unit42.elegance.work Open in urlscan Pro
173.236.35.250 Public Scan

Go To Rescan
Add Verdict Report

URL:
http://unit42.elegance.work/the-gopher-in-the-room-analysis-of-golang-malware-in-the-wild/
Submission: On July 10 via manual (July 10th 2019, 2:22:46 pm UTC) from US

Summary HTTP 50 Redirects Links 52 Behaviour Indicators

Summary

This website contacted 11 IPs in 6 countries across 11 domains to perform 50 HTTP transactions. The main IP is 173.236.35.250, located in Chicago, United States and belongs to SINGLEHOP-LLC - SingleHop LLC, US. The main domain is unit42.elegance.work.

This is the only time unit42.elegance.work was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
31	173.236.35.250 173.236.35.250	32475 (SINGLEHOP...) (SINGLEHOP-LLC - SingleHop LLC)
3	104.111.217.111 104.111.217.111	16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies)
3	2a02:26f0:6c0... 2a02:26f0:6c00:29e::c3a	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1 2	104.103.100.157 104.103.100.157	16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies)
1 3	2a00:1450:400... 2a00:1450:4001:81c::2004	15169 (GOOGLE) (GOOGLE - Google LLC)
1 3	52.212.6.126 52.212.6.126	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
1 2	2a00:1450:400... 2a00:1450:4001:81e::200e	15169 (GOOGLE) (GOOGLE - Google LLC)
1 1	2a00:1450:400... 2a00:1450:400c:c06::9c	15169 (GOOGLE) (GOOGLE - Google LLC)
1	2a00:1450:400... 2a00:1450:4001:808::2003	15169 (GOOGLE) (GOOGLE - Google LLC)
2	66.117.29.224 66.117.29.224	15224 (OMNITURE) (OMNITURE - Adobe Systems Inc.)
1	2a00:1450:400... 2a00:1450:4001:817::2003	15169 (GOOGLE) (GOOGLE - Google LLC)
50	11

31 173.236.35.250 (Chicago, United States)

ASN32475 (SINGLEHOP-LLC - SingleHop LLC, US)
PTR: node03.tmddedicated980.com

unit42.elegance.work	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 104.111.217.111 (Netherlands)

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a104-111-217-111.deploy.static.akamaitechnologies.com

assets.adobedtm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a02:26f0:6c00:29e::c3a (Ascension Island)

ASN20940 (AKAMAI-ASN1, US)

www.paloaltonetworks.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.103.100.157 (Netherlands) 1 redirects

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a104-103-100-157.deploy.static.akamaitechnologies.com

researchcenter.paloaltonetworks.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
blog.paloaltonetworks.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:81c::2004 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE - Google LLC, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 52.212.6.126 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-52-212-6-126.eu-west-1.compute.amazonaws.com

dpm.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:81e::200e (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE - Google LLC, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c06::9c (Brussels, Belgium) 1 redirects

ASN15169 (GOOGLE - Google LLC, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:808::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 66.117.29.224 (United States)

ASN15224 (OMNITURE - Adobe Systems Inc., US)

paloaltonetworks.d1.sc.omtrdc.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:817::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
31	elegance.work unit42.elegance.work	817 KB
5	paloaltonetworks.com 1 redirects www.paloaltonetworks.com researchcenter.paloaltonetworks.com blog.paloaltonetworks.com	7 KB
3	demdex.net 1 redirects dpm.demdex.net	2 KB
3	google.com 1 redirects www.google.com	2 KB
3	adobedtm.com assets.adobedtm.com	90 KB
2	omtrdc.net paloaltonetworks.d1.sc.omtrdc.net	1 KB
2	google-analytics.com 1 redirects www.google-analytics.com	17 KB
1	gstatic.com www.gstatic.com	92 KB
1	google.de www.google.de	374 B
1	doubleclick.net 1 redirects stats.g.doubleclick.net	351 B
0	clearbit.com Failed reveal.clearbit.com Failed
50	11

	Domain	Requested by
31	unit42.elegance.work	unit42.elegance.work
3	dpm.demdex.net	1 redirects unit42.elegance.work
3	www.google.com	1 redirects unit42.elegance.work
3	www.paloaltonetworks.com	unit42.elegance.work
3	assets.adobedtm.com	unit42.elegance.work assets.adobedtm.com
2	paloaltonetworks.d1.sc.omtrdc.net	assets.adobedtm.com unit42.elegance.work
2	www.google-analytics.com	1 redirects unit42.elegance.work
1	www.gstatic.com	www.google.com
1	www.google.de	unit42.elegance.work
1	stats.g.doubleclick.net	1 redirects
1	blog.paloaltonetworks.com	unit42.elegance.work
1	researchcenter.paloaltonetworks.com	1 redirects
0	reveal.clearbit.com Failed	unit42.elegance.work
50	13

This site contains links to these domains. Also see Links.

Domain
www.paloaltonetworks.com
pan-unit42.github.io
www.facebook.com
twitter.com
www.linkedin.com
www.reddit.com
github.com
www.pyinstaller.org
www.virustotal.com
blog.malwarebytes.com
www.trendmicro.com
www.fortinet.com
www.virusradar.com
www.anomali.com
ar.norton.com
www.guardicore.com
www.bleepingcomputer.com
id-ransomware.blogspot.com
www.welivesecurity.com
sensorstechforum.com
securingtomorrow.mcafee.com
blog.talosintelligence.com
researchcenter.paloaltonetworks.com
docs.paloaltonetworks.com
start.paloaltonetworks.com

Subject Issuer	Validity	Valid
	`1970-01-01` - `1970-01-01`	a few seconds	crt.sh
*.paloaltonetworks.com DigiCert SHA2 Secure Server CA	`2018-05-12` - `2019-11-10`	a year	crt.sh
www.google.com Google Internet Authority G3	`2019-06-18` - `2019-09-10`	3 months	crt.sh
*.google-analytics.com Google Internet Authority G3	`2019-06-18` - `2019-09-10`	3 months	crt.sh
www.google.de Google Internet Authority G3	`2019-06-18` - `2019-09-10`	3 months	crt.sh
*.google.com Google Internet Authority G3	`2019-06-18` - `2019-09-10`	3 months	crt.sh

This page contains 1 frames:

Primary Page: http://unit42.elegance.work/the-gopher-in-the-room-analysis-of-golang-malware-in-the-wild/
Frame ID: 1E9560DF180073FC54C088AB7CEE8E57
Requests: 50 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
headers link /rel="https:\/\/api\.w\.org\/"/i
html /<!-- This site is optimized with the Yoast (?:WordPress )?SEO plugin v([\d.]+) -/i

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
headers link /rel="https:\/\/api\.w\.org\/"/i
html /<!-- This site is optimized with the Yoast (?:WordPress )?SEO plugin v([\d.]+) -/i

MySQL (Databases) Expand

Overall confidence: 100%
Detected patterns

html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
headers link /rel="https:\/\/api\.w\.org\/"/i
html /<!-- This site is optimized with the Yoast (?:WordPress )?SEO plugin v([\d.]+) -/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i

Yoast SEO (SEO) Expand

Overall confidence: 100%
Detected patterns

html /<!-- This site is optimized with the Yoast (?:WordPress )?SEO plugin v([\d.]+) -/i

Page Statistics

50
Requests

18 %
HTTPS

55 %
IPv6

11
Domains

13
Subdomains

11
IPs

6
Countries

1027 kB
Transfer

1470 kB
Size

0
Cookies

52 Outgoing links

These are links going to different origins than the main page.

URL: https://www.paloaltonetworks.com/

Search URL Search Domain Scan URL

URL: https://pan-unit42.github.io/playbook_viewer/
Title: Playbooks

Search URL Search Domain Scan URL

URL: https://www.facebook.com/sharer/sharer.php?u=http%3A%2F%2Funit42.elegance.work%2Fthe-gopher-in-the-room-analysis-of-golang-malware-in-the-wild%2F

Search URL Search Domain Scan URL

URL: https://twitter.com/home?status=http%3A%2F%2Funit42.elegance.work%2Fthe-gopher-in-the-room-analysis-of-golang-malware-in-the-wild%2F+-+The+Gopher+in+the+Room%3A+Analysis+of+GoLang+Malware+in+the+Wild

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/shareArticle?mini=true&url=http%3A%2F%2Funit42.elegance.work%2Fthe-gopher-in-the-room-analysis-of-golang-malware-in-the-wild%2F&title=The+Gopher+in+the+Room%3A+Analysis+of+GoLang+Malware+in+the+Wild&summary=&source=

Search URL Search Domain Scan URL

URL: http://www.reddit.com/submit?url=http://unit42.elegance.work/the-gopher-in-the-room-analysis-of-golang-malware-in-the-wild/

Search URL Search Domain Scan URL

URL: https://github.com/Veil-Framework/Veil
Title: Veil

Search URL Search Domain Scan URL

URL: https://github.com/SaturnsVoid/GoBot2/
Title: GoBot2

Search URL Search Domain Scan URL

URL: https://github.com/EgeBalci/HERCULES
Title: HERCULES

Search URL Search Domain Scan URL

URL: https://www.pyinstaller.org/
Title: PyInstaller

Search URL Search Domain Scan URL

URL: https://www.virustotal.com/
Title: VirusTotal

Search URL Search Domain Scan URL

URL: https://github.com/tiagorlampert/CHAOS
Title: CHAOS

Search URL Search Domain Scan URL

URL: https://blog.malwarebytes.com/threat-analysis/2019/01/analyzing-new-stealer-written-golang/
Title: Infostealer

Search URL Search Domain Scan URL

URL: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/troj_tinba.fbbaj
Title: TinyBanker

Search URL Search Domain Scan URL

URL: https://www.fortinet.com/blog/threat-research/new-stealth-worker-campaign-creates-a-multi-platform-army-of-bru.html
Title: GoBrut

Search URL Search Domain Scan URL

URL: https://www.virusradar.com/en/Win32_Neshta.A/description
Title: Neshta

Search URL Search Domain Scan URL

URL: https://github.com/EgeBalci/ARCANUS
Title: ARCANUS

Search URL Search Domain Scan URL

URL: https://twitter.com/michalmalik/status/885283284791562242
Title: Gandalf Botnet

Search URL Search Domain Scan URL

URL: https://github.com/lesnuages/hershell/
Title: hershell

Search URL Search Domain Scan URL

URL: https://www.anomali.com/blog/rocke-evolves-its-arsenal-with-a-new-malware-family-written-in-golan
Title: rocke

Search URL Search Domain Scan URL

URL: https://ar.norton.com/security_response/writeup.jsp?docid=2018-021208-2435-99&tabid=2
Title: ShurL0ckr

Search URL Search Domain Scan URL

URL: https://github.com/abnarain/malware_detection/blob/3cf6fc9e0e72a6757a5a1e2e7c7f054efcb7e044/mirai_report/debug_codes/server_mirai/Mirai-Source-Code/
Title: Mirai

Search URL Search Domain Scan URL

URL: https://github.com/Ne0nd0g/merlin
Title: merlin

Search URL Search Domain Scan URL

URL: https://github.com/EgeBalci/EGESPLOIT
Title: EGESPLOIT

Search URL Search Domain Scan URL

URL: https://github.com/mauri870/ransomware
Title: Mauri870 Ransomware Family

Search URL Search Domain Scan URL

URL: https://github.com/gen0cide/gscript
Title: gscript

Search URL Search Domain Scan URL

URL: https://www.guardicore.com/2018/06/operation-prowli-traffic-manipulation-cryptocurrency-mining/
Title: r2r2

Search URL Search Domain Scan URL

URL: https://www.bleepingcomputer.com/news/security/a-closer-look-at-the-robbinhood-ransomware/
Title: RobbinHood

Search URL Search Domain Scan URL

URL: http://id-ransomware.blogspot.com/2016/12/braincrypt-ransomware.html
Title: braincrypt

Search URL Search Domain Scan URL

URL: https://www.welivesecurity.com/2016/12/20/new-linuxrakos-threat-devices-servers-ssh-scan/
Title: Rakos

Search URL Search Domain Scan URL

URL: https://sensorstechforum.com/remove-trumphead-ransomware/
Title: TrumpHead Ransomware

Search URL Search Domain Scan URL

URL: https://github.com/cw1997/NATBypass
Title: HTRAN

Search URL Search Domain Scan URL

URL: https://github.com/chenhao5188/YourRansom/blob/master/main.go
Title: YourRansom Ransomware

Search URL Search Domain Scan URL

URL: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/ransom_rdw.a
Title: RDW

Search URL Search Domain Scan URL

URL: https://www.bleepingcomputer.com/news/security/new-shifr-raas-lets-any-dummy-enter-the-ransomware-business/
Title: Shifr Ransomware

Search URL Search Domain Scan URL

URL: https://github.com/go-chat-bot/bot
Title: go-bot

Search URL Search Domain Scan URL

URL: https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/free-ransomware-available-dark-web/
Title: RaaS Ransomware

Search URL Search Domain Scan URL

URL: https://blog.talosintelligence.com/2018/05/telegrab.html
Title: TeleGrab

Search URL Search Domain Scan URL

URL: https://github.com/audibleblink/gorsh
Title: gorsh

Search URL Search Domain Scan URL

URL: https://github.com/pan-unit42/iocs/blob/master/golang_malware_results.csv
Title: here

Search URL Search Domain Scan URL

URL: https://www.paloaltonetworks.com/legal-notices/terms-of-use
Title: Terms of Use

Search URL Search Domain Scan URL

URL: https://www.paloaltonetworks.com/legal-notices/privacy
Title: Privacy Statement

Search URL Search Domain Scan URL

URL: https://twitter.com/Unit42_Intel

Search URL Search Domain Scan URL

URL: https://github.com/pan-unit42

Search URL Search Domain Scan URL

URL: https://www.paloaltonetworks.com/resources
Title: Resource Center

Search URL Search Domain Scan URL

URL: https://researchcenter.paloaltonetworks.com/
Title: Blog

Search URL Search Domain Scan URL

URL: https://www.paloaltonetworks.com/communities
Title: Communities

Search URL Search Domain Scan URL

URL: https://docs.paloaltonetworks.com/
Title: Tech Docs

Search URL Search Domain Scan URL

URL: https://www.paloaltonetworks.com/sitemap
Title: Sitemap

Search URL Search Domain Scan URL

URL: https://www.paloaltonetworks.com/legal
Title: Documents

Search URL Search Domain Scan URL

URL: https://start.paloaltonetworks.com/preference-center
Title: Manage Subscriptions

Search URL Search Domain Scan URL

URL: https://www.paloaltonetworks.com/security-disclosure
Title: Report a Vulnerability

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 19

https://researchcenter.paloaltonetworks.com/wp-content/plugins/google-analyticator/external-tracking.min.js?ver=6.4.9 HTTP 301
https://blog.paloaltonetworks.com/wp-content/plugins/google-analyticator/external-tracking.min.js?ver=6.4.9

Request Chain 30

http://dpm.demdex.net/id?d_visid_ver=3.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=9A531C8B532965080A490D4D%40AdobeOrg&d_nsid=0&ts=1562768536753 HTTP 302
http://dpm.demdex.net/id/rd?d_visid_ver=3.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=9A531C8B532965080A490D4D%40AdobeOrg&d_nsid=0&ts=1562768536753

Request Chain 31

http://www.google-analytics.com/ga.js HTTP 307
https://www.google-analytics.com/ga.js

Request Chain 39

http://www.google-analytics.com/r/__utm.gif?utmwv=5.7.2&utms=1&utmn=1078496320&utmhn=unit42.elegance.work&utmcs=UTF-8&utmsr=1600x1200&utmvp=1585x1185&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=The%20Gopher%20in%20the%20Room%3A%20Analysis%20of%20GoLang%20Malware%20in%20the%20Wild&utmhid=97311949&utmr=-&utmp=%2Fthe-gopher-in-the-room-analysis-of-golang-malware-in-the-wild%2F&utmht=1562768536820&utmac=UA-494959-2&utmcc=__utma%3D37867111.1808016770.1562768537.1562768537.1562768537.1%3B%2B__utmz%3D37867111.1562768537.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=1704284424&utmredir=1&utmu=qhCgAAAAAAAAAAAAAAAAAAAE~ HTTP 307
https://www.google-analytics.com/r/__utm.gif?utmwv=5.7.2&utms=1&utmn=1078496320&utmhn=unit42.elegance.work&utmcs=UTF-8&utmsr=1600x1200&utmvp=1585x1185&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=The%20Gopher%20in%20the%20Room%3A%20Analysis%20of%20GoLang%20Malware%20in%20the%20Wild&utmhid=97311949&utmr=-&utmp=%2Fthe-gopher-in-the-room-analysis-of-golang-malware-in-the-wild%2F&utmht=1562768536820&utmac=UA-494959-2&utmcc=__utma%3D37867111.1808016770.1562768537.1562768537.1562768537.1%3B%2B__utmz%3D37867111.1562768537.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=1704284424&utmredir=1&utmu=qhCgAAAAAAAAAAAAAAAAAAAE~ HTTP 302
https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-494959-2&cid=1808016770.1562768537&jid=1704284424&_v=5.7.2&z=1078496320 HTTP 302
https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-494959-2&cid=1808016770.1562768537&jid=1704284424&_v=5.7.2&z=1078496320 HTTP 302
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-494959-2&cid=1808016770.1562768537&jid=1704284424&_v=5.7.2&z=1078496320&slf_rd=1&random=1717549495

50 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request Cookie set / Show response
unit42.elegance.work/the-gopher-in-the-room-analysis-of-golang-malware-in-the-wild/ 70 KB
70 KB 3696ms
433ms Document
text/html 173.236.35.250
SingleHop LLC

General

Check archive.org

Show headers Download Go to

Full URL: http://unit42.elegance.work/the-gopher-in-the-room-analysis-of-golang-malware-in-the-wild/
Protocol: HTTP/1.1
Server: 173.236.35.250 Chicago, United States, ASN32475 (SINGLEHOP-LLC - SingleHop LLC, US),
Reverse DNS: node03.tmddedicated980.com
Software: Apache / PHP/7.2.10
Resource Hash: d7fa4058d9e6a1174dff0ac83996bea8706772f0d2e2eeddb31b72e7a65a16ef

Request headers

Host: unit42.elegance.work
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 10 Jul 2019 14:22:43 GMT
Server: Apache
X-Powered-By: PHP/7.2.10
Link: <http://unit42.elegance.work/wp-json/>; rel="https://api.w.org/", <http://unit42.elegance.work/?p=97266>; rel=shortlink
Set-Cookie: pvc_visits[0]=1562854963b97266; expires=Thu, 11-Jul-2019 14:22:43 GMT; Max-Age=86400; path=/; HttpOnly
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK crayon.min.css
unit42.elegance.work/wp-content/plugins/crayon-syntax-highlighter/css/min/ 20 KB
20 KB 370ms
114ms Stylesheet
text/css 173.236.35.250
SingleHop LLC

General

Check archive.org

Show headers Download Go to

Full URL: http://unit42.elegance.work/wp-content/plugins/crayon-syntax-highlighter/css/min/crayon.min.css?ver=_2.7.2_beta
Requested by: Host: unit42.elegance.work
URL: http://unit42.elegance.work/the-gopher-in-the-room-analysis-of-golang-malware-in-the-wild/
Protocol: HTTP/1.1
Security: , ,
Server: 173.236.35.250 Chicago, United States, ASN32475 (SINGLEHOP-LLC - SingleHop LLC, US),
Reverse DNS: node03.tmddedicated980.com
Software: Apache /
Resource Hash: e3d961493e244e06bf91a9857442891e2e2ad8d49cf8e0a7781c53f0707443d7

Request headers

Referer: http://unit42.elegance.work/the-gopher-in-the-room-analysis-of-golang-malware-in-the-wild/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 10 Jul 2019 14:22:43 GMT
Last-Modified: Mon, 20 Aug 2018 10:09:13 GMT
Server: Apache
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 20172

GET
H/1.1 200
OK style.min.css
unit42.elegance.work/wp-includes/css/dist/block-library/ 29 KB
29 KB 484ms
113ms Stylesheet
text/css 173.236.35.250
SingleHop LLC

General

Check archive.org

Show headers Download Go to

Full URL: http://unit42.elegance.work/wp-includes/css/dist/block-library/style.min.css?ver=5.2.2
Requested by: Host: unit42.elegance.work
URL: http://unit42.elegance.work/the-gopher-in-the-room-analysis-of-golang-malware-in-the-wild/
Protocol: HTTP/1.1
Security: , ,
Server: 173.236.35.250 Chicago, United States, ASN32475 (SINGLEHOP-LLC - SingleHop LLC, US),
Reverse DNS: node03.tmddedicated980.com
Software: Apache /
Resource Hash: 4b8fe5c3d0e5ef7a6582185cbf5c535b5d369c8df1da98c03ed69833e55f474d

Request headers

Referer: http://unit42.elegance.work/the-gopher-in-the-room-analysis-of-golang-malware-in-the-wild/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 10 Jul 2019 14:22:44 GMT
Last-Modified: Wed, 03 Jul 2019 06:16:52 GMT
Server: Apache
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=98
Content-Length: 29295

GET
H/1.1 200
OK dashicons.min.css
unit42.elegance.work/wp-includes/css/ 46 KB
47 KB 599ms
113ms Stylesheet
text/css 173.236.35.250
SingleHop LLC

General

Check archive.org

Show headers Download Go to

Full URL: http://unit42.elegance.work/wp-includes/css/dashicons.min.css?ver=5.2.2
Requested by: Host: unit42.elegance.work
URL: http://unit42.elegance.work/the-gopher-in-the-room-analysis-of-golang-malware-in-the-wild/
Protocol: HTTP/1.1
Security: , ,
Server: 173.236.35.250 Chicago, United States, ASN32475 (SINGLEHOP-LLC - SingleHop LLC, US),
Reverse DNS: node03.tmddedicated980.com
Software: Apache /
Resource Hash: 18aa66c192cbef43a61b1398c292ae5c6c1d40d679428ee998b1c6bfaf61d75a

Request headers

Referer: http://unit42.elegance.work/the-gopher-in-the-room-analysis-of-golang-malware-in-the-wild/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 10 Jul 2019 14:22:44 GMT
Last-Modified: Wed, 03 Jul 2019 06:16:52 GMT
Server: Apache
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=97
Content-Length: 47558

GET
H/1.1 200
OK frontend.css
unit42.elegance.work/wp-content/plugins/post-views-counter/css/ 289 B
529 B 717ms
112ms Stylesheet
text/css 173.236.35.250
SingleHop LLC

General

Check archive.org

Show headers Download Go to

Full URL: http://unit42.elegance.work/wp-content/plugins/post-views-counter/css/frontend.css?ver=1.2.14
Requested by: Host: unit42.elegance.work
URL: http://unit42.elegance.work/the-gopher-in-the-room-analysis-of-golang-malware-in-the-wild/
Protocol: HTTP/1.1
Security: , ,
Server: 173.236.35.250 Chicago, United States, ASN32475 (SINGLEHOP-LLC - SingleHop LLC, US),
Reverse DNS: node03.tmddedicated980.com
Software: Apache /
Resource Hash: f46d96d805c7e9e467422dfe516c43edb4632c0273cea26722fee7ba885f869e

Request headers

Referer: http://unit42.elegance.work/the-gopher-in-the-room-analysis-of-golang-malware-in-the-wild/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 10 Jul 2019 14:22:44 GMT
Last-Modified: Wed, 03 Jul 2019 06:17:58 GMT
Server: Apache
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=96
Content-Length: 289

GET
H/1.1 200
OK svgs-attachment.css
unit42.elegance.work/wp-content/plugins/svg-support/css/ 222 B
462 B 831ms
113ms Stylesheet
text/css 173.236.35.250
SingleHop LLC

General

Check archive.org

Show headers Download Go to

Full URL: http://unit42.elegance.work/wp-content/plugins/svg-support/css/svgs-attachment.css?ver=5.2.2
Requested by: Host: unit42.elegance.work
URL: http://unit42.elegance.work/the-gopher-in-the-room-analysis-of-golang-malware-in-the-wild/
Protocol: HTTP/1.1
Security: , ,
Server: 173.236.35.250 Chicago, United States, ASN32475 (SINGLEHOP-LLC - SingleHop LLC, US),
Reverse DNS: node03.tmddedicated980.com
Software: Apache /
Resource Hash: 756df835cdc3e6d51abfaa6f2cd0d48a3430e2bcc2c12566e06dc79f3ba4ff74

Request headers

Referer: http://unit42.elegance.work/the-gopher-in-the-room-analysis-of-golang-malware-in-the-wild/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 10 Jul 2019 14:22:44 GMT
Last-Modified: Thu, 31 May 2018 09:41:29 GMT
Server: Apache
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=95
Content-Length: 222

GET
H/1.1 200
OK wpp.css
unit42.elegance.work/wp-content/plugins/wordpress-popular-posts/public/css/ 1 KB
1 KB 945ms
113ms Stylesheet
text/css 173.236.35.250
SingleHop LLC

General

Check archive.org

Show headers Download Go to

Full URL: http://unit42.elegance.work/wp-content/plugins/wordpress-popular-posts/public/css/wpp.css?ver=4.2.2
Requested by: Host: unit42.elegance.work
URL: http://unit42.elegance.work/the-gopher-in-the-room-analysis-of-golang-malware-in-the-wild/
Protocol: HTTP/1.1
Security: , ,
Server: 173.236.35.250 Chicago, United States, ASN32475 (SINGLEHOP-LLC - SingleHop LLC, US),
Reverse DNS: node03.tmddedicated980.com
Software: Apache /
Resource Hash: 951c201eceb26489dc9b4cc8ea4e408ae957410ea32b0fc7d4845d851886739f

Request headers

Referer: http://unit42.elegance.work/the-gopher-in-the-room-analysis-of-golang-malware-in-the-wild/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 10 Jul 2019 14:22:44 GMT
Last-Modified: Wed, 03 Jul 2019 12:37:07 GMT
Server: Apache
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=94
Content-Length: 1217

GET
H/1.1 200
OK recaptcha.css
unit42.elegance.work/wp-content/plugins/recaptcha-in-wp-comments-form/css/ 542 B
782 B 1059ms
112ms Stylesheet
text/css 173.236.35.250
SingleHop LLC

General

Check archive.org

Show headers Download Go to

Full URL: http://unit42.elegance.work/wp-content/plugins/recaptcha-in-wp-comments-form/css/recaptcha.css?ver=9.1.2
Requested by: Host: unit42.elegance.work
URL: http://unit42.elegance.work/the-gopher-in-the-room-analysis-of-golang-malware-in-the-wild/
Protocol: HTTP/1.1
Security: , ,
Server: 173.236.35.250 Chicago, United States, ASN32475 (SINGLEHOP-LLC - SingleHop LLC, US),
Reverse DNS: node03.tmddedicated980.com
Software: Apache /
Resource Hash: 90f36058490ad70a82e54642a54b7bd24e03a5bff4f2ab0d3cb9b89d1d0e9485

Request headers

Referer: http://unit42.elegance.work/the-gopher-in-the-room-analysis-of-golang-malware-in-the-wild/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 10 Jul 2019 14:22:44 GMT
Last-Modified: Wed, 03 Jul 2019 06:18:00 GMT
Server: Apache
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=93
Content-Length: 542

GET
H/1.1 200
OK main.css
unit42.elegance.work/wp-content/themes/unit42-v4/dist/styles/ 86 KB
87 KB 1174ms
113ms Stylesheet
text/css 173.236.35.250
SingleHop LLC

General

Check archive.org

Show headers Download Go to

Full URL: http://unit42.elegance.work/wp-content/themes/unit42-v4/dist/styles/main.css
Requested by: Host: unit42.elegance.work
URL: http://unit42.elegance.work/the-gopher-in-the-room-analysis-of-golang-malware-in-the-wild/
Protocol: HTTP/1.1
Security: , ,
Server: 173.236.35.250 Chicago, United States, ASN32475 (SINGLEHOP-LLC - SingleHop LLC, US),
Reverse DNS: node03.tmddedicated980.com
Software: Apache /
Resource Hash: 741b4b38e329d8e96a629a2e063ddba83f0894fc77200cab48c5a70933f3332f

Request headers

Referer: http://unit42.elegance.work/the-gopher-in-the-room-analysis-of-golang-malware-in-the-wild/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 10 Jul 2019 14:22:44 GMT
Last-Modified: Fri, 05 Jul 2019 08:02:16 GMT
Server: Apache
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=92
Content-Length: 88408

GET
H/1.1 200
OK jquery.js Show response
unit42.elegance.work/wp-includes/js/jquery/ 95 KB
95 KB 1630ms
112ms Script
application/javascript 173.236.35.250
SingleHop LLC

General

Check archive.org

Show headers Download Go to

Full URL: http://unit42.elegance.work/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp
Requested by: Host: unit42.elegance.work
URL: http://unit42.elegance.work/the-gopher-in-the-room-analysis-of-golang-malware-in-the-wild/
Protocol: HTTP/1.1
Security: , ,
Server: 173.236.35.250 Chicago, United States, ASN32475 (SINGLEHOP-LLC - SingleHop LLC, US),
Reverse DNS: node03.tmddedicated980.com
Software: Apache /
Resource Hash: 1db21d816296e6939ba1f42962496e4134ae2b0081e26970864c40c6d02bb1df

Request headers

Referer: http://unit42.elegance.work/the-gopher-in-the-room-analysis-of-golang-malware-in-the-wild/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 10 Jul 2019 14:22:45 GMT
Last-Modified: Wed, 03 Jul 2019 06:16:52 GMT
Server: Apache
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=89
Content-Length: 96873

GET
H/1.1 200
OK jquery-migrate.min.js Show response
unit42.elegance.work/wp-includes/js/jquery/ 10 KB
10 KB 1857ms
113ms Script
application/javascript 173.236.35.250
SingleHop LLC

General

Check archive.org

Show headers Download Go to

Full URL: http://unit42.elegance.work/wp-includes/js/jquery/jquery-migrate.min.js?ver=1.4.1
Requested by: Host: unit42.elegance.work
URL: http://unit42.elegance.work/the-gopher-in-the-room-analysis-of-golang-malware-in-the-wild/
Protocol: HTTP/1.1
Security: , ,
Server: 173.236.35.250 Chicago, United States, ASN32475 (SINGLEHOP-LLC - SingleHop LLC, US),
Reverse DNS: node03.tmddedicated980.com
Software: Apache /
Resource Hash: 48eb8b500ae6a38617b5738d2b3faec481922a7782246e31d2755c034a45cd5d

Request headers

Referer: http://unit42.elegance.work/the-gopher-in-the-room-analysis-of-golang-malware-in-the-wild/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 10 Jul 2019 14:22:45 GMT
Last-Modified: Fri, 20 May 2016 06:11:28 GMT
Server: Apache
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=88
Content-Length: 10056

GET
H/1.1 200
OK crayon.min.js Show response
unit42.elegance.work/wp-content/plugins/crayon-syntax-highlighter/js/min/ 22 KB
22 KB 1970ms
112ms Script
application/javascript 173.236.35.250
SingleHop LLC

General

Check archive.org

Show headers Download Go to

Full URL: http://unit42.elegance.work/wp-content/plugins/crayon-syntax-highlighter/js/min/crayon.min.js?ver=_2.7.2_beta
Requested by: Host: unit42.elegance.work
URL: http://unit42.elegance.work/the-gopher-in-the-room-analysis-of-golang-malware-in-the-wild/
Protocol: HTTP/1.1
Security: , ,
Server: 173.236.35.250 Chicago, United States, ASN32475 (SINGLEHOP-LLC - SingleHop LLC, US),
Reverse DNS: node03.tmddedicated980.com
Software: Apache /
Resource Hash: 193fbb968733b8a7049da19274546e6b80b76e9a8f1b837fee9a5fdeb8f97c7b

Request headers

Referer: http://unit42.elegance.work/the-gopher-in-the-room-analysis-of-golang-malware-in-the-wild/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 10 Jul 2019 14:22:45 GMT
Last-Modified: Mon, 20 Aug 2018 10:09:13 GMT
Server: Apache
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=87
Content-Length: 22337

GET
H/1.1 200
OK wpp-4.2.0.min.js Show response
unit42.elegance.work/wp-content/plugins/wordpress-popular-posts/public/js/ 1 KB
1 KB 2084ms
112ms Script
application/javascript 173.236.35.250
SingleHop LLC

General

Check archive.org

Show headers Download Go to

Full URL: http://unit42.elegance.work/wp-content/plugins/wordpress-popular-posts/public/js/wpp-4.2.0.min.js?ver=4.2.2
Requested by: Host: unit42.elegance.work
URL: http://unit42.elegance.work/the-gopher-in-the-room-analysis-of-golang-malware-in-the-wild/
Protocol: HTTP/1.1
Security: , ,
Server: 173.236.35.250 Chicago, United States, ASN32475 (SINGLEHOP-LLC - SingleHop LLC, US),
Reverse DNS: node03.tmddedicated980.com
Software: Apache /
Resource Hash: 9fd7bfa229eec86e2b02fdcf85e49e5b2699a2d9cd53ee36b4df53513d1da1f3

Request headers

Referer: http://unit42.elegance.work/the-gopher-in-the-room-analysis-of-golang-malware-in-the-wild/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 10 Jul 2019 14:22:45 GMT
Last-Modified: Wed, 03 Jul 2019 12:37:07 GMT
Server: Apache
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=86
Content-Length: 1147

GET
H/1.1 200
OK satelliteLib-c3d7b7de9b02c9d954ceaaf6bbd23274ad622720.js Show response
assets.adobedtm.com/90b129d72f4716e69353423cbd3d35a4caed23e2/ 218 KB
53 KB 271ms
14ms Script
application/x-javascript 104.111.217.111
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: http://assets.adobedtm.com/90b129d72f4716e69353423cbd3d35a4caed23e2/satelliteLib-c3d7b7de9b02c9d954ceaaf6bbd23274ad622720.js
Requested by: Host: unit42.elegance.work
URL: http://unit42.elegance.work/the-gopher-in-the-room-analysis-of-golang-malware-in-the-wild/
Protocol: HTTP/1.1
Security: , ,
Server: 104.111.217.111 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a104-111-217-111.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 91c8504b5a55cd04f35927c5fffd818afc53f2a37924e9ade9fdc5a8847c088a

Request headers

Referer: http://unit42.elegance.work/the-gopher-in-the-room-analysis-of-golang-malware-in-the-wild/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 10 Jul 2019 14:22:15 GMT
Content-Encoding: gzip
Last-Modified: Wed, 10 Jul 2019 02:13:44 GMT
Server: Apache
ETag: "8f6c89dee4a98ef924577a6fbbce405f:1562724824"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Cache-Control: max-age=3600
Connection: keep-alive
Accept-Ranges: bytes
Timing-Allow-Origin: *
Content-Length: 53459
Expires: Wed, 10 Jul 2019 15:22:15 GMT

GET
H2 200 attribution.js Show response
www.paloaltonetworks.com/content/dam/pan/en_US/includes/ 13 KB
3 KB 38ms
8ms Script
text/javascript 2a02:26f0:6c00:29e::c3a
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.paloaltonetworks.com/content/dam/pan/en_US/includes/attribution.js

Requested by

Host: unit42.elegance.work
URL: http://unit42.elegance.work/the-gopher-in-the-room-analysis-of-golang-malware-in-the-wild/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:29e::c3a , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Akamai Resource Optimizer /

Resource Hash

e426a3dcfd3548cb02cee9df0c0504691b0c4eaca01023f03f0d2b738448c3a3

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: http://unit42.elegance.work/the-gopher-in-the-room-analysis-of-golang-malware-in-the-wild/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Wed, 10 Jul 2019 14:22:14 GMT
content-encoding: br
last-modified: Mon, 08 Jul 2019 13:10:19 GMT
server: Akamai Resource Optimizer
x-frame-options: SAMEORIGIN
etag: W/"260310-35f0-58d2b2a7bdefe"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: max-age=86400
server-timing: cdn-cache; desc=HIT, edge; dur=1
accept-ranges: bytes
x-robots-tag: noindex
content-length: 2813
expires: Thu, 11 Jul 2019 14:22:14 GMT

GET
H/1.1 200
OK paloaltonetwork.svg
unit42.elegance.work/wp-content/uploads/2019/07/ 6 KB
6 KB 794ms
112ms Image
image/svg+xml 173.236.35.250
SingleHop LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://unit42.elegance.work/wp-content/uploads/2019/07/paloaltonetwork.svg
Requested by: Host: unit42.elegance.work
URL: http://unit42.elegance.work/the-gopher-in-the-room-analysis-of-golang-malware-in-the-wild/
Protocol: HTTP/1.1
Security: , ,
Server: 173.236.35.250 Chicago, United States, ASN32475 (SINGLEHOP-LLC - SingleHop LLC, US),
Reverse DNS: node03.tmddedicated980.com
Software: Apache /
Resource Hash: fae07a533098c30def81bb1c4ff7b1ad6eb91e6f37f8f5f7a864da2643418fde

Request headers

Referer: http://unit42.elegance.work/the-gopher-in-the-room-analysis-of-golang-malware-in-the-wild/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 10 Jul 2019 14:22:45 GMT
Last-Modified: Thu, 04 Jul 2019 12:57:02 GMT
Server: Apache
Content-Type: image/svg+xml
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=85
Content-Length: 6039

GET
H/1.1 200
OK unit42.svg
unit42.elegance.work/wp-content/uploads/2019/07/ 3 KB
4 KB 2897ms
113ms Image
image/svg+xml 173.236.35.250
SingleHop LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://unit42.elegance.work/wp-content/uploads/2019/07/unit42.svg
Requested by: Host: unit42.elegance.work
URL: http://unit42.elegance.work/the-gopher-in-the-room-analysis-of-golang-malware-in-the-wild/
Protocol: HTTP/1.1
Security: , ,
Server: 173.236.35.250 Chicago, United States, ASN32475 (SINGLEHOP-LLC - SingleHop LLC, US),
Reverse DNS: node03.tmddedicated980.com
Software: Apache /
Resource Hash: 9a01022937485049cf468c29d52e6ff63e304fd2f4fb36fc3b3af21eae6b3646

Request headers

Referer: http://unit42.elegance.work/the-gopher-in-the-room-analysis-of-golang-malware-in-the-wild/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 10 Jul 2019 14:22:48 GMT
Last-Modified: Thu, 04 Jul 2019 12:57:32 GMT
Server: Apache
Content-Type: image/svg+xml
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=71
Content-Length: 3368

GET
H/1.1 404
Not Found word-image-14.png
unit42.elegance.work/wp-content/uploads/2019/06/ 18 KB
18 KB 1087ms
396ms Image
text/html 173.236.35.250
SingleHop LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://unit42.elegance.work/wp-content/uploads/2019/06/word-image-14.png
Requested by: Host: unit42.elegance.work
URL: http://unit42.elegance.work/the-gopher-in-the-room-analysis-of-golang-malware-in-the-wild/
Protocol: HTTP/1.1
Security: , ,
Server: 173.236.35.250 Chicago, United States, ASN32475 (SINGLEHOP-LLC - SingleHop LLC, US),
Reverse DNS: node03.tmddedicated980.com
Software: Apache / PHP/7.2.10
Resource Hash: c946d2f8fb58e661ceb211686779c9e0de80461e97ce3e42b0cc787cc3d55ba4

Request headers

Referer: http://unit42.elegance.work/the-gopher-in-the-room-analysis-of-golang-malware-in-the-wild/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 10 Jul 2019 14:22:48 GMT
Server: Apache
X-Powered-By: PHP/7.2.10
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8
Cache-Control: no-cache, must-revalidate, max-age=0
Connection: Keep-Alive
Link: <http://unit42.elegance.work/wp-json/>; rel="https://api.w.org/"
Keep-Alive: timeout=5, max=70
Expires: Wed, 11 Jan 1984 05:00:00 GMT

GET word-image-15.png
unit42.elegance.work/wp-content/uploads/2019/06/ 0
0

GET word-image-16.png
unit42.elegance.work/wp-content/uploads/2019/06/ 0
0

GET
H/1.1

200
OK

external-tracking.min.js Show response
blog.paloaltonetworks.com/wp-content/plugins/google-analyticator/
Redirect Chain

https://researchcenter.paloaltonetworks.com/wp-content/plugins/google-analyticator/external-tracking.min.js?ver=6.4.9
https://blog.paloaltonetworks.com/wp-content/plugins/google-analyticator/external-tracking.min.js?ver=6.4.9

1 KB
2 KB

7250ms
32ms

Script
application/javascript

104.103.100.157
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.paloaltonetworks.com/wp-content/plugins/google-analyticator/external-tracking.min.js?ver=6.4.9

Requested by

Host: unit42.elegance.work
URL: http://unit42.elegance.work/the-gopher-in-the-room-analysis-of-golang-malware-in-the-wild/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.103.100.157 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a104-103-100-157.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

5a9dcb270ba38d94fd27a5ae4c6a6d10bb6a25fe0473df95fe4c405e82801289

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: http://unit42.elegance.work/the-gopher-in-the-room-analysis-of-golang-malware-in-the-wild/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 10 Jul 2019 14:22:31 GMT
Last-Modified: Fri, 10 Jun 2016 15:10:32 GMT
Server: Apache
ETag: "4a6-534edf098ea00"
X-Frame-Options: SAMEORIGIN
Content-Type: application/javascript
Cache-Control: max-age=47726, s-maxage=10
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1190
X-XSS-Protection: 1; mode=block

Redirect headers

Location: https://blog.paloaltonetworks.com/wp-content/plugins/google-analyticator/external-tracking.min.js?ver=6.4.9
Date: Wed, 10 Jul 2019 14:22:24 GMT
Server: AkamaiGHost
Connection: keep-alive
Content-Length: 0

GET
H/1.1 200
OK wpdevart_lightbox_front.css
unit42.elegance.work/wp-content/plugins/lightbox-popup/includes/style/ 1 KB
2 KB 1143ms
113ms Stylesheet
text/css 173.236.35.250
SingleHop LLC

General

Check archive.org

Show headers Download Go to

Full URL: http://unit42.elegance.work/wp-content/plugins/lightbox-popup/includes/style/wpdevart_lightbox_front.css?ver=5.2.2
Requested by: Host: unit42.elegance.work
URL: http://unit42.elegance.work/the-gopher-in-the-room-analysis-of-golang-malware-in-the-wild/
Protocol: HTTP/1.1
Security: , ,
Server: 173.236.35.250 Chicago, United States, ASN32475 (SINGLEHOP-LLC - SingleHop LLC, US),
Reverse DNS: node03.tmddedicated980.com
Software: Apache /
Resource Hash: 094ba542d10bfe736b29264ed9423fcef4236e9b7b6501ddae79d7008128afcf

Request headers

Referer: http://unit42.elegance.work/the-gopher-in-the-room-analysis-of-golang-malware-in-the-wild/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 10 Jul 2019 14:22:45 GMT
Last-Modified: Wed, 03 Jul 2019 06:17:56 GMT
Server: Apache
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=91
Content-Length: 1326

GET
H/1.1 200
OK effects_lightbox.css
unit42.elegance.work/wp-content/plugins/lightbox-popup/includes/style/ 20 KB
20 KB 1257ms
113ms Stylesheet
text/css 173.236.35.250
SingleHop LLC

General

Check archive.org

Show headers Download Go to

Full URL: http://unit42.elegance.work/wp-content/plugins/lightbox-popup/includes/style/effects_lightbox.css?ver=5.2.2
Requested by: Host: unit42.elegance.work
URL: http://unit42.elegance.work/the-gopher-in-the-room-analysis-of-golang-malware-in-the-wild/
Protocol: HTTP/1.1
Security: , ,
Server: 173.236.35.250 Chicago, United States, ASN32475 (SINGLEHOP-LLC - SingleHop LLC, US),
Reverse DNS: node03.tmddedicated980.com
Software: Apache /
Resource Hash: 1c34654c554418c5a458e7bdc59c5c36eefc8c4a18ae4b69cb95cf3210c3ecf0

Request headers

Referer: http://unit42.elegance.work/the-gopher-in-the-room-analysis-of-golang-malware-in-the-wild/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 10 Jul 2019 14:22:45 GMT
Last-Modified: Wed, 03 Jul 2019 06:17:56 GMT
Server: Apache
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=90
Content-Length: 20506

GET
H/1.1 200
OK base.js Show response
unit42.elegance.work/wp-content/plugins/recaptcha-in-wp-comments-form/js/ 3 KB
4 KB 1620ms
113ms Script
application/javascript 173.236.35.250
SingleHop LLC

General

Check archive.org

Show headers Download Go to

Full URL: http://unit42.elegance.work/wp-content/plugins/recaptcha-in-wp-comments-form/js/base.js?ver=9.1.2
Requested by: Host: unit42.elegance.work
URL: http://unit42.elegance.work/the-gopher-in-the-room-analysis-of-golang-malware-in-the-wild/
Protocol: HTTP/1.1
Security: , ,
Server: 173.236.35.250 Chicago, United States, ASN32475 (SINGLEHOP-LLC - SingleHop LLC, US),
Reverse DNS: node03.tmddedicated980.com
Software: Apache /
Resource Hash: 042d0c8026a02a05f6aaa716bab41322c8598ce3580a88dda247c2534d833bfe

Request headers

Referer: http://unit42.elegance.work/the-gopher-in-the-room-analysis-of-golang-malware-in-the-wild/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 10 Jul 2019 14:22:47 GMT
Last-Modified: Wed, 03 Jul 2019 06:18:00 GMT
Server: Apache
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=76
Content-Length: 3540

GET
H/1.1 200
OK recaptcha.js Show response
unit42.elegance.work/wp-content/plugins/recaptcha-in-wp-comments-form/js/ 3 KB
4 KB 1733ms
113ms Script
application/javascript 173.236.35.250
SingleHop LLC

General

Check archive.org

Show headers Download Go to

Full URL: http://unit42.elegance.work/wp-content/plugins/recaptcha-in-wp-comments-form/js/recaptcha.js?ver=9.1.2
Requested by: Host: unit42.elegance.work
URL: http://unit42.elegance.work/the-gopher-in-the-room-analysis-of-golang-malware-in-the-wild/
Protocol: HTTP/1.1
Security: , ,
Server: 173.236.35.250 Chicago, United States, ASN32475 (SINGLEHOP-LLC - SingleHop LLC, US),
Reverse DNS: node03.tmddedicated980.com
Software: Apache /
Resource Hash: 8b180247ed8eeb6e1b6c55026770e825b221d62292072fb01b70ef727eae3d15

Request headers

Referer: http://unit42.elegance.work/the-gopher-in-the-room-analysis-of-golang-malware-in-the-wild/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 10 Jul 2019 14:22:47 GMT
Last-Modified: Wed, 03 Jul 2019 06:18:00 GMT
Server: Apache
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=75
Content-Length: 3526

GET
H2 200 api.js Show response
www.google.com/recaptcha/ 843 B
722 B 27ms
15ms Script
text/javascript 2a00:1450:4001:81c::2004
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api.js?onload=griwpcOnloadCallback&render=explicit&ver=5.2.2

Requested by

Host: unit42.elegance.work
URL: http://unit42.elegance.work/the-gopher-in-the-room-analysis-of-golang-malware-in-the-wild/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

GSE /

Resource Hash

db4a27662605f24990be4b107fce043114aaad83ffa07f62588f23bffd28f0ca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: http://unit42.elegance.work/the-gopher-in-the-room-analysis-of-golang-malware-in-the-wild/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Wed, 10 Jul 2019 14:22:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: GSE
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=UTF-8
status: 200
cache-control: private, max-age=300
alt-svc: quic=":443"; ma=2592000; v="46,43,39"
content-length: 472
x-xss-protection: 1; mode=block
expires: Wed, 10 Jul 2019 14:22:16 GMT

GET
H2 200 api.js Show response
www.google.com/recaptcha/ 762 B
518 B 28ms
16ms Script
text/javascript 2a00:1450:4001:81c::2004
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api.js

Requested by

Host: unit42.elegance.work
URL: http://unit42.elegance.work/the-gopher-in-the-room-analysis-of-golang-malware-in-the-wild/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

GSE /

Resource Hash

e3852329019e5662acec7d5a335114e80c30593602bd09bb65487872586f00f8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: http://unit42.elegance.work/the-gopher-in-the-room-analysis-of-golang-malware-in-the-wild/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Wed, 10 Jul 2019 14:22:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: GSE
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=UTF-8
status: 200
cache-control: private, max-age=300
alt-svc: quic=":443"; ma=2592000; v="46,43,39"
content-length: 448
x-xss-protection: 1; mode=block
expires: Wed, 10 Jul 2019 14:22:16 GMT

GET
H/1.1 200
OK main.js Show response
unit42.elegance.work/wp-content/themes/unit42-v4/dist/scripts/ 98 KB
98 KB 1848ms
113ms Script
application/javascript 173.236.35.250
SingleHop LLC

General

Check archive.org

Show headers Download Go to

Full URL: http://unit42.elegance.work/wp-content/themes/unit42-v4/dist/scripts/main.js
Requested by: Host: unit42.elegance.work
URL: http://unit42.elegance.work/the-gopher-in-the-room-analysis-of-golang-malware-in-the-wild/
Protocol: HTTP/1.1
Security: , ,
Server: 173.236.35.250 Chicago, United States, ASN32475 (SINGLEHOP-LLC - SingleHop LLC, US),
Reverse DNS: node03.tmddedicated980.com
Software: Apache /
Resource Hash: 4844bcb531434637624bd9e9568a012777af451a6ad746b43b9503a3a77773ba

Request headers

Referer: http://unit42.elegance.work/the-gopher-in-the-room-analysis-of-golang-malware-in-the-wild/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 10 Jul 2019 14:22:47 GMT
X-Pad: avoid browser bug
Last-Modified: Wed, 03 Jul 2019 13:13:13 GMT
Server: Apache
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=74
Content-Length: 100557

GET
H/1.1 200
OK wp-embed.min.js Show response
unit42.elegance.work/wp-includes/js/ 1 KB
2 KB 686ms
113ms Script
application/javascript 173.236.35.250
SingleHop LLC

General

Check archive.org

Show headers Download Go to

Full URL: http://unit42.elegance.work/wp-includes/js/wp-embed.min.js?ver=5.2.2
Requested by: Host: unit42.elegance.work
URL: http://unit42.elegance.work/the-gopher-in-the-room-analysis-of-golang-malware-in-the-wild/
Protocol: HTTP/1.1
Security: , ,
Server: 173.236.35.250 Chicago, United States, ASN32475 (SINGLEHOP-LLC - SingleHop LLC, US),
Reverse DNS: node03.tmddedicated980.com
Software: Apache /
Resource Hash: 2152557cac69e2bd7d6debef5037a9f554f9209cc305b8141b3329acb10c42b7

Request headers

Referer: http://unit42.elegance.work/the-gopher-in-the-room-analysis-of-golang-malware-in-the-wild/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 10 Jul 2019 14:22:47 GMT
Last-Modified: Thu, 13 Dec 2018 13:01:03 GMT
Server: Apache
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=73
Content-Length: 1403

GET
H/1.1 200
OK wpdevart_lightbox_front.js Show response
unit42.elegance.work/wp-content/plugins/lightbox-popup/includes/javascript/ 51 KB
51 KB 685ms
113ms Script
application/javascript 173.236.35.250
SingleHop LLC

General

Check archive.org

Show headers Download Go to

Full URL: http://unit42.elegance.work/wp-content/plugins/lightbox-popup/includes/javascript/wpdevart_lightbox_front.js?ver=1.0
Requested by: Host: unit42.elegance.work
URL: http://unit42.elegance.work/the-gopher-in-the-room-analysis-of-golang-malware-in-the-wild/
Protocol: HTTP/1.1
Security: , ,
Server: 173.236.35.250 Chicago, United States, ASN32475 (SINGLEHOP-LLC - SingleHop LLC, US),
Reverse DNS: node03.tmddedicated980.com
Software: Apache /
Resource Hash: c452cf6e1316f6aa6da38b72be07abbeaff1d4df66de567e83d6cf1c6b6fcdc7

Request headers

Referer: http://unit42.elegance.work/the-gopher-in-the-room-analysis-of-golang-malware-in-the-wild/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 10 Jul 2019 14:22:47 GMT
Last-Modified: Wed, 03 Jul 2019 06:17:56 GMT
Server: Apache
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=72
Content-Length: 52396

POST
H/1.1 200
OK / Show response
unit42.elegance.work/wp-json/wordpress-popular-posts/v1/popular-posts/ 43 B
753 B 1396ms
585ms XHR
application/json 173.236.35.250
SingleHop LLC

General

Check archive.org

Show headers Download Go to

Full URL

http://unit42.elegance.work/wp-json/wordpress-popular-posts/v1/popular-posts/

Requested by

Host: unit42.elegance.work
URL: http://unit42.elegance.work/wp-content/plugins/wordpress-popular-posts/public/js/wpp-4.2.0.min.js?ver=4.2.2

Protocol

HTTP/1.1

Security

, ,

Server

173.236.35.250 Chicago, United States, ASN32475 (SINGLEHOP-LLC - SingleHop LLC, US),

Reverse DNS

node03.tmddedicated980.com

Software

Apache / PHP/7.2.10

Resource Hash

74011ee1ebf7bcce1b5d33554e6f8470683b0891a89456dab45489f99d3a2084

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: http://unit42.elegance.work/the-gopher-in-the-room-analysis-of-golang-malware-in-the-wild/
Origin: http://unit42.elegance.work
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

Date: Wed, 10 Jul 2019 14:22:46 GMT
X-Content-Type-Options: nosniff
X-Powered-By: PHP/7.2.10
Transfer-Encoding: chunked
Connection: Keep-Alive
Keep-Alive: timeout=5, max=78
Link: <http://unit42.elegance.work/wp-json/>; rel="https://api.w.org/"
Allow: GET, POST
Server: Apache
X-WP-Nonce: 68bda52ff2
Vary: Origin
Access-Control-Allow-Methods: OPTIONS, GET, POST, PUT, PATCH, DELETE
Content-Type: application/json; charset=UTF-8
Access-Control-Allow-Origin: http://unit42.elegance.work
Access-Control-Expose-Headers: X-WP-Total, X-WP-TotalPages
Access-Control-Allow-Credentials: true
X-Robots-Tag: noindex
Access-Control-Allow-Headers: Authorization, Content-Type

GET
H/1.1

302
Found

rd Show response
dpm.demdex.net/id/
Redirect Chain

http://dpm.demdex.net/id?d_visid_ver=3.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=9A531C8B532965080A490D4D%40AdobeOrg&d_nsid=0&ts=1562768536753
http://dpm.demdex.net/id/rd?d_visid_ver=3.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=9A531C8B532965080A490D4D%40AdobeOrg&d_nsid=0&ts=1562768536753

0
-1 B

308ms
30ms

XHR

52.212.6.126
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: http://dpm.demdex.net/id/rd?d_visid_ver=3.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=9A531C8B532965080A490D4D%40AdobeOrg&d_nsid=0&ts=1562768536753
Requested by: Host: unit42.elegance.work
URL: http://unit42.elegance.work/the-gopher-in-the-room-analysis-of-golang-malware-in-the-wild/
Protocol: HTTP/1.1
Security: , ,
Server: 52.212.6.126 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-52-212-6-126.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://unit42.elegance.work/the-gopher-in-the-room-analysis-of-golang-malware-in-the-wild/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Location: http://dpm.demdex.net/id/rd?d_visid_ver=3.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=9A531C8B532965080A490D4D%40AdobeOrg&d_nsid=0&ts=1562768536753
X-TID: LSTL87XUSYc=
Vary: Origin
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin: http://unit42.elegance.work
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma: no-cache
Access-Control-Allow-Origin: http://unit42.elegance.work
X-TID: LSTL87XUSYc=
Vary: Origin
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Location: http://dpm.demdex.net/id/rd?d_visid_ver=3.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=9A531C8B532965080A490D4D%40AdobeOrg&d_nsid=0&ts=1562768536753
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2

200

ga.js Show response
www.google-analytics.com/
Redirect Chain

http://www.google-analytics.com/ga.js
https://www.google-analytics.com/ga.js

45 KB
17 KB

18ms
6ms

Script
text/javascript

2a00:1450:4001:81e::200e
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/ga.js

Requested by

Host: unit42.elegance.work
URL: http://unit42.elegance.work/the-gopher-in-the-room-analysis-of-golang-malware-in-the-wild/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81e::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: http://unit42.elegance.work/the-gopher-in-the-room-analysis-of-golang-malware-in-the-wild/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 20 Jun 2019 21:35:04 GMT
server: Golfe2
age: 1828
date: Wed, 10 Jul 2019 13:51:48 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
alt-svc: quic=":443"; ma=2592000; v="46,43,39"
content-length: 17168
expires: Wed, 10 Jul 2019 15:51:48 GMT

Redirect headers

Location: https://www.google-analytics.com/ga.js
Non-Authoritative-Reason: HSTS

GET
H/1.1 200
OK article-header-bg.svg
unit42.elegance.work/wp-content/themes/unit42-v4/dist/images/svg/ 2 KB
3 KB 1475ms
113ms Image
image/svg+xml 173.236.35.250
SingleHop LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://unit42.elegance.work/wp-content/themes/unit42-v4/dist/images/svg/article-header-bg.svg
Requested by: Host: unit42.elegance.work
URL: http://unit42.elegance.work/the-gopher-in-the-room-analysis-of-golang-malware-in-the-wild/
Protocol: HTTP/1.1
Security: , ,
Server: 173.236.35.250 Chicago, United States, ASN32475 (SINGLEHOP-LLC - SingleHop LLC, US),
Reverse DNS: node03.tmddedicated980.com
Software: Apache /
Resource Hash: d47b97907e23c9ee25cc5ad69295b8f45e3af0f9620f9f1c868258d129d276d1

Request headers

Referer: http://unit42.elegance.work/wp-content/themes/unit42-v4/dist/styles/main.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 10 Jul 2019 14:22:47 GMT
Last-Modified: Thu, 04 Jul 2019 10:21:51 GMT
Server: Apache
Content-Type: image/svg+xml
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=77
Content-Length: 2346

GET
H/1.1 200
OK LatoLatin-Medium.woff2
unit42.elegance.work/wp-content/themes/unit42-v4/dist/fonts/ 43 KB
43 KB 198ms
113ms Font
application/octet-stream 173.236.35.250
SingleHop LLC

General

Check archive.org

Show headers Download Go to

Full URL: http://unit42.elegance.work/wp-content/themes/unit42-v4/dist/fonts/LatoLatin-Medium.woff2
Requested by: Host: unit42.elegance.work
URL: http://unit42.elegance.work/the-gopher-in-the-room-analysis-of-golang-malware-in-the-wild/
Protocol: HTTP/1.1
Security: , ,
Server: 173.236.35.250 Chicago, United States, ASN32475 (SINGLEHOP-LLC - SingleHop LLC, US),
Reverse DNS: node03.tmddedicated980.com
Software: Apache /
Resource Hash: 60593ef08991381d651875bc78e259b2b66938e1b66175a445a7fefdb46e3d78

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: http://unit42.elegance.work/wp-content/themes/unit42-v4/dist/styles/main.css
Origin: http://unit42.elegance.work

Response headers

Date: Wed, 10 Jul 2019 14:22:45 GMT
Last-Modified: Thu, 04 Jul 2019 10:21:01 GMT
Server: Apache
Content-Type: text/plain
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=84
Content-Length: 43920

GET
H/1.1 200
OK LatoLatin-Black.woff2
unit42.elegance.work/wp-content/themes/unit42-v4/dist/fonts/ 42 KB
43 KB 316ms
113ms Font
application/octet-stream 173.236.35.250
SingleHop LLC

General

Check archive.org

Show headers Download Go to

Full URL: http://unit42.elegance.work/wp-content/themes/unit42-v4/dist/fonts/LatoLatin-Black.woff2
Requested by: Host: unit42.elegance.work
URL: http://unit42.elegance.work/the-gopher-in-the-room-analysis-of-golang-malware-in-the-wild/
Protocol: HTTP/1.1
Security: , ,
Server: 173.236.35.250 Chicago, United States, ASN32475 (SINGLEHOP-LLC - SingleHop LLC, US),
Reverse DNS: node03.tmddedicated980.com
Software: Apache /
Resource Hash: e2c997abb38ede2240d957b57a3216882e8416b1f757f26b92128a8875e00e73

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: http://unit42.elegance.work/wp-content/themes/unit42-v4/dist/styles/main.css
Origin: http://unit42.elegance.work

Response headers

Date: Wed, 10 Jul 2019 14:22:46 GMT
Last-Modified: Thu, 04 Jul 2019 10:19:42 GMT
Server: Apache
Content-Type: text/plain
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=83
Content-Length: 43456

GET
H/1.1 200
OK LatoLatin-Regular.woff2
unit42.elegance.work/wp-content/themes/unit42-v4/dist/fonts/ 43 KB
43 KB 432ms
113ms Font
application/octet-stream 173.236.35.250
SingleHop LLC

General

Check archive.org

Show headers Download Go to

Full URL: http://unit42.elegance.work/wp-content/themes/unit42-v4/dist/fonts/LatoLatin-Regular.woff2
Requested by: Host: unit42.elegance.work
URL: http://unit42.elegance.work/the-gopher-in-the-room-analysis-of-golang-malware-in-the-wild/
Protocol: HTTP/1.1
Security: , ,
Server: 173.236.35.250 Chicago, United States, ASN32475 (SINGLEHOP-LLC - SingleHop LLC, US),
Reverse DNS: node03.tmddedicated980.com
Software: Apache /
Resource Hash: ddd4ef7f97f4361b60841d59753218a57134b0f99f5b46a9612234f1c2733ab0

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: http://unit42.elegance.work/wp-content/themes/unit42-v4/dist/styles/main.css
Origin: http://unit42.elegance.work

Response headers

Date: Wed, 10 Jul 2019 14:22:46 GMT
Last-Modified: Thu, 04 Jul 2019 10:21:14 GMT
Server: Apache
Content-Type: text/plain
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=82
Content-Length: 43760

GET
H/1.1 200
OK unit42-scope.ttf
unit42.elegance.work/wp-content/themes/unit42-v4/dist/fonts/ 4 KB
5 KB 550ms
113ms Font
application/x-font-ttf 173.236.35.250
SingleHop LLC

General

Check archive.org

Show headers Download Go to

Full URL: http://unit42.elegance.work/wp-content/themes/unit42-v4/dist/fonts/unit42-scope.ttf?9e4c90
Requested by: Host: unit42.elegance.work
URL: http://unit42.elegance.work/the-gopher-in-the-room-analysis-of-golang-malware-in-the-wild/
Protocol: HTTP/1.1
Security: , ,
Server: 173.236.35.250 Chicago, United States, ASN32475 (SINGLEHOP-LLC - SingleHop LLC, US),
Reverse DNS: node03.tmddedicated980.com
Software: Apache /
Resource Hash: df35525390ccc434316ed0514469c12c622dd89e107148f71ab8b5256d06cc9b

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: http://unit42.elegance.work/wp-content/themes/unit42-v4/dist/styles/main.css
Origin: http://unit42.elegance.work

Response headers

Date: Wed, 10 Jul 2019 14:22:46 GMT
Last-Modified: Thu, 04 Jul 2019 07:30:14 GMT
Server: Apache
Content-Type: application/x-font-ttf
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=81
Content-Length: 4504

GET
H/1.1 200
OK LatoLatin-Italic.woff2
unit42.elegance.work/wp-content/themes/unit42-v4/dist/fonts/ 44 KB
45 KB 664ms
113ms Font
application/octet-stream 173.236.35.250
SingleHop LLC

General

Check archive.org

Show headers Download Go to

Full URL: http://unit42.elegance.work/wp-content/themes/unit42-v4/dist/fonts/LatoLatin-Italic.woff2
Requested by: Host: unit42.elegance.work
URL: http://unit42.elegance.work/the-gopher-in-the-room-analysis-of-golang-malware-in-the-wild/
Protocol: HTTP/1.1
Security: , ,
Server: 173.236.35.250 Chicago, United States, ASN32475 (SINGLEHOP-LLC - SingleHop LLC, US),
Reverse DNS: node03.tmddedicated980.com
Software: Apache /
Resource Hash: 23d062b46761d2148b84ca93d72dfdf2f16833f2ebb54ebdafdf25f1e10afc50

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: http://unit42.elegance.work/wp-content/themes/unit42-v4/dist/styles/main.css
Origin: http://unit42.elegance.work

Response headers

Date: Wed, 10 Jul 2019 14:22:46 GMT
Last-Modified: Thu, 04 Jul 2019 10:20:41 GMT
Server: Apache
Content-Type: text/plain
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=80
Content-Length: 45388

GET
H/1.1 200
OK LatoLatin-Bold.woff2
unit42.elegance.work/wp-content/themes/unit42-v4/dist/fonts/ 43 KB
44 KB 780ms
113ms Font
application/octet-stream 173.236.35.250
SingleHop LLC

General

Check archive.org

Show headers Download Go to

Full URL: http://unit42.elegance.work/wp-content/themes/unit42-v4/dist/fonts/LatoLatin-Bold.woff2
Requested by: Host: unit42.elegance.work
URL: http://unit42.elegance.work/the-gopher-in-the-room-analysis-of-golang-malware-in-the-wild/
Protocol: HTTP/1.1
Security: , ,
Server: 173.236.35.250 Chicago, United States, ASN32475 (SINGLEHOP-LLC - SingleHop LLC, US),
Reverse DNS: node03.tmddedicated980.com
Software: Apache /
Resource Hash: 276401632a998400be8a5895038f4f72d3760d3c3d6aaf3cf445d109cb9d1540

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: http://unit42.elegance.work/wp-content/themes/unit42-v4/dist/styles/main.css
Origin: http://unit42.elegance.work

Response headers

Date: Wed, 10 Jul 2019 14:22:46 GMT
Last-Modified: Thu, 04 Jul 2019 10:19:54 GMT
Server: Apache
Content-Type: text/plain
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=79
Content-Length: 44380

GET
H2

200

ga-audiences
www.google.de/ads/
Redirect Chain

http://www.google-analytics.com/r/__utm.gif?utmwv=5.7.2&utms=1&utmn=1078496320&utmhn=unit42.elegance.work&utmcs=UTF-8&utmsr=1600x1200&utmvp=1585x1185&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=...
https://www.google-analytics.com/r/__utm.gif?utmwv=5.7.2&utms=1&utmn=1078496320&utmhn=unit42.elegance.work&utmcs=UTF-8&utmsr=1600x1200&utmvp=1585x1185&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt...
https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-494959-2&cid=1808016770.1562768537&jid=1704284424&_v=5.7.2&z=1078496320
https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-494959-2&cid=1808016770.1562768537&jid=1704284424&_v=5.7.2&z=1078496320
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-494959-2&cid=1808016770.1562768537&jid=1704284424&_v=5.7.2&z=1078496320&slf_rd=1&random=1717549495

42 B
374 B

46ms
31ms

Image
image/gif

2a00:1450:4001:808::2003
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-494959-2&cid=1808016770.1562768537&jid=1704284424&_v=5.7.2&z=1078496320&slf_rd=1&random=1717549495

Requested by

Host: unit42.elegance.work
URL: http://unit42.elegance.work/the-gopher-in-the-room-analysis-of-golang-malware-in-the-wild/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://unit42.elegance.work/the-gopher-in-the-room-analysis-of-golang-malware-in-the-wild/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 10 Jul 2019 14:22:16 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43,39"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 10 Jul 2019 14:22:16 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
location: https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-494959-2&cid=1808016770.1562768537&jid=1704284424&_v=5.7.2&z=1078496320&slf_rd=1&random=1717549495
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 302
cache-control: no-cache, no-store, must-revalidate
content-type: text/html; charset=UTF-8
alt-svc: quic=":443"; ma=2592000; v="46,43,39"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK rd Show response
dpm.demdex.net/id/ 217 B
972 B 33ms
31ms XHR
application/json 52.212.6.126
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: http://dpm.demdex.net/id/rd?d_visid_ver=3.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=9A531C8B532965080A490D4D%40AdobeOrg&d_nsid=0&ts=1562768536753
Requested by: Host: unit42.elegance.work
URL: http://unit42.elegance.work/the-gopher-in-the-room-analysis-of-golang-malware-in-the-wild/
Protocol: HTTP/1.1
Security: , ,
Server: 52.212.6.126 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-52-212-6-126.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: a52764d556885a2269e16265533a72b9b8c30119cfc2f906f8361b0a106b2411

Request headers

Referer: http://unit42.elegance.work/the-gopher-in-the-room-analysis-of-golang-malware-in-the-wild/
Origin: http://unit42.elegance.work
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

DCS: dcs-prod-irl1-v038-07712156a.edge-irl1.demdex.com 5.56.0.20190709092241 3ms
Pragma: no-cache
X-TID: djU+gwcFRZE=
Vary: Origin, Accept-Encoding, User-Agent
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin: http://unit42.elegance.work
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json;charset=utf-8
Content-Length: 217
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 200
OK id Show response
paloaltonetworks.d1.sc.omtrdc.net/ 3 B
482 B 1053ms
18ms XHR
application/x-javascript 66.117.29.224
Adobe Systems Inc.

General

Check archive.org

Show headers Download Go to

Full URL

http://paloaltonetworks.d1.sc.omtrdc.net/id?d_visid_ver=3.4.0&d_fieldgroup=A&mcorgid=9A531C8B532965080A490D4D%40AdobeOrg&mid=32179264565889797954098171435332511827&ts=1562768537115

Requested by

Host: assets.adobedtm.com
URL: http://assets.adobedtm.com/90b129d72f4716e69353423cbd3d35a4caed23e2/satelliteLib-c3d7b7de9b02c9d954ceaaf6bbd23274ad622720.js

Protocol

HTTP/1.1

Security

, ,

Server

66.117.29.224 , United States, ASN15224 (OMNITURE - Adobe Systems Inc., US),

Reverse DNS

Software

Omniture DC/2.0.0 /

Resource Hash

ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: http://unit42.elegance.work/the-gopher-in-the-room-analysis-of-golang-malware-in-the-wild/
Origin: http://unit42.elegance.work
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

Date: Wed, 10 Jul 2019 14:22:18 GMT
X-Content-Type-Options: nosniff
Server: Omniture DC/2.0.0
xserver: www5
Vary: Origin
X-C: ms-6.8.1
P3P: CP="This is not a P3P policy"
Access-Control-Allow-Origin: http://unit42.elegance.work
Cache-Control: no-cache, no-store, max-age=0, no-transform, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/x-javascript
Content-Length: 3
X-XSS-Protection: 1; mode=block

GET
H2 200 recaptcha__en.js Show response
www.gstatic.com/recaptcha/api2/v1561357937155/ 264 KB
92 KB 20ms
6ms Script
text/javascript 2a00:1450:4001:817::2003
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/api2/v1561357937155/recaptcha__en.js

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api.js?onload=griwpcOnloadCallback&render=explicit&ver=5.2.2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:817::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

6545c4d7e7c4fa643fb3dbc74cdb699d9289b83a4882bb8625206974a547c4f8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://unit42.elegance.work/the-gopher-in-the-room-analysis-of-golang-malware-in-the-wild/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Wed, 26 Jun 2019 18:19:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 24 Jun 2019 19:15:00 GMT
server: sffe
age: 1195366
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=31536000
accept-ranges: bytes
alt-svc: quic=":443"; ma=2592000; v="46,43,39"
content-length: 94224
x-xss-protection: 0
expires: Thu, 25 Jun 2020 18:19:45 GMT

GET
H/1.1 200
OK satellite-5acf840964746d5f7e00405b.js Show response
assets.adobedtm.com/90b129d72f4716e69353423cbd3d35a4caed23e2/scripts/ 384 B
641 B 16ms
15ms Script
application/x-javascript 104.111.217.111
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: http://assets.adobedtm.com/90b129d72f4716e69353423cbd3d35a4caed23e2/scripts/satellite-5acf840964746d5f7e00405b.js
Requested by: Host: assets.adobedtm.com
URL: http://assets.adobedtm.com/90b129d72f4716e69353423cbd3d35a4caed23e2/satelliteLib-c3d7b7de9b02c9d954ceaaf6bbd23274ad622720.js
Protocol: HTTP/1.1
Security: , ,
Server: 104.111.217.111 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a104-111-217-111.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 74a8ba118fe9dd54de26acf8042b40b1ab1dadc25f07bab2bbc9047989618a75

Request headers

Referer: http://unit42.elegance.work/the-gopher-in-the-room-analysis-of-golang-malware-in-the-wild/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 10 Jul 2019 14:22:31 GMT
Content-Encoding: gzip
Last-Modified: Wed, 10 Jul 2019 02:13:48 GMT
Server: Apache
ETag: "060c62a2b91e1ff5cec0dd282ea08d5e:1562724828"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Cache-Control: max-age=3600
Connection: keep-alive
Accept-Ranges: bytes
Timing-Allow-Origin: *
Content-Length: 223
Expires: Wed, 10 Jul 2019 15:22:31 GMT

GET
H/1.1 200
OK s-code-contents-20fe37e21b06197de161fc72215f77955e6b1712.js Show response
assets.adobedtm.com/90b129d72f4716e69353423cbd3d35a4caed23e2/ 113 KB
37 KB 19ms
8ms Script
application/x-javascript 104.111.217.111
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: http://assets.adobedtm.com/90b129d72f4716e69353423cbd3d35a4caed23e2/s-code-contents-20fe37e21b06197de161fc72215f77955e6b1712.js
Requested by: Host: assets.adobedtm.com
URL: http://assets.adobedtm.com/90b129d72f4716e69353423cbd3d35a4caed23e2/satelliteLib-c3d7b7de9b02c9d954ceaaf6bbd23274ad622720.js
Protocol: HTTP/1.1
Security: , ,
Server: 104.111.217.111 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a104-111-217-111.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: d371bad102b232c1971da45a36104d7719ff0fb845608590d0bd1573049fa057

Request headers

Referer: http://unit42.elegance.work/the-gopher-in-the-room-analysis-of-golang-malware-in-the-wild/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 10 Jul 2019 14:22:31 GMT
Content-Encoding: gzip
Last-Modified: Wed, 10 Jul 2019 02:13:44 GMT
Server: Apache
ETag: "6b40b63d265a1800e76e0533e230814c:1562724824"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Cache-Control: max-age=3600
Connection: keep-alive
Accept-Ranges: bytes
Timing-Allow-Origin: *
Content-Length: 37312
Expires: Wed, 10 Jul 2019 15:22:31 GMT

GET
H2 200 jquery.auto-complete.min.js Show response
www.paloaltonetworks.com/content/dam/pan/en_US/includes/ 4 KB
2 KB 14ms
14ms Script
application/javascript 2a02:26f0:6c00:29e::c3a
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.paloaltonetworks.com/content/dam/pan/en_US/includes/jquery.auto-complete.min.js?_=1562768536405

Requested by

Host: unit42.elegance.work
URL: http://unit42.elegance.work/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:29e::c3a , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Apache /

Resource Hash

dac8bfebb4b63724c5ec1c068f142999c44950ec55208499d1ef0408025eedd9

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: http://unit42.elegance.work/the-gopher-in-the-room-analysis-of-golang-malware-in-the-wild/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Wed, 10 Jul 2019 14:22:31 GMT
content-encoding: gzip
vary: Accept-Encoding
last-modified: Mon, 23 Apr 2018 23:43:21 GMT
server: Apache
x-frame-options: SAMEORIGIN
content-type: application/javascript
status: 200
cache-control: max-age=86400
server-timing: cdn-cache; desc=HIT, edge; dur=2
x-robots-tag: noindex
content-length: 1359
expires: Thu, 11 Jul 2019 14:22:31 GMT

GET reveal
reveal.clearbit.com/v1/companies/ 0
0

GET
H2 200 clearbit-autocomplete.css
www.paloaltonetworks.com/content/dam/pan/en_US/includes/ 2 KB
812 B 12ms
12ms Stylesheet
text/css 2a02:26f0:6c00:29e::c3a
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.paloaltonetworks.com/content/dam/pan/en_US/includes/clearbit-autocomplete.css

Requested by

Host: unit42.elegance.work
URL: http://unit42.elegance.work/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:29e::c3a , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Akamai Resource Optimizer /

Resource Hash

a3b5bbf736e60bb0ad1fc9696df0cb7631b9a1a4ea73a3e827c66288ef2d8918

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: http://unit42.elegance.work/the-gopher-in-the-room-analysis-of-golang-malware-in-the-wild/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Wed, 10 Jul 2019 14:22:31 GMT
content-encoding: br
last-modified: Mon, 08 Jul 2019 12:57:21 GMT
server: Akamai Resource Optimizer
x-frame-options: SAMEORIGIN
etag: W/"e0175-856-58d2afc14b9f5"
vary: Accept-Encoding
content-type: text/css
status: 200
cache-control: max-age=86400
server-timing: cdn-cache; desc=HIT, edge; dur=0
accept-ranges: bytes
content-length: 535
expires: Thu, 11 Jul 2019 14:22:31 GMT

GET
H/1.1 200
OK s05147135468298
paloaltonetworks.d1.sc.omtrdc.net/b/ss/panw-dev/1/JS-2.13.1-D7QN/ 43 B
590 B 21ms
20ms Image
image/gif 66.117.29.224
Adobe Systems Inc.

General

Check archive.org

Show headers Download Go to Show image

Full URL

http://paloaltonetworks.d1.sc.omtrdc.net/b/ss/panw-dev/1/JS-2.13.1-D7QN/s05147135468298?AQB=1&ndh=1&pf=1&t=10%2F6%2F2019%2016%3A22%3A31%203%20-120&D=D%3D&mid=32179264565889797954098171435332511827&aamlh=6&ce=UTF-8&fpCookieDomainPeriods=2&pageName=unit42.elegance.work%3A%20the-gopher-in-the-room-analysis-of-golang-malware-in-the-wild&g=http%3A%2F%2Funit42.elegance.work%2Fthe-gopher-in-the-room-analysis-of-golang-malware-in-the-wild%2F&cc=USD&server=unit42.elegance.work&events=event18%3D17.5%2Cevent19%2Cevent99%3D175&aamb=RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y&c1=7%3A22%20AM%7CWednesday&v1=7%3A22%20AM%7CWednesday&c2=First%20Visit&v2=First%20Visit&c4=1&v4=1&c5=New&v5=New&c6=the%20gopher%20in%20the%20room%3A%20analysis%20of%20golang%20malware%20in%20the%20wild&v6=the%20gopher%20in%20the%20room%3A%20analysis%20of%20golang%20malware%20in%20the%20wild&c7=D%3Dg&v7=D%3Dg&v8=Chrome%2074&c14=21.2%7CJS-DTM%3AAll%20Websites2.13.1%7C171127&c17=175&c32=0%7C0&c33=0x0&c34=0x0&c47=VisitorAPI%20Present&v58=175&v66=32179264565889797954098171435332511827&v109=id-n%2Fa&v117=Direct&v118=Direct&v127=Not%20Available&v140=no-machine-id&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&mcorgid=9A531C8B532965080A490D4D%40AdobeOrg&AQE=1

Requested by

Host: unit42.elegance.work
URL: http://unit42.elegance.work/the-gopher-in-the-room-analysis-of-golang-malware-in-the-wild/

Protocol

HTTP/1.1

Security

, ,

Server

66.117.29.224 , United States, ASN15224 (OMNITURE - Adobe Systems Inc., US),

Reverse DNS

Software

Omniture DC/2.0.0 /

Resource Hash

a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: http://unit42.elegance.work/the-gopher-in-the-room-analysis-of-golang-malware-in-the-wild/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 10 Jul 2019 14:22:31 GMT
X-Content-Type-Options: nosniff
X-C: ms-6.8.1
P3P: CP="This is not a P3P policy"
Connection: keep-alive
Content-Length: 43
X-XSS-Protection: 1; mode=block
Pragma: no-cache
Last-Modified: Thu, 11 Jul 2019 14:22:31 GMT
Server: Omniture DC/2.0.0
xserver: www5
ETag: "3356019908968218624-5738679942024032063"
Vary: *
Content-Type: image/gif
Access-Control-Allow-Origin: *
Cache-Control: no-cache, no-store, max-age=0, no-transform, private
Expires: Tue, 09 Jul 2019 14:22:31 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: unit42.elegance.work
URL: http://unit42.elegance.work/wp-content/uploads/2019/06/word-image-15.png

Domain: unit42.elegance.work
URL: http://unit42.elegance.work/wp-content/uploads/2019/06/word-image-16.png

Domain: reveal.clearbit.com
URL: https://reveal.clearbit.com/v1/companies/reveal?authorization=pk_a7b38d0c71f19d959e5ad59cd17bf59a&variable=reveal&_=1562768536406

Verdicts & Comments Add Verdict or Comment

75 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

3 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: http://unit42.elegance.work/wp-includes/js/jquery/jquery-migrate.min.js?ver=1.4.1(Line 2) Message: JQMIGRATE: Migrate is installed, version 1.4.1
console-api	log	URL: http://assets.adobedtm.com/90b129d72f4716e69353423cbd3d35a4caed23e2/s-code-contents-20fe37e21b06197de161fc72215f77955e6b1712.js(Line 53) Message: Error, missing Report Suite ID in AppMeasurement initialization
console-api	log	URL: http://assets.adobedtm.com/90b129d72f4716e69353423cbd3d35a4caed23e2/s-code-contents-20fe37e21b06197de161fc72215f77955e6b1712.js(Line 206) Message: Analytics loaded, version:

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

assets.adobedtm.com
blog.paloaltonetworks.com
dpm.demdex.net
paloaltonetworks.d1.sc.omtrdc.net
researchcenter.paloaltonetworks.com
reveal.clearbit.com
stats.g.doubleclick.net
unit42.elegance.work
www.google-analytics.com
www.google.com
www.google.de
www.gstatic.com
www.paloaltonetworks.com
reveal.clearbit.com
unit42.elegance.work
104.103.100.157
104.111.217.111
173.236.35.250
2a00:1450:4001:808::2003
2a00:1450:4001:817::2003
2a00:1450:4001:81c::2004
2a00:1450:4001:81e::200e
2a00:1450:400c:c06::9c
2a02:26f0:6c00:29e::c3a
52.212.6.126
66.117.29.224
042d0c8026a02a05f6aaa716bab41322c8598ce3580a88dda247c2534d833bfe
094ba542d10bfe736b29264ed9423fcef4236e9b7b6501ddae79d7008128afcf
1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f
18aa66c192cbef43a61b1398c292ae5c6c1d40d679428ee998b1c6bfaf61d75a
193fbb968733b8a7049da19274546e6b80b76e9a8f1b837fee9a5fdeb8f97c7b
1c34654c554418c5a458e7bdc59c5c36eefc8c4a18ae4b69cb95cf3210c3ecf0
1db21d816296e6939ba1f42962496e4134ae2b0081e26970864c40c6d02bb1df
2152557cac69e2bd7d6debef5037a9f554f9209cc305b8141b3329acb10c42b7
23d062b46761d2148b84ca93d72dfdf2f16833f2ebb54ebdafdf25f1e10afc50
276401632a998400be8a5895038f4f72d3760d3c3d6aaf3cf445d109cb9d1540
4844bcb531434637624bd9e9568a012777af451a6ad746b43b9503a3a77773ba
48eb8b500ae6a38617b5738d2b3faec481922a7782246e31d2755c034a45cd5d
4b8fe5c3d0e5ef7a6582185cbf5c535b5d369c8df1da98c03ed69833e55f474d
5a9dcb270ba38d94fd27a5ae4c6a6d10bb6a25fe0473df95fe4c405e82801289
60593ef08991381d651875bc78e259b2b66938e1b66175a445a7fefdb46e3d78
6545c4d7e7c4fa643fb3dbc74cdb699d9289b83a4882bb8625206974a547c4f8
74011ee1ebf7bcce1b5d33554e6f8470683b0891a89456dab45489f99d3a2084
741b4b38e329d8e96a629a2e063ddba83f0894fc77200cab48c5a70933f3332f
74a8ba118fe9dd54de26acf8042b40b1ab1dadc25f07bab2bbc9047989618a75
756df835cdc3e6d51abfaa6f2cd0d48a3430e2bcc2c12566e06dc79f3ba4ff74
8b180247ed8eeb6e1b6c55026770e825b221d62292072fb01b70ef727eae3d15
90f36058490ad70a82e54642a54b7bd24e03a5bff4f2ab0d3cb9b89d1d0e9485
91c8504b5a55cd04f35927c5fffd818afc53f2a37924e9ade9fdc5a8847c088a
951c201eceb26489dc9b4cc8ea4e408ae957410ea32b0fc7d4845d851886739f
9a01022937485049cf468c29d52e6ff63e304fd2f4fb36fc3b3af21eae6b3646
9fd7bfa229eec86e2b02fdcf85e49e5b2699a2d9cd53ee36b4df53513d1da1f3
a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506
a3b5bbf736e60bb0ad1fc9696df0cb7631b9a1a4ea73a3e827c66288ef2d8918
a52764d556885a2269e16265533a72b9b8c30119cfc2f906f8361b0a106b2411
c452cf6e1316f6aa6da38b72be07abbeaff1d4df66de567e83d6cf1c6b6fcdc7
c946d2f8fb58e661ceb211686779c9e0de80461e97ce3e42b0cc787cc3d55ba4
ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356
d371bad102b232c1971da45a36104d7719ff0fb845608590d0bd1573049fa057
d47b97907e23c9ee25cc5ad69295b8f45e3af0f9620f9f1c868258d129d276d1
d7fa4058d9e6a1174dff0ac83996bea8706772f0d2e2eeddb31b72e7a65a16ef
dac8bfebb4b63724c5ec1c068f142999c44950ec55208499d1ef0408025eedd9
db4a27662605f24990be4b107fce043114aaad83ffa07f62588f23bffd28f0ca
ddd4ef7f97f4361b60841d59753218a57134b0f99f5b46a9612234f1c2733ab0
df35525390ccc434316ed0514469c12c622dd89e107148f71ab8b5256d06cc9b
e2c997abb38ede2240d957b57a3216882e8416b1f757f26b92128a8875e00e73
e3852329019e5662acec7d5a335114e80c30593602bd09bb65487872586f00f8
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e3d961493e244e06bf91a9857442891e2e2ad8d49cf8e0a7781c53f0707443d7
e426a3dcfd3548cb02cee9df0c0504691b0c4eaca01023f03f0d2b738448c3a3
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f46d96d805c7e9e467422dfe516c43edb4632c0273cea26722fee7ba885f869e
fae07a533098c30def81bb1c4ff7b1ad6eb91e6f37f8f5f7a864da2643418fde

unit42.elegance.work Open in urlscan Pro 173.236.35.250 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

50 Requests

18 %HTTPS

55 %IPv6

11 Domains

13 Subdomains

11 IPs

6 Countries

1027 kBTransfer

1470 kBSize

0 Cookies

52 Outgoing links

Redirected requests

50 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

unit42.elegance.work Open in urlscan Pro
173.236.35.250 Public Scan

Screenshot
Live screenshot

Full Image

50
Requests

18 %
HTTPS

55 %
IPv6

11
Domains

13
Subdomains

11
IPs

6
Countries

1027 kB
Transfer

1470 kB
Size

0
Cookies

50 HTTP transactions
0 data transactions