urlscan.io logo urlscan.io
SecurityTrails logo

int0xcc.svbtle.com Open in urlscan Pro
50.17.209.185  Public Scan

Go To Rescan Add Verdict Report
URL: https://int0xcc.svbtle.com/dissecting-emotet-s-network-communication-protocol
Submission: On November 08 via api from US — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 11 IPs in 2 countries across 8 domains to perform 39 HTTP transactions. The main IP is 50.17.209.185, located in Ashburn, United States and belongs to AMAZON-AES, US. The main domain is int0xcc.svbtle.com.
TLS certificate: Issued by Amazon on February 10th 2022. Valid for: a year.
This is the only time int0xcc.svbtle.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

2    50.17.209.185 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-50-17-209-185.compute-1.amazonaws.com
int0xcc.svbtle.com
4    52.222.214.70 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-222-214-70.fra56.r.cloudfront.net
lightning.svbtle.com
4    2606:2800:234:59:254c:406:2366:268c (United States)

ASN15133 (EDGECAST, US)
platform.twitter.com
8    13.226.153.52 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-226-153-52.dus51.r.cloudfront.net
svbtleusercontent.com
9    2a02:26f0:3500:16::215:14a0 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)
use.typekit.net
3    2a00:1450:4001:812::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google-analytics.com
4    2a03:2880:f01c:8012:face:b00c:0:3 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)
connect.facebook.net
static.xx.fbcdn.net
2    104.244.42.200 (United States)

ASN13414 (TWITTER, US)
syndication.twitter.com
2    2a03:2880:f12d:83:face:b00c:0:25de (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)
www.facebook.com
1    2a02:26f0:3500:16::215:1495 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)
p.typekit.net
Apex Domain
Subdomains		 Transfer
10 typekit.net
use.typekit.net — Cisco Umbrella Rank: 980
p.typekit.net — Cisco Umbrella Rank: 1212
148 KB
8 svbtleusercontent.com
svbtleusercontent.com
262 KB
6 twitter.com
platform.twitter.com — Cisco Umbrella Rank: 1007
syndication.twitter.com — Cisco Umbrella Rank: 1255
150 KB
6 svbtle.com
int0xcc.svbtle.com
lightning.svbtle.com
269 KB
3 google-analytics.com
www.google-analytics.com — Cisco Umbrella Rank: 97
20 KB
2 fbcdn.net
static.xx.fbcdn.net — Cisco Umbrella Rank: 600
141 KB
2 facebook.com
www.facebook.com — Cisco Umbrella Rank: 107
13 KB
2 facebook.net
connect.facebook.net — Cisco Umbrella Rank: 180
87 KB
39 8
Domain Requested by
9 use.typekit.net int0xcc.svbtle.com
8 svbtleusercontent.com int0xcc.svbtle.com
4 platform.twitter.com int0xcc.svbtle.com
platform.twitter.com
4 lightning.svbtle.com int0xcc.svbtle.com
lightning.svbtle.com
3 www.google-analytics.com int0xcc.svbtle.com
www.google-analytics.com
2 static.xx.fbcdn.net www.facebook.com
2 www.facebook.com connect.facebook.net
2 syndication.twitter.com platform.twitter.com
int0xcc.svbtle.com
2 connect.facebook.net lightning.svbtle.com
connect.facebook.net
2 int0xcc.svbtle.com lightning.svbtle.com
1 p.typekit.net int0xcc.svbtle.com
39 11

This site contains links to these domains. Also see Links.

Domain
svbtle.com
twitter.com
svbtleusercontent.com
Subject Issuer Validity Valid
svbtle.com
Amazon		 2022-02-10 -
2023-03-11		 a year crt.sh
*.twimg.com
DigiCert TLS RSA SHA256 2020 CA1		 2022-10-06 -
2023-11-06		 a year crt.sh
neutralusercontent.com
Amazon		 2022-02-14 -
2023-03-15		 a year crt.sh
use.typekit.net
DigiCert TLS Hybrid ECC SHA384 2020 CA1		 2022-09-14 -
2023-10-15		 a year crt.sh
*.google-analytics.com
GTS CA 1C3		 2022-10-17 -
2023-01-09		 3 months crt.sh
*.facebook.com
DigiCert SHA2 High Assurance Server CA		 2022-08-18 -
2022-11-16		 3 months crt.sh
syndication.twitter.com
DigiCert TLS Hybrid ECC SHA384 2020 CA1		 2022-03-07 -
2023-03-06		 a year crt.sh

This page contains 4 frames:

Primary Page: https://int0xcc.svbtle.com/dissecting-emotet-s-network-communication-protocol
Frame ID: 6550FCEB990D6BBDEE935E92020DF158
Requests: 35 HTTP requests in this frame

Frame: https://platform.twitter.com/widgets/widget_iframe.644279d1635fd969e87af94a98bd232b.html?origin=https%3A%2F%2Fint0xcc.svbtle.com
Frame ID: 67397462AAA0AB14216006790FE74C07
Requests: 2 HTTP requests in this frame

Frame: https://platform.twitter.com/widgets/tweet_button.644279d1635fd969e87af94a98bd232b.en.html
Frame ID: 8CCF3199EF11B001449F2C9D29D2E70A
Requests: 2 HTTP requests in this frame

Frame: https://www.facebook.com/v3.0/plugins/share_button.php?app_id=346346195413177&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df3407a6484a1fa%26domain%3Dint0xcc.svbtle.com%26is_canvas%3Dfalse%26origin%3Dhttps%253A%252F%252Fint0xcc.svbtle.com%252Ff6ffc032664c4c%26relation%3Dparent.parent&container_width=600&href=https%3A%2F%2Fint0xcc.svbtle.com%2Fdissecting-emotet-s-network-communication-protocol&layout=button_count&locale=en_US&sdk=joey
Frame ID: FF06A1C5EB6407B1271BC431BF6F875D
Requests: 3 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Dissecting Emotet’s network communication protocol

Detected technologies

Overall confidence: 100%
Detected patterns
  • ^https?://[^/]+\.svbtle\.com
Overall confidence: 100%
Detected patterns
  • //connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js
Overall confidence: 100%
Detected patterns
  • google-analytics\.com/(?:ga|urchin|analytics)\.js
Overall confidence: 100%
Detected patterns
  • //platform\.twitter\.com/widgets\.js

Page Statistics

39
Requests

100 %
HTTPS

60 %
IPv6

8
Domains

11
Subdomains

11
IPs

2
Countries

1091 kB
Transfer

2568 kB
Size

4
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

39 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request dissecting-emotet-s-network-communication-protocol
int0xcc.svbtle.com/ 		19 KB
7 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://int0xcc.svbtle.com/dissecting-emotet-s-network-communication-protocol
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
50.17.209.185 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-50-17-209-185.compute-1.amazonaws.com
Software
nginx /
Resource Hash
07d619f8e4a6e5f070c69fc72e2b42edb4c329b4c3adaf83d7e2aac82ffd39f3
Security Headers
Name Value
Strict-Transport-Security max-age=0; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

cache-control
max-age=10, public, max-stale=0
content-encoding
gzip
content-type
text/html; charset=utf-8
date
Tue, 08 Nov 2022 22:59:50 GMT
etag
W/"07d619f8e4a6e5f070c69fc72e2b42ed"
referrer-policy
strict-origin-when-cross-origin
server
nginx
strict-transport-security
max-age=0; includeSubDomains
superexpress
MISS
x-content-type-options
nosniff
x-download-options
noopen
x-permitted-cross-domain-policies
none
x-request-id
b363863a-f50e-4d03-82ce-efab427f283a
x-xss-protection
1; mode=block
build.blog-a869624ade935aae7023557cad0fef14e36077e2c63c8277d6ce4368829fe1c9.css
lightning.svbtle.com/cargo/legacy/ 		143 KB
54 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://lightning.svbtle.com/cargo/legacy/build.blog-a869624ade935aae7023557cad0fef14e36077e2c63c8277d6ce4368829fe1c9.css
Requested by
Host: int0xcc.svbtle.com
URL: https://int0xcc.svbtle.com/dissecting-emotet-s-network-communication-protocol
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
52.222.214.70 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-52-222-214-70.fra56.r.cloudfront.net
Software
nginx /
Resource Hash
9334579d51fd53359f710896507b652ca222ec39bf505cc18c63b7307e1b1011

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://int0xcc.svbtle.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date
Thu, 02 Dec 2021 01:11:09 GMT
content-encoding
gzip
via
1.1 54fc556adf6e8c787574c6f132d70178.cloudfront.net (CloudFront)
last-modified
Thu, 02 Dec 2021 01:10:37 GMT
server
nginx
superexpress
BYPASS
x-amz-cf-pop
FRA56-P3
age
29540921
x-cache
Hit from cloudfront
content-type
text/css
cache-control
max-age=315360000, public, max-age=31536000
content-length
55064
x-amz-cf-id
hud6uAcCCYRch6fDJIeWhNtr13y8_cx9EWg9goZBWmfri4RDj7CvHw==
expires
Thu, 31 Dec 2037 23:55:55 GMT
build.blog-c16625fcb4e36ea9b4a4e9881cf19efabd96bc1d18810abb4c6104e4c55ddd29.js
lightning.svbtle.com/cargo/ 		152 KB
47 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://lightning.svbtle.com/cargo/build.blog-c16625fcb4e36ea9b4a4e9881cf19efabd96bc1d18810abb4c6104e4c55ddd29.js
Requested by
Host: int0xcc.svbtle.com
URL: https://int0xcc.svbtle.com/dissecting-emotet-s-network-communication-protocol
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
52.222.214.70 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-52-222-214-70.fra56.r.cloudfront.net
Software
nginx /
Resource Hash
8150c9b2dfd516c40d330f40246f0d0eacfea4094278169cc1ce6b1b1aadbf67

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://int0xcc.svbtle.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date
Thu, 02 Dec 2021 01:11:09 GMT
content-encoding
gzip
via
1.1 54fc556adf6e8c787574c6f132d70178.cloudfront.net (CloudFront)
last-modified
Thu, 02 Dec 2021 01:10:37 GMT
server
nginx
superexpress
BYPASS
x-amz-cf-pop
FRA56-P3
age
29540921
x-cache
Hit from cloudfront
content-type
application/javascript
cache-control
max-age=315360000, public, max-age=31536000
content-length
48058
x-amz-cf-id
Yd1Gh33OE5M5ILpclfX8VoTgb01uFOZHGfdGUhby9GeQAOnLdLVQQg==
expires
Thu, 31 Dec 2037 23:55:55 GMT
share_buttons-53f2b79c4d11a7526f031a847d91d14c38f60b458227a9e9d9830786eba3b2b8.js
lightning.svbtle.com/cargo/ 		970 B
939 B 		Script
General
Check archive.org
Download Go to
Full URL
https://lightning.svbtle.com/cargo/share_buttons-53f2b79c4d11a7526f031a847d91d14c38f60b458227a9e9d9830786eba3b2b8.js
Requested by
Host: int0xcc.svbtle.com
URL: https://int0xcc.svbtle.com/dissecting-emotet-s-network-communication-protocol
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
52.222.214.70 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-52-222-214-70.fra56.r.cloudfront.net
Software
nginx /
Resource Hash
e284f18e9568826e86d562ae539f5ca8f8c34eaf77df368bbf97b3355e86821f

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://int0xcc.svbtle.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date
Thu, 02 Dec 2021 01:11:09 GMT
content-encoding
gzip
via
1.1 54fc556adf6e8c787574c6f132d70178.cloudfront.net (CloudFront)
last-modified
Thu, 02 Dec 2021 01:10:37 GMT
server
nginx
superexpress
BYPASS
x-amz-cf-pop
FRA56-P3
age
29540921
x-cache
Hit from cloudfront
content-type
application/javascript
cache-control
max-age=315360000, public, max-age=31536000
content-length
533
x-amz-cf-id
AyfV_SUYSp0IdZiQ98gHgVl_ULeic-0dAbclTJUpOyf3f5yD1ubNAQ==
expires
Thu, 31 Dec 2037 23:55:55 GMT
widgets.js
platform.twitter.com/ 		97 KB
29 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://platform.twitter.com/widgets.js
Requested by
Host: int0xcc.svbtle.com
URL: https://int0xcc.svbtle.com/dissecting-emotet-s-network-communication-protocol
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (amb/6B99) /
Resource Hash
c02444f391e8655e79ff8d7d4cb69c3426c3bffbf8731a994fa23aed0f641d12

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://int0xcc.svbtle.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

Date
Tue, 08 Nov 2022 22:59:50 GMT
Content-Encoding
gzip
Age
734
X-Cache
HIT
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server-Timing
x-cache;desc= HIT,x-tw-cdn;desc=VZ,edge;dur=1
Content-Length
29221
x-amzn-internal-status
304
Last-Modified
Wed, 02 Nov 2022 19:43:37 GMT
Server
ECS (amb/6B99)
Etag
"6633f9603c759c40d9b200995454f17c+gzip"
Vary
Accept-Encoding
Access-Control-Allow-Methods
GET
Content-Type
application/javascript; charset=utf-8
Access-Control-Allow-Origin
*
x-tw-cdn
VZ
Cache-Control
public, max-age=1800
8W23UpkDJf2KpMcM2pxB5L0xspap_small.png
svbtleusercontent.com/ 		6 KB
7 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://svbtleusercontent.com/8W23UpkDJf2KpMcM2pxB5L0xspap_small.png
Requested by
Host: int0xcc.svbtle.com
URL: https://int0xcc.svbtle.com/dissecting-emotet-s-network-communication-protocol
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.226.153.52 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-226-153-52.dus51.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
f7b58988d09f8f945f4968a8e70783e7c70f221a2d8de3d8f222e80fe0c88d95

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://int0xcc.svbtle.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date
Tue, 08 Nov 2022 22:59:52 GMT
via
1.1 c51e3be89c14e3f859ea898f7e36ecec.cloudfront.net (CloudFront)
last-modified
Mon, 22 Apr 2019 18:00:44 GMT
server
AmazonS3
x-amz-cf-pop
DUS51-C1
etag
"b4a88826fa019afba80fe4cdb70c3090"
x-cache
Miss from cloudfront
content-type
image/png
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
6338
x-amz-cf-id
-gtytAd9UsbLXs2WcwM1uPiWFnYL0M0hfTWjXjK4P2ehMEW_tjf0tg==
dEwHmD7Z3h28VjAoBMEFBh0xspap_small.png
svbtleusercontent.com/ 		42 KB
42 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://svbtleusercontent.com/dEwHmD7Z3h28VjAoBMEFBh0xspap_small.png
Requested by
Host: int0xcc.svbtle.com
URL: https://int0xcc.svbtle.com/dissecting-emotet-s-network-communication-protocol
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.226.153.52 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-226-153-52.dus51.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
5f080b135ed6ddadfa74d5993743b056b80051650a8465247d1e21e9749aa3ee

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://int0xcc.svbtle.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date
Tue, 08 Nov 2022 22:59:52 GMT
via
1.1 c51e3be89c14e3f859ea898f7e36ecec.cloudfront.net (CloudFront)
last-modified
Mon, 22 Apr 2019 16:38:50 GMT
server
AmazonS3
x-amz-cf-pop
DUS51-C1
etag
"fa08d8ea49211375088ffb988dc22bee"
x-cache
Miss from cloudfront
content-type
image/png
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
42764
x-amz-cf-id
1ttT-8M3cSdD2QYI6S-TgarP-dJd_ejRqwRQZP_B2g2US0Y4P0MmNg==
3Qrq2uNWJp3YNGj9ahhwRp0xspap_small.png
svbtleusercontent.com/ 		49 KB
49 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://svbtleusercontent.com/3Qrq2uNWJp3YNGj9ahhwRp0xspap_small.png
Requested by
Host: int0xcc.svbtle.com
URL: https://int0xcc.svbtle.com/dissecting-emotet-s-network-communication-protocol
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.226.153.52 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-226-153-52.dus51.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
95aa416e20e326bfe2030cf9de3d0b9dbb62efcd1cd614e95fdac11eda90edc7

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://int0xcc.svbtle.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date
Tue, 08 Nov 2022 22:59:52 GMT
via
1.1 c51e3be89c14e3f859ea898f7e36ecec.cloudfront.net (CloudFront)
last-modified
Mon, 22 Apr 2019 17:28:47 GMT
server
AmazonS3
x-amz-cf-pop
DUS51-C1
etag
"8c37bad92c757b35d648c694ff3d2a89"
x-cache
Miss from cloudfront
content-type
image/png
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
50104
x-amz-cf-id
WxgbK9fQFFw_1I0qcSDW1xZaMNhXjOdyXPQeCJZ0QJDU-IZrYRBYig==
8WkQbK67VQWhqemqqvuVue0xspap_small.png
svbtleusercontent.com/ 		38 KB
38 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://svbtleusercontent.com/8WkQbK67VQWhqemqqvuVue0xspap_small.png
Requested by
Host: int0xcc.svbtle.com
URL: https://int0xcc.svbtle.com/dissecting-emotet-s-network-communication-protocol
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.226.153.52 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-226-153-52.dus51.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
927412999f268f79632a3088174cec1bcb3f84d5c6d1ac27457d15eb6b12d7e5

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://int0xcc.svbtle.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date
Tue, 08 Nov 2022 22:59:52 GMT
via
1.1 c51e3be89c14e3f859ea898f7e36ecec.cloudfront.net (CloudFront)
last-modified
Mon, 22 Apr 2019 17:28:54 GMT
server
AmazonS3
x-amz-cf-pop
DUS51-C1
etag
"c35f2c44bbe5fea1a5a46832e7a797d1"
x-cache
Miss from cloudfront
content-type
image/png
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
38450
x-amz-cf-id
l8He61bAibNRs59DmUsR_CRhubXm9uXRs0-ZpUmIHZ1s0b7f7mSDcQ==
vNzZG5i8bi15k6xiGFqf980xspap_small.jpg
svbtleusercontent.com/ 		7 KB
7 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://svbtleusercontent.com/vNzZG5i8bi15k6xiGFqf980xspap_small.jpg
Requested by
Host: int0xcc.svbtle.com
URL: https://int0xcc.svbtle.com/dissecting-emotet-s-network-communication-protocol
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.226.153.52 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-226-153-52.dus51.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
ee5ece28f0c849619336fbe2684026382cac2fd13b926e0a9402a22c8d440de3

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://int0xcc.svbtle.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date
Tue, 08 Nov 2022 22:59:52 GMT
via
1.1 c51e3be89c14e3f859ea898f7e36ecec.cloudfront.net (CloudFront)
last-modified
Mon, 22 Apr 2019 17:29:42 GMT
server
AmazonS3
x-amz-cf-pop
DUS51-C1
etag
"dc2a48a3c7771113b77e12b142d546b1"
x-cache
Miss from cloudfront
content-type
image/jpeg
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
7086
x-amz-cf-id
AWZHZKtX8E0odpTxNDq5LvIlkjb8FywGj3P6WoCtkNCjg2naATh1zw==
nioJVWuizTWKf16igYtDnD0xspap_small.png
svbtleusercontent.com/ 		45 KB
45 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://svbtleusercontent.com/nioJVWuizTWKf16igYtDnD0xspap_small.png
Requested by
Host: int0xcc.svbtle.com
URL: https://int0xcc.svbtle.com/dissecting-emotet-s-network-communication-protocol
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.226.153.52 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-226-153-52.dus51.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
0196eb0d526f60d660cd65f5e47a29b199c2939c0e0e7ff2e7ec3433137856d0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://int0xcc.svbtle.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date
Tue, 08 Nov 2022 22:59:52 GMT
via
1.1 c51e3be89c14e3f859ea898f7e36ecec.cloudfront.net (CloudFront)
last-modified
Mon, 22 Apr 2019 17:30:17 GMT
server
AmazonS3
x-amz-cf-pop
DUS51-C1
etag
"a57aacd716be97f1753796d96ea7aa6e"
x-cache
Miss from cloudfront
content-type
image/png
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
46082
x-amz-cf-id
sRg2io6z3cs-oERiJ1uGqQkqGezjqul4o-adD5GYHeaiVX1inPfeNQ==
veTs1ZU6Rk1Dfy7ZWpjrdA0xspap_small.png
svbtleusercontent.com/ 		61 KB
61 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://svbtleusercontent.com/veTs1ZU6Rk1Dfy7ZWpjrdA0xspap_small.png
Requested by
Host: int0xcc.svbtle.com
URL: https://int0xcc.svbtle.com/dissecting-emotet-s-network-communication-protocol
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.226.153.52 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-226-153-52.dus51.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
459712d283e50875f4758eb089d4895144655781557b093789b6d7f867da7f32

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://int0xcc.svbtle.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date
Tue, 08 Nov 2022 22:59:52 GMT
via
1.1 c51e3be89c14e3f859ea898f7e36ecec.cloudfront.net (CloudFront)
last-modified
Mon, 22 Apr 2019 17:30:28 GMT
server
AmazonS3
x-amz-cf-pop
DUS51-C1
etag
"8089cfa6defc6c6d59cf8b423440730a"
x-cache
Miss from cloudfront
content-type
image/png
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
62498
x-amz-cf-id
qNCLU2OIVo5bdLxhtFxqnyfADYFZmdLRoVDETA9AGDQlbzhyNwjpzw==
tze3uwp.js
use.typekit.net/ 		18 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://use.typekit.net/tze3uwp.js
Requested by
Host: int0xcc.svbtle.com
URL: https://int0xcc.svbtle.com/dissecting-emotet-s-network-communication-protocol
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:3500:16::215:14a0 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
nginx /
Resource Hash
38d8b14f7a64c4558716c9183f3e93e5e17b033e49ccd1ad2b0794e3f9db5b49
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains;

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://int0xcc.svbtle.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains;
content-encoding
gzip
date
Tue, 08 Nov 2022 22:59:51 GMT
server
nginx
vary
Accept-Encoding
content-type
text/javascript;charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=600, stale-while-revalidate=604800
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
content-length
6834
analytics.js
www.google-analytics.com/ 		49 KB
20 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: int0xcc.svbtle.com
URL: https://int0xcc.svbtle.com/dissecting-emotet-s-network-communication-protocol
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:812::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
b42e4a056cb5b80c5a315040826866445ec9332f0749e184509ab2d9d3b86719
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://int0xcc.svbtle.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
date
Tue, 08 Nov 2022 21:24:49 GMT
last-modified
Tue, 27 Sep 2022 22:01:05 GMT
server
Golfe2
age
5701
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
20039
expires
Tue, 08 Nov 2022 23:24:49 GMT
x75cXsjA0QTd7zEA5JgXxUsrIcozqt8Iyw_medium.jpg
svbtleusercontent.com/ 		11 KB
12 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://svbtleusercontent.com/x75cXsjA0QTd7zEA5JgXxUsrIcozqt8Iyw_medium.jpg
Requested by
Host: int0xcc.svbtle.com
URL: https://int0xcc.svbtle.com/dissecting-emotet-s-network-communication-protocol
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.226.153.52 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-226-153-52.dus51.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
a5a11cafb0ef16f132405003f2666375b0f1afd487ef3c648257e93122df0699

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://int0xcc.svbtle.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date
Tue, 08 Nov 2022 16:02:24 GMT
via
1.1 c51e3be89c14e3f859ea898f7e36ecec.cloudfront.net (CloudFront)
last-modified
Wed, 24 Jan 2018 21:11:55 GMT
server
AmazonS3
x-amz-cf-pop
DUS51-C1
age
25047
etag
"2b1b3e4ee6559f5e5aa4ba1e64f0561d"
x-cache
Hit from cloudfront
content-type
image/jpeg
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
11686
x-amz-cf-id
VVH79rx8hxYsJSVuQa4VxlPbzz5gqWws0g8dh9P9p79KofsdkSiV1w==
truncated
/ 		1 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
ea114f7ac8b7e526ba56798ab9cd199b3d4d285033e281de385557cee484461d

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ 		2 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
6cab047139dcd2c52eb659bab737a3873bcf3e81c79b914096da9e653a58964a

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

Content-Type
image/png
sdk.js
connect.facebook.net/en_US/ 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://connect.facebook.net/en_US/sdk.js?_=1667948390888
Requested by
Host: lightning.svbtle.com
URL: https://lightning.svbtle.com/cargo/build.blog-c16625fcb4e36ea9b4a4e9881cf19efabd96bc1d18810abb4c6104e4c55ddd29.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
0dc4081aecd7601360569056e7f5f388deee95681f40dba35faa4ccece710bd8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://int0xcc.svbtle.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; preload; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
date
Tue, 08 Nov 2022 22:59:51 GMT
content-md5
aBTPdxTEOXaZviqKyA3XKA==
document-policy
force-load-at-top
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
1688
x-fb-rlafr
0
x-fb-debug
sCtzlBdR5M6N6QrPQEIo79hFhwrgubir3b9B/r21fBQLkZF1lHpF5L6zSZVq9SG90Bue799UcJy8s01yAcY0BA==
x-fb-trip-id
686109401
x-fb-content-md5
23ce6ed1946c218f8b912a7469810a2e
cross-origin-opener-policy
same-origin-allow-popups
etag
"aed07e8d5a0f27063375a6deea2ef958"
vary
Accept-Encoding
x-frame-options
DENY
content-type
application/x-javascript; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
X-FB-Content-MD5
cache-control
public,max-age=1200,stale-while-revalidate=3600
timing-allow-origin
*
priority
u=3,i
expires
Tue, 08 Nov 2022 23:19:51 GMT
kudos
int0xcc.svbtle.com/5SzcRFh1MQLazwcwXiKsk4/ 		59 B
649 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://int0xcc.svbtle.com/5SzcRFh1MQLazwcwXiKsk4/kudos
Requested by
Host: lightning.svbtle.com
URL: https://lightning.svbtle.com/cargo/build.blog-c16625fcb4e36ea9b4a4e9881cf19efabd96bc1d18810abb4c6104e4c55ddd29.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
50.17.209.185 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-50-17-209-185.compute-1.amazonaws.com
Software
nginx /
Resource Hash
034e924c1ea164d8e9dc0c9ad9a172337cd274703825fd9d851dde73e4d140ec
Security Headers
Name Value
Strict-Transport-Security max-age=0; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Accept
*/*
Referer
https://int0xcc.svbtle.com/dissecting-emotet-s-network-communication-protocol
X-Requested-With
XMLHttpRequest
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date
Tue, 08 Nov 2022 22:59:51 GMT
strict-transport-security
max-age=0; includeSubDomains
x-content-type-options
nosniff
referrer-policy
strict-origin-when-cross-origin
content-encoding
gzip
server
nginx
x-permitted-cross-domain-policies
none
superexpress
BYPASS
etag
W/"034e924c1ea164d8e9dc0c9ad9a17233"
x-download-options
noopen
content-type
application/json; charset=utf-8
x-svbkey-r
I6WP70oNDVyRPNz2dezbB4m0ZKAlMk+5p+C/KoUDeu76Fveixh1JmjQ/WkS90JkLiLMSaK4MY3OVg06k2aLgKg==
cache-control
max-age=2, public, max-stale=0
x-xss-protection
1; mode=block
x-request-id
9fd3b41a-b3fc-4201-b92a-23f976050509
highlight.pack-7516ed3a655de1cc7492d274c48690064d25c6c77c7fb842e82e3034336bf023.js
lightning.svbtle.com/cargo/ 		434 KB
159 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://lightning.svbtle.com/cargo/highlight.pack-7516ed3a655de1cc7492d274c48690064d25c6c77c7fb842e82e3034336bf023.js?_=1667948390889
Requested by
Host: lightning.svbtle.com
URL: https://lightning.svbtle.com/cargo/build.blog-c16625fcb4e36ea9b4a4e9881cf19efabd96bc1d18810abb4c6104e4c55ddd29.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
52.222.214.70 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-52-222-214-70.fra56.r.cloudfront.net
Software
nginx /
Resource Hash
0281321b37efdec888d73c6aeaac70f119d82ddafbe03cf6a1f70fe30eb80f46

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://int0xcc.svbtle.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date
Sun, 27 Feb 2022 12:36:41 GMT
content-encoding
gzip
via
1.1 54fc556adf6e8c787574c6f132d70178.cloudfront.net (CloudFront)
last-modified
Thu, 02 Dec 2021 11:31:34 GMT
server
nginx
superexpress
BYPASS
x-amz-cf-pop
FRA56-P3
age
21982989
x-cache
Hit from cloudfront
content-type
application/javascript
cache-control
max-age=315360000, public, max-age=31536000
content-length
162185
x-amz-cf-id
b-ZTrU6_he0PqmFXtJbJ87XEXXofr3x7Get1R6OBErnjD0Kv3wli4w==
expires
Thu, 31 Dec 2037 23:55:55 GMT
collect
www.google-analytics.com/j/ 		2 B
147 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j98&a=912511294&t=pageview&_s=1&dl=https%3A%2F%2Fint0xcc.svbtle.com%2Fdissecting-emotet-s-network-communication-protocol&ul=en-us&de=UTF-8&dt=Dissecting%20Emotet%E2%80%99s%20network%20communication%20protocol&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAAABAAAAAC~&jid=946783790&gjid=54347802&cid=946803149.1667948391&tid=UA-41994323-1&_gid=285961440.1667948391&_r=1&_slc=1&z=118606283
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:812::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
a048e640908046be06e00eab37742b5d5ff80964af58cfd22f7cb2de4dfe375f
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://int0xcc.svbtle.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 08 Nov 2022 22:59:50 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://int0xcc.svbtle.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
www.google-analytics.com/ 		35 B
194 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google-analytics.com/collect?v=1&_v=j98&a=912511294&t=pageview&_s=2&dl=https%3A%2F%2Fint0xcc.svbtle.com%2Fdissecting-emotet-s-network-communication-protocol&dp=%2Fdissecting-emotet-s-network-communication-protocol&ul=en-us&de=UTF-8&dt=Dissecting%20Emotet%E2%80%99s%20network%20communication%20protocol&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAAABAAAAACgC~&jid=&gjid=&cid=946803149.1667948391&tid=UA-41994323-1&_gid=285961440.1667948391&z=887171449
Requested by
Host: int0xcc.svbtle.com
URL: https://int0xcc.svbtle.com/dissecting-emotet-s-network-communication-protocol
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:812::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://int0xcc.svbtle.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 08 Nov 2022 04:42:33 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
65837
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
widget_iframe.644279d1635fd969e87af94a98bd232b.html
platform.twitter.com/widgets/ Frame 6739 		320 KB
104 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://platform.twitter.com/widgets/widget_iframe.644279d1635fd969e87af94a98bd232b.html?origin=https%3A%2F%2Fint0xcc.svbtle.com
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (amb/6B99) /
Resource Hash
8c0531412c543b9bd978e29acb8f5cf330db9891115d1e9924519d9a675b7b74

Request headers

Referer
https://int0xcc.svbtle.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Access-Control-Allow-Methods
GET
Access-Control-Allow-Origin
*
Age
520737
Cache-Control
public, max-age=315360000
Content-Encoding
gzip
Content-Length
105445
Content-Type
text/html; charset=utf-8
Date
Tue, 08 Nov 2022 22:59:51 GMT
Etag
"50d73c0b4a4c7e4697b9c6ac6f1ecd75+gzip"
Last-Modified
Wed, 02 Nov 2022 19:36:59 GMT
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server
ECS (amb/6B99)
Server-Timing
x-cache;desc= HIT,x-tw-cdn;desc=VZ,edge;dur=1
Vary
Accept-Encoding
X-Cache
HIT
x-tw-cdn
VZ
settings
syndication.twitter.com/ Frame 6739 		914 B
697 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://syndication.twitter.com/settings?session_id=1852b0b87d322d7a80f7e06f3a923bbdfd4ef4b0
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/widgets/widget_iframe.644279d1635fd969e87af94a98bd232b.html?origin=https%3A%2F%2Fint0xcc.svbtle.com
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.200 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
66c1aff8564f0c727747c0a2f1ac6f5a215100fb599807bacecf6b23b1a6a975
Security Headers
Name Value
Strict-Transport-Security max-age=631138519

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://platform.twitter.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

x-response-time
104
date
Tue, 08 Nov 2022 22:59:50 GMT
content-encoding
gzip
strict-transport-security
max-age=631138519
last-modified
Tue, 08 Nov 2022 22:59:51 GMT
server
tsa_o
vary
Origin
content-type
application/json; charset=utf-8
access-control-allow-origin
https://platform.twitter.com
x-transaction-id
58bb78987029a1d7
cache-control
must-revalidate, max-age=600
access-control-allow-credentials
true
perf
7626143928
x-connection-hash
900fb9cfdb4668e3d0098e48a2c2977c88a8d7383d39ad3560a25fb3ea3ed146
content-length
375
sdk.js
connect.facebook.net/en_US/ 		300 KB
85 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://connect.facebook.net/en_US/sdk.js?hash=3cc420a903fdf1528ee7b67fc86d1fdc
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/sdk.js?_=1667948390888
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
f48f0342d55593277d933322745db675346f9978d615102e4782c9403101dd81
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

Referer
https://int0xcc.svbtle.com/
Origin
https://int0xcc.svbtle.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; preload; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
date
Tue, 08 Nov 2022 22:59:51 GMT
content-md5
z0wsMXgh55OoL91nU6P2bg==
document-policy
force-load-at-top
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
86891
x-fb-rlafr
0
x-fb-debug
6MAXcFCbNZGab7CgR+KDDPYrquLKKBOtF0BXQdYl4MYpV9jCJpEW3CMgQOt/1IvUpOJwmtp9ruN8VFTOUFvUgg==
x-fb-content-md5
0ead6d223ec8550ec302f201556bc975
cross-origin-opener-policy
same-origin-allow-popups
etag
"e49bae2460ae0c8915a71ce3eff64d87"
vary
Accept-Encoding
x-frame-options
DENY
content-type
application/x-javascript; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
X-FB-Content-MD5
cache-control
public,max-age=31536000,stale-while-revalidate=3600,immutable
timing-allow-origin
*
priority
u=3,i
expires
Wed, 08 Nov 2023 21:19:14 GMT
l
use.typekit.net/af/7d485b/00000000000000003b9ad1b1/27/ 		19 KB
19 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://use.typekit.net/af/7d485b/00000000000000003b9ad1b1/27/l?subset_id=2&fvd=n7&v=3
Requested by
Host: int0xcc.svbtle.com
URL: https://int0xcc.svbtle.com/dissecting-emotet-s-network-communication-protocol
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:3500:16::215:14a0 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
nginx /
Resource Hash
3b361d49881277ab3b92b0d7edc9f781f8f8ccb6738487b927140fee462aec1d

Request headers

Referer
https://int0xcc.svbtle.com/
Origin
https://int0xcc.svbtle.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date
Tue, 08 Nov 2022 22:59:51 GMT
server
nginx
etag
"518c5f781d51642b3cf2290d365b9b8257de6e1f"
content-type
application/font-woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
content-length
19056
l
use.typekit.net/af/f6bc94/00000000000000003b9ad1bd/27/ 		17 KB
18 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://use.typekit.net/af/f6bc94/00000000000000003b9ad1bd/27/l?subset_id=2&fvd=n1&v=3
Requested by
Host: int0xcc.svbtle.com
URL: https://int0xcc.svbtle.com/dissecting-emotet-s-network-communication-protocol
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:3500:16::215:14a0 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
nginx /
Resource Hash
dee4f86f26516f259814435168f8f5d4404058be291a719c1a422d057b06eb6e

Request headers

Referer
https://int0xcc.svbtle.com/
Origin
https://int0xcc.svbtle.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date
Tue, 08 Nov 2022 22:59:51 GMT
server
nginx
etag
"40c820620bcf640269ca04b9107c3b6886b4dc56"
content-type
application/font-woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
content-length
17792
l
use.typekit.net/af/04b81b/00000000000000003b9ad1bb/27/ 		18 KB
18 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://use.typekit.net/af/04b81b/00000000000000003b9ad1bb/27/l?subset_id=2&fvd=n6&v=3
Requested by
Host: int0xcc.svbtle.com
URL: https://int0xcc.svbtle.com/dissecting-emotet-s-network-communication-protocol
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:3500:16::215:14a0 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
nginx /
Resource Hash
f1c1ae1a41ae40e40b10aa9c031ae6850548fe43a736725051753aa6c411668d

Request headers

Referer
https://int0xcc.svbtle.com/
Origin
https://int0xcc.svbtle.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date
Tue, 08 Nov 2022 22:59:51 GMT
server
nginx
etag
"80987524f2c82c2a36d727971941de8401d3f316"
content-type
application/font-woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
content-length
18692
l
use.typekit.net/af/c9cde8/00000000000000003b9ad1b9/27/ 		18 KB
18 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://use.typekit.net/af/c9cde8/00000000000000003b9ad1b9/27/l?subset_id=2&fvd=n4&v=3
Requested by
Host: int0xcc.svbtle.com
URL: https://int0xcc.svbtle.com/dissecting-emotet-s-network-communication-protocol
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:3500:16::215:14a0 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
nginx /
Resource Hash
e0ed483bba0a14e9fe3b33939500515282721fedb70a8ebad014233c02df57c2

Request headers

Referer
https://int0xcc.svbtle.com/
Origin
https://int0xcc.svbtle.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date
Tue, 08 Nov 2022 22:59:51 GMT
server
nginx
etag
"f9e85be3f0c8dcdcbd6f0a8471a46280ab7bf664"
content-type
application/font-woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
content-length
18504
l
use.typekit.net/af/4ba64f/00000000000000003b9ad1ba/27/ 		19 KB
19 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://use.typekit.net/af/4ba64f/00000000000000003b9ad1ba/27/l?subset_id=2&fvd=i4&v=3
Requested by
Host: int0xcc.svbtle.com
URL: https://int0xcc.svbtle.com/dissecting-emotet-s-network-communication-protocol
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:3500:16::215:14a0 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
nginx /
Resource Hash
6d52e211ba98d5b5348088d0a9a42b3bc015f6f4ab8bee236f702cd09ba72b9d

Request headers

Referer
https://int0xcc.svbtle.com/
Origin
https://int0xcc.svbtle.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date
Tue, 08 Nov 2022 22:59:51 GMT
server
nginx
etag
"8887aa07a5e31ddeba60d1317cef52532c1e4862"
content-type
application/font-woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
content-length
19188
l
use.typekit.net/af/3333ef/00000000000000003b9ad1b5/27/ 		18 KB
18 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://use.typekit.net/af/3333ef/00000000000000003b9ad1b5/27/l?subset_id=2&fvd=n3&v=3
Requested by
Host: int0xcc.svbtle.com
URL: https://int0xcc.svbtle.com/dissecting-emotet-s-network-communication-protocol
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:3500:16::215:14a0 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
nginx /
Resource Hash
75993a0da3a07c0a849c4a41cba9cb2e9889d3aaed349d8025d4bb0a1869964f

Request headers

Referer
https://int0xcc.svbtle.com/
Origin
https://int0xcc.svbtle.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date
Tue, 08 Nov 2022 22:59:51 GMT
server
nginx
etag
"53497a4c5bfe1988b36f82f4d92f806e8f60ed2a"
content-type
application/font-woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
content-length
18468
l
use.typekit.net/af/1709eb/000000000000000000010b60/27/ 		15 KB
16 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://use.typekit.net/af/1709eb/000000000000000000010b60/27/l?subset_id=2&fvd=n7&v=3
Requested by
Host: int0xcc.svbtle.com
URL: https://int0xcc.svbtle.com/dissecting-emotet-s-network-communication-protocol
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:3500:16::215:14a0 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
nginx /
Resource Hash
1367aa73def235dc0f4bbf7a81270334e1d556ee29ad6ea227985d22f55f1893

Request headers

Referer
https://int0xcc.svbtle.com/
Origin
https://int0xcc.svbtle.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date
Tue, 08 Nov 2022 22:59:51 GMT
server
nginx
etag
"fee371a77fb742f93febf06f694b5cca50f4bf98"
content-type
application/font-woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
content-length
15816
l
use.typekit.net/af/3e9574/000000000000000000010b62/27/ 		15 KB
15 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://use.typekit.net/af/3e9574/000000000000000000010b62/27/l?subset_id=2&fvd=n9&v=3
Requested by
Host: int0xcc.svbtle.com
URL: https://int0xcc.svbtle.com/dissecting-emotet-s-network-communication-protocol
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:3500:16::215:14a0 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
nginx /
Resource Hash
30c83da6aac90637c47b07fec96c516a7196e2fd26adf73401bc7076d9d8c4d6

Request headers

Referer
https://int0xcc.svbtle.com/
Origin
https://int0xcc.svbtle.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date
Tue, 08 Nov 2022 22:59:51 GMT
server
nginx
etag
"03a04f1afb39c904d345a4f0c99248d985d54531"
content-type
application/font-woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
content-length
15056
status
www.facebook.com/x/oauth/ 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://www.facebook.com/x/oauth/status?client_id=346346195413177&input_token&origin=1&redirect_uri=https%3A%2F%2Fint0xcc.svbtle.com%2Fdissecting-emotet-s-network-communication-protocol&sdk=joey&wants_cookie_data=true
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/sdk.js?hash=3cc420a903fdf1528ee7b67fc86d1fdc
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f12d:83:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://int0xcc.svbtle.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
date
Tue, 08 Nov 2022 22:59:51 GMT
x-content-type-options
nosniff
document-policy
force-load-at-top
content-security-policy-report-only
default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self' connect.facebook.net;style-src fonts.googleapis.com *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com;font-src data: *.gstatic.com *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com *.tenor.co media.tenor.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net *.giphy.com connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: googleads.g.doubleclick.net www.googleadservices.com *.whatsapp.net *.fb.com *.oculuscdn.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com https://*.giphy.com data:;frame-src *.doubleclick.net *.google.com *.facebook.com www.googleadservices.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com;worker-src blob: *.facebook.com data:;report-uri https://www.facebook.com/csp/reporting/?minimize=0;
alt-svc
h3=":443"; ma=86400
content-length
0
x-fb-rlafr
0
pragma
no-cache
x-fb-debug
EA+k2QQB+JdJoaVhyF7833ypAcU/S8Y0JxnERbvcBnyE4Qs5Y9RI8bjY2ahgw0epFKpaYcTowTJ0v+FUeg/Xuw==
fb-s
unknown
report-to
{"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://int0xcc.svbtle.com
access-control-expose-headers
fb-s
cache-control
private, no-cache, no-store, must-revalidate
access-control-allow-credentials
true
priority
u=3,i
expires
Sat, 01 Jan 2000 00:00:00 GMT
p.gif
p.typekit.net/ 		35 B
228 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://p.typekit.net/p.gif?s=1&k=tze3uwp&ht=tk&h=int0xcc.svbtle.com&f=139.171.173.175.176.5474.13454.13462&a=6834&js=1.21.0&app=typekit&e=js&_=1667948391444
Requested by
Host: int0xcc.svbtle.com
URL: https://int0xcc.svbtle.com/dissecting-emotet-s-network-communication-protocol
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:3500:16::215:1495 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
nginx /
Resource Hash
9b9265c69a5cc295d1ab0d04e0273b3677db1a6216ce2ccf4efc8c277ed84b39

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://int0xcc.svbtle.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

unused62
8096267
date
Tue, 08 Nov 2022 22:59:51 GMT
last-modified
Sat, 09 Oct 2021 02:10:03 GMT
server
nginx
etag
"6160f9fb-23"
content-type
image/gif
access-control-allow-origin
*
cache-control
public, max-age=604800
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
content-length
35
button.d2f864f87f544dc0c11d7d712a191c1f.js
platform.twitter.com/js/ 		7 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://platform.twitter.com/js/button.d2f864f87f544dc0c11d7d712a191c1f.js
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (amb/6B99) /
Resource Hash
236dca679b9983d1fbea0415d584b17d80f1c6942506fc508a5384db924e8795

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://int0xcc.svbtle.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

Date
Tue, 08 Nov 2022 22:59:51 GMT
Content-Encoding
gzip
Age
520736
X-Cache
HIT
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server-Timing
x-cache;desc= HIT,x-tw-cdn;desc=VZ,edge;dur=1
Content-Length
2362
Last-Modified
Wed, 02 Nov 2022 19:36:52 GMT
Server
ECS (amb/6B99)
Etag
"7bb2d17ac20be3bd6ec1079356afecd9+gzip"
Vary
Accept-Encoding
Access-Control-Allow-Methods
GET
Content-Type
application/javascript; charset=utf-8
Access-Control-Allow-Origin
*
x-tw-cdn
VZ
Cache-Control
public, max-age=315360000
tweet_button.644279d1635fd969e87af94a98bd232b.en.html
platform.twitter.com/widgets/ Frame 8CCF 		37 KB
14 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://platform.twitter.com/widgets/tweet_button.644279d1635fd969e87af94a98bd232b.en.html
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (amb/6B99) /
Resource Hash
e44458c2c9acea446178d73575b53255ee7ba669c33cb20cfea94b90908f921d

Request headers

Referer
https://int0xcc.svbtle.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Access-Control-Allow-Methods
GET
Access-Control-Allow-Origin
*
Age
520735
Cache-Control
public, max-age=315360000
Content-Encoding
gzip
Content-Length
13753
Content-Type
text/html; charset=utf-8
Date
Tue, 08 Nov 2022 22:59:51 GMT
Etag
"126ffb93f08e989b18a6e1fc082c9e33+gzip"
Last-Modified
Wed, 02 Nov 2022 19:36:56 GMT
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server
ECS (amb/6B99)
Server-Timing
x-cache;desc= HIT,x-tw-cdn;desc=VZ,edge;dur=1
Vary
Accept-Encoding
X-Cache
HIT
x-tw-cdn
VZ
embeds
syndication.twitter.com/i/jot/ 		43 B
104 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://syndication.twitter.com/i/jot/embeds?l=%7B%22widget_origin%22%3A%22https%3A%2F%2Fint0xcc.svbtle.com%2Fdissecting-emotet-s-network-communication-protocol%22%2C%22widget_frame%22%3Afalse%2C%22widget_site_screen_name%22%3A%22svbtle%22%2C%22widget_creator_screen_name%22%3A%22raashidbhatt%22%2C%22language%22%3A%22en%22%2C%22message%22%3A%22m%3Anocount%3A%22%2C%22context%22%3A%22rufous-eol%22%2C%22_category_%22%3A%22tfw_client_event%22%2C%22triggered_on%22%3A1667948391518%2C%22dnt%22%3Afalse%2C%22client_version%22%3A%22a3525f077c700%3A1667415560940%22%2C%22format_version%22%3A1%2C%22event_namespace%22%3A%7B%22client%22%3A%22tfw%22%2C%22page%22%3A%22button%22%2C%22section%22%3A%22share%22%2C%22action%22%3A%22impression%22%7D%7D&session_id=1852b0b87d322d7a80f7e06f3a923bbdfd4ef4b0
Requested by
Host: int0xcc.svbtle.com
URL: https://int0xcc.svbtle.com/dissecting-emotet-s-network-communication-protocol
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.200 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=631138519

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://int0xcc.svbtle.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

x-response-time
106
date
Tue, 08 Nov 2022 22:59:50 GMT
strict-transport-security
max-age=631138519
last-modified
Tue, 08 Nov 2022 22:59:51 GMT
server
tsa_o
vary
Origin
content-type
image/gif
x-transaction-id
3063e5e11b313dab
cache-control
must-revalidate, max-age=600
perf
7626143928
x-connection-hash
900fb9cfdb4668e3d0098e48a2c2977c88a8d7383d39ad3560a25fb3ea3ed146
content-length
43
truncated
/ Frame 8CCF 		822 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
bed57a09b10b5cfc83c33f5bc6205831a9db085c874bc72d096d05ad2136e4b4

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

Content-Type
image/svg+xml
share_button.php
www.facebook.com/v3.0/plugins/ Frame FF06 		43 KB
13 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.facebook.com/v3.0/plugins/share_button.php?app_id=346346195413177&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df3407a6484a1fa%26domain%3Dint0xcc.svbtle.com%26is_canvas%3Dfalse%26origin%3Dhttps%253A%252F%252Fint0xcc.svbtle.com%252Ff6ffc032664c4c%26relation%3Dparent.parent&container_width=600&href=https%3A%2F%2Fint0xcc.svbtle.com%2Fdissecting-emotet-s-network-communication-protocol&layout=button_count&locale=en_US&sdk=joey
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/sdk.js?hash=3cc420a903fdf1528ee7b67fc86d1fdc
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a03:2880:f12d:83:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
3e10393b90aa59fa33cfa150082022cca42c590f7845d3fd75e5c91702541668
Security Headers
Name Value
Content-Security-Policy default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self' connect.facebook.net;style-src fonts.googleapis.com *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com;font-src data: *.gstatic.com *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com *.tenor.co media.tenor.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net *.giphy.com connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: googleads.g.doubleclick.net www.googleadservices.com *.whatsapp.net *.fb.com *.oculuscdn.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com https://*.giphy.com data:;frame-src *.doubleclick.net *.google.com *.facebook.com www.googleadservices.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://int0xcc.svbtle.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400
cache-control
private, no-cache, no-store, must-revalidate
content-encoding
br
content-security-policy
default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self' connect.facebook.net;style-src fonts.googleapis.com *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com;font-src data: *.gstatic.com *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com *.tenor.co media.tenor.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net *.giphy.com connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: googleads.g.doubleclick.net www.googleadservices.com *.whatsapp.net *.fb.com *.oculuscdn.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com https://*.giphy.com data:;frame-src *.doubleclick.net *.google.com *.facebook.com www.googleadservices.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
content-security-policy-report-only
default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self' connect.facebook.net;style-src fonts.googleapis.com *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com;font-src data: *.gstatic.com *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com *.tenor.co media.tenor.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net *.giphy.com connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: googleads.g.doubleclick.net www.googleadservices.com *.whatsapp.net *.fb.com *.oculuscdn.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com https://*.giphy.com data:;frame-src *.doubleclick.net *.google.com *.facebook.com www.googleadservices.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com;worker-src blob: *.facebook.com data:;report-uri https://www.facebook.com/csp/reporting/?minimize=0;
content-type
text/html; charset="utf-8"
cross-origin-opener-policy
same-origin-allow-popups
cross-origin-resource-policy
cross-origin
date
Tue, 08 Nov 2022 22:59:51 GMT
document-policy
force-load-at-top
expires
Sat, 01 Jan 2000 00:00:00 GMT
facebook-api-version
v8.0
pragma
no-cache
priority
u=3,i
report-to
{"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}
strict-transport-security
max-age=15552000; preload
vary
Accept-Encoding
x-content-type-options
nosniff
x-fb-debug
WZ24/Q5td/o6KAGPcXRLDn3VvAujIfnyk96IjE8FAbMTEH960eCbVnbPHY9UnltxCirTOB1ltIQJFTrk5+5QBQ==
x-fb-rlafr
0
x-xss-protection
0
GzgedhmzSQa.png
static.xx.fbcdn.net/rsrc.php/v3/yn/r/ Frame FF06 		272 B
493 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://static.xx.fbcdn.net/rsrc.php/v3/yn/r/GzgedhmzSQa.png
Requested by
Host: www.facebook.com
URL: https://www.facebook.com/v3.0/plugins/share_button.php?app_id=346346195413177&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df3407a6484a1fa%26domain%3Dint0xcc.svbtle.com%26is_canvas%3Dfalse%26origin%3Dhttps%253A%252F%252Fint0xcc.svbtle.com%252Ff6ffc032664c4c%26relation%3Dparent.parent&container_width=600&href=https%3A%2F%2Fint0xcc.svbtle.com%2Fdissecting-emotet-s-network-communication-protocol&layout=button_count&locale=en_US&sdk=joey
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
0187fed1f15750c2fa9e427912bb64d209aad8b47ee4fa9576f6666b68188d36
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.facebook.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date
Tue, 08 Nov 2022 22:59:51 GMT
x-content-type-options
nosniff
content-md5
lIjeC3eJAboxVqIOEs/Auw==
document-policy
force-load-at-top
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
272
x-fb-rlafr
0
x-fb-debug
5KHwTYluzoVrHoAhmrDtO4MUyWDJNU60dxRv/fN1Atf1saToxTlcQrTaZl9CEP49pR48e9j8HmRZbSl+ckiLZA==
x-fb-trip-id
686109401
last-modified
Mon, 01 Jan 2001 08:00:00 GMT
content-type
image/png
access-control-allow-origin
*
cache-control
public,max-age=31536000,immutable
timing-allow-origin
*
expires
Fri, 03 Nov 2023 01:26:30 GMT
oXHrDM8F3cg.js
static.xx.fbcdn.net/rsrc.php/v3iEpO4/yh/l/en_US/ Frame FF06 		541 KB
141 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.xx.fbcdn.net/rsrc.php/v3iEpO4/yh/l/en_US/oXHrDM8F3cg.js?_nc_x=Ij3Wp8lg5Kz
Requested by
Host: www.facebook.com
URL: https://www.facebook.com/v3.0/plugins/share_button.php?app_id=346346195413177&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df3407a6484a1fa%26domain%3Dint0xcc.svbtle.com%26is_canvas%3Dfalse%26origin%3Dhttps%253A%252F%252Fint0xcc.svbtle.com%252Ff6ffc032664c4c%26relation%3Dparent.parent&container_width=600&href=https%3A%2F%2Fint0xcc.svbtle.com%2Fdissecting-emotet-s-network-communication-protocol&layout=button_count&locale=en_US&sdk=joey
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
485c99d30b63444a64036c3e492076d6880e12841d3b349aed3654de63c35396
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.facebook.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date
Tue, 08 Nov 2022 22:59:51 GMT
content-encoding
br
x-content-type-options
nosniff
content-md5
f5cYT8IO2jIXHyDnkO7ayA==
document-policy
force-load-at-top
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
143919
x-fb-rlafr
0
x-fb-debug
eQQtfHI5AdvqdFsQs+GJvE5F4gYa4nOxnuKnYGgIpT7m6RVta2YqGzRk7oIHJnIvMnSm8ILl19N6GvrzDOl9Pw==
x-fb-trip-id
686109401
last-modified
Mon, 01 Jan 2001 08:00:00 GMT
vary
Accept-Encoding
content-type
application/x-javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public,max-age=31536000,immutable
timing-allow-origin
*
expires
Wed, 08 Nov 2023 15:02:52 GMT

Verdicts & Comments Add Verdict or Comment

54 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 object| 3 object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation function| $ function| jQuery function| Spinner function| delay function| startApplication function| startMenu boolean| isActive function| startCode function| startTweets function| updateKudos function| getKudos function| makeBigParagraph function| checkMessages function| bleedImages function| getImageWidth function| bootstrapKudo function| fireKudo function| sizeUp function| checkImages function| setupImages function| subscribeSuccess function| subscribeCheck function| startBlog function| retinajs object| Turbolinks string| GoogleAnalyticsObject function| ga function| fbAsyncInit function| saveError function| saveSuccess object| google_tag_data object| gaplugins object| gaGlobal object| gaData object| __twttrll object| twttr object| __twttr object| hljs object| FB object| Typekit object| __buffer

4 Cookies

Domain/Path Name / Value
.int0xcc.svbtle.com/ Name: _ga
Value: GA1.3.946803149.1667948391
.int0xcc.svbtle.com/ Name: _gid
Value: GA1.3.285961440.1667948391
.int0xcc.svbtle.com/ Name: _gat
Value: 1
int0xcc.svbtle.com/ Name: svbusr
Value: 892d90f6dc6eb66cbd724313e7a46a35

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=0; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

connect.facebook.net
int0xcc.svbtle.com
lightning.svbtle.com
p.typekit.net
platform.twitter.com
static.xx.fbcdn.net
svbtleusercontent.com
syndication.twitter.com
use.typekit.net
www.facebook.com
www.google-analytics.com
104.244.42.200
13.226.153.52
2606:2800:234:59:254c:406:2366:268c
2a00:1450:4001:812::200e
2a02:26f0:3500:16::215:1495
2a02:26f0:3500:16::215:14a0
2a03:2880:f01c:8012:face:b00c:0:3
2a03:2880:f12d:83:face:b00c:0:25de
50.17.209.185
52.222.214.70
0187fed1f15750c2fa9e427912bb64d209aad8b47ee4fa9576f6666b68188d36
0196eb0d526f60d660cd65f5e47a29b199c2939c0e0e7ff2e7ec3433137856d0
0281321b37efdec888d73c6aeaac70f119d82ddafbe03cf6a1f70fe30eb80f46
034e924c1ea164d8e9dc0c9ad9a172337cd274703825fd9d851dde73e4d140ec
07d619f8e4a6e5f070c69fc72e2b42edb4c329b4c3adaf83d7e2aac82ffd39f3
0dc4081aecd7601360569056e7f5f388deee95681f40dba35faa4ccece710bd8
1367aa73def235dc0f4bbf7a81270334e1d556ee29ad6ea227985d22f55f1893
236dca679b9983d1fbea0415d584b17d80f1c6942506fc508a5384db924e8795
30c83da6aac90637c47b07fec96c516a7196e2fd26adf73401bc7076d9d8c4d6
38d8b14f7a64c4558716c9183f3e93e5e17b033e49ccd1ad2b0794e3f9db5b49
3b361d49881277ab3b92b0d7edc9f781f8f8ccb6738487b927140fee462aec1d
3e10393b90aa59fa33cfa150082022cca42c590f7845d3fd75e5c91702541668
459712d283e50875f4758eb089d4895144655781557b093789b6d7f867da7f32
485c99d30b63444a64036c3e492076d6880e12841d3b349aed3654de63c35396
5f080b135ed6ddadfa74d5993743b056b80051650a8465247d1e21e9749aa3ee
66c1aff8564f0c727747c0a2f1ac6f5a215100fb599807bacecf6b23b1a6a975
6cab047139dcd2c52eb659bab737a3873bcf3e81c79b914096da9e653a58964a
6d52e211ba98d5b5348088d0a9a42b3bc015f6f4ab8bee236f702cd09ba72b9d
75993a0da3a07c0a849c4a41cba9cb2e9889d3aaed349d8025d4bb0a1869964f
8150c9b2dfd516c40d330f40246f0d0eacfea4094278169cc1ce6b1b1aadbf67
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
8c0531412c543b9bd978e29acb8f5cf330db9891115d1e9924519d9a675b7b74
927412999f268f79632a3088174cec1bcb3f84d5c6d1ac27457d15eb6b12d7e5
9334579d51fd53359f710896507b652ca222ec39bf505cc18c63b7307e1b1011
95aa416e20e326bfe2030cf9de3d0b9dbb62efcd1cd614e95fdac11eda90edc7
9b9265c69a5cc295d1ab0d04e0273b3677db1a6216ce2ccf4efc8c277ed84b39
a048e640908046be06e00eab37742b5d5ff80964af58cfd22f7cb2de4dfe375f
a5a11cafb0ef16f132405003f2666375b0f1afd487ef3c648257e93122df0699
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
b42e4a056cb5b80c5a315040826866445ec9332f0749e184509ab2d9d3b86719
bed57a09b10b5cfc83c33f5bc6205831a9db085c874bc72d096d05ad2136e4b4
c02444f391e8655e79ff8d7d4cb69c3426c3bffbf8731a994fa23aed0f641d12
dee4f86f26516f259814435168f8f5d4404058be291a719c1a422d057b06eb6e
e0ed483bba0a14e9fe3b33939500515282721fedb70a8ebad014233c02df57c2
e284f18e9568826e86d562ae539f5ca8f8c34eaf77df368bbf97b3355e86821f
e44458c2c9acea446178d73575b53255ee7ba669c33cb20cfea94b90908f921d
ea114f7ac8b7e526ba56798ab9cd199b3d4d285033e281de385557cee484461d
ee5ece28f0c849619336fbe2684026382cac2fd13b926e0a9402a22c8d440de3
f1c1ae1a41ae40e40b10aa9c031ae6850548fe43a736725051753aa6c411668d
f48f0342d55593277d933322745db675346f9978d615102e4782c9403101dd81
f7b58988d09f8f945f4968a8e70783e7c70f221a2d8de3d8f222e80fe0c88d95