www.helpnetsecurity.com Open in urlscan Pro
100.20.27.10 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.helpnetsecurity.com/2024/08/28/cve-2024-7262-cve-2024-7263/
Submission: On August 29 via api (August 29th 2024, 2:12:50 am UTC) from TR — Scanned from DE

Summary HTTP 17 Redirects Links 13 Behaviour Indicators

Summary

This website contacted 8 IPs in 2 countries across 4 domains to perform 17 HTTP transactions. The main IP is 100.20.27.10, located in Boardman, United States and belongs to AMAZON-02, US. The main domain is www.helpnetsecurity.com. The Cisco Umbrella rank of the primary domain is 662751.
TLS certificate: Issued by Amazon RSA 2048 M02 on June 14th 2024. Valid for: a year.

This is the only time www.helpnetsecurity.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
8	100.20.27.10 100.20.27.10	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:829::200a	15169 (GOOGLE) (GOOGLE)
1	99.86.4.104 99.86.4.104	16509 (AMAZON-02) (AMAZON-02)
1	2600:9000:272... 2600:9000:2724:4400:c:7d55:b3c0:93a1	16509 (AMAZON-02) (AMAZON-02)
3	2a00:1450:400... 2a00:1450:4001:80b::2003	15169 (GOOGLE) (GOOGLE)
2	52.222.214.41 52.222.214.41	16509 (AMAZON-02) (AMAZON-02)
1	18.195.235.189 18.195.235.189	16509 (AMAZON-02) (AMAZON-02)
17	8

8 100.20.27.10 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-100-20-27-10.us-west-2.compute.amazonaws.com

www.helpnetsecurity.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:829::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 99.86.4.104 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-99-86-4-104.fra6.r.cloudfront.net

img2.helpnetsecurity.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2724:4400:c:7d55:b3c0:93a1 (United States)

ASN16509 (AMAZON-02, US)

cdn.matomo.cloud	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:80b::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.222.214.41 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-222-214-41.fra56.r.cloudfront.net

img.helpnetsecurity.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.195.235.189 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-195-235-189.eu-central-1.compute.amazonaws.com

helpnetsecurity.matomo.cloud	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
11	helpnetsecurity.com www.helpnetsecurity.com — Cisco Umbrella Rank: 662751 img2.helpnetsecurity.com img.helpnetsecurity.com	97 KB
3	gstatic.com fonts.gstatic.com	55 KB
2	matomo.cloud cdn.matomo.cloud — Cisco Umbrella Rank: 29612 helpnetsecurity.matomo.cloud	40 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 110	1 KB
17	4

	Domain	Requested by
8	www.helpnetsecurity.com	www.helpnetsecurity.com
3	fonts.gstatic.com	fonts.googleapis.com
2	img.helpnetsecurity.com	www.helpnetsecurity.com
1	helpnetsecurity.matomo.cloud	cdn.matomo.cloud
1	cdn.matomo.cloud	www.helpnetsecurity.com
1	img2.helpnetsecurity.com	www.helpnetsecurity.com
1	fonts.googleapis.com	www.helpnetsecurity.com
17	7

This site contains links to these domains. Also see Links.

Domain
twitter.com
www.linkedin.com
helpnet.link
www.facebook.com
ec2-100-20-27-10.us-west-2.compute.amazonaws.com
www.cisecurity.org

Subject Issuer	Validity	Valid
*.helpnetsecurity.com Amazon RSA 2048 M02	`2024-06-14` - `2025-07-12`	a year	crt.sh
upload.video.google.com WR2	`2024-08-05` - `2024-10-28`	3 months	crt.sh
img2.helpnetsecurity.com Amazon RSA 2048 M03	`2024-06-13` - `2025-07-12`	a year	crt.sh
cdn.matomo.cloud Amazon RSA 2048 M03	`2023-10-27` - `2024-11-23`	a year	crt.sh
*.gstatic.com WR2	`2024-08-05` - `2024-10-28`	3 months	crt.sh
img.helpnetsecurity.com Amazon RSA 2048 M02	`2024-06-13` - `2025-07-12`	a year	crt.sh
*.matomo.cloud Amazon RSA 2048 M02	`2024-05-21` - `2025-06-19`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://www.helpnetsecurity.com/2024/08/28/cve-2024-7262-cve-2024-7263/
Frame ID: CEFF3D10A95EBBCFD8B698E69B38A743
Requests: 19 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

APT group exploits WPS Office for Windows RCE vulnerability (CVE-2024-7262) - Help Net Security

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

<link rel=["']stylesheet["'] [^>]+/wp-(?:content|includes)/
/wp-(?:content|includes)/

Yoast SEO (SEO) Expand

Overall confidence: 100%
Detected patterns

<!-- This site is optimized with the Yoast (?:WordPress )?SEO plugin v([\d.]+) -

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Page Statistics

17
Requests

100 %
HTTPS

43 %
IPv6

4
Domains

7
Subdomains

8
IPs

2
Countries

193 kB
Transfer

495 kB
Size

1
Cookies

13 Outgoing links

These are links going to different origins than the main page.

URL: https://twitter.com/helpnetsecurity

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/helpnetsecurity

Search URL Search Domain Scan URL

URL: https://helpnet.link/2c9312

Search URL Search Domain Scan URL

URL: https://www.facebook.com/sharer/sharer.php?u=https://www.helpnetsecurity.com/2024/08/28/cve-2024-7262-cve-2024-7263/&title=APT%20group%20exploits%20WPS%20Office%20for%20Windows%20RCE%20vulnerability%20(CVE-2024-7262)

Search URL Search Domain Scan URL

URL: https://twitter.com/intent/tweet?url=https://www.helpnetsecurity.com/2024/08/28/cve-2024-7262-cve-2024-7263/&text=APT+group+exploits+WPS+Office+for+Windows+RCE+vulnerability+%28CVE-2024-7262%29

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/shareArticle?mini=true&url=https://www.helpnetsecurity.com/2024/08/28/cve-2024-7262-cve-2024-7263/&title=APT%20group%20exploits%20WPS%20Office%20for%20Windows%20RCE%20vulnerability%20(CVE-2024-7262)&source=https://www.helpnetsecurity.com/2024/08/28/cve-2024-7262-cve-2024-7263/

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/in/romain-dumont-41b95882/
Title: Romain Dumont

Search URL Search Domain Scan URL

URL: https://ec2-100-20-27-10.us-west-2.compute.amazonaws.com/2024/08/28/blackbyte-new-encryptor-ttps/
Title: BlackByte affiliates use new encryptor and new TTPs

Search URL Search Domain Scan URL

URL: https://ec2-100-20-27-10.us-west-2.compute.amazonaws.com/2024/08/28/cve-2024-7262-cve-2024-7263/
Title: APT group exploits WPS Office for Windows RCE vulnerability (CVE-2024-7262)

Search URL Search Domain Scan URL

URL: https://ec2-100-20-27-10.us-west-2.compute.amazonaws.com/2024/08/28/cve-2024-6633/
Title: Critical Fortra FileCatalyst Workflow vulnerability patched (CVE-2024-6633)

Search URL Search Domain Scan URL

URL: https://www.cisecurity.org/insights/white-papers/cis-critical-security-controls-v8-1?utm_source=helpnet&utm_medium=sponsored&utm_campaign=controls&utm_term=theme_ech&utm_content=v8_1
Title: Download: CIS Critical Security Controls v8.1

Search URL Search Domain Scan URL

URL: https://ec2-100-20-27-10.us-west-2.compute.amazonaws.com/2024/08/28/pioneer-kitten-iranian-hackers-partnering-with-ransomware-affiliates/
Title: Pioneer Kitten: Iranian hackers partnering with ransomware affiliates

Search URL Search Domain Scan URL

URL: https://ec2-100-20-27-10.us-west-2.compute.amazonaws.com/2024/08/28/cryptomator-open-source-cloud-storage-encryption/
Title: Cryptomator: Open-source cloud storage encryption

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

17 HTTP transactions
2 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
www.helpnetsecurity.com/2024/08/28/cve-2024-7262-cve-2024-7263/ 70 KB
18 KB 890ms
512ms Document
text/html 100.20.27.10
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.helpnetsecurity.com/2024/08/28/cve-2024-7262-cve-2024-7263/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 100.20.27.10 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-100-20-27-10.us-west-2.compute.amazonaws.com
Software: Apache/2.4.54 (Debian) / PHP/8.0.27
Resource Hash: ce3b7b4048dc253d131d25def6cfa960bf411989f074fe0ee845b8ad3decd609

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

content-encoding: gzip
content-length: 17616
content-type: text/html; charset=UTF-8
date: Thu, 29 Aug 2024 02:12:43 GMT
link: <https://www.helpnetsecurity.com/wp-json/>; rel="https://api.w.org/" <https://www.helpnetsecurity.com/wp-json/wp/v2/posts/310115>; rel="alternate"; type="application/json" <https://www.helpnetsecurity.com/?p=310115>; rel=shortlink
server: Apache/2.4.54 (Debian)
vary: Accept-Encoding
x-powered-by: PHP/8.0.27
x-ua-compatible: IE=edge

GET
H2 200 form-themes.css
www.helpnetsecurity.com/wp-content/plugins/mailchimp-for-wp/assets/css/ 7 KB
1 KB 189ms
187ms Stylesheet
text/css 100.20.27.10
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.helpnetsecurity.com/wp-content/plugins/mailchimp-for-wp/assets/css/form-themes.css?ver=4.9.13
Requested by: Host: www.helpnetsecurity.com
URL: https://www.helpnetsecurity.com/2024/08/28/cve-2024-7262-cve-2024-7263/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 100.20.27.10 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-100-20-27-10.us-west-2.compute.amazonaws.com
Software: Apache/2.4.54 (Debian) /
Resource Hash: bcd3e29ac3fd83b7c69ff7b7476b67aa0c2d07b4bf5089e1f767823856c78c19

Request headers

Referer: https://www.helpnetsecurity.com/2024/08/28/cve-2024-7262-cve-2024-7263/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Thu, 29 Aug 2024 02:12:43 GMT
content-encoding: gzip
last-modified: Thu, 20 Jun 2024 11:45:08 GMT
server: Apache/2.4.54 (Debian)
vary: Accept-Encoding
content-type: text/css; charset=utf-8
accept-ranges: bytes
content-length: 1250

GET
H2 200 css
fonts.googleapis.com/ 18 KB
1 KB 168ms
32ms Stylesheet
text/css 2a00:1450:4001:829::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto%3A300%2C300i%2C400%2C400i%2C500%2C500i%2C700%2C700i&subset=latin%2Clatin-ext&display=swap

Requested by

Host: www.helpnetsecurity.com
URL: https://www.helpnetsecurity.com/2024/08/28/cve-2024-7262-cve-2024-7263/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

43c1442ae5959bac5957595d96e6503bbce4ba333af532fe4264d283ffe7453f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.helpnetsecurity.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Thu, 29 Aug 2024 02:12:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Thu, 29 Aug 2024 02:12:43 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 29 Aug 2024 02:12:43 GMT

GET
H2 200 style.1718883904.css
www.helpnetsecurity.com/wp-content/themes/hns24/ 145 KB
17 KB 191ms
190ms Stylesheet
text/css 100.20.27.10
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.helpnetsecurity.com/wp-content/themes/hns24/style.1718883904.css?ver=6.5.4
Requested by: Host: www.helpnetsecurity.com
URL: https://www.helpnetsecurity.com/2024/08/28/cve-2024-7262-cve-2024-7263/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 100.20.27.10 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-100-20-27-10.us-west-2.compute.amazonaws.com
Software: Apache/2.4.54 (Debian) /
Resource Hash: bd6199333391e5f5fb8626954b05c022471fef96112719e70106b66fc309cc26

Request headers

Referer: https://www.helpnetsecurity.com/2024/08/28/cve-2024-7262-cve-2024-7263/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Thu, 29 Aug 2024 02:12:43 GMT
content-encoding: gzip
last-modified: Thu, 20 Jun 2024 11:45:04 GMT
server: Apache/2.4.54 (Debian)
vary: Accept-Encoding
content-type: text/css; charset=utf-8
accept-ranges: bytes
content-length: 17681

GET
H2 200 CVE-2024-7262.webp
img2.helpnetsecurity.com/posts2024/ 31 KB
31 KB 165ms
29ms Image
image/webp 99.86.4.104
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img2.helpnetsecurity.com/posts2024/CVE-2024-7262.webp
Requested by: Host: www.helpnetsecurity.com
URL: https://www.helpnetsecurity.com/2024/08/28/cve-2024-7262-cve-2024-7263/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.104 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-104.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: ff64490fd7935ac03f4fde5cbbb336cae1adf0468247de11e03c287299b3f1cb

Request headers

Referer: https://www.helpnetsecurity.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Wed, 28 Aug 2024 03:52:20 GMT
x-amz-version-id: RKOhUKv_xdXKmWs.ltz66vn1n67qBOoI
via: 1.1 1b412557b82dda96e078541f9ee8dfb2.cloudfront.net (CloudFront)
last-modified: Wed, 28 Aug 2024 03:52:06 GMT
server: AmazonS3
x-amz-cf-pop: FRA6-C1
age: 80424
etag: "7dd82ef41001a165476939ed94048b82"
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-type: image/webp
accept-ranges: bytes
content-length: 31332
x-amz-cf-id: nl6dGVc2qcKJ4jU9BBGzIkSzBdO-2dUoq_vd-z2B9tjgHGbhD9ab2Q==

GET
H2 200 ads.dist.js Show response
www.helpnetsecurity.com/wp-content/themes/hns24/assets/js/ 236 B
387 B 189ms
188ms Script
application/javascript 100.20.27.10
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.helpnetsecurity.com/wp-content/themes/hns24/assets/js/ads.dist.js?ver=6.5.4
Requested by: Host: www.helpnetsecurity.com
URL: https://www.helpnetsecurity.com/2024/08/28/cve-2024-7262-cve-2024-7263/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 100.20.27.10 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-100-20-27-10.us-west-2.compute.amazonaws.com
Software: Apache/2.4.54 (Debian) /
Resource Hash: 166432cf26cb865bf0f1fbf25501d16871d19686bc018d426e59c23ffd8087b6

Request headers

Referer: https://www.helpnetsecurity.com/2024/08/28/cve-2024-7262-cve-2024-7263/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Thu, 29 Aug 2024 02:12:43 GMT
content-encoding: gzip
last-modified: Thu, 20 Jun 2024 11:45:12 GMT
server: Apache/2.4.54 (Debian)
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
accept-ranges: bytes
content-length: 192

GET
H2 200 forms.js Show response
www.helpnetsecurity.com/wp-content/plugins/mailchimp-for-wp/assets/js/ 6 KB
3 KB 188ms
187ms Script
application/javascript 100.20.27.10
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.helpnetsecurity.com/wp-content/plugins/mailchimp-for-wp/assets/js/forms.js?ver=4.9.13
Requested by: Host: www.helpnetsecurity.com
URL: https://www.helpnetsecurity.com/2024/08/28/cve-2024-7262-cve-2024-7263/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 100.20.27.10 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-100-20-27-10.us-west-2.compute.amazonaws.com
Software: Apache/2.4.54 (Debian) /
Resource Hash: 868a854b080d150aa6cc1a87d0d1b04cd8170e1bd891f93b610cd940d7a73108

Request headers

Referer: https://www.helpnetsecurity.com/2024/08/28/cve-2024-7262-cve-2024-7263/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Thu, 29 Aug 2024 02:12:43 GMT
content-encoding: gzip
last-modified: Thu, 20 Jun 2024 11:45:08 GMT
server: Apache/2.4.54 (Debian)
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
accept-ranges: bytes
content-length: 2617

GET
H2 200 ajax-forms.js Show response
www.helpnetsecurity.com/wp-content/plugins/mc4wp-premium/ajax-forms/assets/js/ 3 KB
2 KB 187ms
186ms Script
application/javascript 100.20.27.10
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.helpnetsecurity.com/wp-content/plugins/mc4wp-premium/ajax-forms/assets/js/ajax-forms.js?ver=4.10.2
Requested by: Host: www.helpnetsecurity.com
URL: https://www.helpnetsecurity.com/2024/08/28/cve-2024-7262-cve-2024-7263/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 100.20.27.10 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-100-20-27-10.us-west-2.compute.amazonaws.com
Software: Apache/2.4.54 (Debian) /
Resource Hash: 77e309bea37f3a1b822f94c9b20d5ae0533a24c3446da5686396e4f5518fd700

Request headers

Referer: https://www.helpnetsecurity.com/2024/08/28/cve-2024-7262-cve-2024-7263/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Thu, 29 Aug 2024 02:12:43 GMT
content-encoding: gzip
last-modified: Thu, 20 Jun 2024 11:45:14 GMT
server: Apache/2.4.54 (Debian)
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
accept-ranges: bytes
content-length: 1531

GET
H2 200 matomo.js Show response
cdn.matomo.cloud/helpnetsecurity.matomo.cloud/ 135 KB
40 KB 178ms
20ms Script
application/javascript 2600:9000:2724:4400:c:7d55:b3c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.matomo.cloud/helpnetsecurity.matomo.cloud/matomo.js

Requested by

Host: www.helpnetsecurity.com
URL: https://www.helpnetsecurity.com/2024/08/28/cve-2024-7262-cve-2024-7263/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2724:4400:c:7d55:b3c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

CloudFront /

Resource Hash

6c48decefc857d3ce02604d4bb249d5d9ee164dd43fb3c8ef77c569f15ca2e75

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://www.helpnetsecurity.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Thu, 29 Aug 2024 00:01:04 GMT
content-encoding: gzip
via: 1.1 b9b04d42286133992b582a519d8da04e.cloudfront.net (CloudFront)
x-amz-version-id: h9cEcEqFMQBR6q9ybByg.3zBU.hPpD2P
strict-transport-security: max-age=31536000
x-amz-cf-pop: FRA56-P12
age: 7900
x-cache: Hit from cloudfront
x-amz-replication-status: FAILED
alt-svc: h3=":443"; ma=86400
last-modified: Mon, 29 Apr 2024 00:01:49 GMT
server: CloudFront
etag: W/"ca010fce9ee54c3ca6ce3af5b2ca378c"
vary: accept-encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=691200
x-amz-cf-id: 2EDNijuqGt2riQsjY1hc9UITx3vAC6nQPfBxiaGYfMK5bkORHAfiAA==

GET
DATA 200
OK truncated
/ 448 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 9c34cb6a9452fb85aae9261facc001e5ddabbc244205164b7cb2d02a41ce7e57

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 1 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b3c2c0e3acf8a32716c89a22025aba9047be34cd2fe7a1316c17c0a2a8753d17

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v32/ 18 KB
18 KB 158ms
44ms Font
font/woff2 2a00:1450:4001:80b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v32/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A300%2C300i%2C400%2C400i%2C500%2C500i%2C700%2C700i&subset=latin%2Clatin-ext&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

89978e658e840b927dddb5cb3a835c7d8526ece79933bd9f3096b301fe1a8571

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.helpnetsecurity.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Mon, 26 Aug 2024 07:19:27 GMT
x-content-type-options: nosniff
age: 240797
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 18536
x-xss-protection: 0
last-modified: Thu, 01 Aug 2024 20:41:24 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 26 Aug 2025 07:19:27 GMT

GET
H2 200 KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v32/ 18 KB
18 KB 141ms
27ms Font
font/woff2 2a00:1450:4001:80b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmWUlfBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A300%2C300i%2C400%2C400i%2C500%2C500i%2C700%2C700i&subset=latin%2Clatin-ext&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d9bada3a44bb2ffa66dec5cc781cafc9ef17ed876cd9b0c5f7ef18228b63cebb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.helpnetsecurity.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 27 Aug 2024 14:09:26 GMT
x-content-type-options: nosniff
age: 129798
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 18596
x-xss-protection: 0
last-modified: Thu, 01 Aug 2024 20:41:21 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 27 Aug 2025 14:09:26 GMT

GET
H2 200 KFOlCnqEu92Fr1MmSU5fBBc4.woff2
fonts.gstatic.com/s/roboto/v32/ 18 KB
19 KB 136ms
22ms Font
font/woff2 2a00:1450:4001:80b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmSU5fBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A300%2C300i%2C400%2C400i%2C500%2C500i%2C700%2C700i&subset=latin%2Clatin-ext&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4dbd328e347e890a801d51f9a5f8d38a3efd51ec34c0aa22cc83d0a95d6d9d71

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.helpnetsecurity.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Mon, 26 Aug 2024 07:44:28 GMT
x-content-type-options: nosniff
age: 239296
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 18492
x-xss-protection: 0
last-modified: Thu, 01 Aug 2024 20:41:19 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 26 Aug 2025 07:44:28 GMT

GET
H2 200 1450275992_key-100x100.png
img.helpnetsecurity.com/wp-content/uploads/2015/12/09195727/ 2 KB
3 KB 139ms
23ms Image
image/png 52.222.214.41
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.helpnetsecurity.com/wp-content/uploads/2015/12/09195727/1450275992_key-100x100.png
Requested by: Host: www.helpnetsecurity.com
URL: https://www.helpnetsecurity.com/2024/08/28/cve-2024-7262-cve-2024-7263/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.222.214.41 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-214-41.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 978b36ee204db17a725e4007a0c391adbe09b03c1703be68a0d1fe9420cc3fb7

Request headers

Referer: https://www.helpnetsecurity.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sun, 29 Oct 2023 21:43:04 GMT
x-amz-version-id: sE8Fq0TPoxli3YBFdhCfrkUGmg7xWXHu
via: 1.1 d9523e44e96d2539081596bb1d268d44.cloudfront.net (CloudFront)
last-modified: Sat, 09 Nov 2019 19:01:54 GMT
server: AmazonS3
x-amz-cf-pop: FRA56-P3
age: 26281781
etag: "fa3716c74779d32c01ea5f5f5599df7a"
x-cache: Hit from cloudfront
content-type: image/png
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 2243
x-amz-cf-id: SogKo4B0_5rlk9rwzLTJTql0PRsqdcADZzejx90ZkdF_3dFr7uzQPw==
expires: Sun, 08 Nov 2020 18:57:27 GMT

POST
H2 200 admin-ajax.php Show response
www.helpnetsecurity.com/wp-admin/ 1 KB
1 KB 470ms
469ms Fetch
text/html 100.20.27.10
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.helpnetsecurity.com/wp-admin/admin-ajax.php

Requested by

Host: www.helpnetsecurity.com
URL: https://www.helpnetsecurity.com/2024/08/28/cve-2024-7262-cve-2024-7263/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

100.20.27.10 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-100-20-27-10.us-west-2.compute.amazonaws.com

Software

Apache/2.4.54 (Debian) / PHP/8.0.27

Resource Hash

f9d422a4da1e8769b2cc47098bba8e18d8a073f3b1d089694adb2812d9ef75bb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.helpnetsecurity.com/2024/08/28/cve-2024-7262-cve-2024-7263/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryAzqTMBD9leBhQlPB

Response headers

cf-edge-cache: no-cache
date: Thu, 29 Aug 2024 02:12:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-powered-by: PHP/8.0.27
content-length: 691
x-ua-compatible: IE=edge
referrer-policy: strict-origin-when-cross-origin
server: Apache/2.4.54 (Debian)
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: text/html; charset=UTF-8
access-control-allow-origin: https://www.helpnetsecurity.com
cache-control: no-cache, must-revalidate, max-age=0
access-control-allow-credentials: true
x-robots-tag: noindex
expires: Wed, 11 Jan 1984 05:00:00 GMT

POST
H2 204 matomo.php
helpnetsecurity.matomo.cloud/ 0
181 B 134ms
59ms Ping
text/plain 18.195.235.189
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://helpnetsecurity.matomo.cloud/matomo.php?action_name=APT%20group%20exploits%20WPS%20Office%20for%20Windows%20RCE%20vulnerability%20(CVE-2024-7262)%20-%20Help%20Net%20Security&idsite=1&rec=1&r=667701&h=4&m=12&s=44&url=https%3A%2F%2Fwww.helpnetsecurity.com%2F2024%2F08%2F28%2Fcve-2024-7262-cve-2024-7263%2F&_id=&_idn=1&send_image=0&_refts=0&pv_id=0PDhTu&fa_pv=1&fa_fp[0][fa_vid]=YRBL1c&fa_fp[0][fa_id]=mc4wp-form-1&fa_fp[0][fa_fv]=1&pf_net=379&pf_srv=512&pf_tfr=4&pf_dm1=207&uadata=%7B%22fullVersionList%22%3A%5B%5D%2C%22mobile%22%3Afalse%2C%22model%22%3A%22%22%2C%22platform%22%3A%22%22%2C%22platformVersion%22%3A%22%22%7D&pdf=1&qt=0&realp=0&wma=0&fla=0&java=0&ag=0&cookie=1&res=1600x1200

Requested by

Host: cdn.matomo.cloud
URL: https://cdn.matomo.cloud/helpnetsecurity.matomo.cloud/matomo.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.195.235.189 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-195-235-189.eu-central-1.compute.amazonaws.com

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://www.helpnetsecurity.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=utf-8

Response headers

access-control-allow-origin: https://www.helpnetsecurity.com
date: Thu, 29 Aug 2024 02:12:44 GMT
strict-transport-security: max-age=31536000
access-control-allow-credentials: true
server: Apache
vary: X-Forwarded-Proto,User-Agent

GET
H2 200 icon.svg
www.helpnetsecurity.com/wp-content/themes/hns24/ 2 KB
1 KB 188ms
187ms Other
image/svg+xml 100.20.27.10
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.helpnetsecurity.com/wp-content/themes/hns24/icon.svg
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 100.20.27.10 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-100-20-27-10.us-west-2.compute.amazonaws.com
Software: Apache/2.4.54 (Debian) /
Resource Hash: 8b5b1ebe6c0e785360a7cd5f209660b2d929065cd2a3dee86ff594f441926dde

Request headers

Referer: https://www.helpnetsecurity.com/2024/08/28/cve-2024-7262-cve-2024-7263/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Thu, 29 Aug 2024 02:12:44 GMT
content-encoding: gzip
last-modified: Thu, 20 Jun 2024 11:45:04 GMT
server: Apache/2.4.54 (Debian)
vary: Accept-Encoding
content-type: image/svg+xml
accept-ranges: bytes
content-length: 844

GET
H2 200 2024_03_cis8-l.png
img.helpnetsecurity.com/wp-content/uploads/2024/08/06111918/ 19 KB
19 KB 25ms
24ms Image
image/png 52.222.214.41
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.helpnetsecurity.com/wp-content/uploads/2024/08/06111918/2024_03_cis8-l.png
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.222.214.41 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-214-41.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: ecf34ad185c3d41bd9c9280bfbaf2a63552a853acaf46d62c13f028eb10c5ea2

Request headers

Referer: https://www.helpnetsecurity.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Wed, 21 Aug 2024 12:37:01 GMT
x-amz-version-id: LtFB8VXBttArg_O2941eslw3kL4dJxa5
via: 1.1 d9523e44e96d2539081596bb1d268d44.cloudfront.net (CloudFront)
last-modified: Tue, 06 Aug 2024 09:19:19 GMT
server: AmazonS3
x-amz-cf-pop: FRA56-P3
age: 653744
etag: "f604677c61a11fc6ea762e3c1a960e4c"
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-type: image/png
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 19230
x-amz-cf-id: uqwSSUxP2NBg0bpSk4rUL-pNqfZhL8qtCCskKS_NSL0JuqiN-qxiDg==

Verdicts & Comments Add Verdict or Comment

10 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.helpnetsecurity.com/	1969-12-31 23:59:59	Name: SSESS4decf0f010bae5a263354c26060a9ea3 Value: nq7de1tpl3emqr12tbpvena8l3

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.matomo.cloud
fonts.googleapis.com
fonts.gstatic.com
helpnetsecurity.matomo.cloud
img.helpnetsecurity.com
img2.helpnetsecurity.com
www.helpnetsecurity.com
100.20.27.10
18.195.235.189
2600:9000:2724:4400:c:7d55:b3c0:93a1
2a00:1450:4001:80b::2003
2a00:1450:4001:829::200a
52.222.214.41
99.86.4.104
166432cf26cb865bf0f1fbf25501d16871d19686bc018d426e59c23ffd8087b6
43c1442ae5959bac5957595d96e6503bbce4ba333af532fe4264d283ffe7453f
4dbd328e347e890a801d51f9a5f8d38a3efd51ec34c0aa22cc83d0a95d6d9d71
6c48decefc857d3ce02604d4bb249d5d9ee164dd43fb3c8ef77c569f15ca2e75
77e309bea37f3a1b822f94c9b20d5ae0533a24c3446da5686396e4f5518fd700
868a854b080d150aa6cc1a87d0d1b04cd8170e1bd891f93b610cd940d7a73108
89978e658e840b927dddb5cb3a835c7d8526ece79933bd9f3096b301fe1a8571
8b5b1ebe6c0e785360a7cd5f209660b2d929065cd2a3dee86ff594f441926dde
978b36ee204db17a725e4007a0c391adbe09b03c1703be68a0d1fe9420cc3fb7
9c34cb6a9452fb85aae9261facc001e5ddabbc244205164b7cb2d02a41ce7e57
b3c2c0e3acf8a32716c89a22025aba9047be34cd2fe7a1316c17c0a2a8753d17
bcd3e29ac3fd83b7c69ff7b7476b67aa0c2d07b4bf5089e1f767823856c78c19
bd6199333391e5f5fb8626954b05c022471fef96112719e70106b66fc309cc26
ce3b7b4048dc253d131d25def6cfa960bf411989f074fe0ee845b8ad3decd609
d9bada3a44bb2ffa66dec5cc781cafc9ef17ed876cd9b0c5f7ef18228b63cebb
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ecf34ad185c3d41bd9c9280bfbaf2a63552a853acaf46d62c13f028eb10c5ea2
f9d422a4da1e8769b2cc47098bba8e18d8a073f3b1d089694adb2812d9ef75bb
ff64490fd7935ac03f4fde5cbbb336cae1adf0468247de11e03c287299b3f1cb

www.helpnetsecurity.com Open in urlscan Pro 100.20.27.10 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

17 Requests

100 %HTTPS

43 %IPv6

4 Domains

7 Subdomains

8 IPs

2 Countries

193 kBTransfer

495 kBSize

1 Cookies

13 Outgoing links

Redirected requests

17 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

10 JavaScript Global Variables

1 Cookies

Indicators

www.helpnetsecurity.com Open in urlscan Pro
100.20.27.10 Public Scan

Screenshot
Live screenshot

Full Image

17
Requests

100 %
HTTPS

43 %
IPv6

4
Domains

7
Subdomains

8
IPs

2
Countries

193 kB
Transfer

495 kB
Size

1
Cookies

17 HTTP transactions
2 data transactions