGc9PSIsInZhbHVlIjoiUXAzd3pzdEtXbVN1SGJxWDlDNTc2cEcrWXNuZllEalVKNjh0T21Sc01IWnVJWktvb3VPaUlJZ1UxWGNqWjlxYlhOSmkzU1VJcU9DczE3TGpMRlp3NkE9PSIsIm1hYyI6IjI0NTM4MjJlNWYyNTdmNjc2ZDI3N2M2ODllYjIzOTA5YzU5Y2QxNzYyOTdmZTRlOGFjMTU3MWE3NmIxOWQxYzkifQ%3D%3D; laravel_session=eyJpdiI6ImtGYzlTR0JUU0FwaTJIcTdZUDZlTlE9PSIsInZhbHVlIjoiRndIVzdsZGJcL0daenVsUWtKeXlsZ2t3SjdLY0VNdHBpZytTVzVrSXNnd2Nrb0tva2grWlhURlFHb1VXYnVFWkhKcWpLXC83V1RQaGFWUlFGOTJhT0UrZz09IiwibWFjIjoiMzIyMjY3YTc4ZGZkMWQyNTk4N2M2ZGY3MjMwNTY2ZDQzOGY3ZWJmOGViM2EwYjY1OTExNjhiZTAxZWFmMjQ2MyJ9
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: cyware.com
referer: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a
:scheme: https
:method: GET
Referer: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Fri, 12 Apr 2019 16:00:11 GMT
x-content-type-options: nosniff
server: nginx
etag: "8be4509bad81335ab96df69b00272638340a7366"
x-frame-options: allow-from https://lynxgrc.com https://www.incidentresponse.com https://cyware.com https://consortiam.net https://securitycurrent.com
content-type: image/jpeg
status: 200
cache-control: max-age=315360000 max-age=86400, no-cache, public
strict-transport-security: max-age=31536000; includeSubDomains; preload;
content-length: 1836
x-xss-protection: 1; mode=block
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 shutterstock_171257957.jpg
cyware.com/smart/unsafe/60x60/smart/filters:quality(80)/https://cystory-images.s3.amazonaws.com/ 2 KB
2 KB 346ms
345ms Image
image/jpeg 54.68.234.114
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cyware.com/smart/unsafe/60x60/smart/filters:quality(80)/https://cystory-images.s3.amazonaws.com/shutterstock_171257957.jpg

Requested by

Host: cyware.com
URL: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.68.234.114 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

ec2-54-68-234-114.us-west-2.compute.amazonaws.com

Software

nginx /

Resource Hash

311263079253a7154b22ea644158f710744d93fd4d1e6baf69fa8f2cfe9d48e4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	nosniff
X-Frame-Options	allow-from https://lynxgrc.com https://www.incidentresponse.com https://cyware.com https://consortiam.net https://securitycurrent.com
X-Xss-Protection	1; mode=block

Request headers

:path: /smart/unsafe/60x60/smart/filters:quality(80)/https://cystory-images.s3.amazonaws.com/shutterstock_171257957.jpg
pragma: no-cache
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: cyware.com
referer: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a
:scheme: https
:method: GET
Referer: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Fri, 12 Apr 2019 16:00:14 GMT
x-content-type-options: nosniff
server: nginx
etag: "ccf6f0f4fe4c8d38ce85735e8573914b912d4caa"
x-frame-options: allow-from https://lynxgrc.com https://www.incidentresponse.com https://cyware.com https://consortiam.net https://securitycurrent.com
content-type: image/jpeg
status: 200
cache-control: max-age=315360000 max-age=86400, no-cache, public
strict-transport-security: max-age=31536000; includeSubDomains; preload;
content-length: 1766
x-xss-protection: 1; mode=block
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 shutterstock_423598096.jpg
cyware.com/smart/unsafe/60x60/smart/filters:quality(80)/https://cystory-images.s3.amazonaws.com/ 2 KB
2 KB 347ms
346ms Image
image/jpeg 54.68.234.114
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cyware.com/smart/unsafe/60x60/smart/filters:quality(80)/https://cystory-images.s3.amazonaws.com/shutterstock_423598096.jpg

Requested by

Host: cyware.com
URL: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.68.234.114 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

ec2-54-68-234-114.us-west-2.compute.amazonaws.com

Software

nginx /

Resource Hash

50e6134276d81a8b3d0c47ffc68a3e78c15a53316f956932ee0b61f59c11472a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	nosniff
X-Frame-Options	allow-from https://lynxgrc.com https://www.incidentresponse.com https://cyware.com https://consortiam.net https://securitycurrent.com
X-Xss-Protection	1; mode=block

Request headers

:path: /smart/unsafe/60x60/smart/filters:quality(80)/https://cystory-images.s3.amazonaws.com/shutterstock_423598096.jpg
pragma: no-cache
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: cyware.com
referer: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a
:scheme: https
:method: GET
Referer: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Fri, 12 Apr 2019 16:00:14 GMT
x-content-type-options: nosniff
server: nginx
etag: "103ef7e690706da6bc680a435d6ff9c581e1b845"
x-frame-options: allow-from https://lynxgrc.com https://www.incidentresponse.com https://cyware.com https://consortiam.net https://securitycurrent.com
content-type: image/jpeg
status: 200
cache-control: max-age=315360000 max-age=86400, no-cache, public
strict-transport-security: max-age=31536000; includeSubDomains; preload;
content-length: 1935
x-xss-protection: 1; mode=block
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 shutterstock_302129432.jpg
cyware.com/smart/unsafe/60x60/smart/filters:quality(80)/https://cystory-images.s3.amazonaws.com/ 2 KB
2 KB 336ms
335ms Image
image/jpeg 54.68.234.114
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cyware.com/smart/unsafe/60x60/smart/filters:quality(80)/https://cystory-images.s3.amazonaws.com/shutterstock_302129432.jpg

Requested by

Host: cyware.com
URL: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.68.234.114 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

ec2-54-68-234-114.us-west-2.compute.amazonaws.com

Software

nginx /

Resource Hash

450a8086ad892febf2348c34e08e0934dca9f6cf173dc5bc55452bd55a67cfcc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	nosniff
X-Frame-Options	allow-from https://lynxgrc.com https://www.incidentresponse.com https://cyware.com https://consortiam.net https://securitycurrent.com
X-Xss-Protection	1; mode=block

Request headers

:path: /smart/unsafe/60x60/smart/filters:quality(80)/https://cystory-images.s3.amazonaws.com/shutterstock_302129432.jpg
pragma: no-cache
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: cyware.com
referer: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a
:scheme: https
:method: GET
Referer: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Fri, 12 Apr 2019 16:00:14 GMT
x-content-type-options: nosniff
server: nginx
etag: "ad93b761bfb0eb6a8e092a04ad8b1e3b3af710ad"
x-frame-options: allow-from https://lynxgrc.com https://www.incidentresponse.com https://cyware.com https://consortiam.net https://securitycurrent.com
content-type: image/jpeg
status: 200
cache-control: max-age=315360000 max-age=86400, no-cache, public
strict-transport-security: max-age=31536000; includeSubDomains; preload;
content-length: 1615
x-xss-protection: 1; mode=block
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 iStock_000083026757_Medium.jpg
cyware.com/smart/unsafe/60x60/smart/filters:quality(80)/https://cystory-images.s3.amazonaws.com/ 2 KB
3 KB 313ms
312ms Image
image/jpeg 54.68.234.114
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cyware.com/smart/unsafe/60x60/smart/filters:quality(80)/https://cystory-images.s3.amazonaws.com/iStock_000083026757_Medium.jpg

Requested by

Host: cyware.com
URL: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.68.234.114 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

ec2-54-68-234-114.us-west-2.compute.amazonaws.com

Software

nginx /

Resource Hash

561498872b20fd40967c2a3794793c85dcafbd9fc5d14b49d34acf959f58c691

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	nosniff
X-Frame-Options	allow-from https://lynxgrc.com https://www.incidentresponse.com https://cyware.com https://consortiam.net https://securitycurrent.com
X-Xss-Protection	1; mode=block

Request headers

:path: /smart/unsafe/60x60/smart/filters:quality(80)/https://cystory-images.s3.amazonaws.com/iStock_000083026757_Medium.jpg
pragma: no-cache
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: cyware.com
referer: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a
:scheme: https
:method: GET
Referer: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Fri, 12 Apr 2019 16:00:14 GMT
x-content-type-options: nosniff
server: nginx
etag: "aaf6aff4ba9c1cc248b590dbe6ec05d41589af98"
x-frame-options: allow-from https://lynxgrc.com https://www.incidentresponse.com https://cyware.com https://consortiam.net https://securitycurrent.com
content-type: image/jpeg
status: 200
cache-control: max-age=315360000 max-age=86400, no-cache, public
strict-transport-security: max-age=31536000; includeSubDomains; preload;
content-length: 2475
x-xss-protection: 1; mode=block
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 shutterstock_518779846.jpg
cyware.com/smart/unsafe/60x60/smart/filters:quality(80)/https://cystory-images.s3.amazonaws.com/ 2 KB
2 KB 644ms
602ms Image
image/jpeg 54.68.234.114
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cyware.com/smart/unsafe/60x60/smart/filters:quality(80)/https://cystory-images.s3.amazonaws.com/shutterstock_518779846.jpg

Requested by

Host: cyware.com
URL: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.68.234.114 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

ec2-54-68-234-114.us-west-2.compute.amazonaws.com

Software

nginx /

Resource Hash

59a61c6fd32ad89e4d7e02e5cd8e0d280913c16eaedc30ac0520203af3e1a53a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	nosniff
X-Frame-Options	allow-from https://lynxgrc.com https://www.incidentresponse.com https://cyware.com https://consortiam.net https://securitycurrent.com
X-Xss-Protection	1; mode=block

Request headers

:path: /smart/unsafe/60x60/smart/filters:quality(80)/https://cystory-images.s3.amazonaws.com/shutterstock_518779846.jpg
pragma: no-cache
cookie: XSRF-TOKEN=eyJpdiI6IitFaGZGZHV0VEI5blRiS2VTMjlVRGc9PSIsInZhbHVlIjoiUXAzd3pzdEtXbVN1SGJxWDlDNTc2cEcrWXNuZllEalVKNjh0T21Sc01IWnVJWktvb3VPaUlJZ1UxWGNqWjlxYlhOSmkzU1VJcU9DczE3TGpMRlp3NkE9PSIsIm1hYyI6IjI0NTM4MjJlNWYyNTdmNjc2ZDI3N2M2ODllYjIzOTA5YzU5Y2QxNzYyOTdmZTRlOGFjMTU3MWE3NmIxOWQxYzkifQ%3D%3D; laravel_session=eyJpdiI6ImtGYzlTR0JUU0FwaTJIcTdZUDZlTlE9PSIsInZhbHVlIjoiRndIVzdsZGJcL0daenVsUWtKeXlsZ2t3SjdLY0VNdHBpZytTVzVrSXNnd2Nrb0tva2grWlhURlFHb1VXYnVFWkhKcWpLXC83V1RQaGFWUlFGOTJhT0UrZz09IiwibWFjIjoiMzIyMjY3YTc4ZGZkMWQyNTk4N2M2ZGY3MjMwNTY2ZDQzOGY3ZWJmOGViM2EwYjY1OTExNjhiZTAxZWFmMjQ2MyJ9
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: cyware.com
referer: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a
:scheme: https
:method: GET
Referer: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Fri, 12 Apr 2019 16:00:11 GMT
x-content-type-options: nosniff
server: nginx
etag: "bde4c3a88eb569d39d62d2f4b29229af7efdd4f7"
x-frame-options: allow-from https://lynxgrc.com https://www.incidentresponse.com https://cyware.com https://consortiam.net https://securitycurrent.com
content-type: image/jpeg
status: 200
cache-control: max-age=315360000 max-age=86400, no-cache, public
strict-transport-security: max-age=31536000; includeSubDomains; preload;
content-length: 2033
x-xss-protection: 1; mode=block
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 iStock_000073075477_Medium.jpg
cyware.com/smart/unsafe/60x60/smart/filters:quality(80)/https://cyware-ent.s3.amazonaws.com/image_bank/ 2 KB
3 KB 632ms
603ms Image
image/jpeg 54.68.234.114
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cyware.com/smart/unsafe/60x60/smart/filters:quality(80)/https://cyware-ent.s3.amazonaws.com/image_bank/iStock_000073075477_Medium.jpg

Requested by

Host: cyware.com
URL: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.68.234.114 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

ec2-54-68-234-114.us-west-2.compute.amazonaws.com

Software

nginx /

Resource Hash

68e5a00cd12a6092781cbd923ee619314a35d51cbbd07c444afa12be06429e99

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	nosniff
X-Frame-Options	allow-from https://lynxgrc.com https://www.incidentresponse.com https://cyware.com https://consortiam.net https://securitycurrent.com
X-Xss-Protection	1; mode=block

Request headers

:path: /smart/unsafe/60x60/smart/filters:quality(80)/https://cyware-ent.s3.amazonaws.com/image_bank/iStock_000073075477_Medium.jpg
pragma: no-cache
cookie: XSRF-TOKEN=eyJpdiI6IitFaGZGZHV0VEI5blRiS2VTMjlVRGc9PSIsInZhbHVlIjoiUXAzd3pzdEtXbVN1SGJxWDlDNTc2cEcrWXNuZllEalVKNjh0T21Sc01IWnVJWktvb3VPaUlJZ1UxWGNqWjlxYlhOSmkzU1VJcU9DczE3TGpMRlp3NkE9PSIsIm1hYyI6IjI0NTM4MjJlNWYyNTdmNjc2ZDI3N2M2ODllYjIzOTA5YzU5Y2QxNzYyOTdmZTRlOGFjMTU3MWE3NmIxOWQxYzkifQ%3D%3D; laravel_session=eyJpdiI6ImtGYzlTR0JUU0FwaTJIcTdZUDZlTlE9PSIsInZhbHVlIjoiRndIVzdsZGJcL0daenVsUWtKeXlsZ2t3SjdLY0VNdHBpZytTVzVrSXNnd2Nrb0tva2grWlhURlFHb1VXYnVFWkhKcWpLXC83V1RQaGFWUlFGOTJhT0UrZz09IiwibWFjIjoiMzIyMjY3YTc4ZGZkMWQyNTk4N2M2ZGY3MjMwNTY2ZDQzOGY3ZWJmOGViM2EwYjY1OTExNjhiZTAxZWFmMjQ2MyJ9
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: cyware.com
referer: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a
:scheme: https
:method: GET
Referer: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Fri, 12 Apr 2019 16:00:11 GMT
x-content-type-options: nosniff
server: nginx
etag: "278649c7b13db6b52858157c5e6408831e196b0a"
x-frame-options: allow-from https://lynxgrc.com https://www.incidentresponse.com https://cyware.com https://consortiam.net https://securitycurrent.com
content-type: image/jpeg
status: 200
cache-control: max-age=315360000 max-age=86400, no-cache, public
strict-transport-security: max-age=31536000; includeSubDomains; preload;
content-length: 2523
x-xss-protection: 1; mode=block
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 previous.svg
cyware.com/assets/images/ 2 KB
1 KB 183ms
181ms Image
image/svg+xml 54.68.234.114
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cyware.com/assets/images/previous.svg

Requested by

Host: cyware.com
URL: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.68.234.114 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

ec2-54-68-234-114.us-west-2.compute.amazonaws.com

Software

nginx /

Resource Hash

10f80d65795b91f649771c8fe006534ebecdc752b6455a80b0ae4f442c9e683b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	nosniff
X-Frame-Options	allow-from https://lynxgrc.com https://www.incidentresponse.com https://cyware.com https://consortiam.net https://securitycurrent.com
X-Xss-Protection	1; mode=block

Request headers

:path: /assets/images/previous.svg
pragma: no-cache
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: cyware.com
referer: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a
:scheme: https
:method: GET
Referer: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Fri, 12 Apr 2019 16:00:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 23 Apr 2018 14:15:02 GMT
server: nginx
etag: W/"5addea66-7a6"
x-frame-options: allow-from https://lynxgrc.com https://www.incidentresponse.com https://cyware.com https://consortiam.net https://securitycurrent.com
content-type: image/svg+xml
status: 200
cache-control: max-age=315360000 max-age=86400, no-cache, public
strict-transport-security: max-age=31536000; includeSubDomains; preload;
x-xss-protection: 1; mode=block
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 next.svg
cyware.com/assets/images/ 2 KB
1 KB 184ms
182ms Image
image/svg+xml 54.68.234.114
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cyware.com/assets/images/next.svg

Requested by

Host: cyware.com
URL: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.68.234.114 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

ec2-54-68-234-114.us-west-2.compute.amazonaws.com

Software

nginx /

Resource Hash

98c2b230213c15bd50f1358e4737eaa86a9e931b96701d819480c403b9890681

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	nosniff
X-Frame-Options	allow-from https://lynxgrc.com https://www.incidentresponse.com https://cyware.com https://consortiam.net https://securitycurrent.com
X-Xss-Protection	1; mode=block

Request headers

:path: /assets/images/next.svg
pragma: no-cache
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: cyware.com
referer: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a
:scheme: https
:method: GET
Referer: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Fri, 12 Apr 2019 16:00:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 23 Apr 2018 14:15:02 GMT
server: nginx
etag: W/"5addea66-7a1"
x-frame-options: allow-from https://lynxgrc.com https://www.incidentresponse.com https://cyware.com https://consortiam.net https://securitycurrent.com
content-type: image/svg+xml
status: 200
cache-control: max-age=315360000 max-age=86400, no-cache, public
strict-transport-security: max-age=31536000; includeSubDomains; preload;
x-xss-protection: 1; mode=block
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 downlogo.svg
cyware.com/assets/images/ 8 KB
4 KB 184ms
183ms Image
image/svg+xml 54.68.234.114
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cyware.com/assets/images/downlogo.svg

Requested by

Host: cyware.com
URL: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.68.234.114 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

ec2-54-68-234-114.us-west-2.compute.amazonaws.com

Software

nginx /

Resource Hash

67c059eb07eb778c21c8406a563d276e02c5399bd1b55c4598f65db0bc3a2942

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	nosniff
X-Frame-Options	allow-from https://lynxgrc.com https://www.incidentresponse.com https://cyware.com https://consortiam.net https://securitycurrent.com
X-Xss-Protection	1; mode=block

Request headers

:path: /assets/images/downlogo.svg
pragma: no-cache
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: cyware.com
referer: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a
:scheme: https
:method: GET
Referer: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Fri, 12 Apr 2019 16:00:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 23 Apr 2018 14:15:02 GMT
server: nginx
etag: W/"5addea66-20ea"
x-frame-options: allow-from https://lynxgrc.com https://www.incidentresponse.com https://cyware.com https://consortiam.net https://securitycurrent.com
content-type: image/svg+xml
status: 200
cache-control: max-age=315360000 max-age=86400, no-cache, public
strict-transport-security: max-age=31536000; includeSubDomains; preload;
x-xss-protection: 1; mode=block
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 footer-image.jpg
cyware.com/assets/images/ 11 KB
11 KB 179ms
178ms Image
image/jpeg 54.68.234.114
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cyware.com/assets/images/footer-image.jpg

Requested by

Host: cyware.com
URL: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.68.234.114 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

ec2-54-68-234-114.us-west-2.compute.amazonaws.com

Software

nginx /

Resource Hash

8d53f618b46864ea125aad59935c1f25cf4c623c99ef990cf76b37a512c818e3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	nosniff
X-Frame-Options	allow-from https://lynxgrc.com https://www.incidentresponse.com https://cyware.com https://consortiam.net https://securitycurrent.com
X-Xss-Protection	1; mode=block

Request headers

:path: /assets/images/footer-image.jpg
pragma: no-cache
cookie: XSRF-TOKEN=eyJpdiI6Ild3T01YWWswQm8yUlZtMUZOOHRyWXc9PSIsInZhbHVlIjoidXNVZ0Z4bzFrVnlVaXA2N2RoSm10OUp5V0tOSGR5aElOSGdxVTZTK1VOZXRcL1VuRUdCXC9yOXlNenl2XC9iaWlyWmVwcjdSYlpDMU85UitJRFwvemdUS1h3PT0iLCJtYWMiOiJkMTdlOGU3NzI2MGMyNTgwYjE5NGMwOWY2ZWVlZTg0Y2NkN2U0NTc1MzM0MjI3NTdiZTA3YWZkZjg5ZTg1ODIyIn0%3D; laravel_session=eyJpdiI6ImVxc3FKWGJ1RFgxbGRmd3c1OFJqRlE9PSIsInZhbHVlIjoiNjVkNWNudDR4OWFhMzF1Snl4K21TZU9CU1hDWVQwTFdHVDJnNHdMc1Q0SUZIbFp5Y3IyY2V0cCtnclkwaXg0TzdCU1E4bE5UNkFTemE5Y1pxTmtOZ3c9PSIsIm1hYyI6IjljY2NlYmIxZmJlNzcyZjI2YzEyOGQ1OGExYWE1MjUxNTQxMzIxM2JiMDg0MjIxOWU4NWIzYzY2ZmUxMTU2MmMifQ%3D%3D
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: cyware.com
referer: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a
:scheme: https
:method: GET
Referer: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Fri, 12 Apr 2019 16:00:14 GMT
x-content-type-options: nosniff
last-modified: Mon, 23 Apr 2018 14:15:02 GMT
server: nginx
etag: "5addea66-2b5b"
x-frame-options: allow-from https://lynxgrc.com https://www.incidentresponse.com https://cyware.com https://consortiam.net https://securitycurrent.com
content-type: image/jpeg
status: 200
cache-control: max-age=315360000 max-age=86400, no-cache, public
strict-transport-security: max-age=31536000; includeSubDomains; preload;
accept-ranges: bytes
content-length: 11099
x-xss-protection: 1; mode=block
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 twitter.svg
cyware.com/enterprise-cdn/images/icons/social/ 5 KB
3 KB 178ms
178ms Image
image/svg+xml 54.68.234.114
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cyware.com/enterprise-cdn/images/icons/social/twitter.svg

Requested by

Host: cyware.com
URL: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.68.234.114 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

ec2-54-68-234-114.us-west-2.compute.amazonaws.com

Software

nginx /

Resource Hash

d3760888ff21751d5deb28a4effe491a2f38bc7aa38ce5e6cbebd4cc1f07db3a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	nosniff
X-Frame-Options	allow-from https://lynxgrc.com https://www.incidentresponse.com https://cyware.com https://consortiam.net https://securitycurrent.com
X-Xss-Protection	1; mode=block

Request headers

:path: /enterprise-cdn/images/icons/social/twitter.svg
pragma: no-cache
cookie: XSRF-TOKEN=eyJpdiI6Ild3T01YWWswQm8yUlZtMUZOOHRyWXc9PSIsInZhbHVlIjoidXNVZ0Z4bzFrVnlVaXA2N2RoSm10OUp5V0tOSGR5aElOSGdxVTZTK1VOZXRcL1VuRUdCXC9yOXlNenl2XC9iaWlyWmVwcjdSYlpDMU85UitJRFwvemdUS1h3PT0iLCJtYWMiOiJkMTdlOGU3NzI2MGMyNTgwYjE5NGMwOWY2ZWVlZTg0Y2NkN2U0NTc1MzM0MjI3NTdiZTA3YWZkZjg5ZTg1ODIyIn0%3D; laravel_session=eyJpdiI6ImVxc3FKWGJ1RFgxbGRmd3c1OFJqRlE9PSIsInZhbHVlIjoiNjVkNWNudDR4OWFhMzF1Snl4K21TZU9CU1hDWVQwTFdHVDJnNHdMc1Q0SUZIbFp5Y3IyY2V0cCtnclkwaXg0TzdCU1E4bE5UNkFTemE5Y1pxTmtOZ3c9PSIsIm1hYyI6IjljY2NlYmIxZmJlNzcyZjI2YzEyOGQ1OGExYWE1MjUxNTQxMzIxM2JiMDg0MjIxOWU4NWIzYzY2ZmUxMTU2MmMifQ%3D%3D
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: cyware.com
referer: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a
:scheme: https
:method: GET
Referer: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Fri, 12 Apr 2019 16:00:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 23 Apr 2018 14:15:02 GMT
server: nginx
etag: W/"5addea66-12c4"
x-frame-options: allow-from https://lynxgrc.com https://www.incidentresponse.com https://cyware.com https://consortiam.net https://securitycurrent.com
content-type: image/svg+xml
status: 200
cache-control: max-age=315360000 max-age=86400, no-cache, public
strict-transport-security: max-age=31536000; includeSubDomains; preload;
x-xss-protection: 1; mode=block
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 facebook.svg
cyware.com/enterprise-cdn/images/icons/social/ 2 KB
1 KB 183ms
179ms Image
image/svg+xml 54.68.234.114
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cyware.com/enterprise-cdn/images/icons/social/facebook.svg

Requested by

Host: cyware.com
URL: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.68.234.114 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

ec2-54-68-234-114.us-west-2.compute.amazonaws.com

Software

nginx /

Resource Hash

b86c6b041b5557452e973e5f07cbf542c02da2cbcaeb33315130d70abcd666d2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	nosniff
X-Frame-Options	allow-from https://lynxgrc.com https://www.incidentresponse.com https://cyware.com https://consortiam.net https://securitycurrent.com
X-Xss-Protection	1; mode=block

Request headers

:path: /enterprise-cdn/images/icons/social/facebook.svg
pragma: no-cache
cookie: XSRF-TOKEN=eyJpdiI6Ild3T01YWWswQm8yUlZtMUZOOHRyWXc9PSIsInZhbHVlIjoidXNVZ0Z4bzFrVnlVaXA2N2RoSm10OUp5V0tOSGR5aElOSGdxVTZTK1VOZXRcL1VuRUdCXC9yOXlNenl2XC9iaWlyWmVwcjdSYlpDMU85UitJRFwvemdUS1h3PT0iLCJtYWMiOiJkMTdlOGU3NzI2MGMyNTgwYjE5NGMwOWY2ZWVlZTg0Y2NkN2U0NTc1MzM0MjI3NTdiZTA3YWZkZjg5ZTg1ODIyIn0%3D; laravel_session=eyJpdiI6ImVxc3FKWGJ1RFgxbGRmd3c1OFJqRlE9PSIsInZhbHVlIjoiNjVkNWNudDR4OWFhMzF1Snl4K21TZU9CU1hDWVQwTFdHVDJnNHdMc1Q0SUZIbFp5Y3IyY2V0cCtnclkwaXg0TzdCU1E4bE5UNkFTemE5Y1pxTmtOZ3c9PSIsIm1hYyI6IjljY2NlYmIxZmJlNzcyZjI2YzEyOGQ1OGExYWE1MjUxNTQxMzIxM2JiMDg0MjIxOWU4NWIzYzY2ZmUxMTU2MmMifQ%3D%3D
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: cyware.com
referer: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a
:scheme: https
:method: GET
Referer: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Fri, 12 Apr 2019 16:00:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 23 Apr 2018 14:15:02 GMT
server: nginx
etag: W/"5addea66-742"
x-frame-options: allow-from https://lynxgrc.com https://www.incidentresponse.com https://cyware.com https://consortiam.net https://securitycurrent.com
content-type: image/svg+xml
status: 200
cache-control: max-age=315360000 max-age=86400, no-cache, public
strict-transport-security: max-age=31536000; includeSubDomains; preload;
x-xss-protection: 1; mode=block
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 linkedin.svg
cyware.com/enterprise-cdn/images/icons/social/ 3 KB
1 KB 182ms
179ms Image
image/svg+xml 54.68.234.114
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cyware.com/enterprise-cdn/images/icons/social/linkedin.svg

Requested by

Host: cyware.com
URL: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.68.234.114 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

ec2-54-68-234-114.us-west-2.compute.amazonaws.com

Software

nginx /

Resource Hash

3d1d97701f3bb301c71e6a47cfdccdd580cd9c8ea9fb02e3c822307c83eda0cf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	nosniff
X-Frame-Options	allow-from https://lynxgrc.com https://www.incidentresponse.com https://cyware.com https://consortiam.net https://securitycurrent.com
X-Xss-Protection	1; mode=block

Request headers

:path: /enterprise-cdn/images/icons/social/linkedin.svg
pragma: no-cache
cookie: XSRF-TOKEN=eyJpdiI6Ild3T01YWWswQm8yUlZtMUZOOHRyWXc9PSIsInZhbHVlIjoidXNVZ0Z4bzFrVnlVaXA2N2RoSm10OUp5V0tOSGR5aElOSGdxVTZTK1VOZXRcL1VuRUdCXC9yOXlNenl2XC9iaWlyWmVwcjdSYlpDMU85UitJRFwvemdUS1h3PT0iLCJtYWMiOiJkMTdlOGU3NzI2MGMyNTgwYjE5NGMwOWY2ZWVlZTg0Y2NkN2U0NTc1MzM0MjI3NTdiZTA3YWZkZjg5ZTg1ODIyIn0%3D; laravel_session=eyJpdiI6ImVxc3FKWGJ1RFgxbGRmd3c1OFJqRlE9PSIsInZhbHVlIjoiNjVkNWNudDR4OWFhMzF1Snl4K21TZU9CU1hDWVQwTFdHVDJnNHdMc1Q0SUZIbFp5Y3IyY2V0cCtnclkwaXg0TzdCU1E4bE5UNkFTemE5Y1pxTmtOZ3c9PSIsIm1hYyI6IjljY2NlYmIxZmJlNzcyZjI2YzEyOGQ1OGExYWE1MjUxNTQxMzIxM2JiMDg0MjIxOWU4NWIzYzY2ZmUxMTU2MmMifQ%3D%3D
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: cyware.com
referer: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a
:scheme: https
:method: GET
Referer: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Fri, 12 Apr 2019 16:00:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 23 Apr 2018 14:15:02 GMT
server: nginx
etag: W/"5addea66-a3e"
x-frame-options: allow-from https://lynxgrc.com https://www.incidentresponse.com https://cyware.com https://consortiam.net https://securitycurrent.com
content-type: image/svg+xml
status: 200
cache-control: max-age=315360000 max-age=86400, no-cache, public
strict-transport-security: max-age=31536000; includeSubDomains; preload;
x-xss-protection: 1; mode=block
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 app-95bc624a6c.js Show response
cyware.com/build/assets/js/ 391 KB
139 KB 553ms
537ms Script
application/javascript 54.68.234.114
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL

https://cyware.com/build/assets/js/app-95bc624a6c.js

Requested by

Host: cyware.com
URL: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.68.234.114 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

ec2-54-68-234-114.us-west-2.compute.amazonaws.com

Software

nginx /

Resource Hash

1174de7545f8068905a8bc9ab7205cb8f5fcdad681a1ca5802ea3298fe90c1dd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	nosniff
X-Frame-Options	allow-from https://lynxgrc.com https://www.incidentresponse.com https://cyware.com https://consortiam.net https://securitycurrent.com
X-Xss-Protection	1; mode=block

Request headers

:path: /build/assets/js/app-95bc624a6c.js
pragma: no-cache
cookie: XSRF-TOKEN=eyJpdiI6IitFaGZGZHV0VEI5blRiS2VTMjlVRGc9PSIsInZhbHVlIjoiUXAzd3pzdEtXbVN1SGJxWDlDNTc2cEcrWXNuZllEalVKNjh0T21Sc01IWnVJWktvb3VPaUlJZ1UxWGNqWjlxYlhOSmkzU1VJcU9DczE3TGpMRlp3NkE9PSIsIm1hYyI6IjI0NTM4MjJlNWYyNTdmNjc2ZDI3N2M2ODllYjIzOTA5YzU5Y2QxNzYyOTdmZTRlOGFjMTU3MWE3NmIxOWQxYzkifQ%3D%3D; laravel_session=eyJpdiI6ImtGYzlTR0JUU0FwaTJIcTdZUDZlTlE9PSIsInZhbHVlIjoiRndIVzdsZGJcL0daenVsUWtKeXlsZ2t3SjdLY0VNdHBpZytTVzVrSXNnd2Nrb0tva2grWlhURlFHb1VXYnVFWkhKcWpLXC83V1RQaGFWUlFGOTJhT0UrZz09IiwibWFjIjoiMzIyMjY3YTc4ZGZkMWQyNTk4N2M2ZGY3MjMwNTY2ZDQzOGY3ZWJmOGViM2EwYjY1OTExNjhiZTAxZWFmMjQ2MyJ9
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: */*
cache-control: no-cache
:authority: cyware.com
referer: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a
:scheme: https
:method: GET
Referer: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Fri, 12 Apr 2019 16:00:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 23 Apr 2018 14:15:02 GMT
server: nginx
etag: W/"5addea66-61a09"
x-frame-options: allow-from https://lynxgrc.com https://www.incidentresponse.com https://cyware.com https://consortiam.net https://securitycurrent.com
content-type: application/javascript
status: 200
cache-control: max-age=315360000 max-age=86400, no-cache, public
strict-transport-security: max-age=31536000; includeSubDomains; preload;
x-xss-protection: 1; mode=block
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 jquery.easing.1.3.min.js Show response
cyware.com/assets/js/ 7 KB
2 KB 383ms
350ms Script
application/javascript 54.68.234.114
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL

https://cyware.com/assets/js/jquery.easing.1.3.min.js

Requested by

Host: cyware.com
URL: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.68.234.114 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

ec2-54-68-234-114.us-west-2.compute.amazonaws.com

Software

nginx /

Resource Hash

bd6e56e7f8ef4922203fda7bea65ff2d112ac295a7c784ba5644c46546449643

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	nosniff
X-Frame-Options	allow-from https://lynxgrc.com https://www.incidentresponse.com https://cyware.com https://consortiam.net https://securitycurrent.com
X-Xss-Protection	1; mode=block

Request headers

:path: /assets/js/jquery.easing.1.3.min.js
pragma: no-cache
cookie: XSRF-TOKEN=eyJpdiI6IitFaGZGZHV0VEI5blRiS2VTMjlVRGc9PSIsInZhbHVlIjoiUXAzd3pzdEtXbVN1SGJxWDlDNTc2cEcrWXNuZllEalVKNjh0T21Sc01IWnVJWktvb3VPaUlJZ1UxWGNqWjlxYlhOSmkzU1VJcU9DczE3TGpMRlp3NkE9PSIsIm1hYyI6IjI0NTM4MjJlNWYyNTdmNjc2ZDI3N2M2ODllYjIzOTA5YzU5Y2QxNzYyOTdmZTRlOGFjMTU3MWE3NmIxOWQxYzkifQ%3D%3D; laravel_session=eyJpdiI6ImtGYzlTR0JUU0FwaTJIcTdZUDZlTlE9PSIsInZhbHVlIjoiRndIVzdsZGJcL0daenVsUWtKeXlsZ2t3SjdLY0VNdHBpZytTVzVrSXNnd2Nrb0tva2grWlhURlFHb1VXYnVFWkhKcWpLXC83V1RQaGFWUlFGOTJhT0UrZz09IiwibWFjIjoiMzIyMjY3YTc4ZGZkMWQyNTk4N2M2ZGY3MjMwNTY2ZDQzOGY3ZWJmOGViM2EwYjY1OTExNjhiZTAxZWFmMjQ2MyJ9
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: */*
cache-control: no-cache
:authority: cyware.com
referer: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a
:scheme: https
:method: GET
Referer: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Fri, 12 Apr 2019 16:00:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 23 Apr 2018 14:15:02 GMT
server: nginx
etag: W/"5addea66-1b37"
x-frame-options: allow-from https://lynxgrc.com https://www.incidentresponse.com https://cyware.com https://consortiam.net https://securitycurrent.com
content-type: application/javascript
status: 200
cache-control: max-age=315360000 max-age=86400, no-cache, public
strict-transport-security: max-age=31536000; includeSubDomains; preload;
x-xss-protection: 1; mode=block
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 read-more.min.js Show response
cyware.com/assets/js/ 905 B
883 B 383ms
350ms Script
application/javascript 54.68.234.114
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL

https://cyware.com/assets/js/read-more.min.js

Requested by

Host: cyware.com
URL: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.68.234.114 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

ec2-54-68-234-114.us-west-2.compute.amazonaws.com

Software

nginx /

Resource Hash

7703d23b349ce43667f86c195a45f7217cd7ac754bb4e518b4d70b8765e4731e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	nosniff
X-Frame-Options	allow-from https://lynxgrc.com https://www.incidentresponse.com https://cyware.com https://consortiam.net https://securitycurrent.com
X-Xss-Protection	1; mode=block

Request headers

:path: /assets/js/read-more.min.js
pragma: no-cache
cookie: XSRF-TOKEN=eyJpdiI6IitFaGZGZHV0VEI5blRiS2VTMjlVRGc9PSIsInZhbHVlIjoiUXAzd3pzdEtXbVN1SGJxWDlDNTc2cEcrWXNuZllEalVKNjh0T21Sc01IWnVJWktvb3VPaUlJZ1UxWGNqWjlxYlhOSmkzU1VJcU9DczE3TGpMRlp3NkE9PSIsIm1hYyI6IjI0NTM4MjJlNWYyNTdmNjc2ZDI3N2M2ODllYjIzOTA5YzU5Y2QxNzYyOTdmZTRlOGFjMTU3MWE3NmIxOWQxYzkifQ%3D%3D; laravel_session=eyJpdiI6ImtGYzlTR0JUU0FwaTJIcTdZUDZlTlE9PSIsInZhbHVlIjoiRndIVzdsZGJcL0daenVsUWtKeXlsZ2t3SjdLY0VNdHBpZytTVzVrSXNnd2Nrb0tva2grWlhURlFHb1VXYnVFWkhKcWpLXC83V1RQaGFWUlFGOTJhT0UrZz09IiwibWFjIjoiMzIyMjY3YTc4ZGZkMWQyNTk4N2M2ZGY3MjMwNTY2ZDQzOGY3ZWJmOGViM2EwYjY1OTExNjhiZTAxZWFmMjQ2MyJ9
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: */*
cache-control: no-cache
:authority: cyware.com
referer: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a
:scheme: https
:method: GET
Referer: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Fri, 12 Apr 2019 16:00:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 23 Apr 2018 14:15:02 GMT
server: nginx
etag: W/"5addea66-389"
x-frame-options: allow-from https://lynxgrc.com https://www.incidentresponse.com https://cyware.com https://consortiam.net https://securitycurrent.com
content-type: application/javascript
status: 200
cache-control: max-age=315360000 max-age=86400, no-cache, public
strict-transport-security: max-age=31536000; includeSubDomains; preload;
x-xss-protection: 1; mode=block
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 common-script.js Show response
cyware.com/assets/js/ 19 KB
7 KB 383ms
350ms Script
application/javascript 54.68.234.114
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL

https://cyware.com/assets/js/common-script.js?v=1488285545

Requested by

Host: cyware.com
URL: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.68.234.114 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

ec2-54-68-234-114.us-west-2.compute.amazonaws.com

Software

nginx /

Resource Hash

c06bf50ee88cc2dff2592b428a13e50ddf4af9e2ea41ef12fad2f4ccf2c9e6e2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	nosniff
X-Frame-Options	allow-from https://lynxgrc.com https://www.incidentresponse.com https://cyware.com https://consortiam.net https://securitycurrent.com
X-Xss-Protection	1; mode=block

Request headers

:path: /assets/js/common-script.js?v=1488285545
pragma: no-cache
cookie: XSRF-TOKEN=eyJpdiI6IitFaGZGZHV0VEI5blRiS2VTMjlVRGc9PSIsInZhbHVlIjoiUXAzd3pzdEtXbVN1SGJxWDlDNTc2cEcrWXNuZllEalVKNjh0T21Sc01IWnVJWktvb3VPaUlJZ1UxWGNqWjlxYlhOSmkzU1VJcU9DczE3TGpMRlp3NkE9PSIsIm1hYyI6IjI0NTM4MjJlNWYyNTdmNjc2ZDI3N2M2ODllYjIzOTA5YzU5Y2QxNzYyOTdmZTRlOGFjMTU3MWE3NmIxOWQxYzkifQ%3D%3D; laravel_session=eyJpdiI6ImtGYzlTR0JUU0FwaTJIcTdZUDZlTlE9PSIsInZhbHVlIjoiRndIVzdsZGJcL0daenVsUWtKeXlsZ2t3SjdLY0VNdHBpZytTVzVrSXNnd2Nrb0tva2grWlhURlFHb1VXYnVFWkhKcWpLXC83V1RQaGFWUlFGOTJhT0UrZz09IiwibWFjIjoiMzIyMjY3YTc4ZGZkMWQyNTk4N2M2ZGY3MjMwNTY2ZDQzOGY3ZWJmOGViM2EwYjY1OTExNjhiZTAxZWFmMjQ2MyJ9
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: */*
cache-control: no-cache
:authority: cyware.com
referer: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a
:scheme: https
:method: GET
Referer: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Fri, 12 Apr 2019 16:00:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 23 Apr 2018 14:15:02 GMT
server: nginx
etag: W/"5addea66-4a86"
x-frame-options: allow-from https://lynxgrc.com https://www.incidentresponse.com https://cyware.com https://consortiam.net https://securitycurrent.com
content-type: application/javascript
status: 200
cache-control: max-age=315360000 max-age=86400, no-cache, public
strict-transport-security: max-age=31536000; includeSubDomains; preload;
x-xss-protection: 1; mode=block
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 googleAuth.js Show response
cyware.com/assets/js/ 7 KB
3 KB 383ms
351ms Script
application/javascript 54.68.234.114
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL

https://cyware.com/assets/js/googleAuth.js?v=1496443036

Requested by

Host: cyware.com
URL: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.68.234.114 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

ec2-54-68-234-114.us-west-2.compute.amazonaws.com

Software

nginx /

Resource Hash

761fa7528c900befe0204a194b8e6ec20c7d9d6f334a36b65f84b72e4db17f5b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	nosniff
X-Frame-Options	allow-from https://lynxgrc.com https://www.incidentresponse.com https://cyware.com https://consortiam.net https://securitycurrent.com
X-Xss-Protection	1; mode=block

Request headers

:path: /assets/js/googleAuth.js?v=1496443036
pragma: no-cache
cookie: XSRF-TOKEN=eyJpdiI6IitFaGZGZHV0VEI5blRiS2VTMjlVRGc9PSIsInZhbHVlIjoiUXAzd3pzdEtXbVN1SGJxWDlDNTc2cEcrWXNuZllEalVKNjh0T21Sc01IWnVJWktvb3VPaUlJZ1UxWGNqWjlxYlhOSmkzU1VJcU9DczE3TGpMRlp3NkE9PSIsIm1hYyI6IjI0NTM4MjJlNWYyNTdmNjc2ZDI3N2M2ODllYjIzOTA5YzU5Y2QxNzYyOTdmZTRlOGFjMTU3MWE3NmIxOWQxYzkifQ%3D%3D; laravel_session=eyJpdiI6ImtGYzlTR0JUU0FwaTJIcTdZUDZlTlE9PSIsInZhbHVlIjoiRndIVzdsZGJcL0daenVsUWtKeXlsZ2t3SjdLY0VNdHBpZytTVzVrSXNnd2Nrb0tva2grWlhURlFHb1VXYnVFWkhKcWpLXC83V1RQaGFWUlFGOTJhT0UrZz09IiwibWFjIjoiMzIyMjY3YTc4ZGZkMWQyNTk4N2M2ZGY3MjMwNTY2ZDQzOGY3ZWJmOGViM2EwYjY1OTExNjhiZTAxZWFmMjQ2MyJ9
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: */*
cache-control: no-cache
:authority: cyware.com
referer: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a
:scheme: https
:method: GET
Referer: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Fri, 12 Apr 2019 16:00:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 23 Apr 2018 14:15:02 GMT
server: nginx
etag: W/"5addea66-1a9f"
x-frame-options: allow-from https://lynxgrc.com https://www.incidentresponse.com https://cyware.com https://consortiam.net https://securitycurrent.com
content-type: application/javascript
status: 200
cache-control: max-age=315360000 max-age=86400, no-cache, public
strict-transport-security: max-age=31536000; includeSubDomains; preload;
x-xss-protection: 1; mode=block
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 conversion.js Show response
www.googleadservices.com/pagead/ 24 KB
9 KB 49ms
16ms Script
text/javascript 172.217.18.98
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion.js

Requested by

Host: cyware.com
URL: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

172.217.18.98 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

zrh04s05-in-f98.1e100.net

Software

cafe /

Resource Hash

1b4db5f8870f0aaeb13d48cc04ddecaf0eafadbd1ef23503b2098821b4643d6c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Fri, 12 Apr 2019 16:00:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,44,43,39",quic=":443"; ma=2592000; v="46,44,43,39"
content-length: 9238
x-xss-protection: 0
server: cafe
etag: 10956419951226987826
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Fri, 12 Apr 2019 16:00:10 GMT

GET
H2 200 jquery.history.js Show response
cyware.com/assets/js/ 22 KB
8 KB 442ms
442ms Script
application/javascript 54.68.234.114
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL

https://cyware.com/assets/js/jquery.history.js

Requested by

Host: cyware.com
URL: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.68.234.114 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

ec2-54-68-234-114.us-west-2.compute.amazonaws.com

Software

nginx /

Resource Hash

3eca2f7a428c7d60d1649538e4552740ce043df021e618b32943481689a8cfaa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	nosniff
X-Frame-Options	allow-from https://lynxgrc.com https://www.incidentresponse.com https://cyware.com https://consortiam.net https://securitycurrent.com
X-Xss-Protection	1; mode=block

Request headers

:path: /assets/js/jquery.history.js
pragma: no-cache
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: */*
cache-control: no-cache
:authority: cyware.com
referer: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a
:scheme: https
:method: GET
Referer: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Fri, 12 Apr 2019 16:00:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 23 Apr 2018 14:15:02 GMT
server: nginx
etag: W/"5addea66-5990"
x-frame-options: allow-from https://lynxgrc.com https://www.incidentresponse.com https://cyware.com https://consortiam.net https://securitycurrent.com
content-type: application/javascript
status: 200
cache-control: max-age=315360000 max-age=86400, no-cache, public
strict-transport-security: max-age=31536000; includeSubDomains; preload;
x-xss-protection: 1; mode=block
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 function.nonnews.js Show response
cyware.com/assets/js/ 171 B
562 B 174ms
173ms Script
application/javascript 54.68.234.114
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL

https://cyware.com/assets/js/function.nonnews.js

Requested by

Host: cyware.com
URL: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.68.234.114 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

ec2-54-68-234-114.us-west-2.compute.amazonaws.com

Software

nginx /

Resource Hash

ed1938bc88c7715a349a183684d6b85185648f3f3b251b3829454e6ba9d13437

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	nosniff
X-Frame-Options	allow-from https://lynxgrc.com https://www.incidentresponse.com https://cyware.com https://consortiam.net https://securitycurrent.com
X-Xss-Protection	1; mode=block

Request headers

:path: /assets/js/function.nonnews.js
pragma: no-cache
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: */*
cache-control: no-cache
:authority: cyware.com
referer: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a
:scheme: https
:method: GET
Referer: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Fri, 12 Apr 2019 16:00:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 23 Apr 2018 14:15:02 GMT
server: nginx
etag: W/"5addea66-ab"
x-frame-options: allow-from https://lynxgrc.com https://www.incidentresponse.com https://cyware.com https://consortiam.net https://securitycurrent.com
content-type: application/javascript
status: 200
cache-control: max-age=315360000 max-age=86400, no-cache, public
strict-transport-security: max-age=31536000; includeSubDomains; preload;
x-xss-protection: 1; mode=block
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 jquery-comments.js Show response
cyware.com/assets/js/ 84 KB
21 KB 178ms
177ms Script
application/javascript 54.68.234.114
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL

https://cyware.com/assets/js/jquery-comments.js

Requested by

Host: cyware.com
URL: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.68.234.114 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

ec2-54-68-234-114.us-west-2.compute.amazonaws.com

Software

nginx /

Resource Hash

f7ac8ff57ddf44369455191ecbc4eff5c6847bf8bb23d303e0dd5fb7e76a68fc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	nosniff
X-Frame-Options	allow-from https://lynxgrc.com https://www.incidentresponse.com https://cyware.com https://consortiam.net https://securitycurrent.com
X-Xss-Protection	1; mode=block

Request headers

:path: /assets/js/jquery-comments.js
pragma: no-cache
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: */*
cache-control: no-cache
:authority: cyware.com
referer: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a
:scheme: https
:method: GET
Referer: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Fri, 12 Apr 2019 16:00:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 23 Apr 2018 14:15:02 GMT
server: nginx
etag: W/"5addea66-14eaa"
x-frame-options: allow-from https://lynxgrc.com https://www.incidentresponse.com https://cyware.com https://consortiam.net https://securitycurrent.com
content-type: application/javascript
status: 200
cache-control: max-age=315360000 max-age=86400, no-cache, public
strict-transport-security: max-age=31536000; includeSubDomains; preload;
x-xss-protection: 1; mode=block
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 comments.js Show response
cyware.com/assets/js/ 5 KB
2 KB 178ms
177ms Script
application/javascript 54.68.234.114
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL

https://cyware.com/assets/js/comments.js

Requested by

Host: cyware.com
URL: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.68.234.114 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

ec2-54-68-234-114.us-west-2.compute.amazonaws.com

Software

nginx /

Resource Hash

607635ff2c2e482d08141e295e3dbd4b34985fbd9837d86f40cd845fb78aa20f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	nosniff
X-Frame-Options	allow-from https://lynxgrc.com https://www.incidentresponse.com https://cyware.com https://consortiam.net https://securitycurrent.com
X-Xss-Protection	1; mode=block

Request headers

:path: /assets/js/comments.js
pragma: no-cache
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: */*
cache-control: no-cache
:authority: cyware.com
referer: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a
:scheme: https
:method: GET
Referer: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Fri, 12 Apr 2019 16:00:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 23 Apr 2018 14:15:02 GMT
server: nginx
etag: W/"5addea66-129b"
x-frame-options: allow-from https://lynxgrc.com https://www.incidentresponse.com https://cyware.com https://consortiam.net https://securitycurrent.com
content-type: application/javascript
status: 200
cache-control: max-age=315360000 max-age=86400, no-cache, public
strict-transport-security: max-age=31536000; includeSubDomains; preload;
x-xss-protection: 1; mode=block
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 function.single.js Show response
cyware.com/assets/js/ 10 KB
3 KB 174ms
174ms Script
application/javascript 54.68.234.114
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL

https://cyware.com/assets/js/function.single.js?v=1491638290

Requested by

Host: cyware.com
URL: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.68.234.114 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

ec2-54-68-234-114.us-west-2.compute.amazonaws.com

Software

nginx /

Resource Hash

05120b6ff0a4018e989c611237c44565f83a674789b6c55eb7c780d5adf9f813

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	nosniff
X-Frame-Options	allow-from https://lynxgrc.com https://www.incidentresponse.com https://cyware.com https://consortiam.net https://securitycurrent.com
X-Xss-Protection	1; mode=block

Request headers

:path: /assets/js/function.single.js?v=1491638290
pragma: no-cache
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: */*
cache-control: no-cache
:authority: cyware.com
referer: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a
:scheme: https
:method: GET
Referer: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Fri, 12 Apr 2019 16:00:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 23 Apr 2018 14:15:02 GMT
server: nginx
etag: W/"5addea66-29b1"
x-frame-options: allow-from https://lynxgrc.com https://www.incidentresponse.com https://cyware.com https://consortiam.net https://securitycurrent.com
content-type: application/javascript
status: 200
cache-control: max-age=315360000 max-age=86400, no-cache, public
strict-transport-security: max-age=31536000; includeSubDomains; preload;
x-xss-protection: 1; mode=block
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 OneSignalPageSDKES6.js Show response
cdn.onesignal.com/sdks/ 212 KB
52 KB 31ms
10ms Script
application/javascript 2606:4700::6810:cea5
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.onesignal.com/sdks/OneSignalPageSDKES6.js?v=150703
Requested by: Host: cdn.onesignal.com
URL: https://cdn.onesignal.com/sdks/OneSignalSDK.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:cea5 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0e10b6e9c0b5b9586c6cdf307466474b438989e57732c2b41ec69b03b363533b

Request headers

Referer: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Fri, 12 Apr 2019 16:00:10 GMT
content-encoding: gzip
cf-cache-status: HIT
server: cloudflare
etag: W/"c855e8eb5fbdafddfa15bc848b662c44"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: public, max-age=259200
cf-ray: 4c6669621bb4c28d-FRA
expires: Mon, 15 Apr 2019 16:00:10 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 43 KB
17 KB 28ms
7ms Script
text/javascript 2a00:1450:4001:81f::200e
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: cyware.com
URL: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a00:1450:4001:81f::200e , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

3e552578c7d450b023f2cd9d28f830be4335c3acc6c4ab6dadda0769f09e5f22

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 16 Jan 2019 20:01:45 GMT
server: Golfe2
age: 1663
date: Fri, 12 Apr 2019 15:32:27 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,44,43,39"
content-length: 17543
expires: Fri, 12 Apr 2019 17:32:27 GMT

GET
H2 200 nav-applestore-light.svg
cyware.com/assets/images/ 664 B
882 B 431ms
421ms Image
image/svg+xml 54.68.234.114
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cyware.com/assets/images/nav-applestore-light.svg

Requested by

Host: cyware.com
URL: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.68.234.114 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

ec2-54-68-234-114.us-west-2.compute.amazonaws.com

Software

nginx /

Resource Hash

0e8c6f4c2c25fff4293caa4a811da95de10b226c9f009a9ce92cf966a7cd790e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	nosniff
X-Frame-Options	allow-from https://lynxgrc.com https://www.incidentresponse.com https://cyware.com https://consortiam.net https://securitycurrent.com
X-Xss-Protection	1; mode=block

Request headers

:path: /assets/images/nav-applestore-light.svg
pragma: no-cache
cookie: XSRF-TOKEN=eyJpdiI6IitFaGZGZHV0VEI5blRiS2VTMjlVRGc9PSIsInZhbHVlIjoiUXAzd3pzdEtXbVN1SGJxWDlDNTc2cEcrWXNuZllEalVKNjh0T21Sc01IWnVJWktvb3VPaUlJZ1UxWGNqWjlxYlhOSmkzU1VJcU9DczE3TGpMRlp3NkE9PSIsIm1hYyI6IjI0NTM4MjJlNWYyNTdmNjc2ZDI3N2M2ODllYjIzOTA5YzU5Y2QxNzYyOTdmZTRlOGFjMTU3MWE3NmIxOWQxYzkifQ%3D%3D; laravel_session=eyJpdiI6ImtGYzlTR0JUU0FwaTJIcTdZUDZlTlE9PSIsInZhbHVlIjoiRndIVzdsZGJcL0daenVsUWtKeXlsZ2t3SjdLY0VNdHBpZytTVzVrSXNnd2Nrb0tva2grWlhURlFHb1VXYnVFWkhKcWpLXC83V1RQaGFWUlFGOTJhT0UrZz09IiwibWFjIjoiMzIyMjY3YTc4ZGZkMWQyNTk4N2M2ZGY3MjMwNTY2ZDQzOGY3ZWJmOGViM2EwYjY1OTExNjhiZTAxZWFmMjQ2MyJ9
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: cyware.com
referer: https://cyware.com/assets/css/design-v2.css?v=1492506833
:scheme: https
:method: GET
Referer: https://cyware.com/assets/css/design-v2.css?v=1492506833
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Fri, 12 Apr 2019 16:00:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 23 Apr 2018 14:15:02 GMT
server: nginx
etag: W/"5addea66-298"
x-frame-options: allow-from https://lynxgrc.com https://www.incidentresponse.com https://cyware.com https://consortiam.net https://securitycurrent.com
content-type: image/svg+xml
status: 200
cache-control: max-age=315360000 max-age=86400, no-cache, public
strict-transport-security: max-age=31536000; includeSubDomains; preload;
x-xss-protection: 1; mode=block
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 nav-playstore-light.svg
cyware.com/assets/images/ 1 KB
938 B 465ms
420ms Image
image/svg+xml 54.68.234.114
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cyware.com/assets/images/nav-playstore-light.svg

Requested by

Host: cyware.com
URL: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.68.234.114 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

ec2-54-68-234-114.us-west-2.compute.amazonaws.com

Software

nginx /

Resource Hash

c07b7c5718ed916e7c46b22170f6eea8e0db670808629a60e0219321db6d5322

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	nosniff
X-Frame-Options	allow-from https://lynxgrc.com https://www.incidentresponse.com https://cyware.com https://consortiam.net https://securitycurrent.com
X-Xss-Protection	1; mode=block

Request headers

:path: /assets/images/nav-playstore-light.svg
pragma: no-cache
cookie: XSRF-TOKEN=eyJpdiI6IitFaGZGZHV0VEI5blRiS2VTMjlVRGc9PSIsInZhbHVlIjoiUXAzd3pzdEtXbVN1SGJxWDlDNTc2cEcrWXNuZllEalVKNjh0T21Sc01IWnVJWktvb3VPaUlJZ1UxWGNqWjlxYlhOSmkzU1VJcU9DczE3TGpMRlp3NkE9PSIsIm1hYyI6IjI0NTM4MjJlNWYyNTdmNjc2ZDI3N2M2ODllYjIzOTA5YzU5Y2QxNzYyOTdmZTRlOGFjMTU3MWE3NmIxOWQxYzkifQ%3D%3D; laravel_session=eyJpdiI6ImtGYzlTR0JUU0FwaTJIcTdZUDZlTlE9PSIsInZhbHVlIjoiRndIVzdsZGJcL0daenVsUWtKeXlsZ2t3SjdLY0VNdHBpZytTVzVrSXNnd2Nrb0tva2grWlhURlFHb1VXYnVFWkhKcWpLXC83V1RQaGFWUlFGOTJhT0UrZz09IiwibWFjIjoiMzIyMjY3YTc4ZGZkMWQyNTk4N2M2ZGY3MjMwNTY2ZDQzOGY3ZWJmOGViM2EwYjY1OTExNjhiZTAxZWFmMjQ2MyJ9
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: cyware.com
referer: https://cyware.com/assets/css/design-v2.css?v=1492506833
:scheme: https
:method: GET
Referer: https://cyware.com/assets/css/design-v2.css?v=1492506833
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Fri, 12 Apr 2019 16:00:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 23 Apr 2018 14:15:02 GMT
server: nginx
etag: W/"5addea66-421"
x-frame-options: allow-from https://lynxgrc.com https://www.incidentresponse.com https://cyware.com https://consortiam.net https://securitycurrent.com
content-type: image/svg+xml
status: 200
cache-control: max-age=315360000 max-age=86400, no-cache, public
strict-transport-security: max-age=31536000; includeSubDomains; preload;
x-xss-protection: 1; mode=block
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 assets_icon_expand.svg
cyware.com/assets/images/ 1 KB
1 KB 450ms
421ms Image
image/svg+xml 54.68.234.114
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cyware.com/assets/images/assets_icon_expand.svg

Requested by

Host: cyware.com
URL: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.68.234.114 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

ec2-54-68-234-114.us-west-2.compute.amazonaws.com

Software

nginx /

Resource Hash

57e3625232492994b84a777179caa2999b706515c4bb5751cce858e399698809

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	nosniff
X-Frame-Options	allow-from https://lynxgrc.com https://www.incidentresponse.com https://cyware.com https://consortiam.net https://securitycurrent.com
X-Xss-Protection	1; mode=block

Request headers

:path: /assets/images/assets_icon_expand.svg
pragma: no-cache
cookie: XSRF-TOKEN=eyJpdiI6IitFaGZGZHV0VEI5blRiS2VTMjlVRGc9PSIsInZhbHVlIjoiUXAzd3pzdEtXbVN1SGJxWDlDNTc2cEcrWXNuZllEalVKNjh0T21Sc01IWnVJWktvb3VPaUlJZ1UxWGNqWjlxYlhOSmkzU1VJcU9DczE3TGpMRlp3NkE9PSIsIm1hYyI6IjI0NTM4MjJlNWYyNTdmNjc2ZDI3N2M2ODllYjIzOTA5YzU5Y2QxNzYyOTdmZTRlOGFjMTU3MWE3NmIxOWQxYzkifQ%3D%3D; laravel_session=eyJpdiI6ImtGYzlTR0JUU0FwaTJIcTdZUDZlTlE9PSIsInZhbHVlIjoiRndIVzdsZGJcL0daenVsUWtKeXlsZ2t3SjdLY0VNdHBpZytTVzVrSXNnd2Nrb0tva2grWlhURlFHb1VXYnVFWkhKcWpLXC83V1RQaGFWUlFGOTJhT0UrZz09IiwibWFjIjoiMzIyMjY3YTc4ZGZkMWQyNTk4N2M2ZGY3MjMwNTY2ZDQzOGY3ZWJmOGViM2EwYjY1OTExNjhiZTAxZWFmMjQ2MyJ9
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: cyware.com
referer: https://cyware.com/assets/css/single.css?v=1490109300
:scheme: https
:method: GET
Referer: https://cyware.com/assets/css/single.css?v=1490109300
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Fri, 12 Apr 2019 16:00:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 23 Apr 2018 14:15:02 GMT
server: nginx
etag: W/"5addea66-540"
x-frame-options: allow-from https://lynxgrc.com https://www.incidentresponse.com https://cyware.com https://consortiam.net https://securitycurrent.com
content-type: image/svg+xml
status: 200
cache-control: max-age=315360000 max-age=86400, no-cache, public
strict-transport-security: max-age=31536000; includeSubDomains; preload;
x-xss-protection: 1; mode=block
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 icons_cyware.svg
cyware.com/assets/images/icons/ 509 B
777 B 182ms
180ms Image
image/svg+xml 54.68.234.114
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cyware.com/assets/images/icons/icons_cyware.svg

Requested by

Host: cyware.com
URL: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.68.234.114 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

ec2-54-68-234-114.us-west-2.compute.amazonaws.com

Software

nginx /

Resource Hash

f49b8dfc7bec82ea7c10c2fc647567f7bd5637353d5da351c5e1fe29af2ebf0d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	nosniff
X-Frame-Options	allow-from https://lynxgrc.com https://www.incidentresponse.com https://cyware.com https://consortiam.net https://securitycurrent.com
X-Xss-Protection	1; mode=block

Request headers

:path: /assets/images/icons/icons_cyware.svg
pragma: no-cache
cookie: XSRF-TOKEN=eyJpdiI6Ild3T01YWWswQm8yUlZtMUZOOHRyWXc9PSIsInZhbHVlIjoidXNVZ0Z4bzFrVnlVaXA2N2RoSm10OUp5V0tOSGR5aElOSGdxVTZTK1VOZXRcL1VuRUdCXC9yOXlNenl2XC9iaWlyWmVwcjdSYlpDMU85UitJRFwvemdUS1h3PT0iLCJtYWMiOiJkMTdlOGU3NzI2MGMyNTgwYjE5NGMwOWY2ZWVlZTg0Y2NkN2U0NTc1MzM0MjI3NTdiZTA3YWZkZjg5ZTg1ODIyIn0%3D; laravel_session=eyJpdiI6ImVxc3FKWGJ1RFgxbGRmd3c1OFJqRlE9PSIsInZhbHVlIjoiNjVkNWNudDR4OWFhMzF1Snl4K21TZU9CU1hDWVQwTFdHVDJnNHdMc1Q0SUZIbFp5Y3IyY2V0cCtnclkwaXg0TzdCU1E4bE5UNkFTemE5Y1pxTmtOZ3c9PSIsIm1hYyI6IjljY2NlYmIxZmJlNzcyZjI2YzEyOGQ1OGExYWE1MjUxNTQxMzIxM2JiMDg0MjIxOWU4NWIzYzY2ZmUxMTU2MmMifQ%3D%3D
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: cyware.com
referer: https://cyware.com/assets/css/design-v2.css?v=1492506833
:scheme: https
:method: GET
Referer: https://cyware.com/assets/css/design-v2.css?v=1492506833
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Fri, 12 Apr 2019 16:00:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 23 Apr 2018 14:15:02 GMT
server: nginx
etag: W/"5addea66-1fd"
x-frame-options: allow-from https://lynxgrc.com https://www.incidentresponse.com https://cyware.com https://consortiam.net https://securitycurrent.com
content-type: image/svg+xml
status: 200
cache-control: max-age=315360000 max-age=86400, no-cache, public
strict-transport-security: max-age=31536000; includeSubDomains; preload;
x-xss-protection: 1; mode=block
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 footer-bg.png
cyware.com/enterprise-cdn/images/ 431 KB
432 KB 188ms
187ms Image
image/png 54.68.234.114
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cyware.com/enterprise-cdn/images/footer-bg.png

Requested by

Host: cyware.com
URL: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.68.234.114 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

ec2-54-68-234-114.us-west-2.compute.amazonaws.com

Software

nginx /

Resource Hash

8c2388a4ac729c06d3cdf6b8e71833e2097c09906dde714850532d170d2cc56f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	nosniff
X-Frame-Options	allow-from https://lynxgrc.com https://www.incidentresponse.com https://cyware.com https://consortiam.net https://securitycurrent.com
X-Xss-Protection	1; mode=block

Request headers

:path: /enterprise-cdn/images/footer-bg.png
pragma: no-cache
cookie: XSRF-TOKEN=eyJpdiI6Ild3T01YWWswQm8yUlZtMUZOOHRyWXc9PSIsInZhbHVlIjoidXNVZ0Z4bzFrVnlVaXA2N2RoSm10OUp5V0tOSGR5aElOSGdxVTZTK1VOZXRcL1VuRUdCXC9yOXlNenl2XC9iaWlyWmVwcjdSYlpDMU85UitJRFwvemdUS1h3PT0iLCJtYWMiOiJkMTdlOGU3NzI2MGMyNTgwYjE5NGMwOWY2ZWVlZTg0Y2NkN2U0NTc1MzM0MjI3NTdiZTA3YWZkZjg5ZTg1ODIyIn0%3D; laravel_session=eyJpdiI6ImVxc3FKWGJ1RFgxbGRmd3c1OFJqRlE9PSIsInZhbHVlIjoiNjVkNWNudDR4OWFhMzF1Snl4K21TZU9CU1hDWVQwTFdHVDJnNHdMc1Q0SUZIbFp5Y3IyY2V0cCtnclkwaXg0TzdCU1E4bE5UNkFTemE5Y1pxTmtOZ3c9PSIsIm1hYyI6IjljY2NlYmIxZmJlNzcyZjI2YzEyOGQ1OGExYWE1MjUxNTQxMzIxM2JiMDg0MjIxOWU4NWIzYzY2ZmUxMTU2MmMifQ%3D%3D
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: cyware.com
referer: https://cyware.com/
:scheme: https
:method: GET
Referer: https://cyware.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Fri, 12 Apr 2019 16:00:14 GMT
x-content-type-options: nosniff
last-modified: Mon, 23 Apr 2018 14:15:02 GMT
server: nginx
etag: "5addea66-6bb4a"
x-frame-options: allow-from https://lynxgrc.com https://www.incidentresponse.com https://cyware.com https://consortiam.net https://securitycurrent.com
content-type: image/png
status: 200
cache-control: max-age=315360000 max-age=86400, no-cache, public
strict-transport-security: max-age=31536000; includeSubDomains; preload;
accept-ranges: bytes
content-length: 441162
x-xss-protection: 1; mode=block
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 Raleway-SemiBold.ttf
cyware.com/enterprise-cdn/fonts/raleway/ 176 KB
177 KB 452ms
409ms Font
application/octet-stream 54.68.234.114
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL

https://cyware.com/enterprise-cdn/fonts/raleway/Raleway-SemiBold.ttf

Requested by

Host: cyware.com
URL: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.68.234.114 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

ec2-54-68-234-114.us-west-2.compute.amazonaws.com

Software

nginx /

Resource Hash

b7680f30199f65ce3b2620713f7cb27a175560ea7402e0b4cba01c5d54508a17

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	nosniff
X-Frame-Options	allow-from https://lynxgrc.com https://www.incidentresponse.com https://cyware.com https://consortiam.net https://securitycurrent.com
X-Xss-Protection	1; mode=block

Request headers

:path: /enterprise-cdn/fonts/raleway/Raleway-SemiBold.ttf
pragma: no-cache
cookie: XSRF-TOKEN=eyJpdiI6IitFaGZGZHV0VEI5blRiS2VTMjlVRGc9PSIsInZhbHVlIjoiUXAzd3pzdEtXbVN1SGJxWDlDNTc2cEcrWXNuZllEalVKNjh0T21Sc01IWnVJWktvb3VPaUlJZ1UxWGNqWjlxYlhOSmkzU1VJcU9DczE3TGpMRlp3NkE9PSIsIm1hYyI6IjI0NTM4MjJlNWYyNTdmNjc2ZDI3N2M2ODllYjIzOTA5YzU5Y2QxNzYyOTdmZTRlOGFjMTU3MWE3NmIxOWQxYzkifQ%3D%3D; laravel_session=eyJpdiI6ImtGYzlTR0JUU0FwaTJIcTdZUDZlTlE9PSIsInZhbHVlIjoiRndIVzdsZGJcL0daenVsUWtKeXlsZ2t3SjdLY0VNdHBpZytTVzVrSXNnd2Nrb0tva2grWlhURlFHb1VXYnVFWkhKcWpLXC83V1RQaGFWUlFGOTJhT0UrZz09IiwibWFjIjoiMzIyMjY3YTc4ZGZkMWQyNTk4N2M2ZGY3MjMwNTY2ZDQzOGY3ZWJmOGViM2EwYjY1OTExNjhiZTAxZWFmMjQ2MyJ9
origin: https://cyware.com
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: */*
cache-control: no-cache
:authority: cyware.com
referer: https://cyware.com/enterprise-cdn/css/style.css
:scheme: https
:method: GET
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: https://cyware.com/enterprise-cdn/css/style.css
Origin: https://cyware.com

Response headers

date: Fri, 12 Apr 2019 16:00:10 GMT
x-content-type-options: nosniff
last-modified: Mon, 23 Apr 2018 14:15:02 GMT
server: nginx
etag: "5addea66-2c10c"
x-frame-options: allow-from https://lynxgrc.com https://www.incidentresponse.com https://cyware.com https://consortiam.net https://securitycurrent.com
content-type: application/octet-stream
status: 200
cache-control: max-age=86400, no-cache, public
strict-transport-security: max-age=31536000; includeSubDomains; preload;
accept-ranges: bytes
content-length: 180492
x-xss-protection: 1; mode=block

GET
H2 200 Raleway-Regular.ttf
cyware.com/enterprise-cdn/fonts/raleway/ 174 KB
175 KB 463ms
420ms Font
application/octet-stream 54.68.234.114
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL

https://cyware.com/enterprise-cdn/fonts/raleway/Raleway-Regular.ttf

Requested by

Host: cyware.com
URL: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.68.234.114 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

ec2-54-68-234-114.us-west-2.compute.amazonaws.com

Software

nginx /

Resource Hash

20e4ae409ffbe8bfd2af14d7f717398408ae8b481005beccb83d62ef4052b681

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	nosniff
X-Frame-Options	allow-from https://lynxgrc.com https://www.incidentresponse.com https://cyware.com https://consortiam.net https://securitycurrent.com
X-Xss-Protection	1; mode=block

Request headers

:path: /enterprise-cdn/fonts/raleway/Raleway-Regular.ttf
pragma: no-cache
cookie: XSRF-TOKEN=eyJpdiI6IitFaGZGZHV0VEI5blRiS2VTMjlVRGc9PSIsInZhbHVlIjoiUXAzd3pzdEtXbVN1SGJxWDlDNTc2cEcrWXNuZllEalVKNjh0T21Sc01IWnVJWktvb3VPaUlJZ1UxWGNqWjlxYlhOSmkzU1VJcU9DczE3TGpMRlp3NkE9PSIsIm1hYyI6IjI0NTM4MjJlNWYyNTdmNjc2ZDI3N2M2ODllYjIzOTA5YzU5Y2QxNzYyOTdmZTRlOGFjMTU3MWE3NmIxOWQxYzkifQ%3D%3D; laravel_session=eyJpdiI6ImtGYzlTR0JUU0FwaTJIcTdZUDZlTlE9PSIsInZhbHVlIjoiRndIVzdsZGJcL0daenVsUWtKeXlsZ2t3SjdLY0VNdHBpZytTVzVrSXNnd2Nrb0tva2grWlhURlFHb1VXYnVFWkhKcWpLXC83V1RQaGFWUlFGOTJhT0UrZz09IiwibWFjIjoiMzIyMjY3YTc4ZGZkMWQyNTk4N2M2ZGY3MjMwNTY2ZDQzOGY3ZWJmOGViM2EwYjY1OTExNjhiZTAxZWFmMjQ2MyJ9
origin: https://cyware.com
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: */*
cache-control: no-cache
:authority: cyware.com
referer: https://cyware.com/enterprise-cdn/css/style.css
:scheme: https
:method: GET
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: https://cyware.com/enterprise-cdn/css/style.css
Origin: https://cyware.com

Response headers

date: Fri, 12 Apr 2019 16:00:10 GMT
x-content-type-options: nosniff
last-modified: Mon, 23 Apr 2018 14:15:02 GMT
server: nginx
etag: "5addea66-2b958"
x-frame-options: allow-from https://lynxgrc.com https://www.incidentresponse.com https://cyware.com https://consortiam.net https://securitycurrent.com
content-type: application/octet-stream
status: 200
cache-control: max-age=86400, no-cache, public
strict-transport-security: max-age=31536000; includeSubDomains; preload;
accept-ranges: bytes
content-length: 178520
x-xss-protection: 1; mode=block

GET
H2 200 S6u9w4BMUTPHh6UVSwiPGQ3q5d0.woff2
fonts.gstatic.com/s/lato/v15/ 14 KB
14 KB 63ms
20ms Font
font/woff2 2a00:1450:4001:808::2003
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/lato/v15/S6u9w4BMUTPHh6UVSwiPGQ3q5d0.woff2

Requested by

Host: cyware.com
URL: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:4001:808::2003 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

9baad10e85c5be8d5697086479983b6b477197103bf8f0f11817b1bdfb9a7451

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: https://fonts.googleapis.com/css?family=Lato:400,900,300,700|Source+Sans+Pro:400,700,400italic,700italic
Origin: https://cyware.com

Response headers

date: Mon, 25 Mar 2019 20:20:25 GMT
x-content-type-options: nosniff
last-modified: Mon, 25 Mar 2019 20:12:18 GMT
server: sffe
age: 1539585
content-type: font/woff2
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,44,43,39"
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-origin: *
content-length: 14176
x-xss-protection: 1; mode=block
expires: Tue, 24 Mar 2020 20:20:25 GMT

GET
H2 200 Raleway-Bold.ttf
cyware.com/enterprise-cdn/fonts/raleway/ 175 KB
176 KB 465ms
423ms Font
application/octet-stream 54.68.234.114
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL

https://cyware.com/enterprise-cdn/fonts/raleway/Raleway-Bold.ttf

Requested by

Host: cyware.com
URL: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.68.234.114 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

ec2-54-68-234-114.us-west-2.compute.amazonaws.com

Software

nginx /

Resource Hash

ca9de8b3be7ccd4b80774a9c7dd56a98c49c276771c5957729b5958d1d579112

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	nosniff
X-Frame-Options	allow-from https://lynxgrc.com https://www.incidentresponse.com https://cyware.com https://consortiam.net https://securitycurrent.com
X-Xss-Protection	1; mode=block

Request headers

:path: /enterprise-cdn/fonts/raleway/Raleway-Bold.ttf
pragma: no-cache
cookie: XSRF-TOKEN=eyJpdiI6IitFaGZGZHV0VEI5blRiS2VTMjlVRGc9PSIsInZhbHVlIjoiUXAzd3pzdEtXbVN1SGJxWDlDNTc2cEcrWXNuZllEalVKNjh0T21Sc01IWnVJWktvb3VPaUlJZ1UxWGNqWjlxYlhOSmkzU1VJcU9DczE3TGpMRlp3NkE9PSIsIm1hYyI6IjI0NTM4MjJlNWYyNTdmNjc2ZDI3N2M2ODllYjIzOTA5YzU5Y2QxNzYyOTdmZTRlOGFjMTU3MWE3NmIxOWQxYzkifQ%3D%3D; laravel_session=eyJpdiI6ImtGYzlTR0JUU0FwaTJIcTdZUDZlTlE9PSIsInZhbHVlIjoiRndIVzdsZGJcL0daenVsUWtKeXlsZ2t3SjdLY0VNdHBpZytTVzVrSXNnd2Nrb0tva2grWlhURlFHb1VXYnVFWkhKcWpLXC83V1RQaGFWUlFGOTJhT0UrZz09IiwibWFjIjoiMzIyMjY3YTc4ZGZkMWQyNTk4N2M2ZGY3MjMwNTY2ZDQzOGY3ZWJmOGViM2EwYjY1OTExNjhiZTAxZWFmMjQ2MyJ9
origin: https://cyware.com
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: */*
cache-control: no-cache
:authority: cyware.com
referer: https://cyware.com/enterprise-cdn/css/style.css
:scheme: https
:method: GET
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: https://cyware.com/enterprise-cdn/css/style.css
Origin: https://cyware.com

Response headers

date: Fri, 12 Apr 2019 16:00:10 GMT
x-content-type-options: nosniff
last-modified: Mon, 23 Apr 2018 14:15:02 GMT
server: nginx
etag: "5addea66-2bc2c"
x-frame-options: allow-from https://lynxgrc.com https://www.incidentresponse.com https://cyware.com https://consortiam.net https://securitycurrent.com
content-type: application/octet-stream
status: 200
cache-control: max-age=86400, no-cache, public
strict-transport-security: max-age=31536000; includeSubDomains; preload;
accept-ranges: bytes
content-length: 179244
x-xss-protection: 1; mode=block

GET
H2 200 Raleway-LightItalic.ttf
cyware.com/enterprise-cdn/fonts/raleway/ 145 KB
145 KB 464ms
422ms Font
application/octet-stream 54.68.234.114
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL

https://cyware.com/enterprise-cdn/fonts/raleway/Raleway-LightItalic.ttf

Requested by

Host: cyware.com
URL: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.68.234.114 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

ec2-54-68-234-114.us-west-2.compute.amazonaws.com

Software

nginx /

Resource Hash

c767a43c0012cdcb76e32f2f3b5005e054ba60fcf52653f7c456f0044e14f1d3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	nosniff
X-Frame-Options	allow-from https://lynxgrc.com https://www.incidentresponse.com https://cyware.com https://consortiam.net https://securitycurrent.com
X-Xss-Protection	1; mode=block

Request headers

:path: /enterprise-cdn/fonts/raleway/Raleway-LightItalic.ttf
pragma: no-cache
cookie: XSRF-TOKEN=eyJpdiI6IitFaGZGZHV0VEI5blRiS2VTMjlVRGc9PSIsInZhbHVlIjoiUXAzd3pzdEtXbVN1SGJxWDlDNTc2cEcrWXNuZllEalVKNjh0T21Sc01IWnVJWktvb3VPaUlJZ1UxWGNqWjlxYlhOSmkzU1VJcU9DczE3TGpMRlp3NkE9PSIsIm1hYyI6IjI0NTM4MjJlNWYyNTdmNjc2ZDI3N2M2ODllYjIzOTA5YzU5Y2QxNzYyOTdmZTRlOGFjMTU3MWE3NmIxOWQxYzkifQ%3D%3D; laravel_session=eyJpdiI6ImtGYzlTR0JUU0FwaTJIcTdZUDZlTlE9PSIsInZhbHVlIjoiRndIVzdsZGJcL0daenVsUWtKeXlsZ2t3SjdLY0VNdHBpZytTVzVrSXNnd2Nrb0tva2grWlhURlFHb1VXYnVFWkhKcWpLXC83V1RQaGFWUlFGOTJhT0UrZz09IiwibWFjIjoiMzIyMjY3YTc4ZGZkMWQyNTk4N2M2ZGY3MjMwNTY2ZDQzOGY3ZWJmOGViM2EwYjY1OTExNjhiZTAxZWFmMjQ2MyJ9
origin: https://cyware.com
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: */*
cache-control: no-cache
:authority: cyware.com
referer: https://cyware.com/enterprise-cdn/css/style.css
:scheme: https
:method: GET
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: https://cyware.com/enterprise-cdn/css/style.css
Origin: https://cyware.com

Response headers

date: Fri, 12 Apr 2019 16:00:10 GMT
x-content-type-options: nosniff
last-modified: Mon, 23 Apr 2018 14:15:02 GMT
server: nginx
etag: "5addea66-24390"
x-frame-options: allow-from https://lynxgrc.com https://www.incidentresponse.com https://cyware.com https://consortiam.net https://securitycurrent.com
content-type: application/octet-stream
status: 200
cache-control: max-age=86400, no-cache, public
strict-transport-security: max-age=31536000; includeSubDomains; preload;
accept-ranges: bytes
content-length: 148368
x-xss-protection: 1; mode=block

GET
H2 200 S6uyw4BMUTPHjx4wXiWtFCc.woff2
fonts.gstatic.com/s/lato/v15/ 14 KB
14 KB 13ms
11ms Font
font/woff2 2a00:1450:4001:808::2003
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/lato/v15/S6uyw4BMUTPHjx4wXiWtFCc.woff2

Requested by

Host: cyware.com
URL: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:4001:808::2003 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

036d841b132c14046e26d8f2da1bc634c6ad34885ed1295660694a91c98933a6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: https://fonts.googleapis.com/css?family=Lato:400,900,300,700|Source+Sans+Pro:400,700,400italic,700italic
Origin: https://cyware.com

Response headers

date: Mon, 25 Mar 2019 20:20:25 GMT
x-content-type-options: nosniff
last-modified: Mon, 25 Mar 2019 20:13:00 GMT
server: sffe
age: 1539585
content-type: font/woff2
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,44,43,39"
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-origin: *
content-length: 14044
x-xss-protection: 1; mode=block
expires: Tue, 24 Mar 2020 20:20:25 GMT

GET
H2

200

collect
stats.g.doubleclick.net/r/
Redirect Chain

https://www.google-analytics.com/r/collect?v=1&_v=j73&a=956014898&t=pageview&_s=1&dl=https%3A%2F%2Fcyware.com%2Fnews%2Fvsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a&...
https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-74369186-1&cid=287711179.1555084811&jid=38822657&_gid=820223684.1555084811&gjid=1474631386&_v=j73&z=1335799128

35 B
103 B

16ms
15ms

Image
image/gif

2a00:1450:400c:c07::9a
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-74369186-1&cid=287711179.1555084811&jid=38822657&_gid=820223684.1555084811&gjid=1474631386&_v=j73&z=1335799128

Requested by

Host: cyware.com
URL: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c07::9a , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
access-control-allow-origin: *
date: Fri, 12 Apr 2019 16:00:11 GMT
content-type: image/gif
status: 200
cache-control: no-cache, no-store, must-revalidate
alt-svc: quic=":443"; ma=2592000; v="46,44,43,39"
content-length: 35
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 12 Apr 2019 16:00:11 GMT
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
access-control-allow-origin: *
location: https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-74369186-1&cid=287711179.1555084811&jid=38822657&_gid=820223684.1555084811&gjid=1474631386&_v=j73&z=1335799128
content-type: text/html; charset=UTF-8
status: 302
cache-control: no-cache, no-store, must-revalidate
alt-svc: quic=":443"; ma=2592000; v="46,44,43,39"
content-length: 416
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 api.js Show response
apis.google.com/js/ 13 KB
5 KB 33ms
32ms Script
application/javascript 2a00:1450:4001:824::200e
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://apis.google.com/js/api.js?onload=onLoadCallback

Requested by

Host: cyware.com
URL: https://cyware.com/assets/js/googleAuth.js?v=1496443036

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a00:1450:4001:824::200e , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

ESF /

Resource Hash

68ca5571204192df1a01690243d505f53eb68c56873fd1d9259fb606f4c8e903

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Fri, 12 Apr 2019 16:00:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: script-src 'report-sample' 'nonce-G0RKllVyX6zTC3TYYxf7rw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /_/cspreport
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
status: 200
strict-transport-security: max-age=31536000
alt-svc: quic=":443"; ma=2592000; v="46,44,43,39"
x-xss-protection: 1; mode=block
x-ua-compatible: IE=edge, chrome=1
server: ESF
etag: "0e8e0efb3880d3df90ed57bd6388659f"
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: private, max-age=1800, stale-while-revalidate=1800
timing-allow-origin: *
expires: Fri, 12 Apr 2019 16:00:11 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/877519502/ 2 KB
1 KB 18ms
18ms Script
text/javascript 2a00:1450:4001:808::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/877519502/?random=1555084811376&cv=9&fst=1555084811376&num=1&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=0&u_nmime=0&sendb=1&frm=0&url=https%3A%2F%2Fcyware.com%2Fnews%2Fvsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a&tiba=VSDC%20website%20gets%20infected%20with%20a%20banking%20trojan%20and%20a%20info-stealer%20%7C%20Cyware%20Hacker%20News&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:4001:808::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

ac567abcdbb2e833a4785dbe5f85597d6fd84cacbfa95a5d6ccd1b9eed86f231

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 12 Apr 2019 16:00:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-type: text/javascript; charset=UTF-8
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: no-cache, must-revalidate
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,44,43,39",quic=":443"; ma=2592000; v="46,44,43,39"
content-length: 1007
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/877519502/ 42 B
117 B 25ms
23ms Image
image/gif 2a00:1450:4001:815::2004
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/877519502/?random=1555084811376&cv=9&fst=1555084800000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=0&u_nmime=0&sendb=1&frm=0&url=https%3A%2F%2Fcyware.com%2Fnews%2Fvsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a&tiba=VSDC%20website%20gets%20infected%20with%20a%20banking%20trojan%20and%20a%20info-stealer%20%7C%20Cyware%20Hacker%20News&fmt=3&cdct=2&is_vtc=1&random=1358175269&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Host: cyware.com
URL: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:4001:815::2004 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 12 Apr 2019 16:00:11 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,44,43,39"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/877519502/ 42 B
109 B 23ms
22ms Image
image/gif 2a00:1450:4001:806::2003
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/877519502/?random=1555084811376&cv=9&fst=1555084800000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=0&u_nmime=0&sendb=1&frm=0&url=https%3A%2F%2Fcyware.com%2Fnews%2Fvsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a&tiba=VSDC%20website%20gets%20infected%20with%20a%20banking%20trojan%20and%20a%20info-stealer%20%7C%20Cyware%20Hacker%20News&fmt=3&cdct=2&is_vtc=1&random=1358175269&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Requested by

Host: cyware.com
URL: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a00:1450:4001:806::2003 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 12 Apr 2019 16:00:11 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,44,43,39"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 cb=gapi.loaded_0 Show response
apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.en_US.-M6wT9WufPM.O/m=auth2/rt=j/sv=1/d=1/ed=1/am=wQ/rs=AGLTcCP32cKYWLu6pk2Zbi2oypw95OUdug/ 101 KB
35 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:824::200e
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.en_US.-M6wT9WufPM.O/m=auth2/rt=j/sv=1/d=1/ed=1/am=wQ/rs=AGLTcCP32cKYWLu6pk2Zbi2oypw95OUdug/cb=gapi.loaded_0

Requested by

Host: apis.google.com
URL: https://apis.google.com/js/api.js?onload=onLoadCallback

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a00:1450:4001:824::200e , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

f6e9dcf435f4e70c4e6026ca9e813cd475b9a8d75e0c17cafe7efbb4c97c4f64

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 08 Apr 2019 17:14:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Sat, 06 Apr 2019 05:39:49 GMT
server: sffe
age: 341168
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
status: 200
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
alt-svc: quic=":443"; ma=2592000; v="46,44,43,39"
content-length: 35465
x-xss-protection: 0
expires: Tue, 07 Apr 2020 17:14:03 GMT

GET
H2 200 iframe
accounts.google.com/o/oauth2/ Frame A4BE 0
0 61ms
50ms Document
text/html 2a00:1450:4016:800::200d
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://accounts.google.com/o/oauth2/iframe

Requested by

Host: apis.google.com
URL: https://apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.en_US.-M6wT9WufPM.O/m=auth2/rt=j/sv=1/d=1/ed=1/am=wQ/rs=AGLTcCP32cKYWLu6pk2Zbi2oypw95OUdug/cb=gapi.loaded_0

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a00:1450:4016:800::200d , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

ESF /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-jKRreMH8lnJTbnhsQybYJQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /o/cspreport
X-Xss-Protection	0

Request headers

:method: GET
:authority: accounts.google.com
:scheme: https
:path: /o/oauth2/iframe
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
referer: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a
accept-encoding: gzip, deflate, br
cookie: NID=181=OicInnBHC10Og2N-1NxqVRL1B4TRceHCZECWz1eYZDy_cS2EDdFPD4QPctCtYY_Pumf4mCnHHqlZ3VGp8I306gT1nBitqjPVkX0-u7lx1p3AJRYQb-M5JjC6lOMZW_GuvHBLvCgz7QPewznUnxj-UoN7Wq6NNoLbKURm-11AnSk
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a

Response headers

status: 200
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Fri, 12 Apr 2019 16:00:11 GMT
content-language: en-US
content-security-policy: script-src 'report-sample' 'nonce-jKRreMH8lnJTbnhsQybYJQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /o/cspreport
content-encoding: gzip
server: ESF
x-xss-protection: 0
alt-svc: quic=":443"; ma=2592000; v="46,44,43,39"

GET
H2 200 web Show response
onesignal.com/api/v1/sync/17c7c929-fe0d-4fde-bffb-b9cd59135eb5/ 3 KB
2 KB 15ms
12ms Script
text/javascript 2606:4700::6810:cea5
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://onesignal.com/api/v1/sync/17c7c929-fe0d-4fde-bffb-b9cd59135eb5/web?callback=__jp0

Requested by

Host: cdn.onesignal.com
URL: https://cdn.onesignal.com/sdks/OneSignalPageSDKES6.js?v=150703

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700::6810:cea5 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / Phusion Passenger 5.3.5

Resource Hash

8b2ba9a59fb37ece30a677d1237b0d0fa16fddfa85d56497cde230bf4adcda48

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Fri, 12 Apr 2019 16:00:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
x-powered-by: Phusion Passenger 5.3.5
status: 200, 200 OK
vary: Accept-Encoding
x-xss-protection: 1; mode=block
x-request-id: 84253b08-5a68-4946-b32c-dd1fded0afe4
x-runtime: 0.068633
cf-bgj: minify
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=300
cf-polished: origSize=2626
cf-ray: 4c666967cf46c28d-FRA
access-control-allow-headers: SDK-Version
expires: Fri, 12 Apr 2019 16:05:11 GMT

GET
H2 200 fontawesome-webfont.woff2
cdnjs.cloudflare.com/ajax/libs/font-awesome/4.6.3/fonts/ 70 KB
70 KB 20ms
19ms Font
application/octet-stream 2606:4700::6813:c497
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.6.3/fonts/fontawesome-webfont.woff2?v=4.6.3

Requested by

Host: cyware.com
URL: https://cyware.com/build/assets/js/app-95bc624a6c.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6813:c497 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

7dacf83f51179de8d7980a513e67ab3a08f2c6272bb5946df8fd77c0d1763b73

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.6.3/css/font-awesome.min.css
Origin: https://cyware.com

Response headers

date: Fri, 12 Apr 2019 16:00:13 GMT
cf-cache-status: HIT
status: 200
strict-transport-security: max-age=15780000; includeSubDomains
content-length: 71896
last-modified: Thu, 17 May 2018 09:19:12 GMT
server: cloudflare
etag: "5afd4910-118d8"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/octet-stream
access-control-allow-origin: *
expires: Wed, 01 Apr 2020 16:00:13 GMT
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 4c6669762e1dbef8-FRA
served-in-seconds: 0.000

GET
H2 200 ab16693a Show response
cyware.com/comments/news/ 2 B
987 B 548ms
547ms XHR
text/html 54.68.234.114
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL

https://cyware.com/comments/news/ab16693a

Requested by

Host: cyware.com
URL: https://cyware.com/build/assets/js/app-95bc624a6c.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.68.234.114 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

ec2-54-68-234-114.us-west-2.compute.amazonaws.com

Software

nginx /

Resource Hash

4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	nosniff
X-Frame-Options	allow-from https://lynxgrc.com https://www.incidentresponse.com https://cyware.com https://consortiam.net https://securitycurrent.com
X-Xss-Protection	1; mode=block

Request headers

:path: /comments/news/ab16693a
pragma: no-cache
accept-encoding: gzip, deflate, br
x-csrf-token: SqIimAXckcCO064K2DqstHNUOZX6qatipBsstKGI
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: */*
cache-control: no-cache
:authority: cyware.com
x-requested-with: XMLHttpRequest
:scheme: https
referer: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a
:method: GET
Accept: */*
Referer: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a
X-CSRF-Token: SqIimAXckcCO064K2DqstHNUOZX6qatipBsstKGI
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
X-Requested-With: XMLHttpRequest

Response headers

date: Fri, 12 Apr 2019 16:00:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: nginx
x-frame-options: allow-from https://lynxgrc.com https://www.incidentresponse.com https://cyware.com https://consortiam.net https://securitycurrent.com
strict-transport-security: max-age=31536000; includeSubDomains; preload;
content-type: text/html; charset=UTF-8
status: 200
cache-control: no-cache max-age=86400, no-cache, public
set-cookie: XSRF-TOKEN=eyJpdiI6Ild3T01YWWswQm8yUlZtMUZOOHRyWXc9PSIsInZhbHVlIjoidXNVZ0Z4bzFrVnlVaXA2N2RoSm10OUp5V0tOSGR5aElOSGdxVTZTK1VOZXRcL1VuRUdCXC9yOXlNenl2XC9iaWlyWmVwcjdSYlpDMU85UitJRFwvemdUS1h3PT0iLCJtYWMiOiJkMTdlOGU3NzI2MGMyNTgwYjE5NGMwOWY2ZWVlZTg0Y2NkN2U0NTc1MzM0MjI3NTdiZTA3YWZkZjg5ZTg1ODIyIn0%3D; expires=Fri, 12-Apr-2019 18:00:14 GMT; Max-Age=7200; path=/ laravel_session=eyJpdiI6ImVxc3FKWGJ1RFgxbGRmd3c1OFJqRlE9PSIsInZhbHVlIjoiNjVkNWNudDR4OWFhMzF1Snl4K21TZU9CU1hDWVQwTFdHVDJnNHdMc1Q0SUZIbFp5Y3IyY2V0cCtnclkwaXg0TzdCU1E4bE5UNkFTemE5Y1pxTmtOZ3c9PSIsIm1hYyI6IjljY2NlYmIxZmJlNzcyZjI2YzEyOGQ1OGExYWE1MjUxNTQxMzIxM2JiMDg0MjIxOWU4NWIzYzY2ZmUxMTU2MmMifQ%3D%3D; expires=Fri, 12-Apr-2019 18:00:14 GMT; Max-Age=7200; path=/; httponly
x-xss-protection: 1; mode=block

GET
H2 200 fontello.woff
cyware.com/assets/fonts/fontello/ 79 KB
79 KB 202ms
201ms Font
application/font-woff 54.68.234.114
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL

https://cyware.com/assets/fonts/fontello/fontello.woff

Requested by

Host: cyware.com
URL: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.68.234.114 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

ec2-54-68-234-114.us-west-2.compute.amazonaws.com

Software

nginx /

Resource Hash

f48c5f8deeb0331479bca66500a0a4e8ae2bf45cee2dbad0614629a5292b9010

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	nosniff
X-Frame-Options	allow-from https://lynxgrc.com https://www.incidentresponse.com https://cyware.com https://consortiam.net https://securitycurrent.com
X-Xss-Protection	1; mode=block

Request headers

:path: /assets/fonts/fontello/fontello.woff
pragma: no-cache
origin: https://cyware.com
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: */*
cache-control: no-cache
:authority: cyware.com
referer: https://cyware.com/assets/fonts/fontello.css
:scheme: https
:method: GET
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: https://cyware.com/assets/fonts/fontello.css
Origin: https://cyware.com

Response headers

date: Fri, 12 Apr 2019 16:00:13 GMT
x-content-type-options: nosniff
last-modified: Mon, 23 Apr 2018 14:15:02 GMT
server: nginx
etag: "5addea66-13bc0"
x-frame-options: allow-from https://lynxgrc.com https://www.incidentresponse.com https://cyware.com https://consortiam.net https://securitycurrent.com
content-type: application/font-woff
status: 200
cache-control: max-age=86400, no-cache, public
strict-transport-security: max-age=31536000; includeSubDomains; preload;
accept-ranges: bytes
content-length: 80832
x-xss-protection: 1; mode=block

GET
H2 200 icomoon.ttf
cyware.com/enterprise-cdn/fonts/ 2 KB
3 KB 198ms
198ms Font
application/octet-stream 54.68.234.114
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL

https://cyware.com/enterprise-cdn/fonts/icomoon.ttf?x1l033

Requested by

Host: cyware.com
URL: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.68.234.114 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

ec2-54-68-234-114.us-west-2.compute.amazonaws.com

Software

nginx /

Resource Hash

e45af4ca61ef501d36fc890a2b64f954886a6fbf345717da66ff185c0e9ec837

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	nosniff
X-Frame-Options	allow-from https://lynxgrc.com https://www.incidentresponse.com https://cyware.com https://consortiam.net https://securitycurrent.com
X-Xss-Protection	1; mode=block

Request headers

:path: /enterprise-cdn/fonts/icomoon.ttf?x1l033
pragma: no-cache
origin: https://cyware.com
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: */*
cache-control: no-cache
:authority: cyware.com
referer: https://cyware.com/enterprise-cdn/css/style.css
:scheme: https
:method: GET
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: https://cyware.com/enterprise-cdn/css/style.css
Origin: https://cyware.com

Response headers

date: Fri, 12 Apr 2019 16:00:13 GMT
x-content-type-options: nosniff
last-modified: Mon, 23 Apr 2018 14:15:02 GMT
server: nginx
etag: "5addea66-87c"
x-frame-options: allow-from https://lynxgrc.com https://www.incidentresponse.com https://cyware.com https://consortiam.net https://securitycurrent.com
content-type: application/octet-stream
status: 200
cache-control: max-age=86400, no-cache, public
strict-transport-security: max-age=31536000; includeSubDomains; preload;
accept-ranges: bytes
content-length: 2172
x-xss-protection: 1; mode=block

GET
H2 200 webPushAnalytics
onesignal.com/ Frame A256 0
0 12ms
11ms Document
text/html 2606:4700::6810:cea5
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://onesignal.com/webPushAnalytics
Requested by: Host: cdn.onesignal.com
URL: https://cdn.onesignal.com/sdks/OneSignalPageSDKES6.js?v=150703
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:cea5 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

:method: GET
:authority: onesignal.com
:scheme: https
:path: /webPushAnalytics
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
referer: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: https://cyware.com/news/vsdc-website-gets-infected-with-a-banking-trojan-and-an-info-stealer-ab16693a

Response headers

status: 200
date: Fri, 12 Apr 2019 16:00:16 GMT
content-type: text/html
set-cookie: __cfduid=d656ebc828b6d90657433c9d8b4ac7ef01555084816; expires=Sat, 11-Apr-20 16:00:16 GMT; path=/; domain=.onesignal.com; HttpOnly
last-modified: Thu, 11 Apr 2019 22:27:24 GMT
cf-cache-status: HIT
expires: Fri, 12 Apr 2019 17:00:16 GMT
cache-control: public, max-age=3600
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
server: cloudflare
cf-ray: 4c666984698bc28d-FRA
content-encoding: gzip

Verdicts & Comments Add Verdict or Comment

131 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	error	URL: https://cdn.onesignal.com/sdks/OneSignalPageSDKES6.js?v=150703(Line 1) Message: TypeError: Cannot read property 'permission' of undefined

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	nosniff
X-Frame-Options	allow-from https://lynxgrc.com https://www.incidentresponse.com https://cyware.com https://consortiam.net https://securitycurrent.com
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

accounts.google.com
apis.google.com
cdn.onesignal.com
cdnjs.cloudflare.com
cyware.com
fonts.googleapis.com
fonts.gstatic.com
googleads.g.doubleclick.net
onesignal.com
stats.g.doubleclick.net
www.google-analytics.com
www.google.com
www.google.de
www.googleadservices.com
172.217.18.98
2606:4700::6810:cea5
2606:4700::6813:c397
2606:4700::6813:c497
2a00:1450:4001:806::2003
2a00:1450:4001:808::2002
2a00:1450:4001:808::2003
2a00:1450:4001:80b::200a
2a00:1450:4001:815::2004
2a00:1450:4001:81f::200e
2a00:1450:4001:824::200e
2a00:1450:400c:c07::9a
2a00:1450:4016:800::200d
54.68.234.114
006f4b582b277a087453c2a96da3cd05a2f14f133ab835cfc09f36e779c0aa48
008a1d103902f15fdb1c191fcb1ce8954330e7b8de43d09abb08555ba609f420
036d841b132c14046e26d8f2da1bc634c6ad34885ed1295660694a91c98933a6
04a5268eb8af9144e7b5d40ac54677c1c8f73d30385229e8e6bf96e4ca014b5c
05120b6ff0a4018e989c611237c44565f83a674789b6c55eb7c780d5adf9f813
0e10b6e9c0b5b9586c6cdf307466474b438989e57732c2b41ec69b03b363533b
0e8c6f4c2c25fff4293caa4a811da95de10b226c9f009a9ce92cf966a7cd790e
10f80d65795b91f649771c8fe006534ebecdc752b6455a80b0ae4f442c9e683b
114e0fbd8281bc352242b55aca9e63593486e044405c8fdf233e4b0f0a97b230
1174de7545f8068905a8bc9ab7205cb8f5fcdad681a1ca5802ea3298fe90c1dd
1b4db5f8870f0aaeb13d48cc04ddecaf0eafadbd1ef23503b2098821b4643d6c
20e4ae409ffbe8bfd2af14d7f717398408ae8b481005beccb83d62ef4052b681
311263079253a7154b22ea644158f710744d93fd4d1e6baf69fa8f2cfe9d48e4
3d1d97701f3bb301c71e6a47cfdccdd580cd9c8ea9fb02e3c822307c83eda0cf
3e552578c7d450b023f2cd9d28f830be4335c3acc6c4ab6dadda0769f09e5f22
3eca2f7a428c7d60d1649538e4552740ce043df021e618b32943481689a8cfaa
3ff9045847adfe2ae953ccf7e895122bb3f596dee094bf54aa1080dabe946592
450a8086ad892febf2348c34e08e0934dca9f6cf173dc5bc55452bd55a67cfcc
4a3952caa0dc47a55f58f2373590368376c7505826ecc6d141e3dd54deab118e
4f4767b497a8593857a7bd4bee7ef3878f6af9f64f14e9e8ebea1437332dc0ee
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
50421864373726117671113bda485e50036446bf071e2e1e78bba9a4ca568e35
50e6134276d81a8b3d0c47ffc68a3e78c15a53316f956932ee0b61f59c11472a
561498872b20fd40967c2a3794793c85dcafbd9fc5d14b49d34acf959f58c691
57e3625232492994b84a777179caa2999b706515c4bb5751cce858e399698809
57e6d7c1ef764bafd0badfd7a0c6fc423d770b35d562f46131a6c61f7b5083ea
59a61c6fd32ad89e4d7e02e5cd8e0d280913c16eaedc30ac0520203af3e1a53a
607635ff2c2e482d08141e295e3dbd4b34985fbd9837d86f40cd845fb78aa20f
6103097e7a7c38345608a2084025a92b068a5acf4977e9c29ea5662943f77594
63514f4ff2a9e50d3a42cb866816043754b390ea84351545ea04fbc9495707be
63a23cb228a3b6e6a33e3a12e6c5bcdf13fe0b28346ccdadca36097a4b13ac50
67c059eb07eb778c21c8406a563d276e02c5399bd1b55c4598f65db0bc3a2942
68ca5571204192df1a01690243d505f53eb68c56873fd1d9259fb606f4c8e903
68e5a00cd12a6092781cbd923ee619314a35d51cbbd07c444afa12be06429e99
6a2550a485a9327f07f42f27f3fdf29fe3d7e47fb337e4ca0df3f4b503547893
6e64c633fbebe6ad2558e6d164a7cc8828ae2217b8f5b1d01ed1bf4059702951
761fa7528c900befe0204a194b8e6ec20c7d9d6f334a36b65f84b72e4db17f5b
7703d23b349ce43667f86c195a45f7217cd7ac754bb4e518b4d70b8765e4731e
7dacf83f51179de8d7980a513e67ab3a08f2c6272bb5946df8fd77c0d1763b73
7dcd5262ac1d4da9d9b3bddb7104f7b3fd8d3d85a4c8495f5d9a4d7a5837bd9f
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
8404ea0d5375cd8990d5ed08d692ba6eb56fbba33498c202cf652d4e321cc055
873a77dc58b11c7a41902e597a40feaa2e4a44cba62e59f36156703c437c9e87
8b2ba9a59fb37ece30a677d1237b0d0fa16fddfa85d56497cde230bf4adcda48
8c2388a4ac729c06d3cdf6b8e71833e2097c09906dde714850532d170d2cc56f
8d53f618b46864ea125aad59935c1f25cf4c623c99ef990cf76b37a512c818e3
90bb48597c7b717d6f39368bbd81d16e2d4cd17293ff2e854ec6199ceab1808b
920712ec1a6003b2511b5b540a602a51be63aaccaf86049c540a34f9e9799686
92626e3aef4197dfd4ec2ffe0ed25bf50fecb5e7e088bf9b583d40c87a2c723c
96696e91e54716b8bc6e223cbea1dcea3cddd6b47dfc94d8d9f0b67a8b1456f9
98c2b230213c15bd50f1358e4737eaa86a9e931b96701d819480c403b9890681
9b003dbc18a1bb2188353f0f9a67ba45f113901a28b5a27f0e5cb4501475a9fc
9baad10e85c5be8d5697086479983b6b477197103bf8f0f11817b1bdfb9a7451
ac567abcdbb2e833a4785dbe5f85597d6fd84cacbfa95a5d6ccd1b9eed86f231
af3b2be48ab334e0cacd5dd12cad15bffb16a624cb8669bdf0ff65a6f3df5059
b7680f30199f65ce3b2620713f7cb27a175560ea7402e0b4cba01c5d54508a17
b86c6b041b5557452e973e5f07cbf542c02da2cbcaeb33315130d70abcd666d2
bac26b9fa83e0b210044bfed0de04b57f842f458476da8260d1556ede6542912
bd6e56e7f8ef4922203fda7bea65ff2d112ac295a7c784ba5644c46546449643
c06bf50ee88cc2dff2592b428a13e50ddf4af9e2ea41ef12fad2f4ccf2c9e6e2
c07b7c5718ed916e7c46b22170f6eea8e0db670808629a60e0219321db6d5322
c767a43c0012cdcb76e32f2f3b5005e054ba60fcf52653f7c456f0044e14f1d3
ca9de8b3be7ccd4b80774a9c7dd56a98c49c276771c5957729b5958d1d579112
cdf908d3e04492b9bee1a4184686b545c5896b326136ce1c056232c99d23c97d
d3760888ff21751d5deb28a4effe491a2f38bc7aa38ce5e6cbebd4cc1f07db3a
e45af4ca61ef501d36fc890a2b64f954886a6fbf345717da66ff185c0e9ec837
ecb2b44000c52e31f735ec551a34feb4420ecd41473ad1317bafabc957b9e4ec
ed1938bc88c7715a349a183684d6b85185648f3f3b251b3829454e6ba9d13437
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
ef73ce9ddc8cf4f4d45f6d02b3f6090150fcfe1c4555c1a99304bbd092de792e
f48c5f8deeb0331479bca66500a0a4e8ae2bf45cee2dbad0614629a5292b9010
f49b8dfc7bec82ea7c10c2fc647567f7bd5637353d5da351c5e1fe29af2ebf0d
f6e9dcf435f4e70c4e6026ca9e813cd475b9a8d75e0c17cafe7efbb4c97c4f64
f7ac8ff57ddf44369455191ecbc4eff5c6847bf8bb23d303e0dd5fb7e76a68fc

cyware.com Open in urlscan Pro 54.68.234.114 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

77 Requests

100 %HTTPS

86 %IPv6

10 Domains

14 Subdomains

14 IPs

2 Countries

1935 kBTransfer

3154 kBSize

0 Cookies

19 Outgoing links

Redirected requests

77 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

cyware.com Open in urlscan Pro
54.68.234.114 Public Scan

Screenshot
Live screenshot

Full Image

77
Requests

100 %
HTTPS

86 %
IPv6

10
Domains

14
Subdomains

14
IPs

2
Countries

1935 kB
Transfer

3154 kB
Size

0
Cookies

77 HTTP transactions
0 data transactions