intezer.com Open in urlscan Pro
199.16.172.82 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/)
Effective URL:
https://intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/
Submission: On May 30 via api (May 30th 2023, 3:10:33 pm UTC) from TR — Scanned from DE

Summary HTTP 183 Redirects Links 31 Behaviour Indicators

Summary

This website contacted 42 IPs in 4 countries across 34 domains to perform 183 HTTP transactions. The main IP is 199.16.172.82, located in United States and belongs to AUTOMATTIC, US. The main domain is intezer.com. The Cisco Umbrella rank of the primary domain is 921956.
TLS certificate: Issued by R3 on May 5th 2023. Valid for: 3 months.

This is the only time intezer.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 11	199.16.172.82 199.16.172.82	2635 (AUTOMATTIC) (AUTOMATTIC)
85	192.0.77.39 192.0.77.39	2635 (AUTOMATTIC) (AUTOMATTIC)
3	2606:4700:10:... 2606:4700:10::6816:46c5	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	2a00:1450:400... 2a00:1450:4001:828::2008	15169 (GOOGLE) (GOOGLE)
1	2600:9000:225... 2600:9000:225e:ce00:4:d7e1:700:93a1	16509 (AMAZON-02) (AMAZON-02)
2	2a03:2880:f08... 2a03:2880:f083:9:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
1	2a00:1450:400... 2a00:1450:4001:812::200a	15169 (GOOGLE) (GOOGLE)
2	2606:4700::68... 2606:4700::6812:853b	13335 (CLOUDFLAR...) (CLOUDFLARENET)
8	2a00:1450:400... 2a00:1450:4001:831::2004	15169 (GOOGLE) (GOOGLE)
2	192.0.76.3 192.0.76.3	2635 (AUTOMATTIC) (AUTOMATTIC)
1	142.250.186.66 142.250.186.66	15169 (GOOGLE) (GOOGLE)
7	2a00:1450:400... 2a00:1450:4001:806::2003	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:801::2002	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:82b::200e	15169 (GOOGLE) (GOOGLE)
1	146.75.116.157 146.75.116.157	54113 (FASTLY) (FASTLY)
1	2a02:26f0:350... 2a02:26f0:3500:16::215:148d	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	18.66.97.49 18.66.97.49	16509 (AMAZON-02) (AMAZON-02)
1	2a04:4e42::396 2a04:4e42::396	54113 (FASTLY) (FASTLY)
1 2	151.139.128.10 151.139.128.10	20446 (STACKPATH...) (STACKPATH-CDN)
1	2606:4700::68... 2606:4700::6812:19c4	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6811:64ac	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6810:8bce	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	13.224.189.77 13.224.189.77	16509 (AMAZON-02) (AMAZON-02)
4	2a00:1450:400... 2a00:1450:4001:82a::2003	15169 (GOOGLE) (GOOGLE)
2	52.71.12.253 52.71.12.253	14618 (AMAZON-AES) (AMAZON-AES)
5	2a00:1450:400... 2a00:1450:4001:830::2003	15169 (GOOGLE) (GOOGLE)
1	151.101.1.140 151.101.1.140	54113 (FASTLY) (FASTLY)
2	104.244.42.133 104.244.42.133	13414 (TWITTER) (TWITTER)
2	104.244.42.3 104.244.42.3	13414 (TWITTER) (TWITTER)
2	2a00:1450:400... 2a00:1450:400c:c00::9d	15169 (GOOGLE) (GOOGLE)
1	52.222.236.43 52.222.236.43	16509 (AMAZON-02) (AMAZON-02)
1	2001:4860:480... 2001:4860:4802:32::36	15169 (GOOGLE) (GOOGLE)
1	2600:9000:20e... 2600:9000:20eb:9800:2:53b2:240:93a1	16509 (AMAZON-02) (AMAZON-02)
4 4	2620:1ec:21::14 2620:1ec:21::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	13.107.42.14 13.107.42.14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
5	2606:4700::68... 2606:4700::6813:9a53	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 4	2620:1ec:c11:... 2620:1ec:c11::200	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	52.31.230.164 52.31.230.164	16509 (AMAZON-02) (AMAZON-02)
1	54.216.0.137 54.216.0.137	16509 (AMAZON-02) (AMAZON-02)
2	2620:1ec:4e:1... 2620:1ec:4e:1::60	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
5	2606:4700::68... 2606:4700::6812:8c65	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	20.231.53.73 20.231.53.73	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1 2	68.219.88.97 68.219.88.97	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
183	42

11 199.16.172.82 (United States) 1 redirects

ASN2635 (AUTOMATTIC, US)

intezer.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

85 192.0.77.39 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)
PTR: wordpress.com

149520725.v2.pressablecdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2606:4700:10::6816:46c5 (United States)

ASN13335 (CLOUDFLARENET, US)

static.addtoany.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:828::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:225e:ce00:4:d7e1:700:93a1 (United States)

ASN16509 (AMAZON-02, US)

sc.lfeeder.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f083:9:face:b00c:0:3 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:812::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6812:853b (United States)

ASN13335 (CLOUDFLARENET, US)

js.hs-scripts.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2a00:1450:4001:831::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 192.0.76.3 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)

stats.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pixel.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.186.66 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s05-in-f2.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2a00:1450:4001:806::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:801::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:82b::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 146.75.116.157 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

static.ads-twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:3500:16::215:148d (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

snap.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.66.97.49 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-66-97-49.fra56.r.cloudfront.net

static.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42::396 (United States)

ASN54113 (FASTLY, US)

www.redditstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 151.139.128.10 (United States) 1 redirects

ASN20446 (STACKPATH-CDN, US)
PTR: map3.hwcdn.net

cdn.mouseflow.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:19c4 (United States)

ASN13335 (CLOUDFLARENET, US)

js.hs-banner.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:64ac (United States)

ASN13335 (CLOUDFLARENET, US)

js.usemessages.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:8bce (United States)

ASN13335 (CLOUDFLARENET, US)

js.hs-analytics.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.224.189.77 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-224-189-77.fra2.r.cloudfront.net

tr-rc.lfeeder.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:82a::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.71.12.253 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-71-12-253.compute-1.amazonaws.com

secure.gaug.es	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:830::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.1.140 (United States)

ASN54113 (FASTLY, US)

alb.reddit.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.244.42.133 (United States)

ASN13414 (TWITTER, US)

t.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.244.42.3 (United States)

ASN13414 (TWITTER, US)

analytics.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:400c:c00::9d (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.222.236.43 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-222-236-43.fra56.r.cloudfront.net

script.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4860:4802:32::36 (United States)

ASN15169 (GOOGLE, US)

region1.analytics.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:20eb:9800:2:53b2:240:93a1 (United States)

ASN16509 (AMAZON-02, US)

cdn.linkedin.oribi.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2620:1ec:21::14 (United States) 4 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.107.42.14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px4.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2606:4700::6813:9a53 (United States)

ASN13335 (CLOUDFLARENET, US)

api.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
app.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
track.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2620:1ec:c11::200 (United States) 1 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

bat.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
c.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.31.230.164 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-31-230-164.eu-west-1.compute.amazonaws.com

in.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.216.0.137 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-216-0-137.eu-west-1.compute.amazonaws.com

content.hotjar.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2620:1ec:4e:1::60 (United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

www.clarity.ms	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2606:4700::6812:8c65 (United States)

ASN13335 (CLOUDFLARENET, US)

static.hsappstatic.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 20.231.53.73 (Tappahannock, United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

q.clarity.ms	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 68.219.88.97 (Dublin, Ireland) 1 redirects

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

c.clarity.ms	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
85	pressablecdn.com 149520725.v2.pressablecdn.com	1 MB
11	gstatic.com fonts.gstatic.com www.gstatic.com	544 KB
11	intezer.com 1 redirects intezer.com — Cisco Umbrella Rank: 921956	101 KB
9	google.com www.google.com — Cisco Umbrella Rank: 2 region1.analytics.google.com — Cisco Umbrella Rank: 3686	47 KB
7	clarity.ms 1 redirects www.clarity.ms — Cisco Umbrella Rank: 952 q.clarity.ms — Cisco Umbrella Rank: 7704 c.clarity.ms — Cisco Umbrella Rank: 1495	27 KB
5	hsappstatic.net static.hsappstatic.net — Cisco Umbrella Rank: 5335	294 KB
5	hubspot.com api.hubspot.com — Cisco Umbrella Rank: 4501 app.hubspot.com — Cisco Umbrella Rank: 5082 track.hubspot.com — Cisco Umbrella Rank: 2133	23 KB
5	linkedin.com 4 redirects px.ads.linkedin.com — Cisco Umbrella Rank: 339 www.linkedin.com — Cisco Umbrella Rank: 603 px4.ads.linkedin.com — Cisco Umbrella Rank: 6328	4 KB
5	google.de www.google.de — Cisco Umbrella Rank: 6080	841 B
5	doubleclick.net googleads.g.doubleclick.net — Cisco Umbrella Rank: 34 stats.g.doubleclick.net — Cisco Umbrella Rank: 76	5 KB
4	bing.com 1 redirects bat.bing.com — Cisco Umbrella Rank: 343 c.bing.com — Cisco Umbrella Rank: 232	15 KB
3	hotjar.com static.hotjar.com — Cisco Umbrella Rank: 633 script.hotjar.com — Cisco Umbrella Rank: 793 in.hotjar.com — Cisco Umbrella Rank: 5511	73 KB
3	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 30	67 KB
3	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 40	252 KB
3	addtoany.com static.addtoany.com — Cisco Umbrella Rank: 3728	27 KB
2	twitter.com analytics.twitter.com — Cisco Umbrella Rank: 637	634 B
2	t.co t.co — Cisco Umbrella Rank: 516	581 B
2	gaug.es secure.gaug.es — Cisco Umbrella Rank: 27315	4 KB
2	mouseflow.com 1 redirects cdn.mouseflow.com — Cisco Umbrella Rank: 6582	17 KB
2	wp.com stats.wp.com — Cisco Umbrella Rank: 2626 pixel.wp.com — Cisco Umbrella Rank: 2471	5 KB
2	hs-scripts.com js.hs-scripts.com — Cisco Umbrella Rank: 2208	2 KB
2	facebook.net connect.facebook.net — Cisco Umbrella Rank: 157	115 KB
2	lfeeder.com sc.lfeeder.com — Cisco Umbrella Rank: 13459 tr-rc.lfeeder.com — Cisco Umbrella Rank: 18558	12 KB
1	hotjar.io content.hotjar.io — Cisco Umbrella Rank: 6022	161 B
1	oribi.io cdn.linkedin.oribi.io — Cisco Umbrella Rank: 825	377 B
1	reddit.com alb.reddit.com — Cisco Umbrella Rank: 1480	157 B
1	hs-analytics.net js.hs-analytics.net — Cisco Umbrella Rank: 1980	21 KB
1	usemessages.com js.usemessages.com — Cisco Umbrella Rank: 4470	22 KB
1	hs-banner.com js.hs-banner.com — Cisco Umbrella Rank: 1986	16 KB
1	redditstatic.com www.redditstatic.com — Cisco Umbrella Rank: 1323	8 KB
1	licdn.com snap.licdn.com — Cisco Umbrella Rank: 725	5 KB
1	ads-twitter.com static.ads-twitter.com — Cisco Umbrella Rank: 651	15 KB
1	googleadservices.com www.googleadservices.com — Cisco Umbrella Rank: 174	18 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 35	2 KB
183	34

	Domain	Requested by
85	149520725.v2.pressablecdn.com	intezer.com 149520725.v2.pressablecdn.com
11	intezer.com	1 redirects intezer.com 149520725.v2.pressablecdn.com
8	www.google.com	intezer.com www.gstatic.com www.google.com
7	fonts.gstatic.com	intezer.com fonts.googleapis.com www.google.com
5	static.hsappstatic.net	app.hubspot.com static.hsappstatic.net
5	www.google.de	intezer.com
4	www.gstatic.com	www.google.com www.gstatic.com
3	q.clarity.ms	www.clarity.ms
3	bat.bing.com	intezer.com bat.bing.com
3	px.ads.linkedin.com	3 redirects
3	www.google-analytics.com	www.googletagmanager.com intezer.com
3	googleads.g.doubleclick.net	www.googletagmanager.com www.googleadservices.com
3	www.googletagmanager.com	intezer.com www.googletagmanager.com
3	static.addtoany.com	intezer.com static.addtoany.com
2	c.clarity.ms	1 redirects
2	www.clarity.ms	bat.bing.com www.clarity.ms
2	app.hubspot.com	js.usemessages.com static.hsappstatic.net
2	api.hubspot.com	js.usemessages.com
2	stats.g.doubleclick.net	www.google-analytics.com www.googletagmanager.com
2	analytics.twitter.com	intezer.com
2	t.co	intezer.com
2	secure.gaug.es	intezer.com
2	cdn.mouseflow.com	1 redirects intezer.com
2	js.hs-scripts.com	intezer.com
2	connect.facebook.net	intezer.com connect.facebook.net
1	c.bing.com	1 redirects
1	track.hubspot.com
1	content.hotjar.io	script.hotjar.com
1	in.hotjar.com	script.hotjar.com
1	pixel.wp.com	intezer.com
1	px4.ads.linkedin.com	intezer.com
1	www.linkedin.com	1 redirects
1	cdn.linkedin.oribi.io	snap.licdn.com
1	region1.analytics.google.com	www.googletagmanager.com
1	script.hotjar.com	static.hotjar.com
1	alb.reddit.com	intezer.com
1	tr-rc.lfeeder.com	intezer.com
1	js.hs-analytics.net	js.hs-scripts.com
1	js.usemessages.com	js.hs-scripts.com
1	js.hs-banner.com	js.hs-scripts.com
1	www.redditstatic.com	www.googletagmanager.com
1	static.hotjar.com	www.googletagmanager.com
1	snap.licdn.com	www.googletagmanager.com
1	static.ads-twitter.com	www.googletagmanager.com
1	www.googleadservices.com	intezer.com
1	stats.wp.com	intezer.com
1	fonts.googleapis.com	intezer.com
1	sc.lfeeder.com	intezer.com
183	48

This site contains links to these domains. Also see Links.

Domain
www.intezer.com
support.intezer.com
analyze.intezer.com
unit42.paloaltonetworks.com
github.com
learn.microsoft.com
www.bcb.gov.br
cybergeeks.tech
support.microsoft.com
twitter.com
www.youtube.com
www.linkedin.com
www.addtoany.com

Subject Issuer	Validity	Valid
tls.automattic.com R3	`2023-05-05` - `2023-08-03`	3 months	crt.sh
*.v2.pressablecdn.com Sectigo RSA Domain Validation Secure Server CA	`2022-07-21` - `2023-08-21`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2023-05-04` - `2024-05-03`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2023-05-08` - `2023-07-31`	3 months	crt.sh
*.lfeeder.com Amazon RSA 2048 M01	`2023-02-28` - `2023-08-07`	5 months	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2023-03-08` - `2023-06-06`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2023-05-08` - `2023-07-31`	3 months	crt.sh
www.google.com GTS CA 1C3	`2023-05-08` - `2023-07-31`	3 months	crt.sh
*.wp.com Sectigo ECC Domain Validation Secure Server CA	`2022-11-14` - `2023-12-15`	a year	crt.sh
www.googleadservices.com GTS CA 1C3	`2023-05-08` - `2023-07-31`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2023-05-08` - `2023-07-31`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2023-05-08` - `2023-07-31`	3 months	crt.sh
ads-twitter.com DigiCert TLS RSA SHA256 2020 CA1	`2022-07-22` - `2023-08-22`	a year	crt.sh
snap.licdn.com DigiCert SHA2 Secure Server CA	`2023-02-01` - `2024-01-31`	a year	crt.sh
*.hotjar.com Amazon ECDSA 256 M01	`2023-03-09` - `2024-04-06`	a year	crt.sh
www.redditstatic.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-04-12` - `2023-10-08`	6 months	crt.sh
*.gaug.es Sectigo RSA Domain Validation Secure Server CA	`2023-03-02` - `2024-04-01`	a year	crt.sh
www.google.de GTS CA 1C3	`2023-05-08` - `2023-07-31`	3 months	crt.sh
*.reddit.com DigiCert TLS RSA SHA256 2020 CA1	`2023-04-19` - `2023-10-15`	6 months	crt.sh
t.co DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2023-02-05` - `2024-02-05`	a year	crt.sh
*.twitter.com DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2023-02-05` - `2024-02-05`	a year	crt.sh
*.google.com GTS CA 1C3	`2023-05-08` - `2023-07-31`	3 months	crt.sh
linkedin.oribi.io Amazon RSA 2048 M01	`2023-02-24` - `2023-08-06`	5 months	crt.sh
hubspot.com Cloudflare Inc ECC CA-3	`2023-02-05` - `2024-02-05`	a year	crt.sh
*.google.de GTS CA 1C3	`2023-05-08` - `2023-07-31`	3 months	crt.sh
www.bing.com Microsoft RSA TLS CA 02	`2023-02-16` - `2023-08-16`	6 months	crt.sh
*.hotjar.io Amazon ECDSA 256 M02	`2023-03-02` - `2024-03-30`	a year	crt.sh
www.clarity.ms DigiCert TLS RSA SHA256 2020 CA1	`2022-12-01` - `2023-12-01`	a year	crt.sh
hsappstatic.net Cloudflare Inc ECC CA-3	`2023-04-10` - `2024-04-09`	a year	crt.sh
a.clarity.ms Microsoft Azure TLS Issuing CA 06	`2023-02-13` - `2024-02-08`	a year	crt.sh

This page contains 4 frames:

Primary Page: https://intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/
Frame ID: F987AF8B015C8EC3D4126CD01490361C
Requests: 166 HTTP requests in this frame

Frame: https://static.addtoany.com/menu/sm.24.html
Frame ID: 8EF14CF3B8B908ED2E9E3ABC2BB809A3
Requests: 1 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LewXc8UAAAAADEYz8dYpHTk55uH2MjKqbyc1sXD&co=aHR0cHM6Ly9pbnRlemVyLmNvbTo0NDM.&hl=de&v=CDFvp7CXAHw7k3HxO47Gm1O9&size=invisible&cb=chxubxafc7zi
Frame ID: 5F391B4EC0A43030FFC45CA061E6A865
Requests: 8 HTTP requests in this frame

Frame: https://app.hubspot.com/conversations-visitor/5492986/threads/utk/6eeeff8c49604e78998746aef0504874?uuid=159a9c4cd36749a78bc6e9266a67c308&mobile=false&mobileSafari=false&hideWelcomeMessage=false&hstc=null&domain=intezer.com&inApp53=false&messagesUtk=6eeeff8c49604e78998746aef0504874&url=https%3A%2F%2Fintezer.com%2Fblog%2Fresearch%2Fcryptoclippy-evolves-to-pilfer-more-financial-data%2F&inline=false&isFullscreen=false&globalCookieOptOut=null&isFirstVisitorSession=true&isAttachmentDisabled=false&enableWidgetCookieBanner=false&isInCMS=false
Frame ID: D67A723C3D48A24F9A7F92B2C7AFFD4A
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

CryptoClippy Evolves to Pilfer Even More Financial Data

Page URL History Show full URLs

https://intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/) HTTP 301
https://intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/ Page URL

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

/wp-(?:content|includes)/

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

AddToAny (Widgets) Expand

Overall confidence: 100%
Detected patterns

addtoany\.com/menu/page\.js

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

Hotjar (Analytics) Expand

Overall confidence: 100%
Detected patterns

//static\.hotjar\.com/

HubSpot Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

js\.hs-analytics\.net/analytics

Linkedin Insight Tag (Analytics) Expand

Overall confidence: 100%
Detected patterns

snap\.licdn\.com/li\.lms-analytics/insight\.min\.js

Mouse Flow (Analytics) Expand

Overall confidence: 100%
Detected patterns

cdn\.mouseflow\.com

Swiper Slider (Miscellaneous) Expand

Overall confidence: 100%
Detected patterns

swiper(?:\.min)?\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

reCAPTCHA (Captchas) Expand

Overall confidence: 100%
Detected patterns

/recaptcha/api\.js

Page Statistics

183
Requests

98 %
HTTPS

58 %
IPv6

34
Domains

48
Subdomains

42
IPs

4
Countries

2852 kB
Transfer

8058 kB
Size

47
Cookies

31 Outgoing links

These are links going to different origins than the main page.

URL: https://www.intezer.com/terms-of-use/
Title: Terms of Use

Search URL Search Domain Scan URL

URL: https://www.intezer.com/privacy/
Title: Privacy Policy

Search URL Search Domain Scan URL

URL: https://support.intezer.com/hc/en-us/
Title: Documentation Dig into documentation about setup, integrations, and working with Intezer’s API

Search URL Search Domain Scan URL

URL: https://analyze.intezer.com/sign-in/?utm_campaign=login-btn&utm_source=intezer
Title: Log in

Search URL Search Domain Scan URL

URL: https://analyze.intezer.com/
Title: Get Free AccountJoin Now

Search URL Search Domain Scan URL

URL: https://unit42.paloaltonetworks.com/crypto-clipper-targets-portuguese-speakers/
Title: report

Search URL Search Domain Scan URL

URL: https://analyze.intezer.com/files/19f0f8831ef9d561f6dc395eff55d165d614fa06d13a9a3d39b120ef18242f12
Title: .NET sample

Search URL Search Domain Scan URL

URL: https://analyze.intezer.com/analyses/97a2e3e1-44da-433e-8b20-a1d5f4200160/genetic-analysis
Title: this file

Search URL Search Domain Scan URL

URL: https://github.com/PowerShellMafia/PowerSploit/blob/master/CodeExecution/Invoke-Shellcode.ps1
Title: open-source project

Search URL Search Domain Scan URL

URL: https://analyze.intezer.com/files/894ad71e6fea9a5068512a7de5c2b176bc9556acf96284f131614d0e402059dc
Title: loader

Search URL Search Domain Scan URL

URL: https://analyze.intezer.com/files/89d7c8c7846068c4f618f80d18944f2fcf47cbebe7390d73c1f16ef0ed48d90b
Title: reported

Search URL Search Domain Scan URL

URL: https://github.com/jthuraisamy/SysWhispers2
Title: SysWhisper

Search URL Search Domain Scan URL

URL: https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/wdm/nf-wdm-rtlgetversion
Title: RtlGetVersion

Search URL Search Domain Scan URL

URL: https://learn.microsoft.com/en-us/windows/win32/api/winnt/ns-winnt-osversioninfoa
Title: OSVERSIONINFOEX.wProductType

Search URL Search Domain Scan URL

URL: https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/wdm/ns-wdm-_osversioninfoexw
Title: documentation

Search URL Search Domain Scan URL

URL: https://analyze.intezer.com/files/d2c85de7c763e8d8990d06f78f226fda36443253c63678c7c0e998499f3af61a
Title: sample

Search URL Search Domain Scan URL

URL: https://www.bcb.gov.br/content/estabilidadefinanceira/forumpireunioes/Anexo%20I%20-%20Padr%C3%B5es%20para%20Inicia%C3%A7%C3%A3o%20do%20PIX.pdf
Title: document

Search URL Search Domain Scan URL

URL: https://learn.microsoft.com/en-us/windows/win32/api/sysinfoapi/nf-sysinfoapi-getsystemfirmwaretable
Title: GetSystemFirmwareTable

Search URL Search Domain Scan URL

URL: https://learn.microsoft.com/en-us/windows/win32/api/combaseapi/nf-combaseapi-cocreateinstance
Title: CoCreateInstance

Search URL Search Domain Scan URL

URL: https://learn.microsoft.com/en-us/windows/win32/com/clsid-key-hklm
Title: CLSID

Search URL Search Domain Scan URL

URL: https://learn.microsoft.com/en-us/windows/win32/api/securitybaseapi/nf-securitybaseapi-gettokeninformation
Title: GetTokenInformation

Search URL Search Domain Scan URL

URL: https://learn.microsoft.com/en-us/windows/win32/api/winnt/ne-winnt-token_elevation_type
Title: TOKEN_ELEVATION_TYPE

Search URL Search Domain Scan URL

URL: https://cybergeeks.tech/a-step-by-step-analysis-of-a-new-version-of-darkside-ransomware/#:~:text=%20the%20ransomware%20can%20perform%20privilege%20escalation%20using%20the%20cmstplua%20com%20interface%20and%20achieves%20persistence%20by%20installing%20itself%20as%20a%20service.%20
Title: DarkSide ransomware

Search URL Search Domain Scan URL

URL: https://learn.microsoft.com/en-us/virtualization/community/team-blog/2010/20100317-explaining-microsoft-remotefx
Title: RemoteFX

Search URL Search Domain Scan URL

URL: https://support.microsoft.com/en-us/topic/kb4570006-update-to-disable-and-remove-the-remotefx-vgpu-component-in-windows-bbdf1531-7188-2bf4-0de6-641de79f09d2
Title: deprecated

Search URL Search Domain Scan URL

URL: https://twitter.com/NicoleFishi19

Search URL Search Domain Scan URL

URL: https://www.youtube.com/channel/UCt5L5ztHh-C1NCKa6bKjXFQ
Title: Youtube

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/intezer-labs
Title: Linkedin

Search URL Search Domain Scan URL

URL: https://twitter.com/intezerlabs
Title: Twitter

Search URL Search Domain Scan URL

URL: https://analyze.intezer.com/sign-in
Title: Log In

Search URL Search Domain Scan URL

URL: https://www.addtoany.com/
Title: AddToAny

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/) HTTP 301
https://intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 111

https://cdn.mouseflow.com/projects/0a2b546a-2cdc-4e6f-8031-6303b379fd45.js HTTP 301
https://cdn.mouseflow.com/projects/0a2b546a-2cdc-4e6f-8031-6303b379fd45_eu.js

Request Chain 144

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1327356&time=1685459426709&url=https%3A%2F%2Fintezer.com%2Fblog%2Fresearch%2Fcryptoclippy-evolves-to-pilfer-more-financial-data%2F HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1327356&time=1685459426709&url=https%3A%2F%2Fintezer.com%2Fblog%2Fresearch%2Fcryptoclippy-evolves-to-pilfer-more-financial-data%2F&cookiesTest=true HTTP 302
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D1327356%26time%3D1685459426709%26url%3Dhttps%253A%252F%252Fintezer.com%252Fblog%252Fresearch%252Fcryptoclippy-evolves-to-pilfer-more-financial-data%252F%26cookiesTest%3Dtrue%26liSync%3Dtrue HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1327356&time=1685459426709&url=https%3A%2F%2Fintezer.com%2Fblog%2Fresearch%2Fcryptoclippy-evolves-to-pilfer-more-financial-data%2F&cookiesTest=true&liSync=true HTTP 302
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=1327356&time=1685459426709&url=https%3A%2F%2Fintezer.com%2Fblog%2Fresearch%2Fcryptoclippy-evolves-to-pilfer-more-financial-data%2F&cookiesTest=true&liSync=true&e_ipv6=AQIumPDpEfMFPQAAAYhtNeFFwH6XBg66P_X_yWYb14V-WdKEM4ZUq4ttPjdDIxgoZVFk9uxtzrVD

Request Chain 178

https://c.clarity.ms/c.gif HTTP 302
https://c.bing.com/c.gif?ctsa=mr&CtsSyncId=1ABC9391F34D469695DC7A9219165479&RedC=c.clarity.ms&MXFR=00C24AAC361B6F6A10A4598D321B61F4 HTTP 302
https://c.clarity.ms/c.gif?ctsa=mr&CtsSyncId=1ABC9391F34D469695DC7A9219165479&MUID=097468F7F21E630117B07BD6F3B26215

183 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/
Redirect Chain

https://intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/)
https://intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/

249 KB
49 KB

39ms
38ms

Document
text/html

199.16.172.82
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

199.16.172.82 , United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

79ed44f57e7d4550271df0742c22995caebae03803ac30ce81a50b57e1a1952a

Security Headers

Name

Value

Content-Security-Policy

frame-ancestors 'self' *.intezer.com; upgrade-insecure-requests; script-src 'self' 'report-sample' 'unsafe-inline' 'unsafe-eval' data: *.mouseflow.com *.lfeeder.com *.addtoany.com *.google.com *.googleapis.com *.intezer.com *.youtube.com googletagmanager.com *.opendns.com *.hsappstatic.net *.hsforms.net *.js-hsforms.net twitter.com *.cloudflare.com *.comeet.co *.twitter.com *.gaug.es *.wp.com *.hsleadflows.net *.gstatic.com *.usemessages.com *.hs-banner.com *.licdn.com *.hs-analytics.net *.ads-twitter.com *.hs-scripts.com *.googleadservices.com *.hotjar.com *.hotjar.io *.bing.com *.microsoft.com *.clarity.ms *.googletagmanager.com *.doubleclick.net *.addtoany.com *.facebook.net *.google-analytics.com *.pressablecdn.com https://www.redditstatic.com/ads/pixel.js; object-src 'self'; frame-src 'self' *.mouseflow.com *.lfeeder.com *.addtoany.com *.hsappstatic.net *.usemessages.com *.recaptcha.net *.intezer.com *.hubspot.com *.pressablecdn.com *.hotjar.com *.hotjar.io *.hsforms.com *.googletagmanager.com *.wp.com *.google.com *.twitter.com *.comeet.com *.comeet.co *.doubleclick.net *.youtube.com; child-src 'self' *.intezer.com; base-uri 'self' *.intezer.com; form-action 'self' https://*.hsforms.com/ https://*.twitter.com/; worker-src 'self' *.intezer.com; report-uri https://csp-prod.intezer.com/cspgate/445999af-dcf0-42b8-a4bc-655be2e8ffbf/2

Strict-Transport-Security

max-age=31536000

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: max-age=159, must-revalidate
content-encoding: br
content-security-policy: frame-ancestors 'self' *.intezer.com; upgrade-insecure-requests; script-src 'self' 'report-sample' 'unsafe-inline' 'unsafe-eval' data: *.mouseflow.com *.lfeeder.com *.addtoany.com *.google.com *.googleapis.com *.intezer.com *.youtube.com googletagmanager.com *.opendns.com *.hsappstatic.net *.hsforms.net *.js-hsforms.net twitter.com *.cloudflare.com *.comeet.co *.twitter.com *.gaug.es *.wp.com *.hsleadflows.net *.gstatic.com *.usemessages.com *.hs-banner.com *.licdn.com *.hs-analytics.net *.ads-twitter.com *.hs-scripts.com *.googleadservices.com *.hotjar.com *.hotjar.io *.bing.com *.microsoft.com *.clarity.ms *.googletagmanager.com *.doubleclick.net *.addtoany.com *.facebook.net *.google-analytics.com *.pressablecdn.com https://www.redditstatic.com/ads/pixel.js; object-src 'self'; frame-src 'self' *.mouseflow.com *.lfeeder.com *.addtoany.com *.hsappstatic.net *.usemessages.com *.recaptcha.net *.intezer.com *.hubspot.com *.pressablecdn.com *.hotjar.com *.hotjar.io *.hsforms.com *.googletagmanager.com *.wp.com *.google.com *.twitter.com *.comeet.com *.comeet.co *.doubleclick.net *.youtube.com; child-src 'self' *.intezer.com; base-uri 'self' *.intezer.com; form-action 'self' https://*.hsforms.com/ https://*.twitter.com/; worker-src 'self' *.intezer.com; report-uri https://csp-prod.intezer.com/cspgate/445999af-dcf0-42b8-a4bc-655be2e8ffbf/2
content-type: text/html; charset=UTF-8
date: Tue, 30 May 2023 15:10:25 GMT
host-header: Pressable
last-modified: Tue, 30 May 2023 15:08:04 GMT
link: <https://intezer.com/wp-json/>; rel="https://api.w.org/" <https://intezer.com/wp-json/wp/v2/posts/34568>; rel="alternate"; type="application/json" <https://intezer.com/?p=34568>; rel=shortlink
server: nginx
strict-transport-security: max-age=31536000
vary: Accept-Encoding Cookie
x-ac: 1.hhn _atomic_ams BYPASS
x-nananana: Batcache-Hit

Redirect headers

content-security-policy: frame-ancestors 'self' *.intezer.com; upgrade-insecure-requests; script-src 'self' 'report-sample' 'unsafe-inline' 'unsafe-eval' data: *.mouseflow.com *.lfeeder.com *.addtoany.com *.google.com *.googleapis.com *.intezer.com *.youtube.com googletagmanager.com *.opendns.com *.hsappstatic.net *.hsforms.net *.js-hsforms.net twitter.com *.cloudflare.com *.comeet.co *.twitter.com *.gaug.es *.wp.com *.hsleadflows.net *.gstatic.com *.usemessages.com *.hs-banner.com *.licdn.com *.hs-analytics.net *.ads-twitter.com *.hs-scripts.com *.googleadservices.com *.hotjar.com *.hotjar.io *.bing.com *.microsoft.com *.clarity.ms *.googletagmanager.com *.doubleclick.net *.addtoany.com *.facebook.net *.google-analytics.com *.pressablecdn.com https://www.redditstatic.com/ads/pixel.js; object-src 'self'; frame-src 'self' *.mouseflow.com *.lfeeder.com *.addtoany.com *.hsappstatic.net *.usemessages.com *.recaptcha.net *.intezer.com *.hubspot.com *.pressablecdn.com *.hotjar.com *.hotjar.io *.hsforms.com *.googletagmanager.com *.wp.com *.google.com *.twitter.com *.comeet.com *.comeet.co *.doubleclick.net *.youtube.com; child-src 'self' *.intezer.com; base-uri 'self' *.intezer.com; form-action 'self' https://*.hsforms.com/ https://*.twitter.com/; worker-src 'self' *.intezer.com; report-uri https://csp-prod.intezer.com/cspgate/445999af-dcf0-42b8-a4bc-655be2e8ffbf/2
content-type: text/html; charset=utf-8
date: Tue, 30 May 2023 15:10:25 GMT
host-header: Pressable
location: https://intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/
server: nginx
strict-transport-security: max-age=31536000
vary: Cookie
x-ac: 1.hhn _atomic_ams BYPASS

GET
H2 200 style.min.css
149520725.v2.pressablecdn.com/wp-includes/css/dist/block-library/ 95 KB
13 KB 75ms
18ms Stylesheet
text/css 192.0.77.39
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://149520725.v2.pressablecdn.com/wp-includes/css/dist/block-library/style.min.css?ver=eb7ddf2ab56d8f1440d99ff3878c69da

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.39 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

aca566587618e75fa291a419c7c430be02e03fc72f6105658c1bc8e7d59a65e4

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intezer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Tue, 30 May 2023 15:10:25 GMT
content-encoding: br
x-ac: 1.hhn _atomic_ams BYPASS
strict-transport-security: max-age=15552000
last-modified: Fri, 10 Mar 2023 00:22:37 GMT
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=315360000
link: <http://intezer.com/wp-includes/css/dist/block-library/style.min.css>; rel="canonical"
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 styles-blocks.css
149520725.v2.pressablecdn.com/wp-content/plugins/prismatic/css/ 526 B
413 B 75ms
19ms Stylesheet
text/css 192.0.77.39
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://149520725.v2.pressablecdn.com/wp-content/plugins/prismatic/css/styles-blocks.css?ver=eb7ddf2ab56d8f1440d99ff3878c69da

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.39 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

dc8e317c924d49916e599d91520cb5f64eb9b1ff74120e5d058ca526d0ec6266

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intezer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Tue, 30 May 2023 15:10:25 GMT
content-encoding: br
x-ac: 2.hhn _atomic_ams BYPASS
strict-transport-security: max-age=15552000
last-modified: Tue, 21 Mar 2023 10:57:36 GMT
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=315360000
link: <http://intezer.com/wp-content/plugins/prismatic/css/styles-blocks.css>; rel="canonical"
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 view.css
149520725.v2.pressablecdn.com/wp-content/plugins/jetpack/jetpack_vendor/automattic/jetpack-videopress/build/block-editor/blocks/video/ 602 B
401 B 90ms
33ms Stylesheet
text/css 192.0.77.39
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://149520725.v2.pressablecdn.com/wp-content/plugins/jetpack/jetpack_vendor/automattic/jetpack-videopress/build/block-editor/blocks/video/view.css?minify=false&ver=34ae973733627b74a14e

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.39 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

d749579e51cf490ba27a6782bcfe07c52e44ffa8e3fbb4db7a4dded9d0d9ef29

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intezer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Tue, 30 May 2023 15:10:25 GMT
content-encoding: br
x-ac: 2.hhn _atomic_ams BYPASS
strict-transport-security: max-age=15552000
last-modified: Tue, 02 May 2023 20:08:24 GMT
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=315360000
link: <http://intezer.com/wp-content/plugins/jetpack/jetpack_vendor/automattic/jetpack-videopress/build/block-editor/blocks/video/view.css>; rel="canonical"
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 mediaelementplayer-legacy.min.css
149520725.v2.pressablecdn.com/wp-includes/js/mediaelement/ 11 KB
3 KB 90ms
34ms Stylesheet
text/css 192.0.77.39
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://149520725.v2.pressablecdn.com/wp-includes/js/mediaelement/mediaelementplayer-legacy.min.css?ver=4.2.17

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.39 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

b7908a015a567ec2363011df2475368dbff34360e9da3fdff50604d6395fb646

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intezer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Tue, 30 May 2023 15:10:25 GMT
content-encoding: br
x-ac: 2.hhn _atomic_ams BYPASS
strict-transport-security: max-age=15552000
last-modified: Tue, 29 Sep 2020 15:53:06 GMT
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=315360000
link: <http://intezer.com/wp-includes/js/mediaelement/mediaelementplayer-legacy.min.css>; rel="canonical"
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 wp-mediaelement.min.css
149520725.v2.pressablecdn.com/wp-includes/js/mediaelement/ 4 KB
1 KB 90ms
34ms Stylesheet
text/css 192.0.77.39
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://149520725.v2.pressablecdn.com/wp-includes/js/mediaelement/wp-mediaelement.min.css?ver=eb7ddf2ab56d8f1440d99ff3878c69da

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.39 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

2e10d353ff038c2cad3492fc17801af3e6ef2669c9e9713bdb78b1dcb104c4fe

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intezer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Tue, 30 May 2023 15:10:25 GMT
content-encoding: br
x-ac: 1.hhn _atomic_ams BYPASS
strict-transport-security: max-age=15552000
last-modified: Fri, 07 Jun 2019 20:45:02 GMT
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=315360000
link: <http://intezer.com/wp-includes/js/mediaelement/wp-mediaelement.min.css>; rel="canonical"
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 classic-themes.min.css
149520725.v2.pressablecdn.com/wp-includes/css/ 291 B
413 B 91ms
35ms Stylesheet
text/css 192.0.77.39
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://149520725.v2.pressablecdn.com/wp-includes/css/classic-themes.min.css?ver=eb7ddf2ab56d8f1440d99ff3878c69da

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.39 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

dcd9f488bd62ba0ee403b07a97e40b9ffd63a0eff61091588c913b16d5153d48

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intezer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Tue, 30 May 2023 15:10:25 GMT
x-ac: 2.hhn _atomic_ams BYPASS
strict-transport-security: max-age=15552000
last-modified: Mon, 13 Feb 2023 20:50:19 GMT
server: nginx
access-control-allow-methods: GET, HEAD
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=315360000
accept-ranges: bytes
link: <http://intezer.com/wp-includes/css/classic-themes.min.css>; rel="canonical"
content-length: 291
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 styles.css
149520725.v2.pressablecdn.com/wp-content/plugins/contact-form-7/includes/css/ 3 KB
1 KB 99ms
43ms Stylesheet
text/css 192.0.77.39
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://149520725.v2.pressablecdn.com/wp-content/plugins/contact-form-7/includes/css/styles.css?ver=5.7.6

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.39 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

ab21762c3f447aa08cbefd5ea3866165f925bd5058a9ae19e23721462de6fb60

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intezer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Tue, 30 May 2023 15:10:25 GMT
content-encoding: br
x-ac: 1.hhn _atomic_ams BYPASS
strict-transport-security: max-age=15552000
last-modified: Mon, 24 Apr 2023 14:22:58 GMT
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=315360000
link: <http://intezer.com/wp-content/plugins/contact-form-7/includes/css/styles.css>; rel="canonical"
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 default.css
149520725.v2.pressablecdn.com/wp-content/plugins/prismatic/lib/highlight/css/ 1 KB
630 B 99ms
44ms Stylesheet
text/css 192.0.77.39
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://149520725.v2.pressablecdn.com/wp-content/plugins/prismatic/lib/highlight/css/default.css?ver=3.3

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.39 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

fbde0ac0921d86c356c41532e7319c887a23bd1b8ff00060cab447249f03c7cf

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intezer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Tue, 30 May 2023 15:10:25 GMT
content-encoding: br
x-ac: 1.hhn _atomic_ams BYPASS
strict-transport-security: max-age=15552000
last-modified: Tue, 21 Mar 2023 10:57:36 GMT
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=315360000
link: <http://intezer.com/wp-content/plugins/prismatic/lib/highlight/css/default.css>; rel="canonical"
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 bootstrap.css
149520725.v2.pressablecdn.com/wp-content/themes/intezer-v2/css/ 187 KB
24 KB 98ms
43ms Stylesheet
text/css 192.0.77.39
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://149520725.v2.pressablecdn.com/wp-content/themes/intezer-v2/css/bootstrap.css?ver=eb7ddf2ab56d8f1440d99ff3878c69da

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.39 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

c40a0cdd5ab5dcc4da78066f70839808bb4ee8fb2f3360dec64fde438770b099

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intezer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Tue, 30 May 2023 15:10:25 GMT
content-encoding: br
x-ac: 1.hhn _atomic_ams BYPASS
strict-transport-security: max-age=15552000
last-modified: Sun, 13 Dec 2020 07:21:39 GMT
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=315360000
link: <http://intezer.com/wp-content/themes/intezer-v2/css/bootstrap.css>; rel="canonical"
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 font-awesome.min.css
149520725.v2.pressablecdn.com/wp-content/themes/intezer-v2/css/ 30 KB
7 KB 99ms
43ms Stylesheet
text/css 192.0.77.39
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://149520725.v2.pressablecdn.com/wp-content/themes/intezer-v2/css/font-awesome.min.css?ver=eb7ddf2ab56d8f1440d99ff3878c69da

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.39 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intezer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Tue, 30 May 2023 15:10:25 GMT
content-encoding: br
x-ac: 1.hhn _atomic_ams BYPASS
strict-transport-security: max-age=15552000
last-modified: Sun, 13 Dec 2020 07:21:41 GMT
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=315360000
link: <http://intezer.com/wp-content/themes/intezer-v2/css/font-awesome.min.css>; rel="canonical"
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 style.css
149520725.v2.pressablecdn.com/wp-content/themes/intezer-v2/ 199 KB
39 KB 97ms
42ms Stylesheet
text/css 192.0.77.39
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://149520725.v2.pressablecdn.com/wp-content/themes/intezer-v2/style.css?ver=1685459283

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.39 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

74055501669731f09bb07f32686333b42e103a5a75c268f7a82836da65273e63

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intezer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Tue, 30 May 2023 15:10:25 GMT
content-encoding: br
x-ac: 2.hhn _atomic_ams BYPASS
strict-transport-security: max-age=15552000
last-modified: Sun, 28 May 2023 07:48:39 GMT
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=315360000
link: <http://intezer.com/wp-content/themes/intezer-v2/style.css>; rel="canonical"
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 elementor-icons.min.css
149520725.v2.pressablecdn.com/wp-content/plugins/elementor/assets/lib/eicons/css/ 19 KB
4 KB 97ms
42ms Stylesheet
text/css 192.0.77.39
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://149520725.v2.pressablecdn.com/wp-content/plugins/elementor/assets/lib/eicons/css/elementor-icons.min.css?ver=5.20.0

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.39 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

a0c3e823a07498a845daa25db9e85afdb4a985866f00b4cf1518f363336cd030

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intezer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Tue, 30 May 2023 15:10:25 GMT
content-encoding: br
x-ac: 1.hhn _atomic_ams BYPASS
strict-transport-security: max-age=15552000
last-modified: Sun, 14 May 2023 16:20:32 GMT
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=315360000
link: <http://intezer.com/wp-content/plugins/elementor/assets/lib/eicons/css/elementor-icons.min.css>; rel="canonical"
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 custom-frontend-legacy.min.css
149520725.v2.pressablecdn.com/wp-content/uploads/elementor/css/ 10 KB
827 B 93ms
38ms Stylesheet
text/css 192.0.77.39
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://149520725.v2.pressablecdn.com/wp-content/uploads/elementor/css/custom-frontend-legacy.min.css?ver=3.13.2

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.39 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

c512792c6e8b615898c14bf48446b971c34aa496a7afd7d2580263bc094756d0

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intezer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Tue, 30 May 2023 15:10:25 GMT
content-encoding: br
x-ac: 1.hhn _atomic_ams BYPASS
strict-transport-security: max-age=15552000
last-modified: Sun, 14 May 2023 16:20:35 GMT
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=315360000
link: <http://intezer.com/wp-content/uploads/elementor/css/custom-frontend-legacy.min.css>; rel="canonical"
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 custom-frontend.min.css
149520725.v2.pressablecdn.com/wp-content/uploads/elementor/css/ 132 KB
17 KB 96ms
41ms Stylesheet
text/css 192.0.77.39
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://149520725.v2.pressablecdn.com/wp-content/uploads/elementor/css/custom-frontend.min.css?ver=1684081234

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.39 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

b3eee56f61d9cf1ef3d005bfee1ef72ad35a8faf10d8973f5c472b4484fa109a

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intezer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Tue, 30 May 2023 15:10:25 GMT
content-encoding: br
x-ac: 2.hhn _atomic_ams BYPASS
strict-transport-security: max-age=15552000
last-modified: Sun, 14 May 2023 16:20:34 GMT
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=315360000
link: <http://intezer.com/wp-content/uploads/elementor/css/custom-frontend.min.css>; rel="canonical"
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 swiper.min.css
149520725.v2.pressablecdn.com/wp-content/plugins/elementor/assets/lib/swiper/css/ 13 KB
2 KB 96ms
41ms Stylesheet
text/css 192.0.77.39
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://149520725.v2.pressablecdn.com/wp-content/plugins/elementor/assets/lib/swiper/css/swiper.min.css?ver=5.3.6

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.39 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

d622534d53d3ac1095af275f0b30274fcd835785577df2dde6d9398e6f7a2c8f

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intezer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Tue, 30 May 2023 15:10:25 GMT
content-encoding: br
x-ac: 2.hhn _atomic_ams BYPASS
strict-transport-security: max-age=15552000
last-modified: Sun, 14 May 2023 16:20:32 GMT
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=315360000
link: <http://intezer.com/wp-content/plugins/elementor/assets/lib/swiper/css/swiper.min.css>; rel="canonical"
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 post-8921.css
149520725.v2.pressablecdn.com/wp-content/uploads/elementor/css/ 1 KB
494 B 95ms
40ms Stylesheet
text/css 192.0.77.39
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://149520725.v2.pressablecdn.com/wp-content/uploads/elementor/css/post-8921.css?ver=1684081234

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.39 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

88b35155e7869354ef8557d34fd38023f643a6689411d3a4f6dbf899b0126573

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intezer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Tue, 30 May 2023 15:10:25 GMT
content-encoding: br
x-ac: 2.hhn _atomic_ams BYPASS
strict-transport-security: max-age=15552000
last-modified: Sun, 14 May 2023 16:20:34 GMT
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=315360000
link: <http://intezer.com/wp-content/uploads/elementor/css/post-8921.css>; rel="canonical"
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 custom-pro-frontend.min.css
149520725.v2.pressablecdn.com/wp-content/uploads/elementor/css/ 426 KB
41 KB 93ms
39ms Stylesheet
text/css 192.0.77.39
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://149520725.v2.pressablecdn.com/wp-content/uploads/elementor/css/custom-pro-frontend.min.css?ver=1684081234

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.39 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

483cb88f0329db0a454099a046627481f4208c92a49ccb7a84faf54fb6014a2d

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intezer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Tue, 30 May 2023 15:10:25 GMT
content-encoding: br
x-ac: 2.hhn _atomic_ams BYPASS
strict-transport-security: max-age=15552000
last-modified: Sun, 14 May 2023 16:20:34 GMT
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=315360000
link: <http://intezer.com/wp-content/uploads/elementor/css/custom-pro-frontend.min.css>; rel="canonical"
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 post-33435.css
149520725.v2.pressablecdn.com/wp-content/uploads/elementor/css/ 1 KB
490 B 91ms
36ms Stylesheet
text/css 192.0.77.39
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://149520725.v2.pressablecdn.com/wp-content/uploads/elementor/css/post-33435.css?ver=1684081234

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.39 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

ef37de3d2d1f415a9459a535fa04e81d83caadb9f7adeed130b346921aff79c9

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intezer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Tue, 30 May 2023 15:10:25 GMT
content-encoding: br
x-ac: 2.hhn _atomic_ams BYPASS
strict-transport-security: max-age=15552000
last-modified: Sun, 14 May 2023 16:20:34 GMT
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=315360000
link: <http://intezer.com/wp-content/uploads/elementor/css/post-33435.css>; rel="canonical"
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 post-33431.css
149520725.v2.pressablecdn.com/wp-content/uploads/elementor/css/ 1 KB
467 B 94ms
39ms Stylesheet
text/css 192.0.77.39
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://149520725.v2.pressablecdn.com/wp-content/uploads/elementor/css/post-33431.css?ver=1684081234

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.39 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

239112a07d6464c06e4d6542364fc0e534dec40c57ed3bcb261b5b3724c171ee

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intezer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Tue, 30 May 2023 15:10:25 GMT
content-encoding: br
x-ac: 1.hhn _atomic_ams BYPASS
strict-transport-security: max-age=15552000
last-modified: Sun, 14 May 2023 16:20:34 GMT
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=315360000
link: <http://intezer.com/wp-content/uploads/elementor/css/post-33431.css>; rel="canonical"
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 post-33426.css
149520725.v2.pressablecdn.com/wp-content/uploads/elementor/css/ 1 KB
467 B 95ms
40ms Stylesheet
text/css 192.0.77.39
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://149520725.v2.pressablecdn.com/wp-content/uploads/elementor/css/post-33426.css?ver=1684081234

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.39 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

aa1c60208eadf18a50947f665629dc72af63e2d4b8cc13595acc3ba3d500d3b1

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intezer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Tue, 30 May 2023 15:10:25 GMT
content-encoding: br
x-ac: 2.hhn _atomic_ams BYPASS
strict-transport-security: max-age=15552000
last-modified: Sun, 14 May 2023 16:20:34 GMT
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=315360000
link: <http://intezer.com/wp-content/uploads/elementor/css/post-33426.css>; rel="canonical"
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 post-32335.css
149520725.v2.pressablecdn.com/wp-content/uploads/elementor/css/ 1 KB
467 B 92ms
38ms Stylesheet
text/css 192.0.77.39
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://149520725.v2.pressablecdn.com/wp-content/uploads/elementor/css/post-32335.css?ver=1684081234

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.39 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

c357b81f57059c74cf09ac0da6661e9d7639be8a76634a9d07c4139354dd432d

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intezer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Tue, 30 May 2023 15:10:25 GMT
content-encoding: br
x-ac: 1.hhn _atomic_ams BYPASS
strict-transport-security: max-age=15552000
last-modified: Sun, 14 May 2023 16:20:34 GMT
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=315360000
link: <http://intezer.com/wp-content/uploads/elementor/css/post-32335.css>; rel="canonical"
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 post-32106.css
149520725.v2.pressablecdn.com/wp-content/uploads/elementor/css/ 1 KB
466 B 91ms
38ms Stylesheet
text/css 192.0.77.39
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://149520725.v2.pressablecdn.com/wp-content/uploads/elementor/css/post-32106.css?ver=1684081234

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.39 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

6f354f47608c7cf776964990c3269ee551e0a30c21ed9ae93816d5360d7a150d

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intezer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Tue, 30 May 2023 15:10:25 GMT
content-encoding: br
x-ac: 1.hhn _atomic_ams BYPASS
strict-transport-security: max-age=15552000
last-modified: Sun, 14 May 2023 16:20:34 GMT
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=315360000
link: <http://intezer.com/wp-content/uploads/elementor/css/post-32106.css>; rel="canonical"
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 post-31690.css
149520725.v2.pressablecdn.com/wp-content/uploads/elementor/css/ 1 KB
467 B 91ms
37ms Stylesheet
text/css 192.0.77.39
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://149520725.v2.pressablecdn.com/wp-content/uploads/elementor/css/post-31690.css?ver=1684081234

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.39 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

a361b4ff331512e51dc8c9446fda25e99928b9355b713b7dd4eb16c10d30260b

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intezer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Tue, 30 May 2023 15:10:25 GMT
content-encoding: br
x-ac: 1.hhn _atomic_ams BYPASS
strict-transport-security: max-age=15552000
last-modified: Sun, 14 May 2023 16:20:34 GMT
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=315360000
link: <http://intezer.com/wp-content/uploads/elementor/css/post-31690.css>; rel="canonical"
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 post-28962.css
149520725.v2.pressablecdn.com/wp-content/uploads/elementor/css/ 1 KB
465 B 95ms
42ms Stylesheet
text/css 192.0.77.39
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://149520725.v2.pressablecdn.com/wp-content/uploads/elementor/css/post-28962.css?ver=1684081234

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.39 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

56223cf90f8f1deef083894d3ff499c8ef77f82a86935f17bbdf03d06369d03e

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intezer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Tue, 30 May 2023 15:10:25 GMT
content-encoding: br
x-ac: 2.hhn _atomic_ams BYPASS
strict-transport-security: max-age=15552000
last-modified: Sun, 14 May 2023 16:20:34 GMT
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=315360000
link: <http://intezer.com/wp-content/uploads/elementor/css/post-28962.css>; rel="canonical"
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 post-27458.css
149520725.v2.pressablecdn.com/wp-content/uploads/elementor/css/ 1 KB
467 B 90ms
37ms Stylesheet
text/css 192.0.77.39
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://149520725.v2.pressablecdn.com/wp-content/uploads/elementor/css/post-27458.css?ver=1684081234

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.39 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

9d5c71e9571012044e6ca5327a3f4a04acb68058ef42fc1a9c6b53c7647e24f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intezer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Tue, 30 May 2023 15:10:25 GMT
content-encoding: br
x-ac: 2.hhn _atomic_ams BYPASS
strict-transport-security: max-age=15552000
last-modified: Sun, 14 May 2023 16:20:34 GMT
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=315360000
link: <http://intezer.com/wp-content/uploads/elementor/css/post-27458.css>; rel="canonical"
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 app.css
149520725.v2.pressablecdn.com/wp-content/plugins/simple-lightbox/client/css/ 231 B
359 B 94ms
41ms Stylesheet
text/css 192.0.77.39
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://149520725.v2.pressablecdn.com/wp-content/plugins/simple-lightbox/client/css/app.css?ver=2.9.3

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.39 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

f00c690f9ac9a7bbd3f1a4346472c52ff3329d51a5cc7823c2277b0aa041c443

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intezer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Tue, 30 May 2023 15:10:25 GMT
x-ac: 2.hhn _atomic_ams BYPASS
strict-transport-security: max-age=15552000
last-modified: Mon, 02 Jan 2023 15:42:45 GMT
server: nginx
access-control-allow-methods: GET, HEAD
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=315360000
accept-ranges: bytes
link: <http://intezer.com/wp-content/plugins/simple-lightbox/client/css/app.css>; rel="canonical"
content-length: 231
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 addtoany.min.css
149520725.v2.pressablecdn.com/wp-content/plugins/add-to-any/ 1 KB
562 B 89ms
36ms Stylesheet
text/css 192.0.77.39
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://149520725.v2.pressablecdn.com/wp-content/plugins/add-to-any/addtoany.min.css?ver=1.16

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.39 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

f93483f0aaf24aea4b5534bb8647d22cd9dfcb4d08d2fd1008787bdfb8a6cc47

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intezer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Tue, 30 May 2023 15:10:25 GMT
content-encoding: br
x-ac: 2.hhn _atomic_ams BYPASS
strict-transport-security: max-age=15552000
last-modified: Thu, 30 Mar 2023 11:10:41 GMT
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=315360000
link: <http://intezer.com/wp-content/plugins/add-to-any/addtoany.min.css>; rel="canonical"
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 style.css
149520725.v2.pressablecdn.com/wp-content/plugins/cf7-conditional-fields/ 2 KB
624 B 94ms
42ms Stylesheet
text/css 192.0.77.39
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://149520725.v2.pressablecdn.com/wp-content/plugins/cf7-conditional-fields/style.css?ver=2.3.8

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.39 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

cedc9155263d1f634191e71f3c9ce256b315f833e375739ed0e65087996428cc

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intezer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Tue, 30 May 2023 15:10:25 GMT
content-encoding: br
x-ac: 1.hhn _atomic_ams BYPASS
strict-transport-security: max-age=15552000
last-modified: Mon, 24 Apr 2023 14:23:10 GMT
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=315360000
link: <http://intezer.com/wp-content/plugins/cf7-conditional-fields/style.css>; rel="canonical"
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 jetpack.css
149520725.v2.pressablecdn.com/wp-content/plugins/jetpack/css/ 97 KB
18 KB 95ms
43ms Stylesheet
text/css 192.0.77.39
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://149520725.v2.pressablecdn.com/wp-content/plugins/jetpack/css/jetpack.css?ver=12.2-a.15

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.39 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

356bb77df62e4ebed4870f1e7b19dead8afe239392406e6b38472d5abebfbb7c

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intezer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Tue, 30 May 2023 15:10:25 GMT
content-encoding: br
x-ac: 1.hhn _atomic_ams BYPASS
strict-transport-security: max-age=15552000
last-modified: Mon, 08 May 2023 16:57:46 GMT
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=315360000
link: <http://intezer.com/wp-content/plugins/jetpack/css/jetpack.css>; rel="canonical"
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 page.js Show response
static.addtoany.com/menu/ 3 KB
2 KB 125ms
37ms Script
application/javascript 2606:4700:10::6816:46c5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.addtoany.com/menu/page.js

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:46c5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2c5cc47eb8499efe3f4353bc50b38690756e78da21b0e158e14293b39c5ef812

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intezer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Tue, 30 May 2023 15:10:26 GMT
via: e3s
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains; preload
age: 153701
alt-svc: h3=":443"; ma=86400
cf-bgj: minify
last-modified: Wed, 11 Jan 2023 01:11:30 GMT
server: cloudflare
etag: W/"c04-5f1f2ae2e431b"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=172800
cf-ray: 7cf7e7649ec6918f-FRA

GET
H2 200 jquery-3.2.1.min.js Show response
149520725.v2.pressablecdn.com/wp-content/themes/intezer-v2/js/ 85 KB
31 KB 96ms
44ms Script
application/javascript 192.0.77.39
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://149520725.v2.pressablecdn.com/wp-content/themes/intezer-v2/js/jquery-3.2.1.min.js?ver=eb7ddf2ab56d8f1440d99ff3878c69da

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.39 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intezer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Tue, 30 May 2023 15:10:25 GMT
content-encoding: br
x-ac: 1.hhn _atomic_ams BYPASS
strict-transport-security: max-age=15552000
last-modified: Sun, 13 Dec 2020 07:21:10 GMT
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=315360000
link: <http://intezer.com/wp-content/themes/intezer-v2/js/jquery-3.2.1.min.js>; rel="canonical"
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 addtoany.min.js Show response
149520725.v2.pressablecdn.com/wp-content/plugins/add-to-any/ 129 B
235 B 68ms
53ms Script
application/javascript 192.0.77.39
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://149520725.v2.pressablecdn.com/wp-content/plugins/add-to-any/addtoany.min.js?ver=1.1

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.39 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

50679e0e3933c945348a2db0cc128bb14b57a60a74fabf8cae13acc14efbb2e1

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intezer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Tue, 30 May 2023 15:10:25 GMT
x-ac: 2.hhn _atomic_ams BYPASS
strict-transport-security: max-age=15552000
last-modified: Thu, 30 Mar 2023 11:10:41 GMT
server: nginx
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=315360000
accept-ranges: bytes
link: <http://intezer.com/wp-content/plugins/add-to-any/addtoany.min.js>; rel="canonical"
content-length: 129
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 /
intezer.com/ 8 KB
3 KB 30ms
29ms Stylesheet
text/css 199.16.172.82
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://intezer.com/?custom-css=e61ea7ab53

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

199.16.172.82 , United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

826f20ce29050cca7c2ca8325ae07d52232bcd79fc5773f131a55bc72ed475c8

Security Headers

Name

Value

Content-Security-Policy

Strict-Transport-Security

max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

x-nananana: Batcache-Hit
date: Tue, 30 May 2023 15:10:25 GMT
strict-transport-security: max-age=31536000
content-encoding: br
content-security-policy: frame-ancestors 'self' *.intezer.com; upgrade-insecure-requests; script-src 'self' 'report-sample' 'unsafe-inline' 'unsafe-eval' data: *.mouseflow.com *.lfeeder.com *.addtoany.com *.google.com *.googleapis.com *.intezer.com *.youtube.com googletagmanager.com *.opendns.com *.hsappstatic.net *.hsforms.net *.js-hsforms.net twitter.com *.cloudflare.com *.comeet.co *.twitter.com *.gaug.es *.wp.com *.hsleadflows.net *.gstatic.com *.usemessages.com *.hs-banner.com *.licdn.com *.hs-analytics.net *.ads-twitter.com *.hs-scripts.com *.googleadservices.com *.hotjar.com *.hotjar.io *.bing.com *.microsoft.com *.clarity.ms *.googletagmanager.com *.doubleclick.net *.addtoany.com *.facebook.net *.google-analytics.com *.pressablecdn.com https://www.redditstatic.com/ads/pixel.js; object-src 'self'; frame-src 'self' *.mouseflow.com *.lfeeder.com *.addtoany.com *.hsappstatic.net *.usemessages.com *.recaptcha.net *.intezer.com *.hubspot.com *.pressablecdn.com *.hotjar.com *.hotjar.io *.hsforms.com *.googletagmanager.com *.wp.com *.google.com *.twitter.com *.comeet.com *.comeet.co *.doubleclick.net *.youtube.com; child-src 'self' *.intezer.com; base-uri 'self' *.intezer.com; form-action 'self' https://*.hsforms.com/ https://*.twitter.com/; worker-src 'self' *.intezer.com; report-uri https://csp-prod.intezer.com/cspgate/445999af-dcf0-42b8-a4bc-655be2e8ffbf/2
last-modified: Tue, 30 May 2023 15:08:47 GMT
server: nginx
x-ac: 1.hhn _atomic_ams BYPASS
vary: Accept-Encoding, Cookie
content-type: text/css;charset=utf-8
cache-control: max-age=202, must-revalidate
host-header: Pressable
expires: Wed, 29 May 2024 15:08:47 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 186 KB
68 KB 122ms
35ms Script
application/javascript 2a00:1450:4001:828::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-725468766

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

1e3fb416c5bccfcc9f00c12c42da0492034165771e592b625e3b95c40b835f56

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intezer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Tue, 30 May 2023 15:10:26 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 69015
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Tue, 30 May 2023 15:10:26 GMT

GET
H2 200 style.basic-ho-is-po-no-da-au-co-au-ga-se-is.css
149520725.v2.pressablecdn.com/wp-content/cache/asp/ 21 KB
4 KB 91ms
39ms Stylesheet
text/css 192.0.77.39
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://149520725.v2.pressablecdn.com/wp-content/cache/asp/style.basic-ho-is-po-no-da-au-co-au-ga-se-is.css?mq=L49Dzf

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.39 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

bf83d132e02e9aa422bfc3e11ad942d3378b2eff3a0ab4442cc0b721c06f46d9

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intezer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Tue, 30 May 2023 15:10:25 GMT
content-encoding: br
x-ac: 1.hhn _atomic_ams BYPASS
strict-transport-security: max-age=15552000
last-modified: Wed, 17 May 2023 08:58:01 GMT
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=315360000
link: <http://intezer.com/wp-content/cache/asp/style.basic-ho-is-po-no-da-au-co-au-ga-se-is.css>; rel="canonical"
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 323 KB
97 KB 154ms
67ms Script
application/javascript 2a00:1450:4001:828::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-KC95766

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

b72903df32a0eed2c36dd2d0404d413f9f85ebcfdd9326c63fce9ba5f9d8edbf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intezer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Tue, 30 May 2023 15:10:26 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 99340
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Tue, 30 May 2023 15:10:26 GMT

GET
H2 200 lftracker_v1_YEgkB8lPLLw8ep3Z.js Show response
sc.lfeeder.com/ 31 KB
11 KB 121ms
27ms Script
application/javascript 2600:9000:225e:ce00:4:d7e1:700:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://sc.lfeeder.com/lftracker_v1_YEgkB8lPLLw8ep3Z.js
Requested by: Host: intezer.com
URL: https://intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:225e:ce00:4:d7e1:700:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 67d5bf0e3ef7883576812006cb54106dccda39afe56f09d2fa166e81ce2c80bd

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intezer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

x-amz-version-id: .HSgUD.TsXy4gKiXNtsa_zdoVNJUYPiz
content-encoding: gzip
via: 1.1 816b7f4e336674d9d7828ef4700482e8.cloudfront.net (CloudFront)
date: Tue, 30 May 2023 14:36:07 GMT
last-modified: Wed, 17 May 2023 07:22:53 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P4
age: 2060
etag: W/"16e165cd5d4a23389d2163a4c295494c"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: max-age=3600
x-amz-cf-id: atVNJBxjFAug03LnxMMjR3ejxwNl8tFEBHb6bOXAYyQnXHN1_Z5E2g==

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 109 KB
29 KB 109ms
22ms Script
application/x-javascript 2a03:2880:f083:9:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f083:9:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

51fd5dd8dcc8fc7d8561d13620c9f6b0eaa33fdceb8265a3268b27aaf8603df2

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intezer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Tue, 30 May 2023 15:10:26 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 28028
x-fb-rlafr: 0
x-xss-protection: 0
pragma: public
x-fb-debug: CtpuP+KdE0Lc+4p6O02yMMXwUykvyqTxdZprzLjVroUzARFKy8Vr2vf/eIU78g7g4u1n0jkiU6xc3wTasLDtdA==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
x-fb-trip-id: 1679558926
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type: application/x-javascript; charset=utf-8
x-frame-options: DENY
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=()
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 wp-emoji-release.min.js Show response
intezer.com/wp-includes/js/ 18 KB
5 KB 47ms
33ms Script
application/javascript 199.16.172.82
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://intezer.com/wp-includes/js/wp-emoji-release.min.js?ver=eb7ddf2ab56d8f1440d99ff3878c69da

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

199.16.172.82 , United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

4f79a89d16a5f717110fe080c0bf90b7e05ff95a4c4983f64d33110bf5f9c230

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Tue, 30 May 2023 15:10:25 GMT
strict-transport-security: max-age=31536000
content-encoding: br
last-modified: Thu, 02 Feb 2023 00:53:25 GMT
server: nginx
x-ac: 1.hhn _atomic_ams BYPASS
etag: W/"63db0985-4904"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=315360000
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 intezer-logo-n.png
149520725.v2.pressablecdn.com/wp-content/uploads/2020/05/ 3 KB
4 KB 67ms
54ms Image
image/png 192.0.77.39
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://149520725.v2.pressablecdn.com/wp-content/uploads/2020/05/intezer-logo-n.png

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.39 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

e85052e09a7415a2ab775cc198a96dc956d9de42b90541a5cdc9c5c176725745

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intezer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Tue, 30 May 2023 15:10:25 GMT
x-ac: 1.hhn _atomic_ams BYPASS
strict-transport-security: max-age=15552000
last-modified: Sun, 13 Dec 2020 07:09:13 GMT
server: nginx
access-control-allow-methods: GET, HEAD
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=604800
accept-ranges: bytes
link: <http://intezer.com/wp-content/uploads/2020/05/intezer-logo-n.png>; rel="canonical"
content-length: 3525
expires: Tue, 06 Jun 2023 15:10:25 GMT

GET
H2 200 blank.png
149520725.v2.pressablecdn.com//wp-content/uploads/ 96 B
216 B 67ms
54ms Image
image/png 192.0.77.39
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://149520725.v2.pressablecdn.com//wp-content/uploads/blank.png

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.39 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

ee44969942e67ce06917b912f9c0c4ed39f72fa59e30e6c37058ad559660be0a

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intezer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Tue, 30 May 2023 15:10:25 GMT
x-ac: 1.hhn _atomic_ams BYPASS
strict-transport-security: max-age=15552000
last-modified: Wed, 10 Aug 2022 09:04:51 GMT
server: nginx
access-control-allow-methods: GET, HEAD
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=604800
accept-ranges: bytes
link: <http://intezer.com/wp-content/uploads/blank.png>; rel="canonical"
content-length: 96
expires: Tue, 06 Jun 2023 15:10:25 GMT

GET
H2 200 facebook.png
intezer.com/wp-content/themes/intezer-v2/images/social/ 510 B
659 B 44ms
31ms Image
image/png 199.16.172.82
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://intezer.com/wp-content/themes/intezer-v2/images/social/facebook.png

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

199.16.172.82 , United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

65a52f6e516f0c632596218b193336646905690934acda722c840c621d7e56d4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Tue, 30 May 2023 15:10:25 GMT
strict-transport-security: max-age=31536000
x-ac: 1.hhn _atomic_ams BYPASS
last-modified: Sun, 13 Dec 2020 07:23:29 GMT
server: nginx
etag: "5fd5c171-1fe"
access-control-allow-methods: GET, HEAD
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=604800
accept-ranges: bytes
content-length: 510
expires: Tue, 06 Jun 2023 15:10:25 GMT

GET
H2 200 blank-square.png
149520725.v2.pressablecdn.com//wp-content/uploads/ 121 B
215 B 67ms
54ms Image
image/png 192.0.77.39
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://149520725.v2.pressablecdn.com//wp-content/uploads/blank-square.png

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.39 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

1d7713fe46f564bb5c7fd77f29197ab0387370a1b41b1b2676cd473317cd56c7

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intezer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Tue, 30 May 2023 15:10:25 GMT
x-ac: 1.hhn _atomic_ams BYPASS
strict-transport-security: max-age=15552000
last-modified: Wed, 10 Aug 2022 09:04:51 GMT
server: nginx
access-control-allow-methods: GET, HEAD
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=604800
accept-ranges: bytes
link: <http://intezer.com/wp-content/uploads/blank-square.png>; rel="canonical"
content-length: 121
expires: Tue, 06 Jun 2023 15:10:25 GMT

GET
H2 200 cropped-intezer-logo-n-150x150.png
149520725.v2.pressablecdn.com/wp-content/uploads/2020/05/ 9 KB
9 KB 67ms
54ms Image
image/png 192.0.77.39
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://149520725.v2.pressablecdn.com/wp-content/uploads/2020/05/cropped-intezer-logo-n-150x150.png

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.39 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

26d71b4c3c0808d3f4c29253ebbe25dcb8832a06e310691aa6cb93b6a4d8e0cf

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intezer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Tue, 30 May 2023 15:10:25 GMT
x-ac: 2.hhn _atomic_ams BYPASS
strict-transport-security: max-age=15552000
last-modified: Wed, 10 Aug 2022 12:37:00 GMT
server: nginx
content-type: image/png
cache-control: max-age=604800
accept-ranges: bytes
link: <http://intezer.com/wp-content/uploads/2020/05/cropped-intezer-logo-n-150x150.png>; rel="canonical"
content-length: 9430
expires: Tue, 06 Jun 2023 15:10:25 GMT

GET
H2 200 post-32757.css
149520725.v2.pressablecdn.com/wp-content/uploads/elementor/css/ 14 KB
2 KB 18ms
18ms Stylesheet
text/css 192.0.77.39
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://149520725.v2.pressablecdn.com/wp-content/uploads/elementor/css/post-32757.css?ver=1684081235

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.39 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

8c7d7e40d3e7aba7d0748001a7d425ab0f7594228348d4dff213e383b922be1d

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intezer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Tue, 30 May 2023 15:10:25 GMT
content-encoding: br
x-ac: 1.hhn _atomic_ams BYPASS
strict-transport-security: max-age=15552000
last-modified: Sun, 14 May 2023 16:20:35 GMT
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=315360000
link: <http://intezer.com/wp-content/uploads/elementor/css/post-32757.css>; rel="canonical"
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 post-33441.css
149520725.v2.pressablecdn.com/wp-content/uploads/elementor/css/ 8 KB
1 KB 19ms
18ms Stylesheet
text/css 192.0.77.39
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://149520725.v2.pressablecdn.com/wp-content/uploads/elementor/css/post-33441.css?ver=1684081235

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.39 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

fb55a8643e38e750bfe49498a8b4799f0bb0bc1020456aafb16446390a4b3b9e

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intezer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Tue, 30 May 2023 15:10:25 GMT
content-encoding: br
x-ac: 1.hhn _atomic_ams BYPASS
strict-transport-security: max-age=15552000
last-modified: Sun, 14 May 2023 16:20:35 GMT
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=315360000
link: <http://intezer.com/wp-content/uploads/elementor/css/post-33441.css>; rel="canonical"
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 post-30574.css
149520725.v2.pressablecdn.com/wp-content/uploads/elementor/css/ 18 KB
2 KB 19ms
18ms Stylesheet
text/css 192.0.77.39
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://149520725.v2.pressablecdn.com/wp-content/uploads/elementor/css/post-30574.css?ver=1684081235

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.39 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

b418be25f4714c24f69dcb25bc8cb3ae149b425ffd4733922ff6778ea172c80c

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intezer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Tue, 30 May 2023 15:10:25 GMT
content-encoding: br
x-ac: 1.hhn _atomic_ams BYPASS
strict-transport-security: max-age=15552000
last-modified: Sun, 14 May 2023 16:20:35 GMT
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=315360000
link: <http://intezer.com/wp-content/uploads/elementor/css/post-30574.css>; rel="canonical"
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 animations.min.css
149520725.v2.pressablecdn.com/wp-content/plugins/elementor/assets/lib/animations/ 18 KB
3 KB 28ms
14ms Stylesheet
text/css 192.0.77.39
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://149520725.v2.pressablecdn.com/wp-content/plugins/elementor/assets/lib/animations/animations.min.css?ver=3.13.2

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.39 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

fe513ef974b767510d0a2b9f1b4d3afa53185b89ab617c869e5e3d6db960192c

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intezer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Tue, 30 May 2023 15:10:25 GMT
content-encoding: br
x-ac: 2.hhn _atomic_ams BYPASS
strict-transport-security: max-age=15552000
last-modified: Sun, 14 May 2023 16:20:32 GMT
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=315360000
link: <http://intezer.com/wp-content/plugins/elementor/assets/lib/animations/animations.min.css>; rel="canonical"
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 css
fonts.googleapis.com/ 32 KB
2 KB 111ms
23ms Stylesheet
text/css 2a00:1450:4001:812::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Open+Sans%3A100%2C100italic%2C200%2C200italic%2C300%2C300italic%2C400%2C400italic%2C500%2C500italic%2C600%2C600italic%2C700%2C700italic%2C800%2C800italic%2C900%2C900italic&display=auto&ver=eb7ddf2ab56d8f1440d99ff3878c69da

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

abe3a9cedd995b871be9c9dfd657cd41a58253968ec3b74d30ce2b648ed275b9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intezer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Tue, 30 May 2023 15:10:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Tue, 30 May 2023 13:21:14 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 30 May 2023 15:10:26 GMT

GET
H2 200 fontawesome.min.css
149520725.v2.pressablecdn.com/wp-content/plugins/elementor/assets/lib/font-awesome/css/ 57 KB
12 KB 39ms
18ms Stylesheet
text/css 192.0.77.39
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://149520725.v2.pressablecdn.com/wp-content/plugins/elementor/assets/lib/font-awesome/css/fontawesome.min.css?ver=5.15.3

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.39 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

d01a2ba2805c78957e15a2958135de0f3cb88e95159dd0f6c0a032bd76b1b0e9

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intezer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Tue, 30 May 2023 15:10:25 GMT
content-encoding: br
x-ac: 1.hhn _atomic_ams BYPASS
strict-transport-security: max-age=15552000
last-modified: Sun, 14 May 2023 16:20:32 GMT
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=315360000
link: <http://intezer.com/wp-content/plugins/elementor/assets/lib/font-awesome/css/fontawesome.min.css>; rel="canonical"
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 solid.min.css
149520725.v2.pressablecdn.com/wp-content/plugins/elementor/assets/lib/font-awesome/css/ 669 B
421 B 42ms
22ms Stylesheet
text/css 192.0.77.39
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://149520725.v2.pressablecdn.com/wp-content/plugins/elementor/assets/lib/font-awesome/css/solid.min.css?ver=5.15.3

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.39 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

37bab6cd583982e8eff58501a99d7c5c4d63664c1ca34f9e3b7cf526c5b73ae2

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intezer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Tue, 30 May 2023 15:10:25 GMT
content-encoding: br
x-ac: 2.hhn _atomic_ams BYPASS
strict-transport-security: max-age=15552000
last-modified: Sun, 14 May 2023 16:20:32 GMT
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=315360000
link: <http://intezer.com/wp-content/plugins/elementor/assets/lib/font-awesome/css/solid.min.css>; rel="canonical"
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 brands.min.css
149520725.v2.pressablecdn.com/wp-content/plugins/elementor/assets/lib/font-awesome/css/ 675 B
422 B 42ms
22ms Stylesheet
text/css 192.0.77.39
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://149520725.v2.pressablecdn.com/wp-content/plugins/elementor/assets/lib/font-awesome/css/brands.min.css?ver=5.15.3

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.39 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

9cd63b8cea25045c14623c538d26752518a58c0c682795ce6ad3078976c65a37

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intezer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Tue, 30 May 2023 15:10:25 GMT
content-encoding: br
x-ac: 1.hhn _atomic_ams BYPASS
strict-transport-security: max-age=15552000
last-modified: Sun, 14 May 2023 16:20:32 GMT
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=315360000
link: <http://intezer.com/wp-content/plugins/elementor/assets/lib/font-awesome/css/brands.min.css>; rel="canonical"
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 index.js Show response
149520725.v2.pressablecdn.com/wp-content/plugins/contact-form-7/includes/swv/js/ 10 KB
3 KB 42ms
23ms Script
application/javascript 192.0.77.39
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://149520725.v2.pressablecdn.com/wp-content/plugins/contact-form-7/includes/swv/js/index.js?ver=5.7.6

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.39 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

52db930f81d97113dde679cac624cb5435b56d4ac486e91a0b6692d2cb615a84

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intezer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Tue, 30 May 2023 15:10:25 GMT
content-encoding: br
x-ac: 2.hhn _atomic_ams BYPASS
strict-transport-security: max-age=15552000
last-modified: Mon, 24 Apr 2023 14:22:58 GMT
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=315360000
link: <http://intezer.com/wp-content/plugins/contact-form-7/includes/swv/js/index.js>; rel="canonical"
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 index.js Show response
149520725.v2.pressablecdn.com/wp-content/plugins/contact-form-7/includes/js/ 13 KB
4 KB 43ms
24ms Script
application/javascript 192.0.77.39
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://149520725.v2.pressablecdn.com/wp-content/plugins/contact-form-7/includes/js/index.js?ver=5.7.6

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.39 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

1060091178cbd6c843b802f516f230f1a3a1e85f1afbd6ef84d80e5430ba457e

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intezer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Tue, 30 May 2023 15:10:25 GMT
content-encoding: br
x-ac: 2.hhn _atomic_ams BYPASS
strict-transport-security: max-age=15552000
last-modified: Mon, 24 Apr 2023 14:22:58 GMT
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=315360000
link: <http://intezer.com/wp-content/plugins/contact-form-7/includes/js/index.js>; rel="canonical"
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 dynamic-conditions-public.js Show response
149520725.v2.pressablecdn.com/wp-content/plugins/dynamicconditions/Public/js/ 2 KB
842 B 47ms
28ms Script
application/javascript 192.0.77.39
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://149520725.v2.pressablecdn.com/wp-content/plugins/dynamicconditions/Public/js/dynamic-conditions-public.js?ver=1.6.0

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.39 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

751d5192326ddefce3e87157f7c9355217cdad7b4a969b5dd3161b4453671389

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intezer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Tue, 30 May 2023 15:10:25 GMT
content-encoding: br
x-ac: 2.hhn _atomic_ams BYPASS
strict-transport-security: max-age=15552000
last-modified: Sun, 22 May 2022 15:26:46 GMT
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=315360000
link: <http://intezer.com/wp-content/plugins/dynamicconditions/Public/js/dynamic-conditions-public.js>; rel="canonical"
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 5492986.js Show response
js.hs-scripts.com/ 1 KB
1 KB 257ms
171ms Script
application/javascript 2606:4700::6812:853b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hs-scripts.com/5492986.js?integration=WordPress&ver=10.1.23
Requested by: Host: intezer.com
URL: https://intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:853b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 46ae8e1e6fe0e2bab78c7eac6ebf4c5953e448a402fbcd9c6986b66edf8e6f41

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intezer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Tue, 30 May 2023 15:10:26 GMT
content-encoding: br
cf-cache-status: EXPIRED
x-hubspot-correlation-id: 47b7954c-1cd2-4fd9-9183-aa84eccfc960
x-evy-trace-route-service-name: envoyset-translator
x-envoy-upstream-service-time: 9
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: c255bc6d-0ef7-48c6-8b6b-14aa9a8e6d10
last-modified: Tue, 30 May 2023 15:08:13 GMT
server: cloudflare
x-trace: 2BFBD785B932BE49F351ABEA7DB3F7312A3D895835000000000000000000
vary: origin, Accept-Encoding
access-control-max-age: 3600
content-type: application/javascript;charset=utf-8
access-control-allow-origin: https://intezer.com
x-evy-trace-virtual-host: all
cache-control: public, max-age=60
access-control-allow-credentials: true
x-evy-trace-served-by-pod: iad02/hubapi-td/envoy-proxy-598c95b5b7-z8kzl
cf-ray: 7cf7e7649b0018de-FRA
expires: Tue, 30 May 2023 15:11:26 GMT

GET
H2 200 frontend.min.js Show response
149520725.v2.pressablecdn.com/wp-content/plugins/link-whisper-premium/js/ 5 KB
2 KB 48ms
29ms Script
application/javascript 192.0.77.39
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://149520725.v2.pressablecdn.com/wp-content/plugins/link-whisper-premium/js/frontend.min.js?ver=1683436547

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.39 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

141ac568be4ebb63260741515cc6e4a81fe3abaa2599567ed81922801800fc5a

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intezer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Tue, 30 May 2023 15:10:25 GMT
content-encoding: br
x-ac: 2.hhn _atomic_ams BYPASS
strict-transport-security: max-age=15552000
last-modified: Sun, 07 May 2023 05:15:47 GMT
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=315360000
link: <http://intezer.com/wp-content/plugins/link-whisper-premium/js/frontend.min.js>; rel="canonical"
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 highlight-core.js Show response
149520725.v2.pressablecdn.com/wp-content/plugins/prismatic/lib/highlight/js/ 269 KB
77 KB 48ms
29ms Script
application/javascript 192.0.77.39
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://149520725.v2.pressablecdn.com/wp-content/plugins/prismatic/lib/highlight/js/highlight-core.js?ver=3.3

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.39 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

78a023cb0f6a3a93cee7dac23789a6884b96e020a553d72d6315e98ec7c782a8

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intezer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Tue, 30 May 2023 15:10:25 GMT
content-encoding: br
x-ac: 2.hhn _atomic_ams BYPASS
strict-transport-security: max-age=15552000
last-modified: Tue, 21 Mar 2023 10:57:36 GMT
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=315360000
link: <http://intezer.com/wp-content/plugins/prismatic/lib/highlight/js/highlight-core.js>; rel="canonical"
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 tether.min.js Show response
149520725.v2.pressablecdn.com/wp-content/themes/intezer-v2/js/ 24 KB
8 KB 53ms
34ms Script
application/javascript 192.0.77.39
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://149520725.v2.pressablecdn.com/wp-content/themes/intezer-v2/js/tether.min.js?ver=eb7ddf2ab56d8f1440d99ff3878c69da

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.39 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

80bd626eb6d57112072a508ee4e5ce3c2fe5673fe0a5d029810033b24aaa5e9f

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intezer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Tue, 30 May 2023 15:10:25 GMT
content-encoding: br
x-ac: 1.hhn _atomic_ams BYPASS
strict-transport-security: max-age=15552000
last-modified: Sun, 13 Dec 2020 07:21:07 GMT
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=315360000
link: <http://intezer.com/wp-content/themes/intezer-v2/js/tether.min.js>; rel="canonical"
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 bootstrap.min.js Show response
149520725.v2.pressablecdn.com/wp-content/themes/intezer-v2/js/ 46 KB
12 KB 53ms
34ms Script
application/javascript 192.0.77.39
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://149520725.v2.pressablecdn.com/wp-content/themes/intezer-v2/js/bootstrap.min.js?ver=eb7ddf2ab56d8f1440d99ff3878c69da

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.39 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

fa421b6ebbd2fb474d3a3866409ce6c1efd120b47ff256fffb8f8f50d556d3d9

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intezer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Tue, 30 May 2023 15:10:25 GMT
content-encoding: br
x-ac: 2.hhn _atomic_ams BYPASS
strict-transport-security: max-age=15552000
last-modified: Sun, 13 Dec 2020 07:21:11 GMT
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=315360000
link: <http://intezer.com/wp-content/themes/intezer-v2/js/bootstrap.min.js>; rel="canonical"
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 main.js Show response
149520725.v2.pressablecdn.com/wp-content/themes/intezer-v2/js/ 20 KB
3 KB 53ms
34ms Script
application/javascript 192.0.77.39
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://149520725.v2.pressablecdn.com/wp-content/themes/intezer-v2/js/main.js?ver=eb7ddf2ab56d8f1440d99ff3878c69da

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.39 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

ec790c72b7e025a7086577ed23d930707374f2c7f5389d0ec4a73bb25f2483d5

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intezer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Tue, 30 May 2023 15:10:25 GMT
content-encoding: br
x-ac: 1.hhn _atomic_ams BYPASS
strict-transport-security: max-age=15552000
last-modified: Sun, 28 May 2023 07:40:57 GMT
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=315360000
link: <http://intezer.com/wp-content/themes/intezer-v2/js/main.js>; rel="canonical"
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 asp-1442fdeb.js Show response
149520725.v2.pressablecdn.com/wp-content/cache/asp/ 129 KB
34 KB 59ms
40ms Script
application/javascript 192.0.77.39
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://149520725.v2.pressablecdn.com/wp-content/cache/asp/asp-1442fdeb.js?ver=L49Dzf

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.39 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

7729932e77517e92d2205976c94098c928a5a2ef660dadade0c7a6c38f861532

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intezer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Tue, 30 May 2023 15:10:25 GMT
content-encoding: br
x-ac: 1.hhn _atomic_ams BYPASS
strict-transport-security: max-age=15552000
last-modified: Wed, 17 May 2023 08:58:05 GMT
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=315360000
link: <http://intezer.com/wp-content/cache/asp/asp-1442fdeb.js>; rel="canonical"
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 scripts.js Show response
149520725.v2.pressablecdn.com/wp-content/plugins/cf7-conditional-fields/js/ 136 KB
33 KB 59ms
41ms Script
application/javascript 192.0.77.39
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://149520725.v2.pressablecdn.com/wp-content/plugins/cf7-conditional-fields/js/scripts.js?ver=2.3.8

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.39 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

c17ce5d402af6a0208a7832cb2a4c23a3bdf10ec8659b35cf746a3bd3a3e165c

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intezer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Tue, 30 May 2023 15:10:25 GMT
content-encoding: br
x-ac: 1.hhn _atomic_ams BYPASS
strict-transport-security: max-age=15552000
last-modified: Mon, 24 Apr 2023 14:23:10 GMT
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=315360000
link: <http://intezer.com/wp-content/plugins/cf7-conditional-fields/js/scripts.js>; rel="canonical"
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 api.js Show response
www.google.com/recaptcha/ 884 B
907 B 173ms
56ms Script
text/javascript 2a00:1450:4001:831::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api.js?render=6LewXc8UAAAAADEYz8dYpHTk55uH2MjKqbyc1sXD&ver=3.0

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

2c4f166190d19357f8f9e9850a0875c502f98e6987745ea69eb821cf2c31bb46

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intezer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Tue, 30 May 2023 15:10:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy: frame-ancestors 'self'
server: GSE
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=300
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 587
x-xss-protection: 1; mode=block
expires: Tue, 30 May 2023 15:10:26 GMT

GET
H2 200 wp-polyfill-inert.min.js Show response
149520725.v2.pressablecdn.com/wp-includes/js/dist/vendor/ 8 KB
3 KB 59ms
41ms Script
application/javascript 192.0.77.39
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://149520725.v2.pressablecdn.com/wp-includes/js/dist/vendor/wp-polyfill-inert.min.js?ver=3.1.2

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.39 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

c1a9a3e223bad631dff12d33b5499eb145cb08d8621c20d9d73870e78d97afe4

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intezer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Tue, 30 May 2023 15:10:25 GMT
content-encoding: br
x-ac: 1.hhn _atomic_ams BYPASS
strict-transport-security: max-age=15552000
last-modified: Wed, 18 Jan 2023 11:16:33 GMT
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=315360000
link: <http://intezer.com/wp-includes/js/dist/vendor/wp-polyfill-inert.min.js>; rel="canonical"
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 regenerator-runtime.min.js Show response
149520725.v2.pressablecdn.com/wp-includes/js/dist/vendor/ 6 KB
3 KB 59ms
41ms Script
application/javascript 192.0.77.39
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://149520725.v2.pressablecdn.com/wp-includes/js/dist/vendor/regenerator-runtime.min.js?ver=0.13.11

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.39 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

6974bfd8fa06b7831f05cb4b25860c851a5ad3f02a6699ebe688987dd7a6ebe6

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intezer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Tue, 30 May 2023 15:10:25 GMT
content-encoding: br
x-ac: 1.hhn _atomic_ams BYPASS
strict-transport-security: max-age=15552000
last-modified: Tue, 07 Feb 2023 15:56:37 GMT
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=315360000
link: <http://intezer.com/wp-includes/js/dist/vendor/regenerator-runtime.min.js>; rel="canonical"
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 wp-polyfill.min.js Show response
149520725.v2.pressablecdn.com/wp-includes/js/dist/vendor/ 17 KB
7 KB 59ms
41ms Script
application/javascript 192.0.77.39
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://149520725.v2.pressablecdn.com/wp-includes/js/dist/vendor/wp-polyfill.min.js?ver=3.15.0

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.39 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

1c1fef6e6b4f9832603850b9b6562e74d9a6a3700ba836efe88facc577121e8b

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intezer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Tue, 30 May 2023 15:10:25 GMT
content-encoding: br
x-ac: 1.hhn _atomic_ams BYPASS
strict-transport-security: max-age=15552000
last-modified: Tue, 20 Sep 2022 15:43:29 GMT
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=315360000
link: <http://intezer.com/wp-includes/js/dist/vendor/wp-polyfill.min.js>; rel="canonical"
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 index.js Show response
149520725.v2.pressablecdn.com/wp-content/plugins/contact-form-7/modules/recaptcha/ 999 B
600 B 59ms
42ms Script
application/javascript 192.0.77.39
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://149520725.v2.pressablecdn.com/wp-content/plugins/contact-form-7/modules/recaptcha/index.js?ver=5.7.6

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.39 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

2648a1333fa24d383fd73a6beaac17156ae78f4267ff7407ad60e05a788df44c

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intezer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Tue, 30 May 2023 15:10:25 GMT
content-encoding: br
x-ac: 2.hhn _atomic_ams BYPASS
strict-transport-security: max-age=15552000
last-modified: Mon, 24 Apr 2023 14:22:58 GMT
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=315360000
link: <http://intezer.com/wp-content/plugins/contact-form-7/modules/recaptcha/index.js>; rel="canonical"
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 e-202322.js Show response
stats.wp.com/ 13 KB
4 KB 99ms
14ms Script
application/javascript 192.0.76.3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.wp.com/e-202322.js
Requested by: Host: intezer.com
URL: https://intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ab8517f3d5171dd42a8b9c22af6a2f944b41d00e7ea54ba02b4ed71a6c59e543

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intezer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

x-nc: HIT hhn
date: Tue, 30 May 2023 15:10:26 GMT
content-encoding: br
last-modified: Fri, 19 May 2023 02:56:42 GMT
server: nginx
etag: W/"6466e56a-3508"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
expires: Sat, 25 May 2024 19:51:30 GMT

GET
H2 200 imagesloaded.min.js Show response
149520725.v2.pressablecdn.com/wp-includes/js/ 5 KB
2 KB 59ms
42ms Script
application/javascript 192.0.77.39
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://149520725.v2.pressablecdn.com/wp-includes/js/imagesloaded.min.js?ver=4.1.4

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.39 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

ff4bd34aa98a0214833619d3d751838db015722dfbbec15cd14dadc66cd67869

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intezer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Tue, 30 May 2023 15:10:25 GMT
content-encoding: br
x-ac: 1.hhn _atomic_ams BYPASS
strict-transport-security: max-age=15552000
last-modified: Sat, 13 Jun 2020 18:53:27 GMT
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=315360000
link: <http://intezer.com/wp-includes/js/imagesloaded.min.js>; rel="canonical"
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 jquery.smartmenus.min.js Show response
149520725.v2.pressablecdn.com/wp-content/plugins/elementor-pro/assets/lib/smartmenus/ 25 KB
7 KB 61ms
44ms Script
application/javascript 192.0.77.39
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://149520725.v2.pressablecdn.com/wp-content/plugins/elementor-pro/assets/lib/smartmenus/jquery.smartmenus.min.js?ver=1.0.1

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.39 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

533e264cc615ee4601da8d2c1dee4a8987319e53d4d7162272f067fbbf250020

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intezer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Tue, 30 May 2023 15:10:25 GMT
content-encoding: br
x-ac: 2.hhn _atomic_ams BYPASS
strict-transport-security: max-age=15552000
last-modified: Wed, 17 May 2023 08:58:12 GMT
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=315360000
link: <http://intezer.com/wp-content/plugins/elementor-pro/assets/lib/smartmenus/jquery.smartmenus.min.js>; rel="canonical"
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 webpack-pro.runtime.min.js Show response
149520725.v2.pressablecdn.com/wp-content/plugins/elementor-pro/assets/js/ 5 KB
2 KB 61ms
44ms Script
application/javascript 192.0.77.39
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://149520725.v2.pressablecdn.com/wp-content/plugins/elementor-pro/assets/js/webpack-pro.runtime.min.js?ver=3.13.1

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.39 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

f2ae4a1938fe6071ac16a5d359018cf424002cc8e14f23fa9c43dd1f51d4fcc6

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intezer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Tue, 30 May 2023 15:10:25 GMT
content-encoding: br
x-ac: 2.hhn _atomic_ams BYPASS
strict-transport-security: max-age=15552000
last-modified: Wed, 17 May 2023 08:58:12 GMT
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=315360000
link: <http://intezer.com/wp-content/plugins/elementor-pro/assets/js/webpack-pro.runtime.min.js>; rel="canonical"
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 webpack.runtime.min.js Show response
149520725.v2.pressablecdn.com/wp-content/plugins/elementor/assets/js/ 5 KB
2 KB 62ms
44ms Script
application/javascript 192.0.77.39
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://149520725.v2.pressablecdn.com/wp-content/plugins/elementor/assets/js/webpack.runtime.min.js?ver=3.13.2

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.39 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

eceee9cbf2cb380924bf8ddcff80de363cf46f7dc35bb336bd2bd08af878bbe2

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intezer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Tue, 30 May 2023 15:10:25 GMT
content-encoding: br
x-ac: 1.hhn _atomic_ams BYPASS
strict-transport-security: max-age=15552000
last-modified: Sun, 14 May 2023 16:20:32 GMT
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=315360000
link: <http://intezer.com/wp-content/plugins/elementor/assets/js/webpack.runtime.min.js>; rel="canonical"
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 frontend-modules.min.js Show response
149520725.v2.pressablecdn.com/wp-content/plugins/elementor/assets/js/ 45 KB
14 KB 67ms
50ms Script
application/javascript 192.0.77.39
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://149520725.v2.pressablecdn.com/wp-content/plugins/elementor/assets/js/frontend-modules.min.js?ver=3.13.2

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.39 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

2fbefccb4ad6c46120918789e367472752f9a20395e5bbf954ef3dc0f3e515ee

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intezer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Tue, 30 May 2023 15:10:25 GMT
content-encoding: br
x-ac: 2.hhn _atomic_ams BYPASS
strict-transport-security: max-age=15552000
last-modified: Sun, 14 May 2023 16:20:32 GMT
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=315360000
link: <http://intezer.com/wp-content/plugins/elementor/assets/js/frontend-modules.min.js>; rel="canonical"
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 hooks.min.js Show response
149520725.v2.pressablecdn.com/wp-includes/js/dist/ 5 KB
2 KB 67ms
50ms Script
application/javascript 192.0.77.39
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://149520725.v2.pressablecdn.com/wp-includes/js/dist/hooks.min.js?ver=4169d3cf8e8d95a3d6d5

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.39 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

9bd82960d99b3a76f4af77a88a346bd61f87bac5ff2f385ee28cd669d8f22134

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intezer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Tue, 30 May 2023 15:10:25 GMT
content-encoding: br
x-ac: 1.hhn _atomic_ams BYPASS
strict-transport-security: max-age=15552000
last-modified: Mon, 11 Apr 2022 12:04:30 GMT
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=315360000
link: <http://intezer.com/wp-includes/js/dist/hooks.min.js>; rel="canonical"
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 i18n.min.js Show response
149520725.v2.pressablecdn.com/wp-includes/js/dist/ 10 KB
4 KB 67ms
51ms Script
application/javascript 192.0.77.39
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://149520725.v2.pressablecdn.com/wp-includes/js/dist/i18n.min.js?ver=9e794f35a71bb98672ae

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.39 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

01c3955df67a9b9d1367957e2c187729eae46b72e92c2b52bdb217b14a8fc874

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intezer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Tue, 30 May 2023 15:10:25 GMT
content-encoding: br
x-ac: 1.hhn _atomic_ams BYPASS
strict-transport-security: max-age=15552000
last-modified: Fri, 23 Sep 2022 19:55:30 GMT
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=315360000
link: <http://intezer.com/wp-includes/js/dist/i18n.min.js>; rel="canonical"
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 frontend.min.js Show response
149520725.v2.pressablecdn.com/wp-content/plugins/elementor-pro/assets/js/ 24 KB
7 KB 68ms
51ms Script
application/javascript 192.0.77.39
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://149520725.v2.pressablecdn.com/wp-content/plugins/elementor-pro/assets/js/frontend.min.js?ver=3.13.1

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.39 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

a9eba9cdd7058e2a7ad28937e19dc6820a079e11ed1728903ceb27a42ffcc9ba

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intezer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Tue, 30 May 2023 15:10:25 GMT
content-encoding: br
x-ac: 2.hhn _atomic_ams BYPASS
strict-transport-security: max-age=15552000
last-modified: Wed, 17 May 2023 08:58:12 GMT
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=315360000
link: <http://intezer.com/wp-content/plugins/elementor-pro/assets/js/frontend.min.js>; rel="canonical"
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 waypoints.min.js Show response
149520725.v2.pressablecdn.com/wp-content/plugins/elementor/assets/lib/waypoints/ 12 KB
3 KB 68ms
51ms Script
application/javascript 192.0.77.39
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://149520725.v2.pressablecdn.com/wp-content/plugins/elementor/assets/lib/waypoints/waypoints.min.js?ver=4.0.2

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.39 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

214674cc77aba35ab3567b88e2739fd08e8e96c61d279559ad61874069683ea0

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intezer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Tue, 30 May 2023 15:10:25 GMT
content-encoding: br
x-ac: 2.hhn _atomic_ams BYPASS
strict-transport-security: max-age=15552000
last-modified: Sun, 14 May 2023 16:20:32 GMT
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=315360000
link: <http://intezer.com/wp-content/plugins/elementor/assets/lib/waypoints/waypoints.min.js>; rel="canonical"
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 core.min.js Show response
149520725.v2.pressablecdn.com/wp-includes/js/jquery/ui/ 21 KB
7 KB 68ms
51ms Script
application/javascript 192.0.77.39
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://149520725.v2.pressablecdn.com/wp-includes/js/jquery/ui/core.min.js?ver=1.13.2

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.39 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

ca7dce2391845e8aec7da135f33fabd10f74eed28a532ac66fd01f761fcfb42f

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intezer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Tue, 30 May 2023 15:10:25 GMT
content-encoding: br
x-ac: 2.hhn _atomic_ams BYPASS
strict-transport-security: max-age=15552000
last-modified: Thu, 02 Feb 2023 16:36:32 GMT
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=315360000
link: <http://intezer.com/wp-includes/js/jquery/ui/core.min.js>; rel="canonical"
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 swiper.min.js Show response
149520725.v2.pressablecdn.com/wp-content/plugins/elementor/assets/lib/swiper/ 136 KB
36 KB 68ms
52ms Script
application/javascript 192.0.77.39
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://149520725.v2.pressablecdn.com/wp-content/plugins/elementor/assets/lib/swiper/swiper.min.js?ver=5.3.6

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.39 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

b23f49f504faa32aac548b6662ffd64412f6738496fab8be38da46c5b7121804

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intezer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Tue, 30 May 2023 15:10:25 GMT
content-encoding: br
x-ac: 1.hhn _atomic_ams BYPASS
strict-transport-security: max-age=15552000
last-modified: Sun, 14 May 2023 16:20:32 GMT
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=315360000
link: <http://intezer.com/wp-content/plugins/elementor/assets/lib/swiper/swiper.min.js>; rel="canonical"
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 share-link.min.js Show response
149520725.v2.pressablecdn.com/wp-content/plugins/elementor/assets/lib/share-link/ 3 KB
1 KB 68ms
52ms Script
application/javascript 192.0.77.39
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://149520725.v2.pressablecdn.com/wp-content/plugins/elementor/assets/lib/share-link/share-link.min.js?ver=3.13.2

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.39 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

138154c0deed3326477b9b4909175101070a5a3a95342291b53d8cc9879a5f47

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intezer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Tue, 30 May 2023 15:10:25 GMT
content-encoding: br
x-ac: 2.hhn _atomic_ams BYPASS
strict-transport-security: max-age=15552000
last-modified: Sun, 14 May 2023 16:20:32 GMT
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=315360000
link: <http://intezer.com/wp-content/plugins/elementor/assets/lib/share-link/share-link.min.js>; rel="canonical"
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 dialog.min.js Show response
149520725.v2.pressablecdn.com/wp-content/plugins/elementor/assets/lib/dialog/ 10 KB
4 KB 68ms
52ms Script
application/javascript 192.0.77.39
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://149520725.v2.pressablecdn.com/wp-content/plugins/elementor/assets/lib/dialog/dialog.min.js?ver=4.9.0

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.39 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

e9ba3d0c5d5408e00becd36ad394fa9ad9c0616741ebdd6dddc8e837db3605ba

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intezer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Tue, 30 May 2023 15:10:25 GMT
content-encoding: br
x-ac: 2.hhn _atomic_ams BYPASS
strict-transport-security: max-age=15552000
last-modified: Sun, 14 May 2023 16:20:32 GMT
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=315360000
link: <http://intezer.com/wp-content/plugins/elementor/assets/lib/dialog/dialog.min.js>; rel="canonical"
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 frontend.min.js Show response
149520725.v2.pressablecdn.com/wp-content/plugins/elementor/assets/js/ 40 KB
13 KB 68ms
52ms Script
application/javascript 192.0.77.39
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://149520725.v2.pressablecdn.com/wp-content/plugins/elementor/assets/js/frontend.min.js?ver=3.13.2

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.39 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

f25567e7b8a0698486afcba5bc45a909e308e0e161d906c63a570b46734751a7

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intezer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Tue, 30 May 2023 15:10:25 GMT
content-encoding: br
x-ac: 2.hhn _atomic_ams BYPASS
strict-transport-security: max-age=15552000
last-modified: Sun, 14 May 2023 16:20:32 GMT
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=315360000
link: <http://intezer.com/wp-content/plugins/elementor/assets/js/frontend.min.js>; rel="canonical"
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 preloaded-elements-handlers.min.js Show response
149520725.v2.pressablecdn.com/wp-content/plugins/elementor-pro/assets/js/ 164 KB
39 KB 68ms
53ms Script
application/javascript 192.0.77.39
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://149520725.v2.pressablecdn.com/wp-content/plugins/elementor-pro/assets/js/preloaded-elements-handlers.min.js?ver=3.13.1

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.39 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

7552d43b5427e2fab2d9b72539d041fa9fb3afbf9ee278ef828192ae61452b0e

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intezer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Tue, 30 May 2023 15:10:25 GMT
content-encoding: br
x-ac: 2.hhn _atomic_ams BYPASS
strict-transport-security: max-age=15552000
last-modified: Wed, 17 May 2023 08:58:12 GMT
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=315360000
link: <http://intezer.com/wp-content/plugins/elementor-pro/assets/js/preloaded-elements-handlers.min.js>; rel="canonical"
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 preloaded-modules.min.js Show response
149520725.v2.pressablecdn.com/wp-content/plugins/elementor/assets/js/ 41 KB
13 KB 68ms
53ms Script
application/javascript 192.0.77.39
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://149520725.v2.pressablecdn.com/wp-content/plugins/elementor/assets/js/preloaded-modules.min.js?ver=3.13.2

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.39 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

14a32c7cfe8286babbffb86185b8d4e3eeb6c7bf6a70d26c49477b7b8c474994

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intezer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Tue, 30 May 2023 15:10:25 GMT
content-encoding: br
x-ac: 1.hhn _atomic_ams BYPASS
strict-transport-security: max-age=15552000
last-modified: Sun, 14 May 2023 16:20:32 GMT
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=315360000
link: <http://intezer.com/wp-content/plugins/elementor/assets/js/preloaded-modules.min.js>; rel="canonical"
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 jquery.sticky.min.js Show response
149520725.v2.pressablecdn.com/wp-content/plugins/elementor-pro/assets/lib/sticky/ 4 KB
2 KB 68ms
53ms Script
application/javascript 192.0.77.39
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://149520725.v2.pressablecdn.com/wp-content/plugins/elementor-pro/assets/lib/sticky/jquery.sticky.min.js?ver=3.13.1

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.39 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

34bbd1c367ffc7d80fcff86c7e5f8777e70f4911bb324e8ecfc7dd3604a96e68

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intezer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Tue, 30 May 2023 15:10:25 GMT
content-encoding: br
x-ac: 1.hhn _atomic_ams BYPASS
strict-transport-security: max-age=15552000
last-modified: Wed, 17 May 2023 08:58:12 GMT
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=315360000
link: <http://intezer.com/wp-content/plugins/elementor-pro/assets/lib/sticky/jquery.sticky.min.js>; rel="canonical"
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 conversion.js Show response
www.googleadservices.com/pagead/ 48 KB
18 KB 156ms
68ms Script
text/javascript 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion.js

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f2.1e100.net

Software

cafe /

Resource Hash

754acb7f1683954de7697922bdf7d8c246e3ed168174c82eacf186bafa933915

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intezer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Tue, 30 May 2023 15:10:26 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 18110
x-xss-protection: 0
server: cafe
etag: 565598911584574198
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Tue, 30 May 2023 15:10:26 GMT

GET
H2 200 5492986.js Show response
js.hs-scripts.com/ 1 KB
692 B 421ms
420ms Script
application/javascript 2606:4700::6812:853b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hs-scripts.com/5492986.js
Requested by: Host: intezer.com
URL: https://intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:853b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ad23d6ebc073bad7ce93ce75c9b42e0dd9a041128014b4166ba8a9e274253cf0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intezer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Tue, 30 May 2023 15:10:26 GMT
content-encoding: br
cf-cache-status: EXPIRED
x-hubspot-correlation-id: aac02c7a-2c2f-4489-8b4f-a5b6a121c09b
x-evy-trace-route-service-name: envoyset-translator
x-envoy-upstream-service-time: 11
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 5bc78f62-bf4b-4aa2-beea-837d6b99a4f7
last-modified: Tue, 30 May 2023 15:08:13 GMT
server: cloudflare
x-trace: 2BA10AAD43E1141D5B2B227C94BB3D5AFCDA949123000000000000000000
vary: origin, Accept-Encoding
access-control-max-age: 3600
content-type: application/javascript;charset=utf-8
access-control-allow-origin: https://intezer.com
x-evy-trace-virtual-host: all
cache-control: public, max-age=60
access-control-allow-credentials: true
x-evy-trace-served-by-pod: iad02/hubapi-td/envoy-proxy-598c95b5b7-6wnvv
cf-ray: 7cf7e7649b0518de-FRA
expires: Tue, 30 May 2023 15:11:26 GMT

GET
H2 200 blog-item.svg
149520725.v2.pressablecdn.com/wp-content/themes/intezer-v2/images/mega/ 552 B
462 B 55ms
54ms Image
image/svg+xml 192.0.77.39
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://149520725.v2.pressablecdn.com/wp-content/themes/intezer-v2/images/mega/blog-item.svg

Requested by

Host: 149520725.v2.pressablecdn.com
URL: https://149520725.v2.pressablecdn.com/wp-content/themes/intezer-v2/style.css?ver=1685459283

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.39 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

24b9f93c7c1dd7ef36951dc6247138107eb9d7ae4beca8b7017f282642617894

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://149520725.v2.pressablecdn.com/wp-content/themes/intezer-v2/style.css?ver=1685459283
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Tue, 30 May 2023 15:10:25 GMT
content-encoding: br
x-ac: 2.hhn _atomic_ams BYPASS
strict-transport-security: max-age=15552000
last-modified: Thu, 30 Mar 2023 14:50:18 GMT
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=604800
link: <http://intezer.com/wp-content/themes/intezer-v2/images/mega/blog-item.svg>; rel="canonical"
expires: Tue, 06 Jun 2023 15:10:25 GMT

GET
H2 200 memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4gaVc.ttf
fonts.gstatic.com/s/opensans/v34/ 31 KB
21 KB 91ms
18ms Font
font/ttf 2a00:1450:4001:806::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v34/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4gaVc.ttf

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

294ed1734fd63bdeca41e4ac6d668c513ea6932b0030ee10c605d09efba1900e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://intezer.com/
Origin: https://intezer.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Sat, 27 May 2023 10:04:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 277544
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 21006
x-xss-protection: 0
last-modified: Mon, 15 Aug 2022 18:14:44 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
vary: Accept-Encoding
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/ttf
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 26 May 2024 10:04:42 GMT

GET
H2 200 fontawesome-webfont.woff2
149520725.v2.pressablecdn.com/wp-content/themes/intezer-v2/fonts/ 75 KB
76 KB 87ms
15ms Font
application/font-woff2 192.0.77.39
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://149520725.v2.pressablecdn.com/wp-content/themes/intezer-v2/fonts/fontawesome-webfont.woff2?v=4.7.0

Requested by

Host: 149520725.v2.pressablecdn.com
URL: https://149520725.v2.pressablecdn.com/wp-content/themes/intezer-v2/css/font-awesome.min.css?ver=eb7ddf2ab56d8f1440d99ff3878c69da

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.39 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://149520725.v2.pressablecdn.com/wp-content/themes/intezer-v2/css/font-awesome.min.css?ver=eb7ddf2ab56d8f1440d99ff3878c69da
Origin: https://intezer.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Tue, 30 May 2023 15:10:26 GMT
x-ac: 1.hhn _atomic_ams BYPASS
strict-transport-security: max-age=15552000
last-modified: Sun, 13 Dec 2020 07:21:24 GMT
server: nginx
access-control-allow-methods: GET, HEAD
content-type: application/font-woff2
access-control-allow-origin: *
cache-control: max-age=315360000
accept-ranges: bytes
link: <http://intezer.com/wp-content/themes/intezer-v2/fonts/fontawesome-webfont.woff2>; rel="canonical"
content-length: 77160
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsg-1x4gaVc.ttf
fonts.gstatic.com/s/opensans/v34/ 31 KB
20 KB 105ms
32ms Font
font/ttf 2a00:1450:4001:806::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v34/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsg-1x4gaVc.ttf

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

131d7ee76b779886898c901bfa19c90b68917c8e4b4b4cc9d929e53a9ecc92a2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://intezer.com/
Origin: https://intezer.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Tue, 30 May 2023 14:23:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2826
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20549
x-xss-protection: 0
last-modified: Mon, 15 Aug 2022 18:14:45 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
vary: Accept-Encoding
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/ttf
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 29 May 2024 14:23:20 GMT

GET
H2 200 museo-700-webfont.woff
149520725.v2.pressablecdn.com/wp-content/themes/intezer-v2/fonts/ 52 KB
52 KB 87ms
16ms Font
application/font-woff 192.0.77.39
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://149520725.v2.pressablecdn.com/wp-content/themes/intezer-v2/fonts/museo-700-webfont.woff

Requested by

Host: 149520725.v2.pressablecdn.com
URL: https://149520725.v2.pressablecdn.com/wp-content/themes/intezer-v2/style.css?ver=1685459283

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.39 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

6bebe6bf7abf43624ab1ed62cabc6a1e1d9d5f1cea38042e516439b5391c1621

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://149520725.v2.pressablecdn.com/wp-content/themes/intezer-v2/style.css?ver=1685459283
Origin: https://intezer.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Tue, 30 May 2023 15:10:26 GMT
x-ac: 1.hhn _atomic_ams BYPASS
strict-transport-security: max-age=15552000
last-modified: Sun, 13 Dec 2020 07:21:20 GMT
server: nginx
access-control-allow-methods: GET, HEAD
content-type: application/font-woff
access-control-allow-origin: *
cache-control: max-age=604800
accept-ranges: bytes
link: <http://intezer.com/wp-content/themes/intezer-v2/fonts/museo-700-webfont.woff>; rel="canonical"
content-length: 53376
expires: Tue, 06 Jun 2023 15:10:26 GMT

GET
H2 200 memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsiH0B4gaVc.ttf
fonts.gstatic.com/s/opensans/v34/ 31 KB
21 KB 25ms
21ms Font
font/ttf 2a00:1450:4001:806::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v34/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsiH0B4gaVc.ttf

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8fdbf9efc2a3dee59ac086edff2cca2c66184470cb4d88cf8eacc574a45cef51

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://intezer.com/
Origin: https://intezer.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Sat, 27 May 2023 06:49:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 289229
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 21053
x-xss-protection: 0
last-modified: Mon, 15 Aug 2022 18:14:42 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
vary: Accept-Encoding
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/ttf
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 26 May 2024 06:49:57 GMT

GET
H2 200 museo-500-webfont.woff
149520725.v2.pressablecdn.com/wp-content/themes/intezer-v2/fonts/ 55 KB
55 KB 32ms
29ms Font
application/font-woff 192.0.77.39
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://149520725.v2.pressablecdn.com/wp-content/themes/intezer-v2/fonts/museo-500-webfont.woff

Requested by

Host: 149520725.v2.pressablecdn.com
URL: https://149520725.v2.pressablecdn.com/wp-content/themes/intezer-v2/style.css?ver=1685459283

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.39 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

c6c82452d4595c717df8f740c6f9ff4e6ae5bc1bb9f716584b27f457f18a1d04

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://149520725.v2.pressablecdn.com/wp-content/themes/intezer-v2/style.css?ver=1685459283
Origin: https://intezer.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Tue, 30 May 2023 15:10:26 GMT
x-ac: 2.hhn _atomic_ams BYPASS
strict-transport-security: max-age=15552000
last-modified: Sun, 13 Dec 2020 07:21:23 GMT
server: nginx
access-control-allow-methods: GET, HEAD
content-type: application/font-woff
access-control-allow-origin: *
cache-control: max-age=604800
accept-ranges: bytes
link: <http://intezer.com/wp-content/themes/intezer-v2/fonts/museo-500-webfont.woff>; rel="canonical"
content-length: 56060
expires: Tue, 06 Jun 2023 15:10:26 GMT

GET
H2 200 museo-300-webfont.woff
149520725.v2.pressablecdn.com/wp-content/themes/intezer-v2/fonts/ 54 KB
54 KB 30ms
29ms Font
application/font-woff 192.0.77.39
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://149520725.v2.pressablecdn.com/wp-content/themes/intezer-v2/fonts/museo-300-webfont.woff

Requested by

Host: 149520725.v2.pressablecdn.com
URL: https://149520725.v2.pressablecdn.com/wp-content/themes/intezer-v2/style.css?ver=1685459283

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.39 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

c38df4a2300e1acd22e8547908f1c0815e4232522aed59fd2d45942480b56f4c

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://149520725.v2.pressablecdn.com/wp-content/themes/intezer-v2/style.css?ver=1685459283
Origin: https://intezer.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Tue, 30 May 2023 15:10:26 GMT
x-ac: 1.hhn _atomic_ams BYPASS
strict-transport-security: max-age=15552000
last-modified: Sun, 13 Dec 2020 07:21:22 GMT
server: nginx
access-control-allow-methods: GET, HEAD
content-type: application/font-woff
access-control-allow-origin: *
cache-control: max-age=604800
accept-ranges: bytes
link: <http://intezer.com/wp-content/themes/intezer-v2/fonts/museo-300-webfont.woff>; rel="canonical"
content-length: 55444
expires: Tue, 06 Jun 2023 15:10:26 GMT

GET
H3 200 memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v35/ 47 KB
47 KB 20ms
19ms Font
font/woff2 2a00:1450:4001:806::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v35/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans%3A100%2C100italic%2C200%2C200italic%2C300%2C300italic%2C400%2C400italic%2C500%2C500italic%2C600%2C600italic%2C700%2C700italic%2C800%2C800italic%2C900%2C900italic&display=auto&ver=eb7ddf2ab56d8f1440d99ff3878c69da

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7c7818c25a18e8a38553fcbcbc2ad0b5e964103a7d2e494f82815e3f70bf3fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://intezer.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Sat, 27 May 2023 00:21:44 GMT
x-content-type-options: nosniff
age: 312522
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 48412
x-xss-protection: 0
last-modified: Tue, 02 May 2023 15:08:53 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 26 May 2024 00:21:44 GMT

GET
H3 200 memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqWuU6F.woff2
fonts.gstatic.com/s/opensans/v35/ 49 KB
49 KB 23ms
22ms Font
font/woff2 2a00:1450:4001:806::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v35/memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqWuU6F.woff2

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3642c7e774562f7483d7b0de93dd1759fc6928e85eebd7e62ddae72e9d46c9cb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://intezer.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Sat, 27 May 2023 12:23:10 GMT
x-content-type-options: nosniff
age: 269236
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 50440
x-xss-protection: 0
last-modified: Tue, 02 May 2023 15:13:42 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 26 May 2024 12:23:10 GMT

GET
H2 200 sm.24.html Show response
static.addtoany.com/menu/ Frame 8EF1 677 B
541 B 34ms
33ms Document
text/html 2606:4700:10::6816:46c5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.addtoany.com/menu/sm.24.html

Requested by

Host: static.addtoany.com
URL: https://static.addtoany.com/menu/page.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:46c5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5a4192e762a449dfd6e63bee835e0941627223c9159e8219acdd01881a1ac175

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://intezer.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 2238217
alt-svc: h3=":443"; ma=86400
cache-control: max-age=315360000, immutable
cf-cache-status: HIT
cf-ray: 7cf7e7662862918f-FRA
content-encoding: br
content-type: text/html; charset=utf-8
date: Tue, 30 May 2023 15:10:26 GMT
etag: W/"2a5-5edb40e6d10d8"
last-modified: Fri, 18 Nov 2022 00:47:55 GMT
server: cloudflare
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Accept-Encoding
via: e4s
x-content-type-options: nosniff

GET
H3 200 core.26680508.js Show response
static.addtoany.com/menu/modules/ 69 KB
25 KB 61ms
37ms Script
application/javascript 2606:4700:10::6816:46c5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.addtoany.com/menu/modules/core.26680508.js

Requested by

Host: static.addtoany.com
URL: https://static.addtoany.com/menu/page.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:10::6816:46c5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

73cfb0ed71e314a835831530e27ba1fde5609b224781f7dbc2dd3eb9a08603cd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://intezer.com/
Origin: https://intezer.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Tue, 30 May 2023 15:10:26 GMT
via: e1s
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains; preload
age: 389737
alt-svc: h3=":443"; ma=86400
cf-bgj: minify
last-modified: Wed, 11 Jan 2023 01:11:29 GMT
server: cloudflare
etag: W/"11452-5f1f2ae24215b"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=315360000, immutable
cf-ray: 7cf7e7664ab56921-FRA

GET
H2 200 128260767783916 Show response
connect.facebook.net/signals/config/ 300 KB
87 KB 148ms
147ms Script
application/x-javascript 2a03:2880:f083:9:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/128260767783916?v=2.9.105&r=canary

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f083:9:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

c6e52031f5b0e365df9f0d842f36ab6844284022501625d97c39edc82b4016ee

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intezer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Tue, 30 May 2023 15:10:26 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-fb-rlafr: 0
x-xss-protection: 0
pragma: public
x-fb-debug: TWsNl6Xvqb9fweF5OJo3Aj6g3rpFNKWEmtWkQAVYHfAAZz6dp9ThqqHGtKlr3VceMMr5S7B4QcmJFAx0dHPZjQ==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
x-fb-trip-id: 1679558926
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type: application/x-javascript; charset=utf-8
x-frame-options: DENY
origin-agent-cluster: ?0
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), midi=(), screen-wake-lock=(), serial=(), usb=()
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 fa-solid-900.woff2
149520725.v2.pressablecdn.com/wp-content/plugins/elementor/assets/lib/font-awesome/webfonts/ 76 KB
77 KB 19ms
19ms Font
application/font-woff2 192.0.77.39
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://149520725.v2.pressablecdn.com/wp-content/plugins/elementor/assets/lib/font-awesome/webfonts/fa-solid-900.woff2

Requested by

Host: 149520725.v2.pressablecdn.com
URL: https://149520725.v2.pressablecdn.com/wp-content/plugins/elementor/assets/lib/font-awesome/css/solid.min.css?ver=5.15.3

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.39 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

d0b4256abed72481585662971262eabee345c19f837af00d7ce24239d3b40eef

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://149520725.v2.pressablecdn.com/wp-content/plugins/elementor/assets/lib/font-awesome/css/solid.min.css?ver=5.15.3
Origin: https://intezer.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Tue, 30 May 2023 15:10:26 GMT
x-ac: 1.hhn _atomic_ams BYPASS
strict-transport-security: max-age=15552000
last-modified: Sun, 14 May 2023 16:20:32 GMT
server: nginx
access-control-allow-methods: GET, HEAD
content-type: application/font-woff2
access-control-allow-origin: *
cache-control: max-age=604800
accept-ranges: bytes
link: <http://intezer.com/wp-content/plugins/elementor/assets/lib/font-awesome/webfonts/fa-solid-900.woff2>; rel="canonical"
content-length: 78196
expires: Tue, 06 Jun 2023 15:10:26 GMT

GET
H2 200 fa-brands-400.woff2
149520725.v2.pressablecdn.com/wp-content/plugins/elementor/assets/lib/font-awesome/webfonts/ 75 KB
75 KB 20ms
20ms Font
application/font-woff2 192.0.77.39
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://149520725.v2.pressablecdn.com/wp-content/plugins/elementor/assets/lib/font-awesome/webfonts/fa-brands-400.woff2

Requested by

Host: 149520725.v2.pressablecdn.com
URL: https://149520725.v2.pressablecdn.com/wp-content/plugins/elementor/assets/lib/font-awesome/css/brands.min.css?ver=5.15.3

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.39 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

43c072c16c9ee6d67acdfa6c6d6685ff1e74eb4237b7cc3c1348ab1c108b26af

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://149520725.v2.pressablecdn.com/wp-content/plugins/elementor/assets/lib/font-awesome/css/brands.min.css?ver=5.15.3
Origin: https://intezer.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Tue, 30 May 2023 15:10:26 GMT
x-ac: 1.hhn _atomic_ams BYPASS
strict-transport-security: max-age=15552000
last-modified: Sun, 14 May 2023 16:20:32 GMT
server: nginx
access-control-allow-methods: GET, HEAD
content-type: application/font-woff2
access-control-allow-origin: *
cache-control: max-age=604800
accept-ranges: bytes
link: <http://intezer.com/wp-content/plugins/elementor/assets/lib/font-awesome/webfonts/fa-brands-400.woff2>; rel="canonical"
content-length: 76764
expires: Tue, 06 Jun 2023 15:10:26 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/725468766/ 3 KB
2 KB 113ms
64ms Script
text/javascript 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/725468766/?random=1685459426346&cv=11&fst=1685459426346&bg=ffffff&guid=ON&async=1&gtm=45be35o0&u_w=1600&u_h=1200&url=https%3A%2F%2Fintezer.com%2Fblog%2Fresearch%2Fcryptoclippy-evolves-to-pilfer-more-financial-data%2F&hn=www.googleadservices.com&frm=0&tiba=CryptoClippy%20Evolves%20to%20Pilfer%20Even%20More%20Financial%20Data&auid=765074824.1685459426&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-725468766

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

aef540cd3fe9f73e976367a08e5afc1f7766d4ca9e8dba3cf30df70d3d80bc23

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intezer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 30 May 2023 15:10:26 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1382
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 optimize.js Show response
www.google-analytics.com/gtm/ 118 KB
46 KB 81ms
35ms Script
application/javascript 2a00:1450:4001:82b::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/gtm/optimize.js?id=OPT-PMZPF7T

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KC95766

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

2d6e80f359af2d33eafa5f52e1fa9e3e4efc112b4d45ef5d941ff83be5da81bb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intezer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Tue, 30 May 2023 15:10:26 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 46955
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Tue, 30 May 2023 15:10:26 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/725468766/ 3 KB
1 KB 91ms
65ms Script
text/javascript 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/725468766/?random=1685459426378&cv=11&fst=1685459426378&bg=ffffff&guid=ON&async=1&gtm=45He35o0&u_w=1600&u_h=1200&url=https%3A%2F%2Fintezer.com%2Fblog%2Fresearch%2Fcryptoclippy-evolves-to-pilfer-more-financial-data%2F&hn=www.googleadservices.com&frm=0&tiba=CryptoClippy%20Evolves%20to%20Pilfer%20Even%20More%20Financial%20Data&auid=765074824.1685459426&uamb=0&uaw=0&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KC95766

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

656cef47b19f647d49326b10d53500ba8b0f97aa71d6c3ebbff79ad0b4aed1ce

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intezer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 30 May 2023 15:10:26 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1365
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 uwt.js Show response
static.ads-twitter.com/ 56 KB
15 KB 88ms
20ms Script
application/javascript 146.75.116.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://static.ads-twitter.com/uwt.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KC95766
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 146.75.116.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: cf7fcc9f75c8717897bfaef72f303fab423ce1b70c98512aeb3677e4af988dee

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intezer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Tue, 30 May 2023 15:10:26 GMT
content-encoding: gzip
last-modified: Thu, 27 Oct 2022 16:56:53 GMT
etag: "32ad004436155ec972bc50e6238b5b67+gzip+gzip"
vary: Accept-Encoding,Host
x-cache: HIT, HIT
content-type: application/javascript; charset=utf-8
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
x-tw-cdn: FT
cache-control: no-cache
accept-ranges: bytes
content-length: 15375
x-served-by: cache-iad-kjyo7100081-IAD, cache-fra-eddf8230056-FRA

GET
H2 200 insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 13 KB
5 KB 134ms
34ms Script
application/x-javascript 2a02:26f0:3500:16::215:148d
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://snap.licdn.com/li.lms-analytics/insight.min.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KC95766

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:3500:16::215:148d Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

f56ccb2db87aacedd9415232e40f80bff9939703df2f9c3f9ec8a092e545349f

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intezer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Tue, 30 May 2023 15:10:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 10 Jan 2023 17:22:56 GMT
x-cdn: AKAM
vary: Accept-Encoding
content-type: application/x-javascript;charset=utf-8
cache-control: max-age=10679
accept-ranges: bytes
content-length: 4777

GET
H2 200 hotjar-2053093.js Show response
static.hotjar.com/c/ 9 KB
4 KB 87ms
25ms Script
application/javascript 18.66.97.49
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://static.hotjar.com/c/hotjar-2053093.js?sv=7

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KC95766

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.97.49 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-66-97-49.fra56.r.cloudfront.net

Software

Resource Hash

99f55b2f38afcf39e0f0bc0843fb5dabb13295d11d518fa64a1de9c6c96487a2

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intezer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

strict-transport-security: max-age=2592000; includeSubDomains
content-encoding: br
x-content-type-options: nosniff
date: Tue, 30 May 2023 15:10:26 GMT
via: 1.1 891011d51eb2353ebe8601f5b6467070.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P2
age: 37
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
etag: W/3766c2540c1eed9af673df24cdc597b6
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
x-cache-hit: 1
cache-control: max-age=60
x-amz-cf-id: yOPl0TG2KaiZb0ycpaz7_Vg7ozq_99Lxh7-v0bqwqVLyT14zSEnI6w==

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 51 KB
21 KB 54ms
25ms Script
text/javascript 2a00:1450:4001:82b::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KC95766

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

e7b90d32907f89c49e9e2a2ccca95133277f756f13a14187936d9b948ff67b44

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intezer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Tue, 30 May 2023 15:04:54 GMT
last-modified: Mon, 17 Apr 2023 22:36:01 GMT
server: Golfe2
age: 332
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20737
expires: Tue, 30 May 2023 17:04:54 GMT

GET
H2 200 pixel.js Show response
www.redditstatic.com/ads/ 23 KB
8 KB 78ms
18ms Script
application/javascript 2a04:4e42::396
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://www.redditstatic.com/ads/pixel.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KC95766
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42::396 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: snooserv /
Resource Hash: cda252dc01c656d59193d8d696f26c3e95f10b87711e2413e28362532bae984a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intezer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Tue, 30 May 2023 15:10:26 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
last-modified: Mon, 23 Jan 2023 21:56:14 GMT
server: snooserv
nel: {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.02, "failure_fraction": 0.02}
etag: "03d5db9dfd00a5719bb4c9261e6fa1bb"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding,Origin
report-to: {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]}
content-type: application/javascript
cache-control: public, max-age=60
accept-ranges: bytes
content-length: 7356

GET
H2

200

0a2b546a-2cdc-4e6f-8031-6303b379fd45_eu.js Show response
cdn.mouseflow.com/projects/
Redirect Chain

https://cdn.mouseflow.com/projects/0a2b546a-2cdc-4e6f-8031-6303b379fd45.js
https://cdn.mouseflow.com/projects/0a2b546a-2cdc-4e6f-8031-6303b379fd45_eu.js

60 KB
17 KB

27ms
27ms

Script
application/javascript

151.139.128.10
STACKPATH-CDN

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.mouseflow.com/projects/0a2b546a-2cdc-4e6f-8031-6303b379fd45_eu.js
Requested by: Host: intezer.com
URL: https://intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/
Protocol: H2
Server: 151.139.128.10 , United States, ASN20446 (STACKPATH-CDN, US),
Reverse DNS: map3.hwcdn.net
Software: /
Resource Hash: 9b5cd0471afe0aa08f6097c16c8e2badcb68bdcb9824819a494003cd65659838

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intezer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Tue, 30 May 2023 15:10:26 GMT
content-encoding: gzip
last-modified: Wed, 21 Sep 2022 13:00:24 GMT
server
etag: "2d72f51cbacdd81:0"
x-hw: 1685459426.cds286.fr8.hn,1685459426.cds344.fr8.c
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=86400
accept-ranges: bytes
content-length: 17408

Redirect headers

date: Tue, 30 May 2023 15:10:26 GMT
x-hw: 1685459426.cds286.fr8.hn,1685459426.cds158.fr8.c
location: https://cdn.mouseflow.com/projects/0a2b546a-2cdc-4e6f-8031-6303b379fd45_eu.js
access-control-allow-origin: *
cache-control: max-age=86400
accept-ranges: bytes
x-hw-loc: https://cdn.mouseflow.com/projects/0a2b546a-2cdc-4e6f-8031-6303b379fd45.js
content-length: 0

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 264 KB
87 KB 51ms
50ms Script
application/javascript 2a00:1450:4001:828::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-77ZEDWXEEK&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KC95766

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

18d0b4ceb6bf42d951807a198abf3f3909befc21639a51eabb0fe091a50360c4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intezer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Tue, 30 May 2023 15:10:26 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 88701
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Tue, 30 May 2023 15:10:26 GMT

GET
H2 200 5492986.js Show response
js.hs-banner.com/ 62 KB
16 KB 210ms
146ms Script
text/javascript 2606:4700::6812:19c4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hs-banner.com/5492986.js
Requested by: Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/5492986.js?integration=WordPress&ver=10.1.23
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:19c4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a72ca284350cc89810ce024c098adbea889cbb8713e6a7f91a1e16ed9aae1ed5

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intezer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Tue, 30 May 2023 15:10:26 GMT
x-amz-version-id: dr0b1tMB9BblCPKNqC7E.NptV5YtrwNt
content-encoding: br
cf-cache-status: REVALIDATED
x-amz-request-id: B28ARZSVXF151CR0
x-amz-server-side-encryption: AES256
x-amz-id-2: mRbUqG6fLn5WPWURzcEN8M9vtkk5eDANwMlAwsOFXmena2EmmjgccOU9MKLynFq0FD/tGAxUZ1E=
last-modified: Mon, 17 Apr 2023 15:38:04 GMT
server: cloudflare
etag: W/"241972ae9a1b96e15bd0d5452cde842d"
access-control-max-age: 604800
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: https://protect.intezer.com
access-control-expose-headers: x-last-modified-timestamp, X-HubSpot-NotFound, X-HS-User-Request, Link, Server-Timing
cache-control: max-age=300, public
access-control-allow-credentials: true
vary: origin, Accept-Encoding
timing-allow-origin: *
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Accept-Charset, Accept-Encoding, X-Override-Internal-Permissions, X-Properties-Source, X-Properties-SourceId, X-Properties-Flag, X-Hubspot-User-Id, X-Hubspot-Trace, X-Hubspot-Callee, X-Hubspot-Offset, X-Hubspot-No-Trace, X-HubSpot-Static-App-Info, X-HubSpot-Messages-Uri, X-HubSpot-Request-Source, X-HubSpot-Request-Reason, Subscription-Billing-Auth-Token, X-App-CSRF, X-Tools-CSRF, Online-Payment-Signing-UUID, X-Source, X-SourceId, X-Origin-UserId, X-Biden-Request-Source, X-HubSpot-CSRF-hubspotapi, X-Force-Cookie-Refresh, X-Force-Cookie-Refresh-No-Cache, X-HS-User-Request, X-Application-Id, X-HS-Referer, X-HubSpot-Correlation-Id
cf-ray: 7cf7e7678ead2bd1-FRA
expires: Tue, 30 May 2023 15:15:26 GMT

GET
H2 200 conversations-embed.js Show response
js.usemessages.com/ 75 KB
22 KB 88ms
36ms Script
application/javascript 2606:4700::6811:64ac
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.usemessages.com/conversations-embed.js
Requested by: Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/5492986.js?integration=WordPress&ver=10.1.23
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:64ac , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3c0d53e3bb5b5c53541fa548b76a8bc07eb9dd240cfe12a161f09ae76885eb36

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intezer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Tue, 30 May 2023 15:10:26 GMT
x-amz-version-id: 5SiLffz8vM6j2j84pfI6k1_yPnuZxMPK
via: 1.1 9d2dee9b44718f249b789987d2cbe62c.cloudfront.net (CloudFront)
cf-cache-status: HIT
content-encoding: br
x-amz-cf-pop: IAD12-P3
age: 578
x-amz-server-side-encryption: AES256
x-evy-trace-route-service-name: envoyset-translator
content-security-policy-report-only: frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=conversations-embed/static-1.13338/bundles/project.js&cfRay=7cf7d948989d1c1e-FRA
x-cache: Hit from cloudfront
cache-tag: staticjsapp-conversations-embed-web-prod,staticjsapp-prod
x-envoy-upstream-service-time: 0
x-amz-replication-status: COMPLETED
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 9c823d5c-36f9-4fd7-bd6d-acc243ee3cf5
last-modified: Tue, 30 May 2023 01:40:24 UTC
server: cloudflare
etag: W/"f2060025be42d580e8b9de86a2e702bf"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
x-hs-cache-status: HIT
x-evy-trace-virtual-host: all
cache-control: max-age=600
x-evy-trace-served-by-pod: iad02/app-td/envoy-proxy-57ff77fcd-wd7jg
cf-ray: 7cf7e767bc151cc9-FRA
x-amz-cf-id: yKw47oquGChb6s4jVcBQlw38Zs8iFBI9unvF3a0uLxMS0YyMvmNtvg==
x-hs-target-asset: conversations-embed/static-1.13338/bundles/project.js

GET
H2 200 5492986.js Show response
js.hs-analytics.net/analytics/1685459400000/ 65 KB
21 KB 227ms
167ms Script
text/javascript 2606:4700::6810:8bce
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hs-analytics.net/analytics/1685459400000/5492986.js
Requested by: Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/5492986.js?integration=WordPress&ver=10.1.23
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:8bce , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8e63117c421644e5480f45f993465a46bbb5dfb9bfb0272c0122eac88f1dd7dd

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intezer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Tue, 30 May 2023 15:10:26 GMT
x-amz-version-id: null
content-encoding: br
cf-cache-status: MISS
x-amz-request-id: 5D29PWQPPMMHR0CA
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
x-envoy-upstream-service-time: 22
x-amz-id-2: OTU5B1zGLg2QovkL34oVtVECNUeyDt96BCk62dVeYMzjxEYuIFD7PkZ/KsrZ32/+XeKgWm50/o0=
x-evy-trace-listener: listener_https
x-request-id: a7f0bbd1-532a-42ed-b250-b81cc2e560c3
x-evy-trace-route-configuration: listener_https/all
last-modified: Tue, 18 Apr 2023 14:04:01 GMT
server: cloudflare
etag: W/"8d5fc90ac89582ad4ef3f47c92739ed3"
vary: origin, Accept-Encoding
content-type: text/javascript
x-evy-trace-virtual-host: all
x-evy-trace-served-by-pod: iad02/analytics-js-proxy-td/envoy-proxy-7dbb6c8f49-f4w7q
cache-control: max-age=300,public
access-control-allow-credentials: false
cf-ray: 7cf7e767ef943a80-FRA
expires: Tue, 30 May 2023 15:15:26 GMT

GET
H2 200 /
tr-rc.lfeeder.com/ 43 B
295 B 150ms
75ms Image
image/gif 13.224.189.77
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tr-rc.lfeeder.com/?sid=YEgkB8lPLLw8ep3Z&data=eyJnYVRyYWNraW5nSWRzIjpbXSwiZ2FNZWFzdXJlbWVudElkcyI6WyJBVy03MjU0Njg3NjYiXSwiZ2FDbGllbnRJZHMiOltdLCJjb250ZXh0Ijp7ImxpYnJhcnkiOnsibmFtZSI6ImxmdHJhY2tlciIsInZlcnNpb24iOiIyLjYxLjAifSwicGFnZVVybCI6Imh0dHBzOi8vaW50ZXplci5jb20vYmxvZy9yZXNlYXJjaC9jcnlwdG9jbGlwcHktZXZvbHZlcy10by1waWxmZXItbW9yZS1maW5hbmNpYWwtZGF0YS8iLCJwYWdlVGl0bGUiOiJDcnlwdG9DbGlwcHkgRXZvbHZlcyB0byBQaWxmZXIgRXZlbiBNb3JlIEZpbmFuY2lhbCBEYXRhIiwicmVmZXJyZXIiOiIifSwiZXZlbnQiOiJ0cmFja2luZy1ldmVudCIsImNsaWVudEV2ZW50SWQiOiIxOWI5YzljMTU2MjVlOTJkIiwic2NyaXB0SWQiOiJZRWdrQjhsUExMdzhlcDNaIiwiY29va2llc0VuYWJsZWQiOnRydWUsImNvbnNlbnRMZXZlbCI6Im5vbmUiLCJhbm9ueW1pemVJcCI6ZmFsc2UsImxmQ2xpZW50SWQiOiJMRjEuMS4yMzNlN2E4YzVlNzg4Y2YwLjE2ODU0NTk0MjY0NTgiLCJmb3JlaWduQ29va2llcyI6W10sInByb3BlcnRpZXMiOnt9LCJhdXRvVHJhY2tpbmdFbmFibGVkIjp0cnVlLCJhdXRvVHJhY2tpbmdNb2RlIjoib25fc2NyaXB0X2xvYWQifQ==
Requested by: Host: intezer.com
URL: https://intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.189.77 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-189-77.fra2.r.cloudfront.net
Software: CloudFront /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intezer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Tue, 30 May 2023 15:10:26 GMT
via: 1.1 c379418fd6100691807f32f274ebe9ce.cloudfront.net (CloudFront)
server: CloudFront
x-amz-cf-pop: FRA2-C1
x-cache: LambdaGeneratedResponse from cloudfront
content-type: image/gif
content-length: 43
x-amz-cf-id: 6XJZdFQRSBfzzdyKQvlLkYkQ4kcWDr8i9XFMNuU__4IWQ_0K4ZrfLQ==

GET
H2 200 recaptcha__de.js Show response
www.gstatic.com/recaptcha/releases/CDFvp7CXAHw7k3HxO47Gm1O9/ 410 KB
165 KB 66ms
18ms Script
text/javascript 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/CDFvp7CXAHw7k3HxO47Gm1O9/recaptcha__de.js

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api.js?render=6LewXc8UAAAAADEYz8dYpHTk55uH2MjKqbyc1sXD&ver=3.0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9e2831acb97097ce89e609e9ff841c6c6293ffeb1ce3e2acc07dfcdeeaa621fd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://intezer.com/
Origin: https://intezer.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Tue, 30 May 2023 14:51:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1153
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 168302
x-xss-protection: 0
last-modified: Mon, 22 May 2023 20:58:33 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 29 May 2024 14:51:13 GMT

GET
H/1.1 200
OK track.js Show response
secure.gaug.es/ 4 KB
4 KB 489ms
111ms Script
application/javascript 52.71.12.253
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.gaug.es/track.js
Requested by: Host: intezer.com
URL: https://intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.71.12.253 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-71-12-253.compute-1.amazonaws.com
Software: nginx/1.10.3 (Ubuntu) /
Resource Hash: df2698e6cf74ed890afa92da10051f880df2ce0b3257b73c5d9ae2f6bea82d3c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intezer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

Date: Tue, 30 May 2023 15:10:26 GMT
Last-Modified: Tue, 16 Aug 2022 10:33:40 GMT
Server: nginx/1.10.3 (Ubuntu)
ETag: "62fb7284-ef5"
Content-Type: application/javascript
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 3829

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/842858921/ 3 KB
2 KB 51ms
50ms Script
text/javascript 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/842858921/?random=1685459426533&cv=9&fst=1685459426533&num=1&guid=ON&resp=GooglemKTybQhCsO&eid=375603261%2C466465926%2C512247839&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fintezer.com%2Fblog%2Fresearch%2Fcryptoclippy-evolves-to-pilfer-more-financial-data%2F&tiba=CryptoClippy%20Evolves%20to%20Pilfer%20Even%20More%20Financial%20Data&hn=www.googleadservices.com&uaa=&uab=&uam=&uap=&uapv=&uaw=0&uafvl=&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

32b55317d8f95eb2771939a8f1c1a95be3cc648a0c3b4d05be13d92a5c5cd072

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intezer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 30 May 2023 15:10:26 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1445
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/725468766/ 42 B
327 B 53ms
52ms Image
image/gif 2a00:1450:4001:831::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/725468766/?random=1685459426346&cv=11&fst=1685458800000&bg=ffffff&guid=ON&async=1&gtm=45be35o0&u_w=1600&u_h=1200&url=https%3A%2F%2Fintezer.com%2Fblog%2Fresearch%2Fcryptoclippy-evolves-to-pilfer-more-financial-data%2F&frm=0&tiba=CryptoClippy%20Evolves%20to%20Pilfer%20Even%20More%20Financial%20Data&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=1692168104&rmt_tld=0&ipr=y

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intezer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 30 May 2023 15:10:26 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/725468766/ 42 B
455 B 107ms
31ms Image
image/gif 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/725468766/?random=1685459426346&cv=11&fst=1685458800000&bg=ffffff&guid=ON&async=1&gtm=45be35o0&u_w=1600&u_h=1200&url=https%3A%2F%2Fintezer.com%2Fblog%2Fresearch%2Fcryptoclippy-evolves-to-pilfer-more-financial-data%2F&frm=0&tiba=CryptoClippy%20Evolves%20to%20Pilfer%20Even%20More%20Financial%20Data&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=1692168104&rmt_tld=1&ipr=y

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intezer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 30 May 2023 15:10:26 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 rp.gif
alb.reddit.com/ 42 B
157 B 182ms
123ms Image
image/gif 151.101.1.140
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://alb.reddit.com/rp.gif?ts=1685459426546&id=t2_hhlhye2a&event=PageVisit&m.itemCount=undefined&m.value=&m.valueDecimal=undefined&m.currency=undefined&m.transactionId=&m.customEventName=&m.products=&uuid=4fade18c-417a-449c-9a1a-d46e9dbaef6a&aaid=&em=&external_id=&idfa=&integration=gtm&opt_out=0&sh=1600&sw=1200&v=rdt_65e23bc4
Requested by: Host: intezer.com
URL: https://intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.1.140 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: Varnish /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intezer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Tue, 30 May 2023 15:10:26 GMT
via: 1.1 varnish
server: Varnish
content-type: image/gif
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
content-length: 42
retry-after: 0

GET
H2 200 /
www.google.com/pagead/1p-user-list/725468766/ 42 B
108 B 55ms
55ms Image
image/gif 2a00:1450:4001:831::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/725468766/?random=1685459426378&cv=11&fst=1685458800000&bg=ffffff&guid=ON&async=1&gtm=45He35o0&u_w=1600&u_h=1200&url=https%3A%2F%2Fintezer.com%2Fblog%2Fresearch%2Fcryptoclippy-evolves-to-pilfer-more-financial-data%2F&frm=0&tiba=CryptoClippy%20Evolves%20to%20Pilfer%20Even%20More%20Financial%20Data&fmt=3&is_vtc=1&random=2670650123&rmt_tld=0&ipr=y

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intezer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 30 May 2023 15:10:26 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/725468766/ 42 B
108 B 104ms
32ms Image
image/gif 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/725468766/?random=1685459426378&cv=11&fst=1685458800000&bg=ffffff&guid=ON&async=1&gtm=45He35o0&u_w=1600&u_h=1200&url=https%3A%2F%2Fintezer.com%2Fblog%2Fresearch%2Fcryptoclippy-evolves-to-pilfer-more-financial-data%2F&frm=0&tiba=CryptoClippy%20Evolves%20to%20Pilfer%20Even%20More%20Financial%20Data&fmt=3&is_vtc=1&random=2670650123&rmt_tld=1&ipr=y

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intezer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 30 May 2023 15:10:26 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 adsct
t.co/i/ 43 B
376 B 261ms
193ms Image
image/gif 104.244.42.133
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?bci=3&eci=2&event_id=c1db0fa0-3255-4095-ab7a-31c0feb81fd8&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=0be97cfe-0706-40e2-8edb-50119a4b26c6&tw_document_href=https%3A%2F%2Fintezer.com%2Fblog%2Fresearch%2Fcryptoclippy-evolves-to-pilfer-more-financial-data%2F&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=nzi1c&type=javascript&version=2.3.29

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.133 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intezer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

x-response-time: 173
date: Tue, 30 May 2023 15:10:26 GMT
strict-transport-security: max-age=0
server: tsa_o
content-type: image/gif;charset=utf-8
x-transaction-id: da2b4032ca5e77c3
cache-control: no-cache, no-store, max-age=0
perf: 7626143928
x-connection-hash: 712d6a211d112771137f122463b08bd0178a08347305e85e3c50de6710ce3f30
content-length: 43

GET
H2 200 adsct
analytics.twitter.com/i/ 43 B
239 B 277ms
199ms Image
image/gif 104.244.42.3
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://analytics.twitter.com/i/adsct?bci=3&eci=2&event_id=c1db0fa0-3255-4095-ab7a-31c0feb81fd8&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=0be97cfe-0706-40e2-8edb-50119a4b26c6&tw_document_href=https%3A%2F%2Fintezer.com%2Fblog%2Fresearch%2Fcryptoclippy-evolves-to-pilfer-more-financial-data%2F&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=nzi1c&type=javascript&version=2.3.29

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.3 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intezer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

x-response-time: 178
date: Tue, 30 May 2023 15:10:26 GMT
strict-transport-security: max-age=631138519
server: tsa_o
content-type: image/gif;charset=utf-8
x-transaction-id: 3ecac72405fa5113
cache-control: no-cache, no-store, max-age=0
perf: 7626143928
x-connection-hash: e01f8fa9ac5cee226015243810f744c7e154ff65c6ba74b030660de6033ec24c
content-length: 43

GET
H2 200 adsct
t.co/i/ 43 B
205 B 221ms
203ms Image
image/gif 104.244.42.133
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?bci=3&eci=2&event_id=29135afb-1ad0-4970-8321-9ecc8004aa8f&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=0be97cfe-0706-40e2-8edb-50119a4b26c6&tw_document_href=https%3A%2F%2Fintezer.com%2Fblog%2Fresearch%2Fcryptoclippy-evolves-to-pilfer-more-financial-data%2F&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=nzh93&type=javascript&version=2.3.29

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.133 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intezer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

x-response-time: 183
date: Tue, 30 May 2023 15:10:26 GMT
strict-transport-security: max-age=0
server: tsa_o
content-type: image/gif;charset=utf-8
x-transaction-id: 5e245bcbc3b06f31
cache-control: no-cache, no-store, max-age=0
perf: 7626143928
x-connection-hash: 712d6a211d112771137f122463b08bd0178a08347305e85e3c50de6710ce3f30
content-length: 43

GET
H2 200 adsct
analytics.twitter.com/i/ 43 B
395 B 196ms
192ms Image
image/gif 104.244.42.3
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://analytics.twitter.com/i/adsct?bci=3&eci=2&event_id=29135afb-1ad0-4970-8321-9ecc8004aa8f&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=0be97cfe-0706-40e2-8edb-50119a4b26c6&tw_document_href=https%3A%2F%2Fintezer.com%2Fblog%2Fresearch%2Fcryptoclippy-evolves-to-pilfer-more-financial-data%2F&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=nzh93&type=javascript&version=2.3.29

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.3 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intezer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

x-response-time: 171
date: Tue, 30 May 2023 15:10:25 GMT
strict-transport-security: max-age=631138519
server: tsa_o
content-type: image/gif;charset=utf-8
x-transaction-id: 5046812f3956878f
cache-control: no-cache, no-store, max-age=0
perf: 7626143928
x-connection-hash: e01f8fa9ac5cee226015243810f744c7e154ff65c6ba74b030660de6033ec24c
content-length: 43

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
346 B 88ms
26ms XHR
text/plain 2a00:1450:400c:c00::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j100&tid=UA-97741055-8&cid=10293912.1685459427&jid=1877805890&gjid=463899513&_gid=208096606.1685459427&_u=aGBAgEABQAAAAEAAI~&z=1617275432

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c00::9d Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://intezer.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
date: Tue, 30 May 2023 15:10:26 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://intezer.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 collect
www.google-analytics.com/ 35 B
192 B 19ms
19ms Image
image/gif 2a00:1450:4001:82b::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j100&a=1218340232&t=pageview&_s=1&dl=https%3A%2F%2Fintezer.com%2Fblog%2Fresearch%2Fcryptoclippy-evolves-to-pilfer-more-financial-data%2F&ul=en-us&de=UTF-8&dt=CryptoClippy%20Evolves%20to%20Pilfer%20Even%20More%20Financial%20Data&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aGBAgEABQAAAAAAAI~&jid=1877805890&gjid=463899513&cid=10293912.1685459427&tid=UA-97741055-8&_gid=208096606.1685459427&gtm=45He35o0n81KC95766&z=1661205699

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intezer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 29 May 2023 22:02:21 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 61685
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 blank.pngw3.webp
149520725.v2.pressablecdn.com//wp-content/uploads/ 92 B
242 B 23ms
21ms Image
image/webp 192.0.77.39
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://149520725.v2.pressablecdn.com//wp-content/uploads/blank.pngw3.webp

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.39 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

53d07bb53f40c3d94a3a9ae3981e7679a11a3e834c9e40be768adec59087b41d

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intezer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Tue, 30 May 2023 15:10:26 GMT
x-ac: 2.hhn _atomic_ams BYPASS
strict-transport-security: max-age=15552000
last-modified: Wed, 10 Aug 2022 09:04:51 GMT
server: nginx
access-control-allow-methods: GET, HEAD
content-type: image/webp
access-control-allow-origin: *
cache-control: max-age=604800
accept-ranges: bytes
link: <http://intezer.com/wp-content/uploads/blank.pngw3.webp>; rel="canonical"
content-length: 92
expires: Tue, 06 Jun 2023 15:10:26 GMT

GET
H2 200 ms-defender-logo.svg
intezer.com/wp-content/themes/intezer-v2/images/product/ 52 KB
36 KB 29ms
27ms Image
image/svg+xml 199.16.172.82
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://intezer.com/wp-content/themes/intezer-v2/images/product/ms-defender-logo.svg

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

199.16.172.82 , United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

5dbac59a207adeec232cd8139a292ea59f5f3ecf65cdad53cbe23873ffd60d2f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Tue, 30 May 2023 15:10:26 GMT
strict-transport-security: max-age=31536000
content-encoding: br
last-modified: Tue, 07 Feb 2023 06:32:06 GMT
server: nginx
x-ac: 1.hhn _atomic_ams BYPASS
etag: W/"63e1f066-cef6"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=604800
expires: Tue, 06 Jun 2023 15:10:26 GMT

GET
H2 200 CrowdStrike.webp
intezer.com/wp-content/themes/intezer-v2/images/product/ 836 B
962 B 27ms
26ms Image
image/webp 199.16.172.82
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://intezer.com/wp-content/themes/intezer-v2/images/product/CrowdStrike.webp

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

199.16.172.82 , United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

207386621d10b498b12fcb82c8c76a7fed8c6ebe71b7637dd017b6b32783d7a9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Tue, 30 May 2023 15:10:26 GMT
strict-transport-security: max-age=31536000
x-ac: 1.hhn _atomic_ams BYPASS
last-modified: Tue, 13 Sep 2022 06:28:34 GMT
server: nginx
etag: "63202312-344"
access-control-allow-methods: GET, HEAD
content-type: image/webp
access-control-allow-origin: *
cache-control: max-age=604800
accept-ranges: bytes
content-length: 836
expires: Tue, 06 Jun 2023 15:10:26 GMT

GET
H2 200 mega-screen-2.png
149520725.v2.pressablecdn.com/wp-content/uploads/2023/03/ 46 KB
47 KB 23ms
21ms Image
image/png 192.0.77.39
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://149520725.v2.pressablecdn.com/wp-content/uploads/2023/03/mega-screen-2.png

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.39 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

c695b9e17e1ebe7936c190afb9024b259fa00b2b46ee49c3a4782ec13d37be7a

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intezer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Tue, 30 May 2023 15:10:26 GMT
x-ac: 1.hhn _atomic_ams BYPASS
strict-transport-security: max-age=15552000
last-modified: Mon, 13 Mar 2023 15:32:01 GMT
server: nginx
access-control-allow-methods: GET, HEAD
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=604800
accept-ranges: bytes
link: <http://intezer.com/wp-content/uploads/2023/03/mega-screen-2.png>; rel="canonical"
content-length: 47567
expires: Tue, 06 Jun 2023 15:10:26 GMT

GET
H2 200 Screenshot_20200720-202117__01-60x60.png
149520725.v2.pressablecdn.com/wp-content/uploads/2020/07/ 8 KB
8 KB 23ms
21ms Image
image/png 192.0.77.39
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://149520725.v2.pressablecdn.com/wp-content/uploads/2020/07/Screenshot_20200720-202117__01-60x60.png

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.39 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

f315409c3b01157861ce987e758ea205aa549654c761c2fd0b4265646a98b63a

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intezer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Tue, 30 May 2023 15:10:26 GMT
x-ac: 1.hhn _atomic_ams BYPASS
strict-transport-security: max-age=15552000
last-modified: Wed, 10 Aug 2022 12:56:29 GMT
server: nginx
content-type: image/png
cache-control: max-age=604800
accept-ranges: bytes
link: <http://intezer.com/wp-content/uploads/2020/07/Screenshot_20200720-202117__01-60x60.png>; rel="canonical"
content-length: 7973
expires: Tue, 06 Jun 2023 15:10:26 GMT

GET
H2 200 Technical-Analysis-of-CryptoClippy-The-Evolving-Menace-That-Pilfers-Financial-Data-from-ClipboardsB-1270x475.jpg
149520725.v2.pressablecdn.com/wp-content/uploads/2023/05/ 74 KB
75 KB 23ms
22ms Image
image/jpeg 192.0.77.39
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://149520725.v2.pressablecdn.com/wp-content/uploads/2023/05/Technical-Analysis-of-CryptoClippy-The-Evolving-Menace-That-Pilfers-Financial-Data-from-ClipboardsB-1270x475.jpg

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.39 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

0c18977a87920133d0e6fdb59c6b10831b511600c90994af2ef9683c1d6fabbc

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intezer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Tue, 30 May 2023 15:10:26 GMT
x-ac: 1.hhn _atomic_ams BYPASS
strict-transport-security: max-age=15552000
last-modified: Wed, 24 May 2023 13:50:49 GMT
server: nginx
content-type: image/jpeg
cache-control: max-age=604800
accept-ranges: bytes
link: <http://intezer.com/wp-content/uploads/2023/05/Technical-Analysis-of-CryptoClippy-The-Evolving-Menace-That-Pilfers-Financial-Data-from-ClipboardsB-1270x475.jpg>; rel="canonical"
content-length: 76110
expires: Tue, 06 Jun 2023 15:10:26 GMT

GET
H2 200 modules.fee08111252915d9fd11.js Show response
script.hotjar.com/ 265 KB
69 KB 92ms
24ms Script
application/javascript 52.222.236.43
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://script.hotjar.com/modules.fee08111252915d9fd11.js

Requested by

Host: static.hotjar.com
URL: https://static.hotjar.com/c/hotjar-2053093.js?sv=7

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.236.43 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-222-236-43.fra56.r.cloudfront.net

Software

Resource Hash

a5c8acffadd7a1ff83b2b39dc2f3a549b537ef0d46ab028c45020b98fdbadf29

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intezer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Fri, 26 May 2023 11:12:07 GMT
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=2592000; includeSubDomains
via: 1.1 30e954298424aa69c035e25834574742.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P4
age: 359899
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 69576
last-modified: Fri, 26 May 2023 11:11:43 GMT
etag: "30d68c2089416d2cc695ef1dd123cb78"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
x-robots-tag: none
x-amz-cf-id: -mvo0nBfE580pLzZ2oMw0K474U2hDRX2DVX3WzAJg2UYpLqwaDYEZg==

POST
H2 204 collect
region1.analytics.google.com/g/ 0
251 B 79ms
27ms Ping
text/plain 2001:4860:4802:32::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.analytics.google.com/g/collect?v=2&tid=G-77ZEDWXEEK&gtm=45je35o0&_p=1218340232&_gaz=1&cid=10293912.1685459427&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=1&sid=1685459426&sct=1&seg=0&dl=https%3A%2F%2Fintezer.com%2Fblog%2Fresearch%2Fcryptoclippy-evolves-to-pilfer-more-financial-data%2F&dt=CryptoClippy%20Evolves%20to%20Pilfer%20Even%20More%20Financial%20Data&en=page_view&_fv=1&_ss=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-77ZEDWXEEK&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intezer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 30 May 2023 15:10:26 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://intezer.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
47 B 39ms
38ms Ping
text/plain 2a00:1450:400c:c00::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-77ZEDWXEEK&cid=10293912.1685459427&gtm=45je35o0&aip=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-77ZEDWXEEK&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:400c:c00::9d Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intezer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 30 May 2023 15:10:26 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://intezer.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
107 B 58ms
57ms Image
image/gif 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-77ZEDWXEEK&cid=10293912.1685459427&gtm=45je35o0&aip=1&z=966055008

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intezer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 30 May 2023 15:10:26 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ga-audiences
www.google.com/ads/ 42 B
63 B 59ms
58ms Image
image/gif 2a00:1450:4001:831::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j100&tid=UA-97741055-8&cid=10293912.1685459427&jid=1877805890&_u=aGBAgEABQAAAAEAAI~&z=295331285

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intezer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 30 May 2023 15:10:26 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
107 B 57ms
56ms Image
image/gif 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j100&tid=UA-97741055-8&cid=10293912.1685459427&jid=1877805890&_u=aGBAgEABQAAAAEAAI~&z=295331285

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intezer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 30 May 2023 15:10:26 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 token Show response
cdn.linkedin.oribi.io/partner/1327356/domain/intezer.com/ 36 B
377 B 86ms
25ms XHR
application/json 2600:9000:20eb:9800:2:53b2:240:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.linkedin.oribi.io/partner/1327356/domain/intezer.com/token
Requested by: Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:9800:2:53b2:240:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 7b1eaaaf180a13c29b6dddc3b0ae23333b4397e0f3c065b4c86da2f2530a5f89

Request headers

Accept: *
Referer: https://intezer.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Tue, 30 May 2023 12:59:15 GMT
content-encoding: gzip
via: 1.1 59d92388a3a66e5f245f384a437fa024.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA2-C1
age: 7871
vary: accept-encoding
x-cache: Hit from cloudfront
content-type: application/json
access-control-allow-origin: *
cache-control: public, max-age=23782
x-amz-cf-id: pig342MXSRMNPV1pCzjt-pYy-kmDkBiSETUUB3qBaYG4lOjNtj41KA==

GET
H2

200

collect
px4.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1327356&time=1685459426709&url=https%3A%2F%2Fintezer.com%2Fblog%2Fresearch%2Fcryptoclippy-evolves-to-pilfer-more-financial-data%2F
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1327356&time=1685459426709&url=https%3A%2F%2Fintezer.com%2Fblog%2Fresearch%2Fcryptoclippy-evolves-to-pilfer-more-financial-data%2F&cookiesTest=true
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D1327356%26time%3D1685459426709%26url%3Dhttps%253A%252F%252Fintezer.com%252Fblog%2...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1327356&time=1685459426709&url=https%3A%2F%2Fintezer.com%2Fblog%2Fresearch%2Fcryptoclippy-evolves-to-pilfer-more-financial-data%2F&cookiesTest=tru...
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=1327356&time=1685459426709&url=https%3A%2F%2Fintezer.com%2Fblog%2Fresearch%2Fcryptoclippy-evolves-to-pilfer-more-financial-data%2F&cookiesTest=tr...

0
267 B

194ms
133ms

Image
application/javascript

13.107.42.14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=1327356&time=1685459426709&url=https%3A%2F%2Fintezer.com%2Fblog%2Fresearch%2Fcryptoclippy-evolves-to-pilfer-more-financial-data%2F&cookiesTest=true&liSync=true&e_ipv6=AQIumPDpEfMFPQAAAYhtNeFFwH6XBg66P_X_yWYb14V-WdKEM4ZUq4ttPjdDIxgoZVFk9uxtzrVD
Requested by: Host: intezer.com
URL: https://intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/
Protocol: H2
Server: 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intezer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Tue, 30 May 2023 15:10:26 GMT
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: 80D95ED9A8A44CB6B0062AECAECEC419 Ref B: DUS30EDGE0312 Ref C: 2023-05-30T15:10:27Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
content-type: application/javascript
x-li-fabric: prod-lva1
x-li-proto: http/2
content-length: 0
x-li-uuid: AAX86pp7L1U+h2cEOZ3zxA==

Redirect headers

date: Tue, 30 May 2023 15:10:27 GMT
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: 8E9C94809AF442DCB262D33CF554346A Ref B: FRAEDGE1907 Ref C: 2023-05-30T15:10:27Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-lva1
location: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=1327356&time=1685459426709&url=https%3A%2F%2Fintezer.com%2Fblog%2Fresearch%2Fcryptoclippy-evolves-to-pilfer-more-financial-data%2F&cookiesTest=true&liSync=true&e_ipv6=AQIumPDpEfMFPQAAAYhtNeFFwH6XBg66P_X_yWYb14V-WdKEM4ZUq4ttPjdDIxgoZVFk9uxtzrVD
x-li-proto: http/2
content-length: 0
x-li-uuid: AAX86pp32kpfvHSwk4Ha6A==

GET
H2 200 g.gif
pixel.wp.com/ 50 B
93 B 26ms
17ms Image
image/gif 192.0.76.3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.wp.com/g.gif?v=ext&blog=186808338&post=34568&tz=-4&srv=intezer.com&hp=atomic&ac=3&amp=0&j=1%3A12.2-a.15&host=intezer.com&ref=&fcp=0&rand=0.5162849423262492
Requested by: Host: intezer.com
URL: https://intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intezer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

access-control-allow-origin: *
date: Tue, 30 May 2023 15:10:26 GMT
cache-control: no-cache
server: nginx
content-length: 50
content-type: image/gif

GET
H2 200 schema Show response
intezer.com/wp-json/contact-form-7/v1/contact-forms/468/feedback/ 752 B
1 KB 30ms
29ms Fetch
application/json 199.16.172.82
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://intezer.com/wp-json/contact-form-7/v1/contact-forms/468/feedback/schema

Requested by

Host: 149520725.v2.pressablecdn.com
URL: https://149520725.v2.pressablecdn.com/wp-content/plugins/contact-form-7/includes/js/index.js?ver=5.7.6

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

199.16.172.82 , United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

0ccfa02f2bf8d957bc33f9a97672c1efe113a2cafe84c410971be0e6c45cc06f

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .intezer.com; upgrade-insecure-requests; script-src 'self' 'report-sample' 'unsafe-inline' 'unsafe-eval' data: .mouseflow.com .lfeeder.com .addtoany.com .google.com .googleapis.com .intezer.com .youtube.com googletagmanager.com .opendns.com .hsappstatic.net .hsforms.net .js-hsforms.net twitter.com .cloudflare.com .comeet.co .twitter.com .gaug.es .wp.com .hsleadflows.net .gstatic.com .usemessages.com .hs-banner.com .licdn.com .hs-analytics.net .ads-twitter.com .hs-scripts.com .googleadservices.com .hotjar.com .hotjar.io .bing.com .microsoft.com .clarity.ms .googletagmanager.com .doubleclick.net .addtoany.com .facebook.net .google-analytics.com .pressablecdn.com https://www.redditstatic.com/ads/pixel.js; object-src 'self'; frame-src 'self' .mouseflow.com .lfeeder.com .addtoany.com .hsappstatic.net .usemessages.com .recaptcha.net .intezer.com .hubspot.com .pressablecdn.com .hotjar.com .hotjar.io .hsforms.com .googletagmanager.com .wp.com .google.com .twitter.com .comeet.com .comeet.co .doubleclick.net .youtube.com; child-src 'self' .intezer.com; base-uri 'self' .intezer.com; form-action 'self' https://.hsforms.com/ https://.twitter.com/; worker-src 'self' .intezer.com; report-uri https://csp-prod.intezer.com/cspgate/445999af-dcf0-42b8-a4bc-655be2e8ffbf/2
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, */*;q=0.1
Referer: https://intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

x-nananana: Batcache-Hit
date: Tue, 30 May 2023 15:10:26 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-security-policy: frame-ancestors 'self' *.intezer.com; upgrade-insecure-requests; script-src 'self' 'report-sample' 'unsafe-inline' 'unsafe-eval' data: *.mouseflow.com *.lfeeder.com *.addtoany.com *.google.com *.googleapis.com *.intezer.com *.youtube.com googletagmanager.com *.opendns.com *.hsappstatic.net *.hsforms.net *.js-hsforms.net twitter.com *.cloudflare.com *.comeet.co *.twitter.com *.gaug.es *.wp.com *.hsleadflows.net *.gstatic.com *.usemessages.com *.hs-banner.com *.licdn.com *.hs-analytics.net *.ads-twitter.com *.hs-scripts.com *.googleadservices.com *.hotjar.com *.hotjar.io *.bing.com *.microsoft.com *.clarity.ms *.googletagmanager.com *.doubleclick.net *.addtoany.com *.facebook.net *.google-analytics.com *.pressablecdn.com https://www.redditstatic.com/ads/pixel.js; object-src 'self'; frame-src 'self' *.mouseflow.com *.lfeeder.com *.addtoany.com *.hsappstatic.net *.usemessages.com *.recaptcha.net *.intezer.com *.hubspot.com *.pressablecdn.com *.hotjar.com *.hotjar.io *.hsforms.com *.googletagmanager.com *.wp.com *.google.com *.twitter.com *.comeet.com *.comeet.co *.doubleclick.net *.youtube.com; child-src 'self' *.intezer.com; base-uri 'self' *.intezer.com; form-action 'self' https://*.hsforms.com/ https://*.twitter.com/; worker-src 'self' *.intezer.com; report-uri https://csp-prod.intezer.com/cspgate/445999af-dcf0-42b8-a4bc-655be2e8ffbf/2
content-encoding: br
x-ac: 1.hhn _atomic_ams BYPASS
host-header: Pressable
last-modified: Tue, 30 May 2023 15:08:49 GMT
server: nginx
vary: Accept-Encoding, Cookie, Origin
allow: GET
content-type: application/json; charset=UTF-8
access-control-expose-headers: X-WP-Total, X-WP-TotalPages, Link
cache-control: max-age=203, must-revalidate
x-robots-tag: noindex
link: <https://intezer.com/wp-json/>; rel="https://api.w.org/"
access-control-allow-headers: Authorization, X-WP-Nonce, Content-Disposition, Content-MD5, Content-Type

GET
H2 200 schema Show response
intezer.com/wp-json/contact-form-7/v1/contact-forms/25657/feedback/ 600 B
1 KB 30ms
29ms Fetch
application/json 199.16.172.82
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://intezer.com/wp-json/contact-form-7/v1/contact-forms/25657/feedback/schema

Requested by

Host: 149520725.v2.pressablecdn.com
URL: https://149520725.v2.pressablecdn.com/wp-content/plugins/contact-form-7/includes/js/index.js?ver=5.7.6

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

199.16.172.82 , United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

d793d023c86594068c454f32a73682505e7a75ada59c94d34c63f7b0e30de865

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .intezer.com; upgrade-insecure-requests; script-src 'self' 'report-sample' 'unsafe-inline' 'unsafe-eval' data: .mouseflow.com .lfeeder.com .addtoany.com .google.com .googleapis.com .intezer.com .youtube.com googletagmanager.com .opendns.com .hsappstatic.net .hsforms.net .js-hsforms.net twitter.com .cloudflare.com .comeet.co .twitter.com .gaug.es .wp.com .hsleadflows.net .gstatic.com .usemessages.com .hs-banner.com .licdn.com .hs-analytics.net .ads-twitter.com .hs-scripts.com .googleadservices.com .hotjar.com .hotjar.io .bing.com .microsoft.com .clarity.ms .googletagmanager.com .doubleclick.net .addtoany.com .facebook.net .google-analytics.com .pressablecdn.com https://www.redditstatic.com/ads/pixel.js; object-src 'self'; frame-src 'self' .mouseflow.com .lfeeder.com .addtoany.com .hsappstatic.net .usemessages.com .recaptcha.net .intezer.com .hubspot.com .pressablecdn.com .hotjar.com .hotjar.io .hsforms.com .googletagmanager.com .wp.com .google.com .twitter.com .comeet.com .comeet.co .doubleclick.net .youtube.com; child-src 'self' .intezer.com; base-uri 'self' .intezer.com; form-action 'self' https://.hsforms.com/ https://.twitter.com/; worker-src 'self' .intezer.com; report-uri https://csp-prod.intezer.com/cspgate/445999af-dcf0-42b8-a4bc-655be2e8ffbf/2
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, */*;q=0.1
Referer: https://intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

x-nananana: Batcache-Hit
date: Tue, 30 May 2023 15:10:26 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-security-policy: frame-ancestors 'self' *.intezer.com; upgrade-insecure-requests; script-src 'self' 'report-sample' 'unsafe-inline' 'unsafe-eval' data: *.mouseflow.com *.lfeeder.com *.addtoany.com *.google.com *.googleapis.com *.intezer.com *.youtube.com googletagmanager.com *.opendns.com *.hsappstatic.net *.hsforms.net *.js-hsforms.net twitter.com *.cloudflare.com *.comeet.co *.twitter.com *.gaug.es *.wp.com *.hsleadflows.net *.gstatic.com *.usemessages.com *.hs-banner.com *.licdn.com *.hs-analytics.net *.ads-twitter.com *.hs-scripts.com *.googleadservices.com *.hotjar.com *.hotjar.io *.bing.com *.microsoft.com *.clarity.ms *.googletagmanager.com *.doubleclick.net *.addtoany.com *.facebook.net *.google-analytics.com *.pressablecdn.com https://www.redditstatic.com/ads/pixel.js; object-src 'self'; frame-src 'self' *.mouseflow.com *.lfeeder.com *.addtoany.com *.hsappstatic.net *.usemessages.com *.recaptcha.net *.intezer.com *.hubspot.com *.pressablecdn.com *.hotjar.com *.hotjar.io *.hsforms.com *.googletagmanager.com *.wp.com *.google.com *.twitter.com *.comeet.com *.comeet.co *.doubleclick.net *.youtube.com; child-src 'self' *.intezer.com; base-uri 'self' *.intezer.com; form-action 'self' https://*.hsforms.com/ https://*.twitter.com/; worker-src 'self' *.intezer.com; report-uri https://csp-prod.intezer.com/cspgate/445999af-dcf0-42b8-a4bc-655be2e8ffbf/2
content-encoding: br
x-ac: 1.hhn _atomic_ams BYPASS
host-header: Pressable
last-modified: Tue, 30 May 2023 15:06:36 GMT
server: nginx
vary: Accept-Encoding, Cookie, Origin
allow: GET
content-type: application/json; charset=UTF-8
access-control-expose-headers: X-WP-Total, X-WP-TotalPages, Link
cache-control: max-age=70, must-revalidate
x-robots-tag: noindex
link: <https://intezer.com/wp-json/>; rel="https://api.w.org/"
access-control-allow-headers: Authorization, X-WP-Nonce, Content-Disposition, Content-MD5, Content-Type

OPTIONS
H2 200 public
api.hubspot.com/livechat-public/v1/message/ Frame 0
0 195ms
141ms Preflight
text/plain 2606:4700::6813:9a53
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://api.hubspot.com/livechat-public/v1/message/public?portalId=5492986&conversations-embed=static-1.13338&mobile=false&messagesUtk=6eeeff8c49604e78998746aef0504874&traceId=6eeeff8c49604e78998746aef0504874

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6813:9a53 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Accept: */*
Access-Control-Request-Headers: x-hubspot-messages-uri
Access-Control-Request-Method: GET
Origin: https://intezer.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

access-control-allow-credentials: false
access-control-allow-headers: Accept, Accept-Charset, Accept-Encoding, Accept-Language, Content-Type, Host, Origin, Referer, User-Agent, X-HubSpot-Messages-Uri
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
access-control-allow-origin: https://intezer.com
allow: HEAD,GET,OPTIONS
alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 7cf7e76c0e9dbb7d-FRA
content-length: 18
content-type: text/plain; charset=utf-8
date: Tue, 30 May 2023 15:10:27 GMT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4ivGpppocOkioj86cA4XM2vWsJLBDtgHShwMzoKqsETQyB2gKriaDlRk7%2BDJQRiK7UcFV2w2ujFx9Pck1WdH3bXoRSThxPVmb6uld8eovnGrVWtCU0gb1sgsFejLwqF%2BKBFs19PCpfjtW6NxSQ%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: origin, Accept-Encoding
x-envoy-upstream-service-time: 2
x-evy-trace-listener: listener_https
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-route-service-name: envoyset-translator
x-evy-trace-served-by-pod: iad02/hubapi-td/envoy-proxy-598c95b5b7-vgrjq
x-evy-trace-virtual-host: all
x-hubspot-correlation-id: 8f3e9b7d-de7d-4ac7-b628-e1b96ea8f25d
x-request-id: 8aac6bd1-a848-41e8-898a-eed6d3d21e43
x-trace: 2B904CE0F6990CAD492B804EB8C50D5B471A3EC88F000000000000000000

GET
H2 200 public Show response
api.hubspot.com/livechat-public/v1/message/ 3 KB
2 KB 239ms
238ms XHR
application/json 2606:4700::6813:9a53
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: js.usemessages.com
URL: https://js.usemessages.com/conversations-embed.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6813:9a53 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c8d173880b02a84226d7e6dd6f959614c512aecfe369d083dbc98f89e64a94bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://intezer.com/
accept-language: de-DE,de;q=0.9
X-HubSpot-Messages-Uri: https://intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Tue, 30 May 2023 15:10:27 GMT
content-encoding: gzip
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: cdcdbef5-b547-4137-8a80-896d4e7f8722
x-envoy-upstream-service-time: 92
alt-svc: h3=":443"; ma=86400
content-length: 1477
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 9380a23c-045c-426b-b359-e3179b8f7ce9
server: cloudflare
x-trace: 2BB2B7F7FF1B314415CE64345AC99D12E07B4680FB000000000000000000
vary: origin, Accept-Encoding
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
content-type: application/json;charset=utf-8
access-control-allow-origin: https://intezer.com
x-evy-trace-served-by-pod: iad02/hubapi-td/envoy-proxy-598c95b5b7-t5ghn
cache-control: no-cache, no-store, no-transform, must-revalidate, max-age=0
access-control-allow-credentials: false
x-evy-trace-virtual-host: all
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7Zl4JYwDq3kai00j%2BjP9%2BbVNAT8TahuCbjk73bnou5og7XdWDRE8isn7LJffw7O0XzJrkFbcOUmgTcX93TkFmVXWLya1wpjNm7xn4jZkGM68a22ljS1140Vu7Tc7BMl9Z7BhgtD0IZl%2FJ7bK5Q%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 7cf7e76cefedbb7d-FRA
access-control-allow-headers: Accept, Accept-Charset, Accept-Encoding, Accept-Language, Content-Type, Host, Origin, Referer, User-Agent, X-HubSpot-Messages-Uri

GET
H3 200 anchor Show response
www.google.com/recaptcha/api2/ Frame 5F39 50 KB
27 KB 206ms
46ms Document
text/html 2a00:1450:4001:831::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LewXc8UAAAAADEYz8dYpHTk55uH2MjKqbyc1sXD&co=aHR0cHM6Ly9pbnRlemVyLmNvbTo0NDM.&hl=de&v=CDFvp7CXAHw7k3HxO47Gm1O9&size=invisible&cb=chxubxafc7zi

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/CDFvp7CXAHw7k3HxO47Gm1O9/recaptcha__de.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

7f808c820fc351aec548e6e362185342fa77158fee45617b1386eb4288c347d5

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-xZD0jo970LGQREBcVR3FKg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://intezer.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-encoding: gzip
content-length: 27463
content-security-policy: script-src 'report-sample' 'nonce-xZD0jo970LGQREBcVR3FKg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Tue, 30 May 2023 15:10:27 GMT
expires: Mon, 01 Jan 1990 00:00:00 GMT
pragma: no-cache
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 200 /
www.google.com/pagead/1p-user-list/842858921/ 42 B
64 B 31ms
31ms Image
image/gif 2a00:1450:4001:831::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/842858921/?random=1685459426533&cv=9&fst=1685458800000&num=1&guid=ON&eid=375603261%2C466465926%2C512247839&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&sendb=1&frm=0&url=https%3A%2F%2Fintezer.com%2Fblog%2Fresearch%2Fcryptoclippy-evolves-to-pilfer-more-financial-data%2F&tiba=CryptoClippy%20Evolves%20to%20Pilfer%20Even%20More%20Financial%20Data&fmt=3&is_vtc=1&random=2478959656&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intezer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 30 May 2023 15:10:27 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.de/pagead/1p-user-list/842858921/ 42 B
64 B 46ms
46ms Image
image/gif 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/842858921/?random=1685459426533&cv=9&fst=1685458800000&num=1&guid=ON&eid=375603261%2C466465926%2C512247839&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&sendb=1&frm=0&url=https%3A%2F%2Fintezer.com%2Fblog%2Fresearch%2Fcryptoclippy-evolves-to-pilfer-more-financial-data%2F&tiba=CryptoClippy%20Evolves%20to%20Pilfer%20Even%20More%20Financial%20Data&fmt=3&is_vtc=1&random=2478959656&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intezer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 30 May 2023 15:10:27 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 bat.js Show response
bat.bing.com/ 40 KB
12 KB 189ms
44ms Script
application/javascript 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/bat.js

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

679804e244b4127b7ecd99a513b57d6a4f91866410e16da69ce02f98f534051d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intezer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
date: Tue, 30 May 2023 15:10:26 GMT
last-modified: Thu, 11 May 2023 18:08:27 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 7FB0C07ED56B4083BBCBF0752AB96250 Ref B: FRA31EDGE0105 Ref C: 2023-05-30T15:10:27Z
etag: "80df77953384d91:0"
vary: Accept-Encoding
x-cache: CONFIG_NOCACHE
content-type: application/javascript
cache-control: private,max-age=1800
accept-ranges: bytes
content-length: 12183

POST
H2 200 visit-data Show response
in.hotjar.com/api/v2/client/sites/2053093/ 148 B
322 B 158ms
54ms XHR
application/json 52.31.230.164
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://in.hotjar.com/api/v2/client/sites/2053093/visit-data?sv=7
Requested by: Host: script.hotjar.com
URL: https://script.hotjar.com/modules.fee08111252915d9fd11.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 52.31.230.164 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-31-230-164.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: b52decccecb8f993977580d4dc13b92831339b2cf80679a4ddadafc7b6fa559c

Request headers

Referer: https://intezer.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36
Content-Type: text/plain; charset=UTF-8

Response headers

date: Tue, 30 May 2023 15:10:27 GMT
content-encoding: br
vary: Accept-Encoding
access-control-max-age: 86400
content-type: application/json
access-control-allow-origin: *
cache-control: no-cache, no-store
access-control-allow-credentials: true

GET
H/1.1 200
OK track.gif
secure.gaug.es/ 35 B
389 B 118ms
117ms Image
image/gif 52.71.12.253
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://secure.gaug.es/track.gif?h[site_id]=5fd5ade352684d3c97554910&h[resource]=https%3A%2F%2Fintezer.com%2Fblog%2Fresearch%2Fcryptoclippy-evolves-to-pilfer-more-financial-data%2F&h[referrer]=&h[title]=CryptoClippy%20Evolves%20to%20Pilfer%20Even%20More%20Financial%20Data&h[user_agent]=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F113.0.5672.126%20Safari%2F537.36&h[unique]=1&h[unique_hour]=1&h[unique_day]=1&h[unique_month]=1&h[unique_year]=1&h[screenx]=1600&h[browserx]=1600&h[browsery]=1200&timestamp=1685459427459

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.71.12.253 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-71-12-253.compute-1.amazonaws.com

Software

nginx/1.10.3 (Ubuntu) /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intezer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 30 May 2023 15:10:27 GMT
X-Content-Type-Options: nosniff
Last-Modified: Tue, 30 May 2023 15:10:27 GMT
Server: nginx/1.10.3 (Ubuntu)
Content-Type: image/gif
Cache-Control: no-store, no-cache, must-revalidate, private
Connection: keep-alive
Content-Length: 35
Expires: Sat, 25 Nov 2000 05:00:00 GMT

GET
H3 200 styles__ltr.css
www.gstatic.com/recaptcha/releases/CDFvp7CXAHw7k3HxO47Gm1O9/ Frame 5F39 55 KB
24 KB 59ms
19ms Stylesheet
text/css 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/CDFvp7CXAHw7k3HxO47Gm1O9/styles__ltr.css

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LewXc8UAAAAADEYz8dYpHTk55uH2MjKqbyc1sXD&co=aHR0cHM6Ly9pbnRlemVyLmNvbTo0NDM.&hl=de&v=CDFvp7CXAHw7k3HxO47Gm1O9&size=invisible&cb=chxubxafc7zi

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

952833e41ba7a4b64c31a2d7b07dde81bf5bbacf5cbb967821cfe459d0c4a0d8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Tue, 30 May 2023 14:10:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 3619
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 24605
x-xss-protection: 0
last-modified: Mon, 22 May 2023 20:58:33 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/css
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 29 May 2024 14:10:08 GMT

GET
H3 200 recaptcha__de.js Show response
www.gstatic.com/recaptcha/releases/CDFvp7CXAHw7k3HxO47Gm1O9/ Frame 5F39 410 KB
164 KB 68ms
29ms Script
text/javascript 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/CDFvp7CXAHw7k3HxO47Gm1O9/recaptcha__de.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9e2831acb97097ce89e609e9ff841c6c6293ffeb1ce3e2acc07dfcdeeaa621fd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Tue, 30 May 2023 14:51:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1154
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 168302
x-xss-protection: 0
last-modified: Mon, 22 May 2023 20:58:33 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 29 May 2024 14:51:13 GMT

GET
H2 200 187039661.js Show response
bat.bing.com/p/action/ 4 KB
2 KB 122ms
122ms Script
application/javascript 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/p/action/187039661.js

Requested by

Host: bat.bing.com
URL: https://bat.bing.com/bat.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

8755993ca7a6955463a05d13dbb86808c5823932a9ef985c641f66e2a7eb016b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intezer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
date: Tue, 30 May 2023 15:10:26 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 2AE36041F8C8495D9082EBBC9DD83F22 Ref B: FRA31EDGE0105 Ref C: 2023-05-30T15:10:27Z
vary: Accept-Encoding
x-cache: CONFIG_NOCACHE
content-type: application/javascript; charset=utf-8
cache-control: private,max-age=60
content-length: 1498

GET
H2 204 0
bat.bing.com/action/ 0
287 B 43ms
42ms Image
text/plain 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bat.bing.com/action/0?ti=187039661&Ver=2&mid=f2134627-6f04-42eb-8333-92a9f81f983c&sid=1c16e9f0fefc11ed9b666f2ed91091ab&vid=1c17a170fefc11edbc8eff22e51c5ea5&vids=1&msclkid=N&pi=1200101525&lg=en-US&sw=1600&sh=1200&sc=24&tl=CryptoClippy%20Evolves%20to%20Pilfer%20Even%20More%20Financial%20Data&p=https%3A%2F%2Fintezer.com%2Fblog%2Fresearch%2Fcryptoclippy-evolves-to-pilfer-more-financial-data%2F&r=&lt=1514&evt=pageLoad&sv=1&rn=234786

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intezer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Tue, 30 May 2023 15:10:26 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 6EC259F14BCF41C7BF52C8ED22A4368F Ref B: FRA31EDGE0105 Ref C: 2023-05-30T15:10:27Z
x-cache: CONFIG_NOCACHE
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 / Show response
content.hotjar.io/ 56 B
161 B 252ms
82ms XHR
application/json 54.216.0.137
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://content.hotjar.io/?gzip=1
Requested by: Host: script.hotjar.com
URL: https://script.hotjar.com/modules.fee08111252915d9fd11.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 54.216.0.137 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-216-0-137.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 75ca98e0814eea3fd18c8c85ed036534f2177d895244e63d32bccba1de121dc9

Request headers

Referer: https://intezer.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36
Content-Type: text/plain; charset=UTF-8

Response headers

access-control-allow-origin: *
date: Tue, 30 May 2023 15:10:27 GMT
content-length: 56
vary: Origin
content-type: application/json

GET
H2 200 6eeeff8c49604e78998746aef0504874 Show response
app.hubspot.com/conversations-visitor/5492986/threads/utk/ Frame D67A 53 KB
19 KB 263ms
214ms Document
text/html 2606:4700::6813:9a53
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://app.hubspot.com/conversations-visitor/5492986/threads/utk/6eeeff8c49604e78998746aef0504874?uuid=159a9c4cd36749a78bc6e9266a67c308&mobile=false&mobileSafari=false&hideWelcomeMessage=false&hstc=null&domain=intezer.com&inApp53=false&messagesUtk=6eeeff8c49604e78998746aef0504874&url=https%3A%2F%2Fintezer.com%2Fblog%2Fresearch%2Fcryptoclippy-evolves-to-pilfer-more-financial-data%2F&inline=false&isFullscreen=false&globalCookieOptOut=null&isFirstVisitorSession=true&isAttachmentDisabled=false&enableWidgetCookieBanner=false&isInCMS=false

Requested by

Host: js.usemessages.com
URL: https://js.usemessages.com/conversations-embed.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6813:9a53 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e9199a4ca8d325186ee5d8c1b4618efface309ec6d01a7b0a3670d8e0822fade

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://intezer.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: false
age: 2535
alt-svc: h3=":443"; ma=86400
cache-control: max-age=600
cache-tag: staticjsapp-conversations-visitor-ui-web-prod,staticjsapp-prod
cf-cache-status: DYNAMIC
cf-ray: 7cf7e76ec8171c73-FRA
content-encoding: br
content-security-policy-report-only: script-src 'self' www.hubspot.com *.hsappstatic.net *.hs-analytics.net *.hs-banner.com *.hsforms.net *.hsleadflows.net *.hs-scripts.com *.hubspotfeedback.com *.usemessages.com js.hubspot.com *.hsadspixel.net *.hscollectedforms.net js-agent.newrelic.com bam.nr-data.net bam-cell.nr-data.net *.google-analytics.com www.googletagmanager.com data: 'unsafe-inline' 'unsafe-eval' blob: connect.facebook.net www.gstatic.cn www.gstatic.com www.google.com *.fullstory.com fullstory.com apis.google.com snap.licdn.com; report-uri https://send.hsbrowserreports.com/csp/report?resource=conversations-visitor-ui/static-1.15792/html/index.html&cfRay=7cf7e76ec8171c73&reqUrl=https%3A%2F%2Fapp.hubspot.com%2Fconversations-visitor%2F5492986%2Fthreads%2Futk%2F6eeeff8c49604e78998746aef0504874%3Fuuid%3D159a9c4cd36749a78bc6e9266a67c308%26mobile%3Dfalse%26mobileSafari%3Dfalse%26hideWelcomeMessage%3Dfalse%26hstc%3Dnull%26domain%3Dintezer.com%26inApp53%3Dfalse%26messagesUtk%3D6eeeff8c49604e78998746aef0504874%26url%3Dhttps%253A%252F%252Fintezer.com%252Fblog%252Fresearch%252Fcryptoclippy-evolves-to-pilfer-more-financial-data%252F%26inline%3Dfalse%26isFullscreen%3Dfalse%26globalCookieOptOut%3Dnull%26isFirstVisitorSession%3Dtrue%26isAttachmentDisabled%3Dfalse%26enableWidgetCookieBanner%3Dfalse%26isInCMS%3Dfalse&referrer=https%3A%2F%2Fintezer.com%2F&cfenv=prod&pdt=2023-05-30&csp=ro
content-type: text/html; charset=utf-8
date: Tue, 30 May 2023 15:10:27 GMT
etag: W/"b2539ddd033fcf8b69d90f8a63533275"
last-modified: Tue, 30 May 2023 01:40:24 UTC
report-to: {"group":"default","max_age":86400,"endpoints":[{"url":"https://send.hsbrowserreports.com/csp/reports"}]}
reporting-endpoints: default="https://send.hsbrowserreports.com/csp/reports?cfRay=7cf7e76ec8171c73&resource=conversations-visitor-ui/static-1.15792/html/index.html"
server: cloudflare
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: origin, Accept-Encoding
via: 1.1 c13d71f8919c23db6bbd1c08a4dfb350.cloudfront.net (CloudFront)
x-amz-cf-id: KHYAp0ujj-rGEi3M4w4ZG6MwcUWtbvkFrFqu05s-ffjTHWff_eQA7Q==
x-amz-cf-pop: IAD12-P3
x-amz-replication-status: COMPLETED
x-amz-server-side-encryption: AES256
x-amz-version-id: 4DIkoXMmDXdUOyK.TBYqqLgU3MIEgqEK
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 5
x-evy-trace-listener: listener_https
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-route-service-name: envoyset-translator
x-evy-trace-served-by-pod: iad02/app-td/envoy-proxy-57ff77fcd-5flz8
x-evy-trace-virtual-host: all
x-hs-cache-status: MISS
x-hs-target-asset: conversations-visitor-ui/static-1.15792/html/index.html
x-hs-worker-debug-mode: false
x-request-id: c10d485c-af3f-401e-ad81-9932c2d2a0bc

GET
H3 200 logo_48.png
www.gstatic.com/recaptcha/api2/ Frame 5F39 2 KB
2 KB 20ms
19ms Image
image/png 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/recaptcha/api2/logo_48.png

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/CDFvp7CXAHw7k3HxO47Gm1O9/styles__ltr.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1b9efb22c938500971aac2b2130a475fa23684dd69e43103894968df83145b8a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.gstatic.com/recaptcha/releases/CDFvp7CXAHw7k3HxO47Gm1O9/styles__ltr.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Sat, 27 May 2023 22:52:35 GMT
x-content-type-options: nosniff
age: 231472
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2228
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: image/png
cache-control: public, max-age=604800
accept-ranges: bytes
expires: Sat, 03 Jun 2023 22:52:35 GMT

GET
H3 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v18/ Frame 5F39 15 KB
15 KB 22ms
21ms Font
font/woff2 2a00:1450:4001:806::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.google.com/
Origin: https://www.google.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Sat, 27 May 2023 23:28:35 GMT
x-content-type-options: nosniff
age: 229312
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15344
x-xss-protection: 0
last-modified: Mon, 16 Oct 2017 17:32:55 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 26 May 2024 23:28:35 GMT

GET
H3 200 KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v18/ Frame 5F39 15 KB
15 KB 22ms
22ms Font
font/woff2 2a00:1450:4001:806::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5a8c1e7681318caa29e9f44e8a6e271f6a4067a2703e9916dfd4fe9099241db7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.google.com/
Origin: https://www.google.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Sat, 27 May 2023 17:47:45 GMT
x-content-type-options: nosniff
age: 249762
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15552
x-xss-protection: 0
last-modified: Mon, 16 Oct 2017 17:33:02 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 26 May 2024 17:47:45 GMT

GET
H3 200 webworker.js
www.google.com/recaptcha/api2/ Frame 5F39 102 B
134 B 31ms
31ms Other
text/javascript 2a00:1450:4001:831::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/webworker.js?hl=de&v=CDFvp7CXAHw7k3HxO47Gm1O9

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

d7bd1344379eb2ac9631066d92e8675977cfdac8dd9ce4b751c01c3f13725a87

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LewXc8UAAAAADEYz8dYpHTk55uH2MjKqbyc1sXD&co=aHR0cHM6Ly9pbnRlemVyLmNvbTo0NDM.&hl=de&v=CDFvp7CXAHw7k3HxO47Gm1O9&size=invisible&cb=chxubxafc7zi
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Tue, 30 May 2023 15:10:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy: frame-ancestors 'self'
server: GSE
cross-origin-embedder-policy: require-corp
x-frame-options: SAMEORIGIN
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=300
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 112
x-xss-protection: 1; mode=block
expires: Tue, 30 May 2023 15:10:27 GMT

GET
H2 200 187039661 Show response
www.clarity.ms/tag/uet/ 826 B
1 KB 310ms
237ms Script
application/x-javascript 2620:1ec:4e:1::60
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.clarity.ms/tag/uet/187039661
Requested by: Host: bat.bing.com
URL: https://bat.bing.com/p/action/187039661.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2620:1ec:4e:1::60 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 70b380217d6444e301842ece6b8ff9d0008c407bd8b1e963f0d5425b0e5bccc6

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intezer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

expires: -1
date: Tue, 30 May 2023 15:10:28 GMT
x-azure-ref: 20230530T151027Z-zk2dwvmq5x3q50eya02k3fpxtn00000000q000000001hbdw
x-cache: CONFIG_NOCACHE
content-type: application/x-javascript
cache-control: no-cache, no-store
accept-ranges: bytes
content-length: 826
request-context: appId=cid-v1:67bc0b23-8423-4b52-b1ca-6a87709ceaa2

GET
H2 200 bundle.production.js Show response
static.hsappstatic.net/head-dlb/static-1.338/ Frame D67A 44 KB
17 KB 88ms
42ms Script
application/javascript 2606:4700::6812:8c65
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.hsappstatic.net/head-dlb/static-1.338/bundle.production.js

Requested by

Host: app.hubspot.com
URL: https://app.hubspot.com/conversations-visitor/5492986/threads/utk/6eeeff8c49604e78998746aef0504874?uuid=159a9c4cd36749a78bc6e9266a67c308&mobile=false&mobileSafari=false&hideWelcomeMessage=false&hstc=null&domain=intezer.com&inApp53=false&messagesUtk=6eeeff8c49604e78998746aef0504874&url=https%3A%2F%2Fintezer.com%2Fblog%2Fresearch%2Fcryptoclippy-evolves-to-pilfer-more-financial-data%2F&inline=false&isFullscreen=false&globalCookieOptOut=null&isFirstVisitorSession=true&isAttachmentDisabled=false&enableWidgetCookieBanner=false&isInCMS=false

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:8c65 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ef39ee441c4e7792c5cda9a8bd86ddce96d9b17bda0cc9f7187f1a70ce9b3ed5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://app.hubspot.com/
Origin: https://app.hubspot.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Tue, 30 May 2023 15:10:28 GMT
x-amz-version-id: uq4ahwTgbmdDVq3iqHPHE8OZSufTo1wc
via: 1.1 9dcbfb7225622c2aeed01d74cae329de.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-cf-pop: DFW56-P3
age: 2318209
x-amz-server-side-encryption: AES256
content-encoding: br
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
alt-svc: h3=":443"; ma=86400
last-modified: Fri, 28 Apr 2023 15:18:57 GMT
server: cloudflare
etag: W/"d4a36ffcc533bcbae2a557884d3059e8"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: https://app.hubspot.com
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ee5jwkFptCfcn1mp4ZLPDmo%2B3qcvDHyp46Ss%2BYY8Uul1yZEDNFTO7PSd56FSo3ces5%2BJENJ730wwT4SV1nNhW%2FXio9mk%2FJCvzwhqe9CFuU5h6QszxP%2FIogQY19%2B3DthxIDouu%2Bebr8Pvc%2Fjoq%2BzkzA5aEQk%3D"}],"group":"cf-nel","max_age":604800}
vary: Origin,Accept-Encoding,Access-Control-Request-Headers,Access-Control-Request-Method
access-control-allow-credentials: true
cache-control: public, max-age=31536000
cf-ray: 7cf7e771ab8439bc-FRA
x-amz-cf-id: WCB6sbsj641bNkTUZYeHeQqqPFvy0eG6CW_nsGKruKsQOlnSKL3EdQ==
expires: Wed, 29 May 2024 15:10:28 GMT

GET
H2 200 visitor.css
static.hsappstatic.net/conversations-visitor-ui/static-1.14945/sass/ Frame D67A 20 KB
4 KB 75ms
29ms Stylesheet
text/css 2606:4700::6812:8c65
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.hsappstatic.net/conversations-visitor-ui/static-1.14945/sass/visitor.css

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:8c65 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

36d655313c51c3540e79a4ed3bff5be86110779b4e25043a6e78150a58cdbc66

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://app.hubspot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Tue, 30 May 2023 15:10:28 GMT
x-amz-version-id: eTttM9S_vWGkXsa3G13R54bOHuRyRlPL
via: 1.1 83f1b8f73f37458f38e2ee1fc0b9e68c.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-cf-pop: FRA56-P2
age: 382836
x-amz-server-side-encryption: AES256
content-encoding: br
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
alt-svc: h3=":443"; ma=86400
last-modified: Mon, 06 Mar 2023 22:24:16 GMT
server: cloudflare
etag: W/"8b2053a9d9199e217c1f3e61d80f5d90"
vary: Origin,Accept-Encoding,Access-Control-Request-Headers,Access-Control-Request-Method
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0whe6d8LT1%2FMTUmlgyTDpIx6ijE8VbPl7PUVmCJrtH8oEI3Hdm00ZhLwgyykXx6UDsZg4rCqk9XyQuw1jgT0T4JJEevGl1NHSEhVnlWlAQ6AyXEvCIEqDF9ZY%2FYgxvANiOhF0267HDCRdHlNsfMRtkQgQSw%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: public, max-age=31536000
cf-ray: 7cf7e771bb011c44-FRA
x-amz-cf-id: F69-l_lgR8CvzYkALyJjbsbMoXGo16KCrraz0StpySiZ-WJRV87_8A==
expires: Wed, 29 May 2024 15:10:28 GMT

GET
H2 200 bundle.production.js Show response
static.hsappstatic.net/hubspot-dlb/static-1.392/ Frame D67A 294 KB
94 KB 88ms
42ms Script
application/javascript 2606:4700::6812:8c65
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.hsappstatic.net/hubspot-dlb/static-1.392/bundle.production.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:8c65 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a827ba0a43cbeb52e1f7c01fac1d8526f1a927ef58d5a0bc4ea4047a8b47f075

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://app.hubspot.com/
Origin: https://app.hubspot.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Tue, 30 May 2023 15:10:28 GMT
x-amz-version-id: GyJQrIoHDRIfCuwwSVVsJwX13g1Qp9_O
via: 1.1 4a502b22092e94faddf9a5b056e273ae.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-cf-pop: FRA56-P2
age: 428507
x-amz-server-side-encryption: AES256
content-encoding: br
x-cache: RefreshHit from cloudfront
x-amz-replication-status: COMPLETED
alt-svc: h3=":443"; ma=86400
last-modified: Thu, 06 Apr 2023 11:56:47 GMT
server: cloudflare
etag: W/"90cd3e4c19469ce68f12da7dbe18af11"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: https://app.hubspot.com
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9Hl4pkWqmbGW587GhUqTEoVNgW3SG8kW3%2F9mqkIe6J%2FKFjFUSYsx3EPdqfQLyFPhqht1bAuyO9fb18Ny5qrSkym3745dwZ780ytR%2Fa90Pu66J840GAgEotrcXLFAiIm187REhACC1nMXYqC%2BR2jbAyl%2FXew%3D"}],"group":"cf-nel","max_age":604800}
vary: Origin,Accept-Encoding,Access-Control-Request-Headers,Access-Control-Request-Method
access-control-allow-credentials: true
cache-control: public, max-age=31536000
cf-ray: 7cf7e771bb8739bc-FRA
x-amz-cf-id: nMqgVUK1U6dxkmvZXUF0SXQiscRE_Qjq6yTuxlzQnbm4-tuKDKLgTg==
expires: Wed, 29 May 2024 15:10:28 GMT

GET
H2 200 visitor.js Show response
static.hsappstatic.net/conversations-visitor-ui/static-1.15792/bundles/ Frame D67A 608 KB
178 KB 88ms
43ms Script
application/javascript 2606:4700::6812:8c65
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.hsappstatic.net/conversations-visitor-ui/static-1.15792/bundles/visitor.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:8c65 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

75810fc3be228b577572981b725b351e0bc507e1c664f0aa6510e87e1680165b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://app.hubspot.com/
Origin: https://app.hubspot.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Tue, 30 May 2023 15:10:28 GMT
x-amz-version-id: Je2yxkvNvOCySRhCVvU.8jgwBjM1udXK
via: 1.1 83f1b8f73f37458f38e2ee1fc0b9e68c.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-cf-pop: FRA56-P2
age: 5393
x-amz-server-side-encryption: AES256
content-encoding: br
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
alt-svc: h3=":443"; ma=86400
last-modified: Tue, 30 May 2023 13:23:50 GMT
server: cloudflare
etag: W/"8341fb0b1cc4bca25ed2b9cfdbf54a94"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: https://app.hubspot.com
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HZ8S5FbNBZsm%2FOgRItUudtpMU4nwjUJbyyXwHV95i%2FlTyoJQZIit%2FKR8b2n9e536zW9qhnTkz%2FTg%2BS%2FZRHMtNN7MierJtNO5EEd1Doy1RCDOkwAFDHh8ZyAA1y6lotdefn6j7nMXWdtN1VDCNbGKBbC%2BG9Q%3D"}],"group":"cf-nel","max_age":604800}
vary: Origin,Accept-Encoding,Access-Control-Request-Headers,Access-Control-Request-Method
access-control-allow-credentials: true
cache-control: public, max-age=31536000
cf-ray: 7cf7e771bb8939bc-FRA
x-amz-cf-id: gm6nvddX5NUbV594PVQdIJ5hgRxrVcKwifZ5G_B6MSSaF0Du34c2wQ==
expires: Wed, 29 May 2024 15:10:28 GMT

POST
H3 200 reload Show response
www.google.com/recaptcha/api2/ Frame 5F39 33 KB
19 KB 79ms
78ms XHR
application/json 2a00:1450:4001:831::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/reload?k=6LewXc8UAAAAADEYz8dYpHTk55uH2MjKqbyc1sXD

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/CDFvp7CXAHw7k3HxO47Gm1O9/recaptcha__de.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

c69ac3819fafb748eeb860483cd9c5275e08afb3861d5d045ac69bec6f7f76d9

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LewXc8UAAAAADEYz8dYpHTk55uH2MjKqbyc1sXD&co=aHR0cHM6Ly9pbnRlemVyLmNvbTo0NDM.&hl=de&v=CDFvp7CXAHw7k3HxO47Gm1O9&size=invisible&cb=chxubxafc7zi
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36
Content-Type: application/x-protobuffer

Response headers

date: Tue, 30 May 2023 15:10:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy: frame-ancestors 'self'
server: GSE
x-frame-options: SAMEORIGIN
content-type: application/json; charset=utf-8
cache-control: private, max-age=0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 18966
x-xss-protection: 1; mode=block
expires: Tue, 30 May 2023 15:10:28 GMT

GET
H2 200 clarity.js Show response
www.clarity.ms/s/0.7.8/ 57 KB
24 KB 63ms
61ms Script
application/javascript 2620:1ec:4e:1::60
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.clarity.ms/s/0.7.8/clarity.js
Requested by: Host: www.clarity.ms
URL: https://www.clarity.ms/tag/uet/187039661
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2620:1ec:4e:1::60 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 9987dcc652130026523219440b654a3e307d16f186019031ad60a28d6f73aa2a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intezer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Tue, 30 May 2023 15:10:28 GMT
content-encoding: br
last-modified: Tue, 30 May 2023 02:32:08 GMT
etag: W/"0x8DB60B610B985EC"
vary: Accept-Encoding
x-azure-ref: 20230530T151028Z-zk2dwvmq5x3q50eya02k3fpxtn00000000q000000001hber
content-type: application/javascript;charset=utf-8
access-control-allow-origin: *
x-ms-request-id: 781d70a5-801e-003a-5ba5-9234a3000000
cache-control: public, max-age=86400
x-cache: TCP_HIT
x-ms-version: 2018-03-28

POST
H/1.1 204
No Content collect Show response
q.clarity.ms/ 0
291 B 339ms
107ms XHR
text/plain 20.231.53.73
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://q.clarity.ms/collect
Requested by: Host: www.clarity.ms
URL: https://www.clarity.ms/s/0.7.8/clarity.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 20.231.53.73 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/x-clarity-gzip
Referer: https://intezer.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

Access-Control-Allow-Origin: https://intezer.com
Date: Tue, 30 May 2023 15:10:28 GMT
Access-Control-Allow-Credentials: true
Server: nginx/1.18.0 (Ubuntu)
Connection: keep-alive
Vary: Origin
Request-Context: appId=cid-v1:3d284f99-f285-495c-ac33-dedd7ecf1ac8

GET
H2 200 i18n-data-data-locales-en-us.js Show response
static.hsappstatic.net/conversations-visitor-ui/static-1.15785/ Frame D67A 776 B
857 B 29ms
27ms Script
application/javascript 2606:4700::6812:8c65
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.hsappstatic.net/conversations-visitor-ui/static-1.15785/i18n-data-data-locales-en-us.js

Requested by

Host: static.hsappstatic.net
URL: https://static.hsappstatic.net/conversations-visitor-ui/static-1.15792/bundles/visitor.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:8c65 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d5773922958407876324a55ff40662ecd526f8829178ab8790a6e8dce853b3f5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://app.hubspot.com/
Origin: https://app.hubspot.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Tue, 30 May 2023 15:10:28 GMT
x-amz-version-id: SpNiq4P9pGdDdfmtMtY74SmCGTt9GDKN
via: 1.1 0baa339c02d06988c65d8623d1b3c6ec.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-cf-pop: FRA56-P2
age: 5393
x-amz-server-side-encryption: AES256
content-encoding: br
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
alt-svc: h3=":443"; ma=86400
last-modified: Fri, 26 May 2023 19:36:10 GMT
server: cloudflare
etag: W/"28c9a8bedc7c9bf5c53a75a4a0be86eb"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: https://app.hubspot.com
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VE1Y1tuKskE0Uf7W0mniV7mnxaS7bHqi%2FTcMjeNTuYa4pbyefjOn3NMpseFBvnapx%2FqNrNNUcyCUmx2hsQFD0D3cLK%2F6%2FMAeZh7CQcPS4Djolja043%2B9hqnre61gyetfRpX84o3ym8oHIeUOrHshz7HHRuk%3D"}],"group":"cf-nel","max_age":604800}
vary: Origin,Accept-Encoding,Access-Control-Request-Headers,Access-Control-Request-Method
access-control-allow-credentials: true
cache-control: public, max-age=31536000
cf-ray: 7cf7e7733dd039bc-FRA
x-amz-cf-id: gWVgtDbY1DvfWkQHFfVHSgWnI0TtmkSZXffQJ0Ky8IIBXhxDXDdOnw==
expires: Wed, 29 May 2024 15:10:28 GMT

GET
H2 200 refill Show response
intezer.com/wp-json/contact-form-7/v1/contact-forms/468/ 2 B
1 KB 31ms
29ms Fetch
application/json 199.16.172.82
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://intezer.com/wp-json/contact-form-7/v1/contact-forms/468/refill

Requested by

Host: 149520725.v2.pressablecdn.com
URL: https://149520725.v2.pressablecdn.com/wp-content/plugins/contact-form-7/includes/js/index.js?ver=5.7.6

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

199.16.172.82 , United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .intezer.com; upgrade-insecure-requests; script-src 'self' 'report-sample' 'unsafe-inline' 'unsafe-eval' data: .mouseflow.com .lfeeder.com .addtoany.com .google.com .googleapis.com .intezer.com .youtube.com googletagmanager.com .opendns.com .hsappstatic.net .hsforms.net .js-hsforms.net twitter.com .cloudflare.com .comeet.co .twitter.com .gaug.es .wp.com .hsleadflows.net .gstatic.com .usemessages.com .hs-banner.com .licdn.com .hs-analytics.net .ads-twitter.com .hs-scripts.com .googleadservices.com .hotjar.com .hotjar.io .bing.com .microsoft.com .clarity.ms .googletagmanager.com .doubleclick.net .addtoany.com .facebook.net .google-analytics.com .pressablecdn.com https://www.redditstatic.com/ads/pixel.js; object-src 'self'; frame-src 'self' .mouseflow.com .lfeeder.com .addtoany.com .hsappstatic.net .usemessages.com .recaptcha.net .intezer.com .hubspot.com .pressablecdn.com .hotjar.com .hotjar.io .hsforms.com .googletagmanager.com .wp.com .google.com .twitter.com .comeet.com .comeet.co .doubleclick.net .youtube.com; child-src 'self' .intezer.com; base-uri 'self' .intezer.com; form-action 'self' https://.hsforms.com/ https://.twitter.com/; worker-src 'self' .intezer.com; report-uri https://csp-prod.intezer.com/cspgate/445999af-dcf0-42b8-a4bc-655be2e8ffbf/2
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, */*;q=0.1
Referer: https://intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

x-nananana: Batcache-Hit
date: Tue, 30 May 2023 15:10:28 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-security-policy: frame-ancestors 'self' *.intezer.com; upgrade-insecure-requests; script-src 'self' 'report-sample' 'unsafe-inline' 'unsafe-eval' data: *.mouseflow.com *.lfeeder.com *.addtoany.com *.google.com *.googleapis.com *.intezer.com *.youtube.com googletagmanager.com *.opendns.com *.hsappstatic.net *.hsforms.net *.js-hsforms.net twitter.com *.cloudflare.com *.comeet.co *.twitter.com *.gaug.es *.wp.com *.hsleadflows.net *.gstatic.com *.usemessages.com *.hs-banner.com *.licdn.com *.hs-analytics.net *.ads-twitter.com *.hs-scripts.com *.googleadservices.com *.hotjar.com *.hotjar.io *.bing.com *.microsoft.com *.clarity.ms *.googletagmanager.com *.doubleclick.net *.addtoany.com *.facebook.net *.google-analytics.com *.pressablecdn.com https://www.redditstatic.com/ads/pixel.js; object-src 'self'; frame-src 'self' *.mouseflow.com *.lfeeder.com *.addtoany.com *.hsappstatic.net *.usemessages.com *.recaptcha.net *.intezer.com *.hubspot.com *.pressablecdn.com *.hotjar.com *.hotjar.io *.hsforms.com *.googletagmanager.com *.wp.com *.google.com *.twitter.com *.comeet.com *.comeet.co *.doubleclick.net *.youtube.com; child-src 'self' *.intezer.com; base-uri 'self' *.intezer.com; form-action 'self' https://*.hsforms.com/ https://*.twitter.com/; worker-src 'self' *.intezer.com; report-uri https://csp-prod.intezer.com/cspgate/445999af-dcf0-42b8-a4bc-655be2e8ffbf/2
content-encoding: br
x-ac: 1.hhn _atomic_ams BYPASS
host-header: Pressable
last-modified: Tue, 30 May 2023 15:08:03 GMT
server: nginx
vary: Accept-Encoding, Cookie, Origin
allow: GET
content-type: application/json; charset=UTF-8
access-control-expose-headers: X-WP-Total, X-WP-TotalPages, Link
cache-control: max-age=155, must-revalidate
x-robots-tag: noindex
link: <https://intezer.com/wp-json/>; rel="https://api.w.org/"
access-control-allow-headers: Authorization, X-WP-Nonce, Content-Disposition, Content-MD5, Content-Type

GET
H2 200 refill Show response
intezer.com/wp-json/contact-form-7/v1/contact-forms/25657/ 2 B
1 KB 32ms
31ms Fetch
application/json 199.16.172.82
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://intezer.com/wp-json/contact-form-7/v1/contact-forms/25657/refill

Requested by

Host: 149520725.v2.pressablecdn.com
URL: https://149520725.v2.pressablecdn.com/wp-content/plugins/contact-form-7/includes/js/index.js?ver=5.7.6

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

199.16.172.82 , United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .intezer.com; upgrade-insecure-requests; script-src 'self' 'report-sample' 'unsafe-inline' 'unsafe-eval' data: .mouseflow.com .lfeeder.com .addtoany.com .google.com .googleapis.com .intezer.com .youtube.com googletagmanager.com .opendns.com .hsappstatic.net .hsforms.net .js-hsforms.net twitter.com .cloudflare.com .comeet.co .twitter.com .gaug.es .wp.com .hsleadflows.net .gstatic.com .usemessages.com .hs-banner.com .licdn.com .hs-analytics.net .ads-twitter.com .hs-scripts.com .googleadservices.com .hotjar.com .hotjar.io .bing.com .microsoft.com .clarity.ms .googletagmanager.com .doubleclick.net .addtoany.com .facebook.net .google-analytics.com .pressablecdn.com https://www.redditstatic.com/ads/pixel.js; object-src 'self'; frame-src 'self' .mouseflow.com .lfeeder.com .addtoany.com .hsappstatic.net .usemessages.com .recaptcha.net .intezer.com .hubspot.com .pressablecdn.com .hotjar.com .hotjar.io .hsforms.com .googletagmanager.com .wp.com .google.com .twitter.com .comeet.com .comeet.co .doubleclick.net .youtube.com; child-src 'self' .intezer.com; base-uri 'self' .intezer.com; form-action 'self' https://.hsforms.com/ https://.twitter.com/; worker-src 'self' .intezer.com; report-uri https://csp-prod.intezer.com/cspgate/445999af-dcf0-42b8-a4bc-655be2e8ffbf/2
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, */*;q=0.1
Referer: https://intezer.com/blog/research/cryptoclippy-evolves-to-pilfer-more-financial-data/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

x-nananana: Batcache-Hit
date: Tue, 30 May 2023 15:10:28 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-security-policy: frame-ancestors 'self' *.intezer.com; upgrade-insecure-requests; script-src 'self' 'report-sample' 'unsafe-inline' 'unsafe-eval' data: *.mouseflow.com *.lfeeder.com *.addtoany.com *.google.com *.googleapis.com *.intezer.com *.youtube.com googletagmanager.com *.opendns.com *.hsappstatic.net *.hsforms.net *.js-hsforms.net twitter.com *.cloudflare.com *.comeet.co *.twitter.com *.gaug.es *.wp.com *.hsleadflows.net *.gstatic.com *.usemessages.com *.hs-banner.com *.licdn.com *.hs-analytics.net *.ads-twitter.com *.hs-scripts.com *.googleadservices.com *.hotjar.com *.hotjar.io *.bing.com *.microsoft.com *.clarity.ms *.googletagmanager.com *.doubleclick.net *.addtoany.com *.facebook.net *.google-analytics.com *.pressablecdn.com https://www.redditstatic.com/ads/pixel.js; object-src 'self'; frame-src 'self' *.mouseflow.com *.lfeeder.com *.addtoany.com *.hsappstatic.net *.usemessages.com *.recaptcha.net *.intezer.com *.hubspot.com *.pressablecdn.com *.hotjar.com *.hotjar.io *.hsforms.com *.googletagmanager.com *.wp.com *.google.com *.twitter.com *.comeet.com *.comeet.co *.doubleclick.net *.youtube.com; child-src 'self' *.intezer.com; base-uri 'self' *.intezer.com; form-action 'self' https://*.hsforms.com/ https://*.twitter.com/; worker-src 'self' *.intezer.com; report-uri https://csp-prod.intezer.com/cspgate/445999af-dcf0-42b8-a4bc-655be2e8ffbf/2
content-encoding: br
x-ac: 1.hhn _atomic_ams BYPASS
host-header: Pressable
last-modified: Tue, 30 May 2023 15:06:59 GMT
server: nginx
vary: Accept-Encoding, Cookie, Origin
allow: GET
content-type: application/json; charset=UTF-8
access-control-expose-headers: X-WP-Total, X-WP-TotalPages, Link
cache-control: max-age=91, must-revalidate
x-robots-tag: noindex
link: <https://intezer.com/wp-json/>; rel="https://api.w.org/"
access-control-allow-headers: Authorization, X-WP-Nonce, Content-Disposition, Content-MD5, Content-Type

GET
H2 200 __ptq.gif
track.hubspot.com/ 45 B
687 B 161ms
151ms Image
image/gif 2606:4700::6813:9a53
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://track.hubspot.com/__ptq.gif?k=1&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=1944070336&v=1.1&a=5492986&ct=blog-post&rcu=https%3A%2F%2Fintezer.com%2Fblog%2Fresearch%2Fcryptoclippy-evolves-to-pilfer-more-financial-data%2F&pu=https%3A%2F%2Fintezer.com%2Fblog%2Fresearch%2Fcryptoclippy-evolves-to-pilfer-more-financial-data%2F&t=CryptoClippy+Evolves+to+Pilfer+Even+More+Financial+Data&cts=1685459428419&vi=816b68cfc6c40a096090b2e3c90318fc&nc=true&u=193884914.816b68cfc6c40a096090b2e3c90318fc.1685459428415.1685459428415.1685459428415.1&b=193884914.1.1685459428416&pt=0&cc=15

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6813:9a53 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intezer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Tue, 30 May 2023 15:10:28 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: dbeec492-851e-4223-ba1d-6d91afc9eeac
p3p: CP="NOI CUR ADM OUR NOR STA NID"
x-envoy-upstream-service-time: 12
alt-svc: h3=":443"; ma=86400
content-length: 45
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: e25e5d4a-a165-475e-89c5-121e749a1af2
server: cloudflare
vary: origin, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=IeN3lTzykDpO7rKd7V6yBB9ZoLB6POZXF38UZLVylAp8TqQyvu1q5D6QLSFe64Bq2R9Spuve%2FWP39OPl%2FDlpH9rsbg8JiGtSxmzphaeg5Czk776AkYDRbid6G12qZpAI805W9z0sg4PXVkHSdcj7"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
x-evy-trace-served-by-pod: iad02/analytics-tracking-td/envoy-proxy-5f6448c676-lqfnv
x-evy-trace-virtual-host: all
cache-control: no-cache, no-store, no-transform
access-control-allow-credentials: false
cf-ray: 7cf7e773ce741c73-FRA
x-robots-tag: none

GET
H2

200

c.gif
c.clarity.ms/
Redirect Chain

https://c.clarity.ms/c.gif
https://c.bing.com/c.gif?ctsa=mr&CtsSyncId=1ABC9391F34D469695DC7A9219165479&RedC=c.clarity.ms&MXFR=00C24AAC361B6F6A10A4598D321B61F4
https://c.clarity.ms/c.gif?ctsa=mr&CtsSyncId=1ABC9391F34D469695DC7A9219165479&MUID=097468F7F21E630117B07BD6F3B26215

42 B
443 B

39ms
39ms

Image
image/gif

68.219.88.97
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.clarity.ms/c.gif?ctsa=mr&CtsSyncId=1ABC9391F34D469695DC7A9219165479&MUID=097468F7F21E630117B07BD6F3B26215
Protocol: H2
Server: 68.219.88.97 Dublin, Ireland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://intezer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 30 May 2023 15:10:28 GMT
last-modified: Thu, 04 May 2023 15:33:28 GMT
server: Microsoft-IIS/10.0
etag: "6de038c69d7ed91:0"
x-powered-by: ASP.NET
content-type: image/gif
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
cache-control: private, no-cache, proxy-revalidate, no-store
accept-ranges: bytes
content-length: 42

Redirect headers

pragma: no-cache
date: Tue, 30 May 2023 15:10:27 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: BF0DBA564B0241E9A7A5624DB78CE653 Ref B: FRA31EDGE0105 Ref C: 2023-05-30T15:10:28Z
x-powered-by: ASP.NET
x-cache: CONFIG_NOCACHE
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
location: https://c.clarity.ms/c.gif?ctsa=mr&CtsSyncId=1ABC9391F34D469695DC7A9219165479&MUID=097468F7F21E630117B07BD6F3B26215
cache-control: private, no-cache, proxy-revalidate, no-store
content-length: 0

POST
H2 204 rhumb
app.hubspot.com/api/cartographer/v1/ Frame D67A 0
1 KB 143ms
142ms Ping
text/plain 2606:4700::6813:9a53
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://app.hubspot.com/api/cartographer/v1/rhumb?hs_static_app=conversations-visitor-ui&hs_static_app_version=1.15792

Requested by

Host: static.hsappstatic.net
URL: https://static.hsappstatic.net/conversations-visitor-ui/static-1.15792/bundles/visitor.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6813:9a53 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://app.hubspot.com/conversations-visitor/5492986/threads/utk/6eeeff8c49604e78998746aef0504874?uuid=159a9c4cd36749a78bc6e9266a67c308&mobile=false&mobileSafari=false&hideWelcomeMessage=false&hstc=null&domain=intezer.com&inApp53=false&messagesUtk=6eeeff8c49604e78998746aef0504874&url=https%3A%2F%2Fintezer.com%2Fblog%2Fresearch%2Fcryptoclippy-evolves-to-pilfer-more-financial-data%2F&inline=false&isFullscreen=false&globalCookieOptOut=null&isFirstVisitorSession=true&isAttachmentDisabled=false&enableWidgetCookieBanner=false&isInCMS=false
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Tue, 30 May 2023 15:10:28 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: 0882e30f-683c-4d47-a3a5-b590f9a5b0eb
x-envoy-upstream-service-time: 4
alt-svc: h3=":443"; ma=86400
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 86e22ba4-4359-48b7-824c-ce7f2a77679d
server: cloudflare
vary: origin, Accept-Encoding
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HmAMOWBq7JkeFD9ob2Ia38JT8wYJpo5rWhED5hvBQbo1ZEjmyZ2zNr2wzXMS5m%2FLvX4yp9BVojyaug8VVHMRi%2FWn1Zs670b5tw7RcvPifdwpJ1txLLhWYu87Jv1xzQMyMxqK99xZ3xwxR0%2FmrQ%3D%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: https://app.hubspot.com
x-evy-trace-served-by-pod: iad02/hubapi-td/envoy-proxy-598c95b5b7-z9vjn
access-control-expose-headers: x-last-modified-timestamp, X-HubSpot-NotFound, X-HS-User-Request, Link, Server-Timing, X-Hubspot-Correct-Hublet, X-HubSpot-Auth-Failure
access-control-max-age: 604800
access-control-allow-credentials: true
x-evy-trace-virtual-host: all
cf-ray: 7cf7e773eea01c73-FRA
access-control-allow-headers: Authorization, Origin, X-Requested-With, Content-Type, Accept, Accept-Charset, Accept-Encoding, X-Override-Internal-Permissions, X-Properties-Source, X-Properties-SourceId, X-Properties-Flag, X-Hubspot-User-Id, X-Hubspot-Trace, X-Hubspot-Callee, X-Hubspot-Offset, X-Hubspot-No-Trace, X-HubSpot-Static-App-Info, X-HubSpot-Messages-Uri, X-HubSpot-Request-Source, X-HubSpot-Request-Reason, Subscription-Billing-Auth-Token, X-App-CSRF, X-Tools-CSRF, Online-Payment-Signing-UUID, X-Source, X-SourceId, X-Origin-UserId, X-Biden-Request-Source, X-HubSpot-CSRF-hubspotapi, X-Force-Cookie-Refresh, X-Force-Cookie-Refresh-No-Cache, X-HS-User-Request, X-Application-Id, X-HS-Referer
timing-allow-origin: *

POST
H/1.1 204
No Content collect Show response
q.clarity.ms/ 0
291 B 328ms
327ms XHR
text/plain 20.231.53.73
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://q.clarity.ms/collect
Requested by: Host: www.clarity.ms
URL: https://www.clarity.ms/s/0.7.8/clarity.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 20.231.53.73 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/x-clarity-gzip
Referer: https://intezer.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

Access-Control-Allow-Origin: https://intezer.com
Date: Tue, 30 May 2023 15:10:28 GMT
Access-Control-Allow-Credentials: true
Server: nginx/1.18.0 (Ubuntu)
Connection: keep-alive
Vary: Origin
Request-Context: appId=cid-v1:3d284f99-f285-495c-ac33-dedd7ecf1ac8

POST
H/1.1 204
No Content collect Show response
q.clarity.ms/ 0
291 B 110ms
110ms XHR
text/plain 20.231.53.73
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://q.clarity.ms/collect
Requested by: Host: www.clarity.ms
URL: https://www.clarity.ms/s/0.7.8/clarity.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 20.231.53.73 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/x-clarity-gzip
Referer: https://intezer.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

Access-Control-Allow-Origin: https://intezer.com
Date: Tue, 30 May 2023 15:10:31 GMT
Access-Control-Allow-Credentials: true
Server: nginx/1.18.0 (Ubuntu)
Connection: keep-alive
Vary: Origin
Request-Context: appId=cid-v1:3d284f99-f285-495c-ac33-dedd7ecf1ac8

Verdicts & Comments Add Verdict or Comment

218 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

47 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
www.google.com/recaptcha	1970-01-20 16:30:11	Name: _GRECAPTCHA Value: 09ALyjir8XTbG6uLMvJ2Ah9_Zmw1tmV9hfDnf9KBUiXm79T3UgiphSZi4h4p0sUMdRVT4q8CWHSwVeJK2RYMoGopA
.intezer.com/	1970-01-20 14:20:35	Name: _gcl_au Value: 1.1.765074824.1685459426
.intezer.com/	1970-01-20 20:56:35	Name: _lfa Value: LF1.1.233e7a8c5e788cf0.1685459426458
.intezer.com/	1970-01-20 14:20:35	Name: _rdt_uuid Value: 1685459426545.4fade18c-417a-449c-9a1a-d46e9dbaef6a
.intezer.com/	1970-01-20 12:12:25	Name: _gid Value: GA1.2.208096606.1685459427
.intezer.com/	1970-01-20 12:10:59	Name: _dc_gtm_UA-97741055-8 Value: 1
.doubleclick.net/	1970-01-20 21:32:35	Name: IDE Value: AHWqTUnDULaIWXo_fbWJ6EFbe3NiF12Pv2mWRzwuUO2jfxqqWiIN54rRWP_53qry
.intezer.com/	1970-01-20 21:46:59	Name: _ga_77ZEDWXEEK Value: GS1.1.1685459426.1.0.1685459426.60.0.0
.intezer.com/	1970-01-20 21:46:59	Name: _ga Value: GA1.1.10293912.1685459427
.t.co/	1970-01-20 21:46:59	Name: muc_ads Value: ef26fb2f-8077-49e7-bdfa-b30fcc2e3047
.twitter.com/	1970-01-20 21:46:59	Name: personalization_id Value: "v1_iq+3zYCEJEsDYSnkW5O87g=="
.linkedin.com/	1970-01-20 14:20:35	Name: li_sugr Value: 763f6565-464c-46a9-89d9-f9e1f5d8c7d7
.linkedin.com/	1970-01-20 20:56:35	Name: bcookie Value: "v=2&f80de9b5-4999-4f04-89f7-cbd661c47896"
.linkedin.com/	1970-01-20 12:12:25	Name: lidc Value: "b=VGST00:s=V:r=V:a=V:p=V:g=3013:u=1:x=1:i=1685459426:t=1685545826:v=2:sig=AQHR5ecOPcyhZt5Mux5yX4t2UKiI7oAw"
intezer.com/	1970-01-20 12:12:25	Name: ln_or Value: eyIxMzI3MzU2IjoiZCJ9
.intezer.com/	1970-01-20 20:56:35	Name: _hjSessionUser_2053093 Value: eyJpZCI6IjFjZWE3MmRmLWI3ODQtNWRkYy1hZTAwLWYwNGRhNzA3YmU3NyIsImNyZWF0ZWQiOjE2ODU0NTk0MjczMzAsImV4aXN0aW5nIjpmYWxzZX0=
.intezer.com/	1970-01-20 12:11:01	Name: _hjFirstSeen Value: 1
.intezer.com/	1970-01-20 12:10:59	Name: _hjIncludedInSessionSample_2053093 Value: 1
.intezer.com/	1970-01-20 12:11:01	Name: _hjSession_2053093 Value: eyJpZCI6ImY3ODY0NjZjLTE2ZmMtNDZmYS1iOWQwLTJkNDRmYmFmY2M1MCIsImNyZWF0ZWQiOjE2ODU0NTk0MjczNDAsImluU2FtcGxlIjp0cnVlfQ==
.intezer.com/	1970-01-20 12:11:01	Name: _hjAbsoluteSessionInProgress Value: 0
.linkedin.com/	1970-01-20 12:54:11	Name: UserMatchHistory Value: AQLYKno5itD8iwAAAYhtNd_5lKZpfmqGia388xMRU6wiyGEJK0RRWTxg_lFBbbW4ZKwDC1-FnwBKNA
.linkedin.com/	1970-01-20 12:54:11	Name: AnalyticsSyncHistory Value: AQIXpP1mCKlccgAAAYhtNd_5I_EMy1Qvw6kN3ESfwCP1sSByhO21YTJ_KPULZaxYJm-Bp0aRgk9l4CT8n5ipAg
intezer.com/	1970-01-20 12:11:03	Name: _gauges_unique_hour Value: 1
intezer.com/	1970-01-20 12:12:25	Name: _gauges_unique_day Value: 1
intezer.com/	1970-01-20 12:55:37	Name: _gauges_unique_month Value: 1
intezer.com/	1970-01-20 20:56:35	Name: _gauges_unique_year Value: 1
intezer.com/	1970-01-20 20:56:35	Name: _gauges_unique Value: 1
.intezer.com/	1970-01-20 12:12:25	Name: _uetsid Value: 1c16e9f0fefc11ed9b666f2ed91091ab
.intezer.com/	1970-01-20 21:32:35	Name: _uetvid Value: 1c17a170fefc11edbc8eff22e51c5ea5
.bing.com/	1970-01-20 21:32:35	Name: MUID Value: 097468F7F21E630117B07BD6F3B26215
.www.linkedin.com/	1970-01-20 20:56:35	Name: bscookie Value: "v=1&2023053015102771fa195e-c7fb-4add-86af-919df5e8f1ddAQFOQWcdNZ80jmSz9BGocZugqXQbJUAO"
.linkedin.com/	1970-01-20 16:30:11	Name: li_gc Value: MTswOzE2ODU0NTk0Mjc7MjswMjFHtMihotZy31HheeoCgkv9Bn/kuqMYgWVwd3d4uSqYQg==
.hubspot.com/	1970-01-20 12:11:01	Name: __cf_bm Value: OV3AUvkEWa..0GQCLmXz2FBTfL93qRLjcA1NybXXEqo-1685459427-0-AdiD9XiVTTN6xWrR5OVx4ny+dmEmMmgn/nCzRy+GHHtlrPFS7OBxErjBhRQw2SFKiY+SLLVTKpUQIUvY3kuJOG0=
www.clarity.ms/	1970-01-20 20:56:35	Name: CLID Value: 2c8223c6c5d644298f01900a689dcf29.20230530.20240529
.intezer.com/	1970-01-20 20:56:35	Name: _clck Value: 8yg07b\|2\|fc1\|0\|1245
.intezer.com/	1970-01-20 16:30:11	Name: __hstc Value: 193884914.816b68cfc6c40a096090b2e3c90318fc.1685459428415.1685459428415.1685459428415.1
.intezer.com/	1970-01-20 16:30:11	Name: hubspotutk Value: 816b68cfc6c40a096090b2e3c90318fc
.intezer.com/	1969-12-31 23:59:59	Name: __hssrc Value: 1
.intezer.com/	1970-01-20 12:11:01	Name: __hssc Value: 193884914.1.1685459428416
.intezer.com/	1970-01-20 16:30:11	Name: messagesUtk Value: 6eeeff8c49604e78998746aef0504874
.c.bing.com/	1970-01-20 12:21:04	Name: MR Value: 0
.c.bing.com/	1970-01-20 21:32:35	Name: SRM_B Value: 097468F7F21E630117B07BD6F3B26215
.intezer.com/	1970-01-20 12:12:25	Name: _clsk Value: 1gvmu3t\|1685459428619\|1\|1\|q.clarity.ms/collect
.c.clarity.ms/	1969-12-31 23:59:59	Name: SM Value: C
.clarity.ms/	1970-01-20 21:32:35	Name: MUID Value: 097468F7F21E630117B07BD6F3B26215
.c.clarity.ms/	1970-01-20 12:21:04	Name: MR Value: 0
.c.clarity.ms/	1970-01-20 12:11:00	Name: ANONCHK Value: 0

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header

Value

Content-Security-Policy

Strict-Transport-Security

max-age=31536000

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

149520725.v2.pressablecdn.com
alb.reddit.com
analytics.twitter.com
api.hubspot.com
app.hubspot.com
bat.bing.com
c.bing.com
c.clarity.ms
cdn.linkedin.oribi.io
cdn.mouseflow.com
connect.facebook.net
content.hotjar.io
fonts.googleapis.com
fonts.gstatic.com
googleads.g.doubleclick.net
in.hotjar.com
intezer.com
js.hs-analytics.net
js.hs-banner.com
js.hs-scripts.com
js.usemessages.com
pixel.wp.com
px.ads.linkedin.com
px4.ads.linkedin.com
q.clarity.ms
region1.analytics.google.com
sc.lfeeder.com
script.hotjar.com
secure.gaug.es
snap.licdn.com
static.addtoany.com
static.ads-twitter.com
static.hotjar.com
static.hsappstatic.net
stats.g.doubleclick.net
stats.wp.com
t.co
tr-rc.lfeeder.com
track.hubspot.com
www.clarity.ms
www.google-analytics.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagmanager.com
www.gstatic.com
www.linkedin.com
www.redditstatic.com
104.244.42.133
104.244.42.3
13.107.42.14
13.224.189.77
142.250.186.66
146.75.116.157
151.101.1.140
151.139.128.10
18.66.97.49
192.0.76.3
192.0.77.39
199.16.172.82
20.231.53.73
2001:4860:4802:32::36
2600:9000:20eb:9800:2:53b2:240:93a1
2600:9000:225e:ce00:4:d7e1:700:93a1
2606:4700:10::6816:46c5
2606:4700::6810:8bce
2606:4700::6811:64ac
2606:4700::6812:19c4
2606:4700::6812:853b
2606:4700::6812:8c65
2606:4700::6813:9a53
2620:1ec:21::14
2620:1ec:4e:1::60
2620:1ec:c11::200
2a00:1450:4001:801::2002
2a00:1450:4001:806::2003
2a00:1450:4001:812::200a
2a00:1450:4001:828::2008
2a00:1450:4001:82a::2003
2a00:1450:4001:82b::200e
2a00:1450:4001:830::2003
2a00:1450:4001:831::2004
2a00:1450:400c:c00::9d
2a02:26f0:3500:16::215:148d
2a03:2880:f083:9:face:b00c:0:3
2a04:4e42::396
52.222.236.43
52.31.230.164
52.71.12.253
54.216.0.137
68.219.88.97
01c3955df67a9b9d1367957e2c187729eae46b72e92c2b52bdb217b14a8fc874
0c18977a87920133d0e6fdb59c6b10831b511600c90994af2ef9683c1d6fabbc
0ccfa02f2bf8d957bc33f9a97672c1efe113a2cafe84c410971be0e6c45cc06f
1060091178cbd6c843b802f516f230f1a3a1e85f1afbd6ef84d80e5430ba457e
131d7ee76b779886898c901bfa19c90b68917c8e4b4b4cc9d929e53a9ecc92a2
138154c0deed3326477b9b4909175101070a5a3a95342291b53d8cc9879a5f47
141ac568be4ebb63260741515cc6e4a81fe3abaa2599567ed81922801800fc5a
14a32c7cfe8286babbffb86185b8d4e3eeb6c7bf6a70d26c49477b7b8c474994
18d0b4ceb6bf42d951807a198abf3f3909befc21639a51eabb0fe091a50360c4
1b9efb22c938500971aac2b2130a475fa23684dd69e43103894968df83145b8a
1c1fef6e6b4f9832603850b9b6562e74d9a6a3700ba836efe88facc577121e8b
1d7713fe46f564bb5c7fd77f29197ab0387370a1b41b1b2676cd473317cd56c7
1e3fb416c5bccfcc9f00c12c42da0492034165771e592b625e3b95c40b835f56
207386621d10b498b12fcb82c8c76a7fed8c6ebe71b7637dd017b6b32783d7a9
214674cc77aba35ab3567b88e2739fd08e8e96c61d279559ad61874069683ea0
239112a07d6464c06e4d6542364fc0e534dec40c57ed3bcb261b5b3724c171ee
24b9f93c7c1dd7ef36951dc6247138107eb9d7ae4beca8b7017f282642617894
2648a1333fa24d383fd73a6beaac17156ae78f4267ff7407ad60e05a788df44c
26d71b4c3c0808d3f4c29253ebbe25dcb8832a06e310691aa6cb93b6a4d8e0cf
294ed1734fd63bdeca41e4ac6d668c513ea6932b0030ee10c605d09efba1900e
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe
2c4f166190d19357f8f9e9850a0875c502f98e6987745ea69eb821cf2c31bb46
2c5cc47eb8499efe3f4353bc50b38690756e78da21b0e158e14293b39c5ef812
2d6e80f359af2d33eafa5f52e1fa9e3e4efc112b4d45ef5d941ff83be5da81bb
2e10d353ff038c2cad3492fc17801af3e6ef2669c9e9713bdb78b1dcb104c4fe
2fbefccb4ad6c46120918789e367472752f9a20395e5bbf954ef3dc0f3e515ee
32b55317d8f95eb2771939a8f1c1a95be3cc648a0c3b4d05be13d92a5c5cd072
34bbd1c367ffc7d80fcff86c7e5f8777e70f4911bb324e8ecfc7dd3604a96e68
356bb77df62e4ebed4870f1e7b19dead8afe239392406e6b38472d5abebfbb7c
3642c7e774562f7483d7b0de93dd1759fc6928e85eebd7e62ddae72e9d46c9cb
36d655313c51c3540e79a4ed3bff5be86110779b4e25043a6e78150a58cdbc66
37bab6cd583982e8eff58501a99d7c5c4d63664c1ca34f9e3b7cf526c5b73ae2
3c0d53e3bb5b5c53541fa548b76a8bc07eb9dd240cfe12a161f09ae76885eb36
3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc
43c072c16c9ee6d67acdfa6c6d6685ff1e74eb4237b7cc3c1348ab1c108b26af
46ae8e1e6fe0e2bab78c7eac6ebf4c5953e448a402fbcd9c6986b66edf8e6f41
483cb88f0329db0a454099a046627481f4208c92a49ccb7a84faf54fb6014a2d
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
4f79a89d16a5f717110fe080c0bf90b7e05ff95a4c4983f64d33110bf5f9c230
50679e0e3933c945348a2db0cc128bb14b57a60a74fabf8cae13acc14efbb2e1
51fd5dd8dcc8fc7d8561d13620c9f6b0eaa33fdceb8265a3268b27aaf8603df2
52db930f81d97113dde679cac624cb5435b56d4ac486e91a0b6692d2cb615a84
533e264cc615ee4601da8d2c1dee4a8987319e53d4d7162272f067fbbf250020
53d07bb53f40c3d94a3a9ae3981e7679a11a3e834c9e40be768adec59087b41d
56223cf90f8f1deef083894d3ff499c8ef77f82a86935f17bbdf03d06369d03e
5a4192e762a449dfd6e63bee835e0941627223c9159e8219acdd01881a1ac175
5a8c1e7681318caa29e9f44e8a6e271f6a4067a2703e9916dfd4fe9099241db7
5dbac59a207adeec232cd8139a292ea59f5f3ecf65cdad53cbe23873ffd60d2f
656cef47b19f647d49326b10d53500ba8b0f97aa71d6c3ebbff79ad0b4aed1ce
65a52f6e516f0c632596218b193336646905690934acda722c840c621d7e56d4
679804e244b4127b7ecd99a513b57d6a4f91866410e16da69ce02f98f534051d
67d5bf0e3ef7883576812006cb54106dccda39afe56f09d2fa166e81ce2c80bd
6974bfd8fa06b7831f05cb4b25860c851a5ad3f02a6699ebe688987dd7a6ebe6
6bebe6bf7abf43624ab1ed62cabc6a1e1d9d5f1cea38042e516439b5391c1621
6f354f47608c7cf776964990c3269ee551e0a30c21ed9ae93816d5360d7a150d
70b380217d6444e301842ece6b8ff9d0008c407bd8b1e963f0d5425b0e5bccc6
73cfb0ed71e314a835831530e27ba1fde5609b224781f7dbc2dd3eb9a08603cd
74055501669731f09bb07f32686333b42e103a5a75c268f7a82836da65273e63
751d5192326ddefce3e87157f7c9355217cdad7b4a969b5dd3161b4453671389
754acb7f1683954de7697922bdf7d8c246e3ed168174c82eacf186bafa933915
7552d43b5427e2fab2d9b72539d041fa9fb3afbf9ee278ef828192ae61452b0e
75810fc3be228b577572981b725b351e0bc507e1c664f0aa6510e87e1680165b
75ca98e0814eea3fd18c8c85ed036534f2177d895244e63d32bccba1de121dc9
7729932e77517e92d2205976c94098c928a5a2ef660dadade0c7a6c38f861532
78a023cb0f6a3a93cee7dac23789a6884b96e020a553d72d6315e98ec7c782a8
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
79ed44f57e7d4550271df0742c22995caebae03803ac30ce81a50b57e1a1952a
7b1eaaaf180a13c29b6dddc3b0ae23333b4397e0f3c065b4c86da2f2530a5f89
7c7818c25a18e8a38553fcbcbc2ad0b5e964103a7d2e494f82815e3f70bf3fc5
7f808c820fc351aec548e6e362185342fa77158fee45617b1386eb4288c347d5
80bd626eb6d57112072a508ee4e5ce3c2fe5673fe0a5d029810033b24aaa5e9f
826f20ce29050cca7c2ca8325ae07d52232bcd79fc5773f131a55bc72ed475c8
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de
8755993ca7a6955463a05d13dbb86808c5823932a9ef985c641f66e2a7eb016b
88b35155e7869354ef8557d34fd38023f643a6689411d3a4f6dbf899b0126573
8c7d7e40d3e7aba7d0748001a7d425ab0f7594228348d4dff213e383b922be1d
8e63117c421644e5480f45f993465a46bbb5dfb9bfb0272c0122eac88f1dd7dd
8fdbf9efc2a3dee59ac086edff2cca2c66184470cb4d88cf8eacc574a45cef51
952833e41ba7a4b64c31a2d7b07dde81bf5bbacf5cbb967821cfe459d0c4a0d8
9987dcc652130026523219440b654a3e307d16f186019031ad60a28d6f73aa2a
99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12
99f55b2f38afcf39e0f0bc0843fb5dabb13295d11d518fa64a1de9c6c96487a2
9b5cd0471afe0aa08f6097c16c8e2badcb68bdcb9824819a494003cd65659838
9bd82960d99b3a76f4af77a88a346bd61f87bac5ff2f385ee28cd669d8f22134
9cd63b8cea25045c14623c538d26752518a58c0c682795ce6ad3078976c65a37
9d5c71e9571012044e6ca5327a3f4a04acb68058ef42fc1a9c6b53c7647e24f8
9e2831acb97097ce89e609e9ff841c6c6293ffeb1ce3e2acc07dfcdeeaa621fd
a0c3e823a07498a845daa25db9e85afdb4a985866f00b4cf1518f363336cd030
a361b4ff331512e51dc8c9446fda25e99928b9355b713b7dd4eb16c10d30260b
a5c8acffadd7a1ff83b2b39dc2f3a549b537ef0d46ab028c45020b98fdbadf29
a72ca284350cc89810ce024c098adbea889cbb8713e6a7f91a1e16ed9aae1ed5
a827ba0a43cbeb52e1f7c01fac1d8526f1a927ef58d5a0bc4ea4047a8b47f075
a9eba9cdd7058e2a7ad28937e19dc6820a079e11ed1728903ceb27a42ffcc9ba
aa1c60208eadf18a50947f665629dc72af63e2d4b8cc13595acc3ba3d500d3b1
ab21762c3f447aa08cbefd5ea3866165f925bd5058a9ae19e23721462de6fb60
ab8517f3d5171dd42a8b9c22af6a2f944b41d00e7ea54ba02b4ed71a6c59e543
abe3a9cedd995b871be9c9dfd657cd41a58253968ec3b74d30ce2b648ed275b9
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
aca566587618e75fa291a419c7c430be02e03fc72f6105658c1bc8e7d59a65e4
ad23d6ebc073bad7ce93ce75c9b42e0dd9a041128014b4166ba8a9e274253cf0
aef540cd3fe9f73e976367a08e5afc1f7766d4ca9e8dba3cf30df70d3d80bc23
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b23f49f504faa32aac548b6662ffd64412f6738496fab8be38da46c5b7121804
b3eee56f61d9cf1ef3d005bfee1ef72ad35a8faf10d8973f5c472b4484fa109a
b418be25f4714c24f69dcb25bc8cb3ae149b425ffd4733922ff6778ea172c80c
b52decccecb8f993977580d4dc13b92831339b2cf80679a4ddadafc7b6fa559c
b72903df32a0eed2c36dd2d0404d413f9f85ebcfdd9326c63fce9ba5f9d8edbf
b7908a015a567ec2363011df2475368dbff34360e9da3fdff50604d6395fb646
bf83d132e02e9aa422bfc3e11ad942d3378b2eff3a0ab4442cc0b721c06f46d9
c17ce5d402af6a0208a7832cb2a4c23a3bdf10ec8659b35cf746a3bd3a3e165c
c1a9a3e223bad631dff12d33b5499eb145cb08d8621c20d9d73870e78d97afe4
c357b81f57059c74cf09ac0da6661e9d7639be8a76634a9d07c4139354dd432d
c38df4a2300e1acd22e8547908f1c0815e4232522aed59fd2d45942480b56f4c
c40a0cdd5ab5dcc4da78066f70839808bb4ee8fb2f3360dec64fde438770b099
c512792c6e8b615898c14bf48446b971c34aa496a7afd7d2580263bc094756d0
c695b9e17e1ebe7936c190afb9024b259fa00b2b46ee49c3a4782ec13d37be7a
c69ac3819fafb748eeb860483cd9c5275e08afb3861d5d045ac69bec6f7f76d9
c6c82452d4595c717df8f740c6f9ff4e6ae5bc1bb9f716584b27f457f18a1d04
c6e52031f5b0e365df9f0d842f36ab6844284022501625d97c39edc82b4016ee
c8d173880b02a84226d7e6dd6f959614c512aecfe369d083dbc98f89e64a94bf
ca7dce2391845e8aec7da135f33fabd10f74eed28a532ac66fd01f761fcfb42f
cda252dc01c656d59193d8d696f26c3e95f10b87711e2413e28362532bae984a
cedc9155263d1f634191e71f3c9ce256b315f833e375739ed0e65087996428cc
cf7fcc9f75c8717897bfaef72f303fab423ce1b70c98512aeb3677e4af988dee
d01a2ba2805c78957e15a2958135de0f3cb88e95159dd0f6c0a032bd76b1b0e9
d0b4256abed72481585662971262eabee345c19f837af00d7ce24239d3b40eef
d5773922958407876324a55ff40662ecd526f8829178ab8790a6e8dce853b3f5
d622534d53d3ac1095af275f0b30274fcd835785577df2dde6d9398e6f7a2c8f
d749579e51cf490ba27a6782bcfe07c52e44ffa8e3fbb4db7a4dded9d0d9ef29
d793d023c86594068c454f32a73682505e7a75ada59c94d34c63f7b0e30de865
d7bd1344379eb2ac9631066d92e8675977cfdac8dd9ce4b751c01c3f13725a87
dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4
dc8e317c924d49916e599d91520cb5f64eb9b1ff74120e5d058ca526d0ec6266
dcd9f488bd62ba0ee403b07a97e40b9ffd63a0eff61091588c913b16d5153d48
df2698e6cf74ed890afa92da10051f880df2ce0b3257b73c5d9ae2f6bea82d3c
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e7b90d32907f89c49e9e2a2ccca95133277f756f13a14187936d9b948ff67b44
e85052e09a7415a2ab775cc198a96dc956d9de42b90541a5cdc9c5c176725745
e9199a4ca8d325186ee5d8c1b4618efface309ec6d01a7b0a3670d8e0822fade
e9ba3d0c5d5408e00becd36ad394fa9ad9c0616741ebdd6dddc8e837db3605ba
ec790c72b7e025a7086577ed23d930707374f2c7f5389d0ec4a73bb25f2483d5
eceee9cbf2cb380924bf8ddcff80de363cf46f7dc35bb336bd2bd08af878bbe2
ee44969942e67ce06917b912f9c0c4ed39f72fa59e30e6c37058ad559660be0a
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
ef37de3d2d1f415a9459a535fa04e81d83caadb9f7adeed130b346921aff79c9
ef39ee441c4e7792c5cda9a8bd86ddce96d9b17bda0cc9f7187f1a70ce9b3ed5
f00c690f9ac9a7bbd3f1a4346472c52ff3329d51a5cc7823c2277b0aa041c443
f25567e7b8a0698486afcba5bc45a909e308e0e161d906c63a570b46734751a7
f2ae4a1938fe6071ac16a5d359018cf424002cc8e14f23fa9c43dd1f51d4fcc6
f315409c3b01157861ce987e758ea205aa549654c761c2fd0b4265646a98b63a
f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1
f56ccb2db87aacedd9415232e40f80bff9939703df2f9c3f9ec8a092e545349f
f93483f0aaf24aea4b5534bb8647d22cd9dfcb4d08d2fd1008787bdfb8a6cc47
fa421b6ebbd2fb474d3a3866409ce6c1efd120b47ff256fffb8f8f50d556d3d9
fb55a8643e38e750bfe49498a8b4799f0bb0bc1020456aafb16446390a4b3b9e
fbde0ac0921d86c356c41532e7319c887a23bd1b8ff00060cab447249f03c7cf
fe513ef974b767510d0a2b9f1b4d3afa53185b89ab617c869e5e3d6db960192c
ff4bd34aa98a0214833619d3d751838db015722dfbbec15cd14dadc66cd67869

intezer.com Open in urlscan Pro 199.16.172.82 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

183 Requests

98 %HTTPS

58 %IPv6

34 Domains

48 Subdomains

42 IPs

4 Countries

2852 kBTransfer

8058 kBSize

47 Cookies

31 Outgoing links

Page URL History

Redirected requests

183 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

intezer.com Open in urlscan Pro
199.16.172.82 Public Scan

Screenshot
Live screenshot

Full Image

183
Requests

98 %
HTTPS

58 %
IPv6

34
Domains

48
Subdomains

42
IPs

4
Countries

2852 kB
Transfer

8058 kB
Size

47
Cookies

183 HTTP transactions
0 data transactions