intezer.com Open in urlscan Pro
199.16.172.82 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://intezer.com/blog/research/unraveling-malware-encryption-secrets/&#8221
Effective URL:
https://intezer.com/blog/research/unraveling-malware-encryption-secrets/&
Submission: On December 07 via api (December 7th 2024, 7:10:26 am UTC) from BY — Scanned from DE

Summary HTTP 123 Redirects Links 8 Behaviour Indicators

Summary

This website contacted 33 IPs in 4 countries across 28 domains to perform 123 HTTP transactions. The main IP is 199.16.172.82, located in United States and belongs to AUTOMATTIC, US. The main domain is intezer.com.
TLS certificate: Issued by E5 on November 13th 2024. Valid for: 3 months.

This is the only time intezer.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
8	199.16.172.82 199.16.172.82	2635 (AUTOMATTIC) (AUTOMATTIC)
6	2a00:1450:400... 2a00:1450:4001:813::2008	15169 (GOOGLE) (GOOGLE)
1	2600:9000:26d... 2600:9000:26da:7800:4:d7e1:700:93a1	16509 (AMAZON-02) (AMAZON-02)
56	192.0.77.39 192.0.77.39	2635 (AUTOMATTIC) (AUTOMATTIC)
3	172.67.39.148 172.67.39.148	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2606:4700::68... 2606:4700::6810:8dd1	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	172.217.18.4 172.217.18.4	15169 (GOOGLE) (GOOGLE)
2	192.0.76.3 192.0.76.3	2635 (AUTOMATTIC) (AUTOMATTIC)
1	2a00:1450:400... 2a00:1450:4001:813::200a	15169 (GOOGLE) (GOOGLE)
1	104.18.26.50 104.18.26.50	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2a02:26f0:350... 2a02:26f0:3500:10::210:a99	20940 (AKAMAI-AS...) (AKAMAI-ASN1 Akamai International B.V.)
2	2620:1ec:33:1... 2620:1ec:33:1::10	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
2	2a00:1450:400... 2a00:1450:4001:828::200e	15169 (GOOGLE) (GOOGLE)
1	142.250.74.195 142.250.74.195	15169 (GOOGLE) (GOOGLE)
3	2620:1ec:bdf::45 2620:1ec:bdf::45	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
5	2606:4700:20:... 2606:4700:20::681a:bc	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	52.218.242.224 52.218.242.224	16509 (AMAZON-02) (AMAZON-02)
2	2606:4700::68... 2606:4700::6812:1fb0	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	18.173.187.127 18.173.187.127	16509 (AMAZON-02) (AMAZON-02)
2	2a00:1450:400... 2a00:1450:400c:c07::9a	15169 (GOOGLE) (GOOGLE)
1 3	2620:1ec:21::14 2620:1ec:21::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	13.107.42.14 13.107.42.14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
2	2001:4860:480... 2001:4860:4802:32::36	15169 (GOOGLE) (GOOGLE)
1	142.250.186.35 142.250.186.35	15169 (GOOGLE) (GOOGLE)
2	2620:1ec:c11:... 2620:1ec:c11::237	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	2606:4700::68... 2606:4700::6810:a0a8	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700:440... 2606:4700:4400::ac40:9310	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:830::2003	15169 (GOOGLE) (GOOGLE)
2	3.215.198.72 3.215.198.72	14618 (AMAZON-AES) (AMAZON-AES)
3	172.175.38.6 172.175.38.6	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	51.77.64.70 51.77.64.70	16276 (OVH OVH SAS) (OVH OVH SAS)
1	2606:4700::68... 2606:4700::6810:7674	13335 (CLOUDFLAR...) (CLOUDFLARENET)
123	33

8 199.16.172.82 (United States)

ASN2635 (AUTOMATTIC, US)

intezer.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a00:1450:4001:813::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:26da:7800:4:d7e1:700:93a1 (United States)

ASN16509 (AMAZON-02, US)

sc.lfeeder.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

56 192.0.77.39 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)
PTR: wordpress.com

149520725.v2.pressablecdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 172.67.39.148 (United States)

ASN13335 (CLOUDFLARENET, US)

static.addtoany.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6810:8dd1 (United States)

ASN13335 (CLOUDFLARENET, US)

js.hs-scripts.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
js-na1.hs-scripts.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 172.217.18.4 (United States)

ASN15169 (GOOGLE, US)
PTR: fra02s19-in-f4.1e100.net

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 192.0.76.3 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)

stats.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pixel.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:813::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.18.26.50 (None, )

ASN13335 (CLOUDFLARENET, US)

cdn.mouseflow.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a02:26f0:3500:10::210:a99 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL)

snap.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2620:1ec:33:1::10 (United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

bat.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:828::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.74.195 (Plainview, United States)

ASN15169 (GOOGLE, US)
PTR: fra24s02-in-f3.1e100.net

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2620:1ec:bdf::45 (United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

www.clarity.ms	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2606:4700:20::681a:bc (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.getkoala.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
api.getkoala.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.218.242.224 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: s3-us-west-2.amazonaws.com

s3-us-west-2.amazonaws.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6812:1fb0 (United States)

ASN13335 (CLOUDFLARENET, US)

tracking.g2crowd.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.173.187.127 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-173-187-127.muc50.r.cloudfront.net

tr-rc.lfeeder.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:400c:c07::9a (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2620:1ec:21::14 (United States) 1 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.107.42.14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px4.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2001:4860:4802:32::36 (United States)

ASN15169 (GOOGLE, US)

region1.analytics.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.186.35 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s04-in-f3.1e100.net

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2620:1ec:c11::237 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

bat.bing.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:a0a8 (United States)

ASN13335 (CLOUDFLARENET, US)

js.hs-analytics.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:4400::ac40:9310 (United States)

ASN13335 (CLOUDFLARENET, US)

js.hs-banner.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:830::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 3.215.198.72 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-215-198-72.compute-1.amazonaws.com

secure.gaug.es	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 172.175.38.6 (Boydton, United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

k.clarity.ms	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 51.77.64.70 (Germany)

ASN16276 (OVH OVH SAS, FR)
PTR: de-fra-1.pro.ip-api.com

pro.ip-api.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:7674 (United States)

ASN13335 (CLOUDFLARENET, US)

track.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
56	pressablecdn.com 149520725.v2.pressablecdn.com	487 KB
8	intezer.com intezer.com	44 KB
6	clarity.ms www.clarity.ms — Cisco Umbrella Rank: 625 k.clarity.ms — Cisco Umbrella Rank: 8151	30 KB
6	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 39	553 KB
5	getkoala.com cdn.getkoala.com — Cisco Umbrella Rank: 74301 api.getkoala.com — Cisco Umbrella Rank: 48122	26 KB
5	google.com www.google.com — Cisco Umbrella Rank: 3 region1.analytics.google.com — Cisco Umbrella Rank: 4108	994 B
4	linkedin.com 1 redirects px.ads.linkedin.com — Cisco Umbrella Rank: 333 px4.ads.linkedin.com — Cisco Umbrella Rank: 7032	2 KB
3	addtoany.com static.addtoany.com — Cisco Umbrella Rank: 4382	28 KB
2	gaug.es secure.gaug.es — Cisco Umbrella Rank: 27256	4 KB
2	bing.net bat.bing.net — Cisco Umbrella Rank: 8327	466 B
2	doubleclick.net stats.g.doubleclick.net — Cisco Umbrella Rank: 135	912 B
2	g2crowd.com tracking.g2crowd.com — Cisco Umbrella Rank: 8407	2 KB
2	gstatic.com fonts.gstatic.com www.gstatic.com	265 KB
2	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 36	22 KB
2	bing.com bat.bing.com — Cisco Umbrella Rank: 359	16 KB
2	licdn.com snap.licdn.com — Cisco Umbrella Rank: 831	15 KB
2	wp.com stats.wp.com — Cisco Umbrella Rank: 3804 pixel.wp.com — Cisco Umbrella Rank: 3757	3 KB
2	hs-scripts.com js.hs-scripts.com — Cisco Umbrella Rank: 2580 js-na1.hs-scripts.com — Cisco Umbrella Rank: 6680	2 KB
2	lfeeder.com sc.lfeeder.com — Cisco Umbrella Rank: 15595 tr-rc.lfeeder.com — Cisco Umbrella Rank: 21771	12 KB
1	hubspot.com track.hubspot.com — Cisco Umbrella Rank: 2477	1 KB
1	ip-api.com pro.ip-api.com — Cisco Umbrella Rank: 7020	381 B
1	hs-banner.com js.hs-banner.com — Cisco Umbrella Rank: 2343	19 KB
1	hs-analytics.net js.hs-analytics.net — Cisco Umbrella Rank: 2358	25 KB
1	google.de www.google.de — Cisco Umbrella Rank: 10745	63 B
1	amazonaws.com s3-us-west-2.amazonaws.com	12 KB
1	mouseflow.com cdn.mouseflow.com — Cisco Umbrella Rank: 7737	17 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 29	2 KB
0	apollo.io Failed assets.apollo.io Failed
123	28

	Domain	Requested by
56	149520725.v2.pressablecdn.com	intezer.com 149520725.v2.pressablecdn.com
8	intezer.com	intezer.com 149520725.v2.pressablecdn.com
6	www.googletagmanager.com	intezer.com www.googletagmanager.com
4	api.getkoala.com	cdn.getkoala.com
3	k.clarity.ms	www.clarity.ms
3	px.ads.linkedin.com	1 redirects snap.licdn.com
3	www.clarity.ms	intezer.com bat.bing.com www.clarity.ms
3	www.google.com	intezer.com www.googletagmanager.com www.gstatic.com
3	static.addtoany.com	intezer.com static.addtoany.com
2	secure.gaug.es	intezer.com
2	bat.bing.net	bat.bing.com intezer.com
2	region1.analytics.google.com	www.googletagmanager.com
2	stats.g.doubleclick.net	www.google-analytics.com www.googletagmanager.com
2	tracking.g2crowd.com	intezer.com tracking.g2crowd.com
2	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com
2	bat.bing.com	www.googletagmanager.com bat.bing.com
2	snap.licdn.com	www.googletagmanager.com snap.licdn.com
1	track.hubspot.com
1	js-na1.hs-scripts.com	js.hs-analytics.net
1	pro.ip-api.com	s3-us-west-2.amazonaws.com
1	pixel.wp.com	intezer.com
1	www.gstatic.com	www.google.com
1	js.hs-banner.com	js.hs-scripts.com
1	js.hs-analytics.net	js.hs-scripts.com
1	www.google.de	intezer.com
1	px4.ads.linkedin.com	intezer.com
1	tr-rc.lfeeder.com	intezer.com
1	s3-us-west-2.amazonaws.com	intezer.com
1	cdn.getkoala.com	intezer.com
1	fonts.gstatic.com	fonts.googleapis.com
1	cdn.mouseflow.com	www.googletagmanager.com
1	fonts.googleapis.com	149520725.v2.pressablecdn.com
1	stats.wp.com	intezer.com
1	js.hs-scripts.com	intezer.com
1	sc.lfeeder.com	intezer.com
0	assets.apollo.io Failed	intezer.com
123	36

This site contains links to these domains. Also see Links.

Domain
www.intezer.com
docs.intezer.com
analyze.intezer.com
www.youtube.com
www.linkedin.com
twitter.com

Subject Issuer	Validity	Valid
tls.automattic.com E5	`2024-11-13` - `2025-02-11`	3 months	crt.sh
*.google-analytics.com WR2	`2024-11-04` - `2025-01-27`	3 months	crt.sh
*.lfeeder.com Amazon RSA 2048 M02	`2024-02-20` - `2025-03-20`	a year	crt.sh
v2.pressablecdn.com E5	`2024-10-12` - `2025-01-10`	3 months	crt.sh
static.addtoany.com WE1	`2024-11-03` - `2025-02-01`	3 months	crt.sh
hs-scripts.com WE1	`2024-11-24` - `2025-02-22`	3 months	crt.sh
*.google.com WR2	`2024-11-04` - `2025-01-27`	3 months	crt.sh
*.wp.com Sectigo ECC Domain Validation Secure Server CA	`2023-11-28` - `2024-12-28`	a year	crt.sh
upload.video.google.com WR2	`2024-11-04` - `2025-01-27`	3 months	crt.sh
cdn.mouseflow.com WE1	`2024-11-21` - `2025-02-19`	3 months	crt.sh
snap.licdn.com DigiCert SHA2 Secure Server CA	`2024-12-02` - `2025-12-01`	a year	crt.sh
www.bing.com Microsoft Azure RSA TLS Issuing CA 03	`2024-09-16` - `2025-03-15`	6 months	crt.sh
*.gstatic.com WR2	`2024-11-04` - `2025-01-27`	3 months	crt.sh
www.clarity.ms DigiCert TLS RSA SHA256 2020 CA1	`2024-09-04` - `2025-09-04`	a year	crt.sh
getkoala.com WE1	`2024-10-19` - `2025-01-17`	3 months	crt.sh
*.s3-us-west-2.amazonaws.com Amazon RSA 2048 M01	`2024-11-14` - `2025-11-11`	a year	crt.sh
g2crowd.com WE1	`2024-10-19` - `2025-01-17`	3 months	crt.sh
*.g.doubleclick.net WR2	`2024-10-21` - `2025-01-13`	3 months	crt.sh
www.linkedin.com DigiCert SHA2 Secure Server CA	`2024-10-14` - `2025-04-14`	6 months	crt.sh
*.google.de WR2	`2024-11-04` - `2025-01-27`	3 months	crt.sh
bat.bing.net Microsoft Azure RSA TLS Issuing CA 07	`2024-10-27` - `2025-04-25`	6 months	crt.sh
hs-analytics.net WE1	`2024-12-05` - `2025-03-05`	3 months	crt.sh
hs-banner.com WE1	`2024-11-22` - `2025-02-20`	3 months	crt.sh
*.gaug.es Sectigo RSA Domain Validation Secure Server CA	`2024-03-03` - `2025-04-03`	a year	crt.sh
a.clarity.ms Microsoft Azure RSA TLS Issuing CA 08	`2024-06-23` - `2025-06-18`	a year	crt.sh
*.ip-api.com Sectigo RSA Domain Validation Secure Server CA	`2023-12-21` - `2025-01-20`	a year	crt.sh
hubspot.com WE1	`2024-12-01` - `2025-03-01`	3 months	crt.sh

This page contains 4 frames:

Primary Page: https://intezer.com/blog/research/unraveling-malware-encryption-secrets/&
Frame ID: 43B077FB957A465BA8B07788E3BE2E50
Requests: 120 HTTP requests in this frame

Frame: https://www.googletagmanager.com/static/service_worker/4c30/sw_iframe.html?origin=https%3A%2F%2Fintezer.com
Frame ID: E8D31C6F5017427117E970AEA6FCBDEE
Requests: 1 HTTP requests in this frame

Frame: https://static.addtoany.com/menu/sm.25.html
Frame ID: 6CF11437AC685B16C96D95F2FAC3467F
Requests: 1 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LewXc8UAAAAADEYz8dYpHTk55uH2MjKqbyc1sXD&co=aHR0cHM6Ly9pbnRlemVyLmNvbTo0NDM.&hl=de&v=pPK749sccDmVW_9DSeTMVvh2&size=invisible&cb=4ulks2j839ld
Frame ID: D223C505D190320D434331892C66980C
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Page not found - Intezer

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

/wp-(?:content|includes)/

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

AddToAny (Widgets) Expand

Overall confidence: 100%
Detected patterns

addtoany\.com/menu/page\.js

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

HubSpot Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

js\.hs-analytics\.net/analytics

Linkedin Insight Tag (Analytics) Expand

Overall confidence: 100%
Detected patterns

snap\.licdn\.com/li\.lms-analytics/insight\.min\.js

Mouse Flow (Analytics) Expand

Overall confidence: 100%
Detected patterns

cdn\.mouseflow\.com

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

reCAPTCHA (Captchas) Expand

Overall confidence: 100%
Detected patterns

/recaptcha/api\.js

Page Statistics

123
Requests

98 %
HTTPS

56 %
IPv6

28
Domains

36
Subdomains

33
IPs

4
Countries

1591 kB
Transfer

4787 kB
Size

27
Cookies

8 Outgoing links

These are links going to different origins than the main page.

URL: https://www.intezer.com/terms-of-use/
Title: Terms of Use

Search URL Search Domain Scan URL

URL: https://www.intezer.com/privacy/
Title: Privacy Policy

Search URL Search Domain Scan URL

URL: https://docs.intezer.com/
Title: Documentation Dig into documentation about setup, integrations, and working with Intezer’s API

Search URL Search Domain Scan URL

URL: https://analyze.intezer.com/sign-in/?utm_campaign=login-btn&utm_source=intezer
Title: Log in

Search URL Search Domain Scan URL

URL: https://www.youtube.com/channel/UCt5L5ztHh-C1NCKa6bKjXFQ
Title: Youtube

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/intezer-labs
Title: Linkedin

Search URL Search Domain Scan URL

URL: https://twitter.com/intezerlabs

Search URL Search Domain Scan URL

URL: https://analyze.intezer.com/sign-in
Title: Log In

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 85

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1327356&time=1733555422288&url=https%3A%2F%2Fintezer.com%2Fblog%2Fresearch%2Funraveling-malware-encryption-secrets%2F%26%238221&tm=gtmv2 HTTP 302
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=1327356&time=1733555422288&url=https%3A%2F%2Fintezer.com%2Fblog%2Fresearch%2Funraveling-malware-encryption-secrets%2F%26%238221&tm=gtmv2&e_ipv6=AQKDL9FCST9bfgAAAZOf9ITSL8B6T4x8jXnyw0dLNlj4Ab_a81C2gL33dIWMpsqi

123 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 404 Primary Request & Show response
intezer.com/blog/research/unraveling-malware-encryption-secrets/ 146 KB
32 KB 1008ms
984ms Document
text/html 199.16.172.82
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://intezer.com/blog/research/unraveling-malware-encryption-secrets/&

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

199.16.172.82 , United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

4d52bfae84f573b802b6e5c12064b9c26b218755751bac6fdbc0325398419143

Security Headers

Name

Value

Content-Security-Policy

frame-ancestors 'self' *.intezer.com *.salesforce.com salesforce.com intezer.my.salesforce.com https://intezer.my.salesforce.com/; upgrade-insecure-requests; script-src 'self' 'report-sample' 'unsafe-inline' 'unsafe-eval' data: interactive-img.com/js/include.js *.datatables.net *.salesforce.com salesforce.com yoast.com stylemixthemes.com *.bootstrapcdn.com *.chilipiper.com *.na.chilipiper.com *.wp-rocket.me *.storylane.io *.clearbitscripts.com *.clearbitjs.com *.clarity.ms *.googleoptimize.com *.mouseflow.com *.lfeeder.com *.addtoany.com *.google.com *.googleapis.com *.intezer.com *.youtube.com googletagmanager.com *.opendns.com *.hsappstatic.net *.hsforms.net *.js-hsforms.net *.cloudflare.com *.comeet.co *.twitter.com *.gaug.es *.wp.com *.hsleadflows.net *.gstatic.com *.usemessages.com *.hs-banner.com *.licdn.com *.hs-analytics.net *.ads-twitter.com *.hs-scripts.com *.googleadservices.com *.hotjar.com *.hotjar.io *.bing.com *.microsoft.com *.clarity.ms *.googletagmanager.com *.doubleclick.net *.addtoany.com *.facebook.net *.google-analytics.com *.pressablecdn.com *.redditstatic.com *.getkoala.com *.cookieyes.com *.cdn-cookieyes.com *.hubspot.com *.g2crowd.com s3-us-west-2.amazonaws.com/b2bjsstore/b/GNLKQHEMX96Q/reb2b.js.gz; object-src 'self'; frame-src 'self' wordpress.com *.storylane.io *.wp-rocket.me *.chilipiper.com *.na.chilipiper.com *.mouseflow.com *.lfeeder.com *.addtoany.com *.hsappstatic.net *.usemessages.com *.recaptcha.net *.intezer.com *.salesforce.com salesforce.com intezer.my.salesforce.com *.hubspot.com *.pressablecdn.com *.hotjar.com *.hotjar.io *.hsforms.com *.googletagmanager.com *.wp.com *.google.com *.twitter.com *.facebook.com *.comeet.com *.comeet.co *.doubleclick.net *.youtube.com; child-src 'self' *.intezer.com; base-uri 'self' *.intezer.com; form-action 'self' *.hsforms.com *.twitter.com *.facebook.com *.g2crowd.com *.salesforce.com salesforce.com;

Strict-Transport-Security

max-age=31536000

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: no-cache, must-revalidate, max-age=0
content-encoding: br
content-security-policy: frame-ancestors 'self' *.intezer.com *.salesforce.com salesforce.com intezer.my.salesforce.com https://intezer.my.salesforce.com/; upgrade-insecure-requests; script-src 'self' 'report-sample' 'unsafe-inline' 'unsafe-eval' data: interactive-img.com/js/include.js *.datatables.net *.salesforce.com salesforce.com yoast.com stylemixthemes.com *.bootstrapcdn.com *.chilipiper.com *.na.chilipiper.com *.wp-rocket.me *.storylane.io *.clearbitscripts.com *.clearbitjs.com *.clarity.ms *.googleoptimize.com *.mouseflow.com *.lfeeder.com *.addtoany.com *.google.com *.googleapis.com *.intezer.com *.youtube.com googletagmanager.com *.opendns.com *.hsappstatic.net *.hsforms.net *.js-hsforms.net *.cloudflare.com *.comeet.co *.twitter.com *.gaug.es *.wp.com *.hsleadflows.net *.gstatic.com *.usemessages.com *.hs-banner.com *.licdn.com *.hs-analytics.net *.ads-twitter.com *.hs-scripts.com *.googleadservices.com *.hotjar.com *.hotjar.io *.bing.com *.microsoft.com *.clarity.ms *.googletagmanager.com *.doubleclick.net *.addtoany.com *.facebook.net *.google-analytics.com *.pressablecdn.com *.redditstatic.com *.getkoala.com *.cookieyes.com *.cdn-cookieyes.com *.hubspot.com *.g2crowd.com s3-us-west-2.amazonaws.com/b2bjsstore/b/GNLKQHEMX96Q/reb2b.js.gz; object-src 'self'; frame-src 'self' wordpress.com *.storylane.io *.wp-rocket.me *.chilipiper.com *.na.chilipiper.com *.mouseflow.com *.lfeeder.com *.addtoany.com *.hsappstatic.net *.usemessages.com *.recaptcha.net *.intezer.com *.salesforce.com salesforce.com intezer.my.salesforce.com *.hubspot.com *.pressablecdn.com *.hotjar.com *.hotjar.io *.hsforms.com *.googletagmanager.com *.wp.com *.google.com *.twitter.com *.facebook.com *.comeet.com *.comeet.co *.doubleclick.net *.youtube.com; child-src 'self' *.intezer.com; base-uri 'self' *.intezer.com; form-action 'self' *.hsforms.com *.twitter.com *.facebook.com *.g2crowd.com *.salesforce.com salesforce.com;
content-type: text/html; charset=UTF-8
date: Sat, 07 Dec 2024 07:10:22 GMT
expires: Wed, 11 Jan 1984 05:00:00 GMT
host-header: wpcloud
link: <https://intezer.com/wp-json/>; rel="https://api.w.org/"
server: nginx
strict-transport-security: max-age=31536000
vary: Accept-Encoding Cookie
x-ac: 1.hhn _atomic_ams MISS

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 422 KB
129 KB 60ms
38ms Script
application/javascript 2a00:1450:4001:813::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-WJV4WMH

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/unraveling-malware-encryption-secrets/&

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

98c01c3c72f888b1324c87f42945175edea1b2bc790cfb7c7d6cdcd093b27a16

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://intezer.com/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1080:0"}],}
expires: Sat, 07 Dec 2024 07:10:22 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 07 Dec 2024 07:10:22 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Sat, 07 Dec 2024 06:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1080:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 131257
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 lftracker_v1_YEgkB8lPLLw8ep3Z.js Show response
sc.lfeeder.com/ 31 KB
12 KB 62ms
14ms Script
application/javascript 2600:9000:26da:7800:4:d7e1:700:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://sc.lfeeder.com/lftracker_v1_YEgkB8lPLLw8ep3Z.js
Requested by: Host: intezer.com
URL: https://intezer.com/blog/research/unraveling-malware-encryption-secrets/&
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:26da:7800:4:d7e1:700:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 3da4a3da0a8fdf3a5c534b4ec332e85a42f2115e7c96a240216ee8fbf18d0aae

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://intezer.com/

Response headers

content-encoding: br
x-amz-version-id: pQPSA0GmNbIVfiHfSHgAvIE1x0mW6uAF
etag: W/"56af16385e0b0c9eff3084df9a202017"
age: 639
x-cache: Hit from cloudfront
x-amz-cf-id: R1ZkW0gH8eh62pHMiUzt78TRqo93EYqInGcCKL8Hywksw9XaptxTIw==
date: Sat, 07 Dec 2024 06:59:44 GMT
content-type: application/javascript
vary: accept-encoding, Origin
last-modified: Wed, 09 Oct 2024 07:34:42 GMT
cache-control: max-age=3600
cross-origin-resource-policy: cross-origin
via: 1.1 3a5ebe10b769db9444c2df2c2e8a76a8.cloudfront.net (CloudFront)
x-amz-cf-pop: MUC50-P4
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 style.min.css
149520725.v2.pressablecdn.com/wp-includes/css/dist/block-library/ 112 KB
15 KB 40ms
16ms Stylesheet
text/css 192.0.77.39
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://149520725.v2.pressablecdn.com/wp-includes/css/dist/block-library/style.min.css?ver=e14e519f58e4be4a5941885148f74694

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/unraveling-malware-encryption-secrets/&

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.39 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

3bb38d0f302677ff4104564454f60f495133579d6e6dfb722b3de850df596502

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://intezer.com/

Response headers

strict-transport-security: max-age=15552000
link: <http://intezer.com/wp-includes/css/dist/block-library/style.min.css>; rel="canonical"
cache-control: max-age=315360000
content-encoding: br
x-nc: HIT hhn 1
access-control-allow-methods: GET, HEAD
expires: Thu, 31 Dec 2037 23:55:55 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400, h3=":443"; ma=86400
date: Sat, 07 Dec 2024 07:10:22 GMT
x-ac: 2.hhn _atomic_ams MISS
content-type: text/css
last-modified: Thu, 07 Nov 2024 16:05:23 GMT
server: nginx
vary: Accept-Encoding

GET
H2 200 mediaelementplayer-legacy.min.css
149520725.v2.pressablecdn.com/wp-includes/js/mediaelement/ 11 KB
3 KB 39ms
16ms Stylesheet
text/css 192.0.77.39
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://149520725.v2.pressablecdn.com/wp-includes/js/mediaelement/mediaelementplayer-legacy.min.css?ver=4.2.17

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/unraveling-malware-encryption-secrets/&

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.39 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

b7908a015a567ec2363011df2475368dbff34360e9da3fdff50604d6395fb646

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://intezer.com/

Response headers

strict-transport-security: max-age=15552000
link: <http://intezer.com/wp-includes/js/mediaelement/mediaelementplayer-legacy.min.css>; rel="canonical"
cache-control: max-age=315360000
content-encoding: br
x-nc: HIT hhn 1
access-control-allow-methods: GET, HEAD
expires: Thu, 31 Dec 2037 23:55:55 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400, h3=":443"; ma=86400
date: Sat, 07 Dec 2024 07:10:22 GMT
x-ac: 1.hhn _atomic_ams MISS
content-type: text/css
last-modified: Tue, 29 Sep 2020 15:53:06 GMT
server: nginx
vary: Accept-Encoding

GET
H2 200 wp-mediaelement.min.css
149520725.v2.pressablecdn.com/wp-includes/js/mediaelement/ 4 KB
1 KB 45ms
22ms Stylesheet
text/css 192.0.77.39
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://149520725.v2.pressablecdn.com/wp-includes/js/mediaelement/wp-mediaelement.min.css?ver=e14e519f58e4be4a5941885148f74694

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/unraveling-malware-encryption-secrets/&

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.39 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

2e10d353ff038c2cad3492fc17801af3e6ef2669c9e9713bdb78b1dcb104c4fe

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://intezer.com/

Response headers

strict-transport-security: max-age=15552000
link: <http://intezer.com/wp-includes/js/mediaelement/wp-mediaelement.min.css>; rel="canonical"
cache-control: max-age=315360000
content-encoding: br
x-nc: HIT hhn 1
access-control-allow-methods: GET, HEAD
expires: Thu, 31 Dec 2037 23:55:55 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400, h3=":443"; ma=86400
date: Sat, 07 Dec 2024 07:10:22 GMT
x-ac: 2.hhn _atomic_ams MISS
content-type: text/css
last-modified: Fri, 07 Jun 2019 20:45:02 GMT
server: nginx
vary: Accept-Encoding

GET
H2 200 bootstrap.css
149520725.v2.pressablecdn.com/wp-content/themes/intezer-v2/css/ 187 KB
24 KB 46ms
23ms Stylesheet
text/css 192.0.77.39
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://149520725.v2.pressablecdn.com/wp-content/themes/intezer-v2/css/bootstrap.css?ver=e14e519f58e4be4a5941885148f74694

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/unraveling-malware-encryption-secrets/&

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.39 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

c40a0cdd5ab5dcc4da78066f70839808bb4ee8fb2f3360dec64fde438770b099

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://intezer.com/

Response headers

strict-transport-security: max-age=15552000
link: <http://intezer.com/wp-content/themes/intezer-v2/css/bootstrap.css>; rel="canonical"
cache-control: max-age=315360000
content-encoding: br
x-nc: HIT hhn 1
access-control-allow-methods: GET, HEAD
expires: Thu, 31 Dec 2037 23:55:55 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400, h3=":443"; ma=86400
date: Sat, 07 Dec 2024 07:10:22 GMT
x-ac: 1.hhn _atomic_ams MISS
content-type: text/css
last-modified: Sun, 13 Dec 2020 07:21:39 GMT
server: nginx
vary: Accept-Encoding

GET
H2 200 style.css
149520725.v2.pressablecdn.com/wp-content/themes/intezer-v2/ 206 KB
40 KB 54ms
31ms Stylesheet
text/css 192.0.77.39
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://149520725.v2.pressablecdn.com/wp-content/themes/intezer-v2/style.css?ver=1733555421

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/unraveling-malware-encryption-secrets/&

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.39 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

209cf774eba62c66b53a6fa3d37bfeed07d856422de590b973352a0bb85e86dc

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://intezer.com/

Response headers

strict-transport-security: max-age=15552000
link: <http://intezer.com/wp-content/themes/intezer-v2/style.css>; rel="canonical"
cache-control: max-age=315360000
content-encoding: br
x-nc: MISS hhn 1
access-control-allow-methods: GET, HEAD
expires: Thu, 31 Dec 2037 23:55:55 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400, h3=":443"; ma=86400
date: Sat, 07 Dec 2024 07:10:22 GMT
x-ac: 1.hhn _atomic_ams MISS
content-type: text/css
last-modified: Wed, 30 Oct 2024 07:55:48 GMT
server: nginx
vary: Accept-Encoding

GET
H2 200 fadeIn.min.css
149520725.v2.pressablecdn.com/wp-content/plugins/elementor/assets/lib/animations/styles/ 77 B
499 B 41ms
18ms Stylesheet
text/css 192.0.77.39
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://149520725.v2.pressablecdn.com/wp-content/plugins/elementor/assets/lib/animations/styles/fadeIn.min.css?ver=3.25.10

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/unraveling-malware-encryption-secrets/&

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.39 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

d9c370831c74b1850d70f5b1c99453d6cda21e5099428a3f21c43bd96c3acb5d

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://intezer.com/

Response headers

strict-transport-security: max-age=15552000
link: <http://intezer.com/wp-content/plugins/elementor/assets/lib/animations/styles/fadeIn.min.css>; rel="canonical"
cache-control: max-age=315360000
x-nc: HIT hhn 1
access-control-allow-methods: GET, HEAD
expires: Thu, 31 Dec 2037 23:55:55 GMT
accept-ranges: bytes
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400, h3=":443"; ma=86400
content-length: 77
date: Sat, 07 Dec 2024 07:10:22 GMT
x-ac: 2.hhn _atomic_ams MISS
content-type: text/css
last-modified: Mon, 25 Nov 2024 09:48:25 GMT
server: nginx

GET
H2 200 custom-frontend.min.css
149520725.v2.pressablecdn.com/wp-content/uploads/elementor/css/ 59 KB
8 KB 29ms
7ms Stylesheet
text/css 192.0.77.39
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://149520725.v2.pressablecdn.com/wp-content/uploads/elementor/css/custom-frontend.min.css?ver=1732175232

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/unraveling-malware-encryption-secrets/&

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.39 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

4edbb30d40d6fbee57e7f3dd7ce40167ef6d6cb5daacbcebc14c89d49848312c

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://intezer.com/

Response headers

strict-transport-security: max-age=15552000
link: <http://intezer.com/wp-content/uploads/elementor/css/custom-frontend.min.css>; rel="canonical"
cache-control: max-age=315360000
content-encoding: br
x-nc: HIT hhn 1
access-control-allow-methods: GET, HEAD
expires: Thu, 31 Dec 2037 23:55:55 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400, h3=":443"; ma=86400
date: Sat, 07 Dec 2024 07:10:22 GMT
x-ac: 2.hhn _atomic_ams MISS
content-type: text/css
last-modified: Thu, 21 Nov 2024 07:47:12 GMT
server: nginx
vary: Accept-Encoding

GET
H2 200 swiper.min.css
149520725.v2.pressablecdn.com/wp-content/plugins/elementor/assets/lib/swiper/v8/css/ 16 KB
5 KB 30ms
7ms Stylesheet
text/css 192.0.77.39
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://149520725.v2.pressablecdn.com/wp-content/plugins/elementor/assets/lib/swiper/v8/css/swiper.min.css?ver=8.4.5

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/unraveling-malware-encryption-secrets/&

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.39 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

c57e64fcb72bddafa9c38de574441c3e69ac6c961df96b0cad34da83658bd196

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://intezer.com/

Response headers

strict-transport-security: max-age=15552000
link: <http://intezer.com/wp-content/plugins/elementor/assets/lib/swiper/v8/css/swiper.min.css>; rel="canonical"
cache-control: max-age=315360000
content-encoding: br
x-nc: HIT hhn 1
access-control-allow-methods: GET, HEAD
expires: Thu, 31 Dec 2037 23:55:55 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400, h3=":443"; ma=86400
date: Sat, 07 Dec 2024 07:10:22 GMT
x-ac: 2.hhn _atomic_ams MISS
content-type: text/css
last-modified: Mon, 25 Nov 2024 09:48:25 GMT
server: nginx
vary: Accept-Encoding

GET
H2 200 e-swiper.min.css
149520725.v2.pressablecdn.com/wp-content/plugins/elementor/assets/css/conditionals/ 10 KB
1 KB 30ms
7ms Stylesheet
text/css 192.0.77.39
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://149520725.v2.pressablecdn.com/wp-content/plugins/elementor/assets/css/conditionals/e-swiper.min.css?ver=3.25.10

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/unraveling-malware-encryption-secrets/&

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.39 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

9bc52b3c4e9973d64baa482f332ed895f80d0cd2be37e6a49bf1a2e831eb5ac9

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://intezer.com/

Response headers

strict-transport-security: max-age=15552000
link: <http://intezer.com/wp-content/plugins/elementor/assets/css/conditionals/e-swiper.min.css>; rel="canonical"
cache-control: max-age=315360000
content-encoding: br
x-nc: HIT hhn 1
access-control-allow-methods: GET, HEAD
expires: Thu, 31 Dec 2037 23:55:55 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400, h3=":443"; ma=86400
date: Sat, 07 Dec 2024 07:10:22 GMT
x-ac: 1.hhn _atomic_ams MISS
content-type: text/css
last-modified: Mon, 25 Nov 2024 09:48:25 GMT
server: nginx
vary: Accept-Encoding

GET
H2 200 post-8921.css
149520725.v2.pressablecdn.com/wp-content/uploads/elementor/css/ 1 KB
824 B 30ms
8ms Stylesheet
text/css 192.0.77.39
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://149520725.v2.pressablecdn.com/wp-content/uploads/elementor/css/post-8921.css?ver=1732175232

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/unraveling-malware-encryption-secrets/&

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.39 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

8f5d8fdb9ab7ad2cdd14072ba8d7d306459e2e01bcb4e87b44f4b0f0fa835f27

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://intezer.com/

Response headers

strict-transport-security: max-age=15552000
link: <http://intezer.com/wp-content/uploads/elementor/css/post-8921.css>; rel="canonical"
cache-control: max-age=315360000
content-encoding: br
x-nc: HIT hhn 1
access-control-allow-methods: GET, HEAD
expires: Thu, 31 Dec 2037 23:55:55 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400, h3=":443"; ma=86400
date: Sat, 07 Dec 2024 07:10:22 GMT
x-ac: 1.hhn _atomic_ams MISS
content-type: text/css
last-modified: Thu, 21 Nov 2024 07:47:12 GMT
server: nginx
vary: Accept-Encoding

GET
H2 200 popup.min.css
149520725.v2.pressablecdn.com/wp-content/plugins/elementor-pro/assets/css/conditionals/ 974 B
790 B 32ms
9ms Stylesheet
text/css 192.0.77.39
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://149520725.v2.pressablecdn.com/wp-content/plugins/elementor-pro/assets/css/conditionals/popup.min.css?ver=3.25.4

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/unraveling-malware-encryption-secrets/&

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.39 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

104a8d629d83b0015aceaccb0ccff6178efeff33c99a132a148728f800431b93

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://intezer.com/

Response headers

strict-transport-security: max-age=15552000
link: <http://intezer.com/wp-content/plugins/elementor-pro/assets/css/conditionals/popup.min.css>; rel="canonical"
cache-control: max-age=315360000
content-encoding: br
x-nc: HIT hhn 1
access-control-allow-methods: GET, HEAD
expires: Thu, 31 Dec 2037 23:55:55 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400, h3=":443"; ma=86400
date: Sat, 07 Dec 2024 07:10:22 GMT
x-ac: 2.hhn _atomic_ams MISS
content-type: text/css
last-modified: Thu, 21 Nov 2024 07:47:08 GMT
server: nginx
vary: Accept-Encoding

GET
H2 200 post-28962.css
149520725.v2.pressablecdn.com/wp-content/uploads/elementor/css/ 1 KB
777 B 30ms
7ms Stylesheet
text/css 192.0.77.39
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://149520725.v2.pressablecdn.com/wp-content/uploads/elementor/css/post-28962.css?ver=1732175232

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/unraveling-malware-encryption-secrets/&

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.39 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

ce22146374a9ffdf8e2120212e21cf01990aa5df3d13e25b27627c00783b2638

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://intezer.com/

Response headers

strict-transport-security: max-age=15552000
link: <http://intezer.com/wp-content/uploads/elementor/css/post-28962.css>; rel="canonical"
cache-control: max-age=315360000
content-encoding: br
x-nc: HIT hhn 1
access-control-allow-methods: GET, HEAD
expires: Thu, 31 Dec 2037 23:55:55 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400, h3=":443"; ma=86400
date: Sat, 07 Dec 2024 07:10:22 GMT
x-ac: 2.hhn _atomic_ams MISS
content-type: text/css
last-modified: Thu, 21 Nov 2024 07:47:12 GMT
server: nginx
vary: Accept-Encoding

GET
H2 200 app.css
149520725.v2.pressablecdn.com/wp-content/plugins/simple-lightbox/client/css/ 231 B
641 B 42ms
19ms Stylesheet
text/css 192.0.77.39
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://149520725.v2.pressablecdn.com/wp-content/plugins/simple-lightbox/client/css/app.css?ver=2.9.3

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/unraveling-malware-encryption-secrets/&

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.39 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

f00c690f9ac9a7bbd3f1a4346472c52ff3329d51a5cc7823c2277b0aa041c443

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://intezer.com/

Response headers

strict-transport-security: max-age=15552000
link: <http://intezer.com/wp-content/plugins/simple-lightbox/client/css/app.css>; rel="canonical"
cache-control: max-age=315360000
x-nc: HIT hhn 1
access-control-allow-methods: GET, HEAD
expires: Thu, 31 Dec 2037 23:55:55 GMT
accept-ranges: bytes
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400, h3=":443"; ma=86400
content-length: 231
date: Sat, 07 Dec 2024 07:10:22 GMT
x-ac: 1.hhn _atomic_ams MISS
content-type: text/css
last-modified: Mon, 02 Jan 2023 15:42:45 GMT
server: nginx

GET
H2 200 addtoany.min.css
149520725.v2.pressablecdn.com/wp-content/plugins/add-to-any/ 2 KB
914 B 40ms
17ms Stylesheet
text/css 192.0.77.39
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://149520725.v2.pressablecdn.com/wp-content/plugins/add-to-any/addtoany.min.css?ver=1.16

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/unraveling-malware-encryption-secrets/&

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.39 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

c19e3e4151ea4933fa9ba9703c51fe20ad469237771214b1c5001d1b107ddef5

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://intezer.com/

Response headers

strict-transport-security: max-age=15552000
link: <http://intezer.com/wp-content/plugins/add-to-any/addtoany.min.css>; rel="canonical"
cache-control: max-age=315360000
content-encoding: br
x-nc: HIT hhn 1
access-control-allow-methods: GET, HEAD
expires: Thu, 31 Dec 2037 23:55:55 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400, h3=":443"; ma=86400
date: Sat, 07 Dec 2024 07:10:22 GMT
x-ac: 1.hhn _atomic_ams MISS
content-type: text/css
last-modified: Mon, 25 Nov 2024 09:47:23 GMT
server: nginx
vary: Accept-Encoding

GET
H2 200 style.css
149520725.v2.pressablecdn.com/wp-content/plugins/cf7-conditional-fields/ 2 KB
922 B 39ms
17ms Stylesheet
text/css 192.0.77.39
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://149520725.v2.pressablecdn.com/wp-content/plugins/cf7-conditional-fields/style.css?ver=2.5.3

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/unraveling-malware-encryption-secrets/&

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.39 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

cedc9155263d1f634191e71f3c9ce256b315f833e375739ed0e65087996428cc

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://intezer.com/

Response headers

strict-transport-security: max-age=15552000
link: <http://intezer.com/wp-content/plugins/cf7-conditional-fields/style.css>; rel="canonical"
cache-control: max-age=315360000
content-encoding: br
x-nc: HIT hhn 1
access-control-allow-methods: GET, HEAD
expires: Thu, 31 Dec 2037 23:55:55 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400, h3=":443"; ma=86400
date: Sat, 07 Dec 2024 07:10:22 GMT
x-ac: 2.hhn _atomic_ams MISS
content-type: text/css
last-modified: Wed, 04 Dec 2024 15:44:52 GMT
server: nginx
vary: Accept-Encoding

GET
H3 200 page.js Show response
static.addtoany.com/menu/ 3 KB
2 KB 63ms
21ms Script
application/javascript 172.67.39.148
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.addtoany.com/menu/page.js

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/unraveling-malware-encryption-secrets/&

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.39.148 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2471f4232ccca845a9da8b10e5be81e7323faa5891b9715f425661505f183434

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://intezer.com/

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"3ae23968c16ec39faa9f97db5ea5195b"
age: 18681
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qyoFO7h%2Fn%2BvU7VayUSU6Aovlwi0jPZFMLV9kRu8uEz%2Bi73a2hgsY5e1EZNWCQ4b4JN57aqcXkoLYBsiiBhvWqunO39Tofnzw7hTkK9s4CoFQJwQyqRHv5fpN3R%2F2Z6%2BHDTHG3mlm"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Sat, 07 Dec 2024 07:10:22 GMT
content-type: application/javascript
vary: Accept-Encoding
priority: u=3,i=?0
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400, stale-while-revalidate=30, public
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8ee2b20cf8cf9b45-FRA
access-control-allow-origin: *
server: cloudflare

GET
H2 200 jquery-3.2.1.min.js Show response
149520725.v2.pressablecdn.com/wp-content/themes/intezer-v2/js/ 279 KB
84 KB 44ms
22ms Script
application/javascript 192.0.77.39
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://149520725.v2.pressablecdn.com/wp-content/themes/intezer-v2/js/jquery-3.2.1.min.js?ver=e14e519f58e4be4a5941885148f74694

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/unraveling-malware-encryption-secrets/&

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.39 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

126add89639e7ac92dff67c061c2e32486ecca91d0d1d1ed8f1bc5ee34596a27

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://intezer.com/

Response headers

strict-transport-security: max-age=15552000
link: <http://intezer.com/wp-content/themes/intezer-v2/js/jquery-3.2.1.min.js>; rel="canonical"
cache-control: max-age=315360000
content-encoding: br
x-nc: HIT hhn 1
access-control-allow-methods: GET, HEAD
expires: Thu, 31 Dec 2037 23:55:55 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400, h3=":443"; ma=86400
date: Sat, 07 Dec 2024 07:10:22 GMT
x-ac: 1.hhn _atomic_ams HIT
content-type: application/javascript
last-modified: Mon, 05 Feb 2024 11:42:44 GMT
server: nginx
vary: Accept-Encoding

GET
H3 200 addtoany.min.js Show response
149520725.v2.pressablecdn.com/wp-content/plugins/add-to-any/ 129 B
530 B 23ms
20ms Script
application/javascript 192.0.77.39
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://149520725.v2.pressablecdn.com/wp-content/plugins/add-to-any/addtoany.min.js?ver=1.1

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/unraveling-malware-encryption-secrets/&

Protocol

Security

QUIC, , AES_128_GCM

Server

192.0.77.39 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

50679e0e3933c945348a2db0cc128bb14b57a60a74fabf8cae13acc14efbb2e1

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://intezer.com/

Response headers

strict-transport-security: max-age=15552000
link: <http://intezer.com/wp-content/plugins/add-to-any/addtoany.min.js>; rel="canonical"
cache-control: max-age=315360000
x-nc: HIT hhn 2
access-control-allow-methods: GET, HEAD
expires: Thu, 31 Dec 2037 23:55:55 GMT
accept-ranges: bytes
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400, h3=":443"; ma=86400
content-length: 129
date: Sat, 07 Dec 2024 07:10:22 GMT
x-ac: 1.hhn _atomic_ams MISS
content-type: application/javascript
last-modified: Mon, 25 Nov 2024 09:47:23 GMT
server: nginx

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 283 KB
98 KB 42ms
38ms Script
application/javascript 2a00:1450:4001:813::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-725468766

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/unraveling-malware-encryption-secrets/&

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

9ad1e9379d36751705965bcb5922f2970726c627d0ab441a380d0d7731c73db5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://intezer.com/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Sat, 07 Dec 2024 07:10:22 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 07 Dec 2024 07:10:22 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Sat, 07 Dec 2024 06:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 99737
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 style.basic-ho-is-po-no-da-au-co-au-se-is.css
149520725.v2.pressablecdn.com/wp-content/cache/asp/ 21 KB
5 KB 38ms
17ms Stylesheet
text/css 192.0.77.39
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://149520725.v2.pressablecdn.com/wp-content/cache/asp/style.basic-ho-is-po-no-da-au-co-au-se-is.css?mq=heUuLr

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/unraveling-malware-encryption-secrets/&

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.39 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

f825cbeb2a8aa255d837ad9d53514b6dcd0338ce353d817af7a64e80fb5203ec

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://intezer.com/

Response headers

strict-transport-security: max-age=15552000
link: <http://intezer.com/wp-content/cache/asp/style.basic-ho-is-po-no-da-au-co-au-se-is.css>; rel="canonical"
cache-control: max-age=315360000
content-encoding: br
x-nc: HIT hhn 1
access-control-allow-methods: GET, HEAD
expires: Thu, 31 Dec 2037 23:55:55 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400, h3=":443"; ma=86400
date: Sat, 07 Dec 2024 07:10:22 GMT
x-ac: 2.hhn _atomic_ams MISS
content-type: text/css
last-modified: Sun, 03 Nov 2024 14:36:20 GMT
server: nginx
vary: Accept-Encoding

GET
H2 200 mega-star.svg
intezer.com/assets/mega/ 307 B
627 B 8ms
7ms Image
image/svg+xml 199.16.172.82
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://intezer.com/assets/mega/mega-star.svg

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/unraveling-malware-encryption-secrets/&

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

199.16.172.82 , United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

07c5f537fe8fe8730f255bdbca90e77ef6b5612d396ed8dcabbd1888dd2776a0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://intezer.com/blog/research/unraveling-malware-encryption-secrets/&

Response headers

strict-transport-security: max-age=31536000
cache-control: max-age=31536000
etag: "661e2b5b-133"
access-control-allow-methods: GET, HEAD
expires: Sat, 06 Dec 2025 02:47:42 GMT
accept-ranges: bytes
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
content-length: 307
date: Sat, 07 Dec 2024 07:10:22 GMT
x-ac: 1.hhn _atomic_ams HIT
content-type: image/svg+xml
last-modified: Tue, 16 Apr 2024 07:40:11 GMT
server: nginx

GET
H3 200 intezer-logo-n.png
149520725.v2.pressablecdn.com/wp-content/uploads/2020/05/ 3 KB
4 KB 25ms
23ms Image
image/png 192.0.77.39
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://149520725.v2.pressablecdn.com/wp-content/uploads/2020/05/intezer-logo-n.png

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/unraveling-malware-encryption-secrets/&

Protocol

Security

QUIC, , AES_128_GCM

Server

192.0.77.39 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

e85052e09a7415a2ab775cc198a96dc956d9de42b90541a5cdc9c5c176725745

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://intezer.com/

Response headers

strict-transport-security: max-age=15552000
link: <http://intezer.com/wp-content/uploads/2020/05/intezer-logo-n.png>; rel="canonical"
cache-control: max-age=604800
x-nc: HIT hhn 2
access-control-allow-methods: GET, HEAD
expires: Sat, 14 Dec 2024 07:10:22 GMT
accept-ranges: bytes
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400, h3=":443"; ma=86400
content-length: 3525
date: Sat, 07 Dec 2024 07:10:22 GMT
x-ac: 1.hhn _atomic_ams HIT
content-type: image/png
last-modified: Sun, 13 Dec 2020 07:09:13 GMT
server: nginx

GET
H2 200 post-32757.css
149520725.v2.pressablecdn.com/wp-content/uploads/elementor/css/ 22 KB
2 KB 16ms
12ms Stylesheet
text/css 192.0.77.39
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://149520725.v2.pressablecdn.com/wp-content/uploads/elementor/css/post-32757.css?ver=1732175232

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/unraveling-malware-encryption-secrets/&

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.39 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

530caf71534c7f8a0673a1ad3cbceb6e7ae061953f850d0102b6b68fd9e17a5d

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://intezer.com/

Response headers

strict-transport-security: max-age=15552000
link: <http://intezer.com/wp-content/uploads/elementor/css/post-32757.css>; rel="canonical"
cache-control: max-age=315360000
content-encoding: br
x-nc: HIT hhn 1
access-control-allow-methods: GET, HEAD
expires: Thu, 31 Dec 2037 23:55:55 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400, h3=":443"; ma=86400
date: Sat, 07 Dec 2024 07:10:22 GMT
x-ac: 2.hhn _atomic_ams MISS
content-type: text/css
last-modified: Thu, 21 Nov 2024 07:47:12 GMT
server: nginx
vary: Accept-Encoding

GET
H2 200 widget-heading.min.css
149520725.v2.pressablecdn.com/wp-content/plugins/elementor/assets/css/ 600 B
592 B 16ms
13ms Stylesheet
text/css 192.0.77.39
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://149520725.v2.pressablecdn.com/wp-content/plugins/elementor/assets/css/widget-heading.min.css?ver=3.25.10

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/unraveling-malware-encryption-secrets/&

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.39 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

768ce279895a5bf92b52e3fd9141ec2e700dd614070e7f6f56ba0e75533fd08b

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://intezer.com/

Response headers

strict-transport-security: max-age=15552000
link: <http://intezer.com/wp-content/plugins/elementor/assets/css/widget-heading.min.css>; rel="canonical"
cache-control: max-age=315360000
content-encoding: br
x-nc: HIT hhn 1
access-control-allow-methods: GET, HEAD
expires: Thu, 31 Dec 2037 23:55:55 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400, h3=":443"; ma=86400
date: Sat, 07 Dec 2024 07:10:22 GMT
x-ac: 2.hhn _atomic_ams MISS
content-type: text/css
last-modified: Mon, 25 Nov 2024 09:48:25 GMT
server: nginx
vary: Accept-Encoding

GET
H3 200 post-33441.css
149520725.v2.pressablecdn.com/wp-content/uploads/elementor/css/ 10 KB
2 KB 9ms
8ms Stylesheet
text/css 192.0.77.39
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://149520725.v2.pressablecdn.com/wp-content/uploads/elementor/css/post-33441.css?ver=1732175232

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/unraveling-malware-encryption-secrets/&

Protocol

Security

QUIC, , AES_128_GCM

Server

192.0.77.39 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

d8ee8979b5cc9f40d08ebb95ed4755334afb6b9718434591d5e85a3e2a721c77

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://intezer.com/

Response headers

strict-transport-security: max-age=15552000
link: <http://intezer.com/wp-content/uploads/elementor/css/post-33441.css>; rel="canonical"
cache-control: max-age=315360000
content-encoding: br
x-nc: HIT hhn 2
access-control-allow-methods: GET, HEAD
expires: Thu, 31 Dec 2037 23:55:55 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400, h3=":443"; ma=86400
date: Sat, 07 Dec 2024 07:10:22 GMT
x-ac: 1.hhn _atomic_ams MISS
content-type: text/css
last-modified: Thu, 21 Nov 2024 07:47:12 GMT
server: nginx
vary: Accept-Encoding

GET
H3 200 widget-posts.min.css
149520725.v2.pressablecdn.com/wp-content/plugins/elementor-pro/assets/css/ 14 KB
3 KB 8ms
8ms Stylesheet
text/css 192.0.77.39
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://149520725.v2.pressablecdn.com/wp-content/plugins/elementor-pro/assets/css/widget-posts.min.css?ver=3.25.4

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/unraveling-malware-encryption-secrets/&

Protocol

Security

QUIC, , AES_128_GCM

Server

192.0.77.39 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

f859a8cc18d7cd132b29e699b4ffb33b7ff83f74b4c73df293c806d18bc7c231

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://intezer.com/

Response headers

strict-transport-security: max-age=15552000
link: <http://intezer.com/wp-content/plugins/elementor-pro/assets/css/widget-posts.min.css>; rel="canonical"
cache-control: max-age=315360000
content-encoding: br
x-nc: HIT hhn 2
access-control-allow-methods: GET, HEAD
expires: Thu, 31 Dec 2037 23:55:55 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400, h3=":443"; ma=86400
date: Sat, 07 Dec 2024 07:10:22 GMT
x-ac: 1.hhn _atomic_ams HIT
content-type: text/css
last-modified: Thu, 21 Nov 2024 07:47:08 GMT
server: nginx
vary: Accept-Encoding

GET
H3 200 post-30574.css
149520725.v2.pressablecdn.com/wp-content/uploads/elementor/css/ 18 KB
2 KB 8ms
7ms Stylesheet
text/css 192.0.77.39
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://149520725.v2.pressablecdn.com/wp-content/uploads/elementor/css/post-30574.css?ver=1732175234

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/unraveling-malware-encryption-secrets/&

Protocol

Security

QUIC, , AES_128_GCM

Server

192.0.77.39 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

149e18d6d030d14062baa104ab746d3b68558350a284b90d2867f78deacad286

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://intezer.com/

Response headers

strict-transport-security: max-age=15552000
link: <http://intezer.com/wp-content/uploads/elementor/css/post-30574.css>; rel="canonical"
cache-control: max-age=315360000
content-encoding: br
x-nc: HIT hhn 2
access-control-allow-methods: GET, HEAD
expires: Thu, 31 Dec 2037 23:55:55 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400, h3=":443"; ma=86400
date: Sat, 07 Dec 2024 07:10:22 GMT
x-ac: 2.hhn _atomic_ams MISS
content-type: text/css
last-modified: Thu, 21 Nov 2024 07:47:14 GMT
server: nginx
vary: Accept-Encoding

GET
H3 200 widget-image.min.css
149520725.v2.pressablecdn.com/wp-content/plugins/elementor/assets/css/ 254 B
655 B 9ms
9ms Stylesheet
text/css 192.0.77.39
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://149520725.v2.pressablecdn.com/wp-content/plugins/elementor/assets/css/widget-image.min.css?ver=3.25.10

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/unraveling-malware-encryption-secrets/&

Protocol

Security

QUIC, , AES_128_GCM

Server

192.0.77.39 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

c96637576deebc6e435e2c5a65868b0db2d57b477009d704f050c51a50abd4a1

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://intezer.com/

Response headers

strict-transport-security: max-age=15552000
link: <http://intezer.com/wp-content/plugins/elementor/assets/css/widget-image.min.css>; rel="canonical"
cache-control: max-age=315360000
x-nc: HIT hhn 2
access-control-allow-methods: GET, HEAD
expires: Thu, 31 Dec 2037 23:55:55 GMT
accept-ranges: bytes
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400, h3=":443"; ma=86400
content-length: 254
date: Sat, 07 Dec 2024 07:10:22 GMT
x-ac: 1.hhn _atomic_ams MISS
content-type: text/css
last-modified: Mon, 25 Nov 2024 09:48:25 GMT
server: nginx

GET
H3 200 e-animation-pop.min.css
149520725.v2.pressablecdn.com/wp-content/plugins/elementor/assets/lib/animations/styles/ 278 B
693 B 7ms
7ms Stylesheet
text/css 192.0.77.39
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://149520725.v2.pressablecdn.com/wp-content/plugins/elementor/assets/lib/animations/styles/e-animation-pop.min.css?ver=3.25.10

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/unraveling-malware-encryption-secrets/&

Protocol

Security

QUIC, , AES_128_GCM

Server

192.0.77.39 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

f9b907ed9da65ad0737a8dbdad9bfbf9019e2ae0526953b38a934d8c1a31e76b

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://intezer.com/

Response headers

strict-transport-security: max-age=15552000
link: <http://intezer.com/wp-content/plugins/elementor/assets/lib/animations/styles/e-animation-pop.min.css>; rel="canonical"
cache-control: max-age=315360000
x-nc: HIT hhn 2
access-control-allow-methods: GET, HEAD
expires: Thu, 31 Dec 2037 23:55:55 GMT
accept-ranges: bytes
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400, h3=":443"; ma=86400
content-length: 278
date: Sat, 07 Dec 2024 07:10:22 GMT
x-ac: 1.hhn _atomic_ams HIT
content-type: text/css
last-modified: Mon, 25 Nov 2024 09:48:25 GMT
server: nginx

GET
H3 200 widget-social-icons.min.css
149520725.v2.pressablecdn.com/wp-content/plugins/elementor/assets/css/ 5 KB
1 KB 8ms
8ms Stylesheet
text/css 192.0.77.39
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://149520725.v2.pressablecdn.com/wp-content/plugins/elementor/assets/css/widget-social-icons.min.css?ver=3.25.10

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/unraveling-malware-encryption-secrets/&

Protocol

Security

QUIC, , AES_128_GCM

Server

192.0.77.39 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

0cd088147551ecae9b1e29c2ac532c56bb99132973e1310f4911d7fa31997a12

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://intezer.com/

Response headers

strict-transport-security: max-age=15552000
link: <http://intezer.com/wp-content/plugins/elementor/assets/css/widget-social-icons.min.css>; rel="canonical"
cache-control: max-age=315360000
content-encoding: br
x-nc: HIT hhn 2
access-control-allow-methods: GET, HEAD
expires: Thu, 31 Dec 2037 23:55:55 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400, h3=":443"; ma=86400
date: Sat, 07 Dec 2024 07:10:22 GMT
x-ac: 2.hhn _atomic_ams HIT
content-type: text/css
last-modified: Mon, 25 Nov 2024 09:48:25 GMT
server: nginx
vary: Accept-Encoding

GET
H3 200 custom-apple-webkit.min.css
149520725.v2.pressablecdn.com/wp-content/uploads/elementor/css/ 7 KB
992 B 8ms
8ms Stylesheet
text/css 192.0.77.39
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://149520725.v2.pressablecdn.com/wp-content/uploads/elementor/css/custom-apple-webkit.min.css?ver=1732175232

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/unraveling-malware-encryption-secrets/&

Protocol

Security

QUIC, , AES_128_GCM

Server

192.0.77.39 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

76b80d7b9fdc1017c678cc0a4562b0126dc049fb6f310f4fe812dfb959590bfd

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://intezer.com/

Response headers

strict-transport-security: max-age=15552000
link: <http://intezer.com/wp-content/uploads/elementor/css/custom-apple-webkit.min.css>; rel="canonical"
cache-control: max-age=315360000
content-encoding: br
x-nc: HIT hhn 2
access-control-allow-methods: GET, HEAD
expires: Thu, 31 Dec 2037 23:55:55 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400, h3=":443"; ma=86400
date: Sat, 07 Dec 2024 07:10:22 GMT
x-ac: 1.hhn _atomic_ams MISS
content-type: text/css
last-modified: Thu, 21 Nov 2024 07:47:12 GMT
server: nginx
vary: Accept-Encoding

GET
H3 200 widget-text-editor.min.css
149520725.v2.pressablecdn.com/wp-content/plugins/elementor/assets/css/ 704 B
629 B 7ms
7ms Stylesheet
text/css 192.0.77.39
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://149520725.v2.pressablecdn.com/wp-content/plugins/elementor/assets/css/widget-text-editor.min.css?ver=3.25.10

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/unraveling-malware-encryption-secrets/&

Protocol

Security

QUIC, , AES_128_GCM

Server

192.0.77.39 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

8774a849519bd33b973e8b0deb311ce92a48e0803fb8c78fccd5e06251ef0623

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://intezer.com/

Response headers

strict-transport-security: max-age=15552000
link: <http://intezer.com/wp-content/plugins/elementor/assets/css/widget-text-editor.min.css>; rel="canonical"
cache-control: max-age=315360000
content-encoding: br
x-nc: HIT hhn 2
access-control-allow-methods: GET, HEAD
expires: Thu, 31 Dec 2037 23:55:55 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400, h3=":443"; ma=86400
date: Sat, 07 Dec 2024 07:10:22 GMT
x-ac: 1.hhn _atomic_ams HIT
content-type: text/css
last-modified: Mon, 25 Nov 2024 09:48:25 GMT
server: nginx
vary: Accept-Encoding

GET
H3 200 custom-pro-widget-nav-menu.min.css
149520725.v2.pressablecdn.com/wp-content/uploads/elementor/css/ 26 KB
4 KB 8ms
8ms Stylesheet
text/css 192.0.77.39
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://149520725.v2.pressablecdn.com/wp-content/uploads/elementor/css/custom-pro-widget-nav-menu.min.css?ver=1732175232

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/unraveling-malware-encryption-secrets/&

Protocol

Security

QUIC, , AES_128_GCM

Server

192.0.77.39 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

5154ce99fedfb9c89a77c87343782bd79fedcc4296f230416194353b378fe2bd

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://intezer.com/

Response headers

strict-transport-security: max-age=15552000
link: <http://intezer.com/wp-content/uploads/elementor/css/custom-pro-widget-nav-menu.min.css>; rel="canonical"
cache-control: max-age=315360000
content-encoding: br
x-nc: HIT hhn 2
access-control-allow-methods: GET, HEAD
expires: Thu, 31 Dec 2037 23:55:55 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400, h3=":443"; ma=86400
date: Sat, 07 Dec 2024 07:10:22 GMT
x-ac: 2.hhn _atomic_ams MISS
content-type: text/css
last-modified: Thu, 21 Nov 2024 07:47:12 GMT
server: nginx
vary: Accept-Encoding

GET
H3 200 dynamic-conditions-public.js Show response
149520725.v2.pressablecdn.com/wp-content/plugins/dynamicconditions/Public/js/ 2 KB
1 KB 8ms
8ms Script
application/javascript 192.0.77.39
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://149520725.v2.pressablecdn.com/wp-content/plugins/dynamicconditions/Public/js/dynamic-conditions-public.js?ver=1.7.4

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/unraveling-malware-encryption-secrets/&

Protocol

Security

QUIC, , AES_128_GCM

Server

192.0.77.39 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

751d5192326ddefce3e87157f7c9355217cdad7b4a969b5dd3161b4453671389

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://intezer.com/

Response headers

strict-transport-security: max-age=15552000
link: <http://intezer.com/wp-content/plugins/dynamicconditions/Public/js/dynamic-conditions-public.js>; rel="canonical"
cache-control: max-age=315360000
content-encoding: br
x-nc: HIT hhn 2
access-control-allow-methods: GET, HEAD
expires: Thu, 31 Dec 2037 23:55:55 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400, h3=":443"; ma=86400
date: Sat, 07 Dec 2024 07:10:22 GMT
x-ac: 1.hhn _atomic_ams MISS
content-type: application/javascript
last-modified: Tue, 13 Aug 2024 05:57:10 GMT
server: nginx
vary: Accept-Encoding

GET
H2 200 5492986.js Show response
js.hs-scripts.com/ 1000 B
904 B 196ms
167ms Script
application/javascript 2606:4700::6810:8dd1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js.hs-scripts.com/5492986.js?integration=WordPress&ver=11.1.75

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/unraveling-malware-encryption-secrets/&

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:8dd1 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

79686b4ccd4520cc65e78f229a2d31730654977827ca8986b4a4193626bc724c

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://intezer.com/

Response headers

access-control-max-age: 3600
content-encoding: gzip
cf-cache-status: EXPIRED
x-content-type-options: nosniff
expires: Sat, 07 Dec 2024 07:11:52 GMT
date: Sat, 07 Dec 2024 07:10:22 GMT
x-hubspot-correlation-id: 821d89b9-d907-4c89-9d2a-e506cc95efd0
content-type: application/javascript;charset=utf-8
vary: origin, Accept-Encoding
last-modified: Sat, 07 Dec 2024 07:10:22 GMT
cache-control: public, max-age=90
access-control-allow-credentials: true
cf-ray: 8ee2b20ccf75a5f4-FRA
accept-ranges: bytes
access-control-allow-origin: https://intezer.com
content-length: 535
server: cloudflare

GET
H3 200 tether.min.js Show response
149520725.v2.pressablecdn.com/wp-content/themes/intezer-v2/js/ 24 KB
8 KB 12ms
11ms Script
application/javascript 192.0.77.39
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://149520725.v2.pressablecdn.com/wp-content/themes/intezer-v2/js/tether.min.js?ver=e14e519f58e4be4a5941885148f74694

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/unraveling-malware-encryption-secrets/&

Protocol

Security

QUIC, , AES_128_GCM

Server

192.0.77.39 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

80bd626eb6d57112072a508ee4e5ce3c2fe5673fe0a5d029810033b24aaa5e9f

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://intezer.com/

Response headers

strict-transport-security: max-age=15552000
link: <http://intezer.com/wp-content/themes/intezer-v2/js/tether.min.js>; rel="canonical"
cache-control: max-age=315360000
content-encoding: br
x-nc: HIT hhn 2
access-control-allow-methods: GET, HEAD
expires: Thu, 31 Dec 2037 23:55:55 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400, h3=":443"; ma=86400
date: Sat, 07 Dec 2024 07:10:22 GMT
x-ac: 1.hhn _atomic_ams MISS
content-type: application/javascript
last-modified: Sun, 13 Dec 2020 07:21:07 GMT
server: nginx
vary: Accept-Encoding

GET
H3 200 bootstrap.min.js Show response
149520725.v2.pressablecdn.com/wp-content/themes/intezer-v2/js/ 46 KB
13 KB 8ms
7ms Script
application/javascript 192.0.77.39
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://149520725.v2.pressablecdn.com/wp-content/themes/intezer-v2/js/bootstrap.min.js?ver=e14e519f58e4be4a5941885148f74694

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/unraveling-malware-encryption-secrets/&

Protocol

Security

QUIC, , AES_128_GCM

Server

192.0.77.39 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

fa421b6ebbd2fb474d3a3866409ce6c1efd120b47ff256fffb8f8f50d556d3d9

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://intezer.com/

Response headers

strict-transport-security: max-age=15552000
link: <http://intezer.com/wp-content/themes/intezer-v2/js/bootstrap.min.js>; rel="canonical"
cache-control: max-age=315360000
content-encoding: br
x-nc: HIT hhn 2
access-control-allow-methods: GET, HEAD
expires: Thu, 31 Dec 2037 23:55:55 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400, h3=":443"; ma=86400
date: Sat, 07 Dec 2024 07:10:22 GMT
x-ac: 1.hhn _atomic_ams HIT
content-type: application/javascript
last-modified: Sun, 13 Dec 2020 07:21:11 GMT
server: nginx
vary: Accept-Encoding

GET
H3 200 main.js Show response
149520725.v2.pressablecdn.com/wp-content/themes/intezer-v2/js/ 18 KB
3 KB 11ms
8ms Script
application/javascript 192.0.77.39
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://149520725.v2.pressablecdn.com/wp-content/themes/intezer-v2/js/main.js?ver=e14e519f58e4be4a5941885148f74694

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/unraveling-malware-encryption-secrets/&

Protocol

Security

QUIC, , AES_128_GCM

Server

192.0.77.39 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

ae10c69ed7139158b505d4afa75c19376a69586da56868cadd61532889930c15

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://intezer.com/

Response headers

strict-transport-security: max-age=15552000
link: <http://intezer.com/wp-content/themes/intezer-v2/js/main.js>; rel="canonical"
cache-control: max-age=315360000
content-encoding: br
x-nc: HIT hhn 2
access-control-allow-methods: GET, HEAD
expires: Thu, 31 Dec 2037 23:55:55 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400, h3=":443"; ma=86400
date: Sat, 07 Dec 2024 07:10:22 GMT
x-ac: 1.hhn _atomic_ams MISS
content-type: application/javascript
last-modified: Thu, 26 Sep 2024 07:29:48 GMT
server: nginx
vary: Accept-Encoding

GET
H3 200 infinite-scroll.js Show response
149520725.v2.pressablecdn.com/wp-content/themes/intezer-v2/js/ 1 KB
1005 B 11ms
8ms Script
application/javascript 192.0.77.39
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://149520725.v2.pressablecdn.com/wp-content/themes/intezer-v2/js/infinite-scroll.js

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/unraveling-malware-encryption-secrets/&

Protocol

Security

QUIC, , AES_128_GCM

Server

192.0.77.39 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

ffb13661f2156df8aae98bba71c9d9f56c4ba06b296f6e1e6e46768ad77fb44b

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://intezer.com/

Response headers

strict-transport-security: max-age=15552000
link: <http://intezer.com/wp-content/themes/intezer-v2/js/infinite-scroll.js>; rel="canonical"
cache-control: max-age=604800
content-encoding: br
x-nc: HIT hhn 2
access-control-allow-methods: GET, HEAD
expires: Sat, 14 Dec 2024 07:10:22 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400, h3=":443"; ma=86400
date: Sat, 07 Dec 2024 07:10:22 GMT
x-ac: 1.hhn _atomic_ams HIT
content-type: application/javascript
last-modified: Fri, 14 Jun 2024 07:46:30 GMT
server: nginx
vary: Accept-Encoding

GET
H3 200 hooks.min.js Show response
149520725.v2.pressablecdn.com/wp-includes/js/dist/ 5 KB
2 KB 11ms
7ms Script
application/javascript 192.0.77.39
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://149520725.v2.pressablecdn.com/wp-includes/js/dist/hooks.min.js?ver=4d63a3d491d11ffd8ac6

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/unraveling-malware-encryption-secrets/&

Protocol

Security

QUIC, , AES_128_GCM

Server

192.0.77.39 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

9a1e0d38b691f1d22a92cff65ec0439b428170ac39a4493c7ecb06d5585f56a3

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://intezer.com/

Response headers

strict-transport-security: max-age=15552000
link: <http://intezer.com/wp-includes/js/dist/hooks.min.js>; rel="canonical"
cache-control: max-age=315360000
content-encoding: br
x-nc: HIT hhn 2
access-control-allow-methods: GET, HEAD
expires: Thu, 31 Dec 2037 23:55:55 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400, h3=":443"; ma=86400
date: Sat, 07 Dec 2024 07:10:22 GMT
x-ac: 1.hhn _atomic_ams MISS
content-type: application/javascript
last-modified: Mon, 30 Sep 2024 05:11:31 GMT
server: nginx
vary: Accept-Encoding

GET
H3 200 i18n.min.js Show response
149520725.v2.pressablecdn.com/wp-includes/js/dist/ 9 KB
4 KB 17ms
12ms Script
application/javascript 192.0.77.39
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://149520725.v2.pressablecdn.com/wp-includes/js/dist/i18n.min.js?ver=5e580eb46a90c2b997e6

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/unraveling-malware-encryption-secrets/&

Protocol

Security

QUIC, , AES_128_GCM

Server

192.0.77.39 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

f313d12ea6124bd28fc4a6b7163d253bb83d5aeab5edce594880c5c3df475cbc

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://intezer.com/

Response headers

strict-transport-security: max-age=15552000
link: <http://intezer.com/wp-includes/js/dist/i18n.min.js>; rel="canonical"
cache-control: max-age=315360000
content-encoding: br
x-nc: HIT hhn 2
access-control-allow-methods: GET, HEAD
expires: Thu, 31 Dec 2037 23:55:55 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400, h3=":443"; ma=86400
date: Sat, 07 Dec 2024 07:10:22 GMT
x-ac: 2.hhn _atomic_ams MISS
content-type: application/javascript
last-modified: Thu, 15 Feb 2024 16:53:15 GMT
server: nginx
vary: Accept-Encoding

GET
H3 200 index.js Show response
149520725.v2.pressablecdn.com/wp-content/plugins/contact-form-7/includes/swv/js/ 12 KB
4 KB 17ms
13ms Script
application/javascript 192.0.77.39
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://149520725.v2.pressablecdn.com/wp-content/plugins/contact-form-7/includes/swv/js/index.js?ver=6.0.1

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/unraveling-malware-encryption-secrets/&

Protocol

Security

QUIC, , AES_128_GCM

Server

192.0.77.39 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

6d60e3b25e56d35148888b5a08c8eb0ff3806f9698d4f6f54a35eab7d27f4c2f

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://intezer.com/

Response headers

strict-transport-security: max-age=15552000
link: <http://intezer.com/wp-content/plugins/contact-form-7/includes/swv/js/index.js>; rel="canonical"
cache-control: max-age=315360000
content-encoding: br
x-nc: HIT hhn 2
access-control-allow-methods: GET, HEAD
expires: Thu, 31 Dec 2037 23:55:55 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400, h3=":443"; ma=86400
date: Sat, 07 Dec 2024 07:10:22 GMT
x-ac: 1.hhn _atomic_ams HIT
content-type: application/javascript
last-modified: Wed, 04 Dec 2024 15:44:45 GMT
server: nginx
vary: Accept-Encoding

GET
H3 200 index.js Show response
149520725.v2.pressablecdn.com/wp-content/plugins/contact-form-7/includes/js/ 13 KB
5 KB 16ms
12ms Script
application/javascript 192.0.77.39
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://149520725.v2.pressablecdn.com/wp-content/plugins/contact-form-7/includes/js/index.js?ver=6.0.1

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/unraveling-malware-encryption-secrets/&

Protocol

Security

QUIC, , AES_128_GCM

Server

192.0.77.39 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

ddcce687729cb358abf9d0d8e1217a097859be2b0d18c23d7c851b38c87bc9c0

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://intezer.com/

Response headers

strict-transport-security: max-age=15552000
link: <http://intezer.com/wp-content/plugins/contact-form-7/includes/js/index.js>; rel="canonical"
cache-control: max-age=315360000
content-encoding: br
x-nc: HIT hhn 2
access-control-allow-methods: GET, HEAD
expires: Thu, 31 Dec 2037 23:55:55 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400, h3=":443"; ma=86400
date: Sat, 07 Dec 2024 07:10:22 GMT
x-ac: 1.hhn _atomic_ams HIT
content-type: application/javascript
last-modified: Wed, 04 Dec 2024 15:44:45 GMT
server: nginx
vary: Accept-Encoding

GET
H3 200 scripts.js Show response
149520725.v2.pressablecdn.com/wp-content/plugins/cf7-conditional-fields/js/ 55 KB
13 KB 16ms
12ms Script
application/javascript 192.0.77.39
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://149520725.v2.pressablecdn.com/wp-content/plugins/cf7-conditional-fields/js/scripts.js?ver=2.5.3

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/unraveling-malware-encryption-secrets/&

Protocol

Security

QUIC, , AES_128_GCM

Server

192.0.77.39 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

5e03f3d3ed70ec769c840d5108bc0f3eb4c008a8054b93063aaea46c9fc0cb33

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://intezer.com/

Response headers

strict-transport-security: max-age=15552000
link: <http://intezer.com/wp-content/plugins/cf7-conditional-fields/js/scripts.js>; rel="canonical"
cache-control: max-age=315360000
content-encoding: br
x-nc: HIT hhn 2
access-control-allow-methods: GET, HEAD
expires: Thu, 31 Dec 2037 23:55:55 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400, h3=":443"; ma=86400
date: Sat, 07 Dec 2024 07:10:22 GMT
x-ac: 2.hhn _atomic_ams HIT
content-type: application/javascript
last-modified: Wed, 04 Dec 2024 15:44:52 GMT
server: nginx
vary: Accept-Encoding

GET
H3 200 api.js Show response
www.google.com/recaptcha/ 1 KB
994 B 44ms
40ms Script
text/javascript 172.217.18.4
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api.js?render=6LewXc8UAAAAADEYz8dYpHTk55uH2MjKqbyc1sXD&ver=3.0

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/unraveling-malware-encryption-secrets/&

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.4 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra02s19-in-f4.1e100.net

Software

ESF /

Resource Hash

75787e3c30ea0cc0ba8fca298cc258dfc3b0c251a93eb1c77adb7d6377a9d4e6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://intezer.com/

Response headers

cache-control: private, max-age=300
content-encoding: gzip
cross-origin-resource-policy: cross-origin
report-to: {"group":"coop_38fac9d5b82543fc4729580d18ff2d3d","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/38fac9d5b82543fc4729580d18ff2d3d"}]}
x-content-type-options: nosniff
expires: Sat, 07 Dec 2024 07:10:22 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cross-origin-opener-policy-report-only: same-origin; report-to="coop_38fac9d5b82543fc4729580d18ff2d3d"
date: Sat, 07 Dec 2024 07:10:22 GMT
x-xss-protection: 0
content-type: text/javascript; charset=utf-8
server: ESF
x-frame-options: SAMEORIGIN

GET
H3 200 wp-polyfill.min.js Show response
149520725.v2.pressablecdn.com/wp-includes/js/dist/vendor/ 37 KB
14 KB 16ms
12ms Script
application/javascript 192.0.77.39
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://149520725.v2.pressablecdn.com/wp-includes/js/dist/vendor/wp-polyfill.min.js?ver=3.15.0

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/unraveling-malware-encryption-secrets/&

Protocol

Security

QUIC, , AES_128_GCM

Server

192.0.77.39 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

4be59303a71dba6e02707efdaf510e858b5a703d09811680dbc3fada6c2111c5

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://intezer.com/

Response headers

strict-transport-security: max-age=15552000
link: <http://intezer.com/wp-includes/js/dist/vendor/wp-polyfill.min.js>; rel="canonical"
cache-control: max-age=315360000
content-encoding: br
x-nc: HIT hhn 2
access-control-allow-methods: GET, HEAD
expires: Thu, 31 Dec 2037 23:55:55 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400, h3=":443"; ma=86400
date: Sat, 07 Dec 2024 07:10:22 GMT
x-ac: 1.hhn _atomic_ams MISS
content-type: application/javascript
last-modified: Fri, 20 Sep 2024 01:55:35 GMT
server: nginx
vary: Accept-Encoding

GET
H3 200 index.js Show response
149520725.v2.pressablecdn.com/wp-content/plugins/contact-form-7/modules/recaptcha/ 934 B
884 B 19ms
15ms Script
application/javascript 192.0.77.39
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://149520725.v2.pressablecdn.com/wp-content/plugins/contact-form-7/modules/recaptcha/index.js?ver=6.0.1

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/unraveling-malware-encryption-secrets/&

Protocol

Security

QUIC, , AES_128_GCM

Server

192.0.77.39 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

df0ec8330290d184b1084527076cb87d41b33ba706ff5ab579d761f0cb6a744b

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://intezer.com/

Response headers

strict-transport-security: max-age=15552000
link: <http://intezer.com/wp-content/plugins/contact-form-7/modules/recaptcha/index.js>; rel="canonical"
cache-control: max-age=315360000
content-encoding: br
x-nc: HIT hhn 2
access-control-allow-methods: GET, HEAD
expires: Thu, 31 Dec 2037 23:55:55 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400, h3=":443"; ma=86400
date: Sat, 07 Dec 2024 07:10:22 GMT
x-ac: 2.hhn _atomic_ams HIT
content-type: application/javascript
last-modified: Wed, 04 Dec 2024 15:44:45 GMT
server: nginx
vary: Accept-Encoding

GET
H2 200 e-202449.js Show response
stats.wp.com/ 7 KB
3 KB 54ms
10ms Script
application/javascript 192.0.76.3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.wp.com/e-202449.js
Requested by: Host: intezer.com
URL: https://intezer.com/blog/research/unraveling-malware-encryption-secrets/&
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 5badd609a51ede5bab5b89534fc3011a4dd1ab487cc7081d7cf38479bcbab855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://intezer.com/

Response headers

cache-control: max-age=31536000
content-encoding: br
x-nc: HIT hhn
etag: W/14421-1717166113530.9253
x-minify: t
x-minify-cache: hit
access-control-allow-methods: GET, HEAD
expires: Sat, 29 Nov 2025 15:15:41 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
date: Sat, 07 Dec 2024 07:10:22 GMT
content-type: application/javascript
vary: Accept-Encoding
server: nginx

GET
H3 200 imagesloaded.min.js Show response
149520725.v2.pressablecdn.com/wp-includes/js/ 5 KB
2 KB 19ms
15ms Script
application/javascript 192.0.77.39
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://149520725.v2.pressablecdn.com/wp-includes/js/imagesloaded.min.js?ver=5.0.0

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/unraveling-malware-encryption-secrets/&

Protocol

Security

QUIC, , AES_128_GCM

Server

192.0.77.39 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

b65b3de1bc923b9355248a0d941a0eaee15dfb9a6b8eadb51323a8df6189dcd1

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://intezer.com/

Response headers

strict-transport-security: max-age=15552000
link: <http://intezer.com/wp-includes/js/imagesloaded.min.js>; rel="canonical"
cache-control: max-age=315360000
content-encoding: br
x-nc: HIT hhn 2
access-control-allow-methods: GET, HEAD
expires: Thu, 31 Dec 2037 23:55:55 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400, h3=":443"; ma=86400
date: Sat, 07 Dec 2024 07:10:22 GMT
x-ac: 1.hhn _atomic_ams MISS
content-type: application/javascript
last-modified: Fri, 11 Aug 2023 18:18:26 GMT
server: nginx
vary: Accept-Encoding

GET
H3 200 jquery.smartmenus.min.js Show response
149520725.v2.pressablecdn.com/wp-content/plugins/elementor-pro/assets/lib/smartmenus/ 24 KB
8 KB 19ms
16ms Script
application/javascript 192.0.77.39
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://149520725.v2.pressablecdn.com/wp-content/plugins/elementor-pro/assets/lib/smartmenus/jquery.smartmenus.min.js?ver=1.2.1

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/unraveling-malware-encryption-secrets/&

Protocol

Security

QUIC, , AES_128_GCM

Server

192.0.77.39 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

f9b60ae2f2938c589960ef00d9b9a644f0847f7183f597cdc3fbf8cfe904c552

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://intezer.com/

Response headers

strict-transport-security: max-age=15552000
link: <http://intezer.com/wp-content/plugins/elementor-pro/assets/lib/smartmenus/jquery.smartmenus.min.js>; rel="canonical"
cache-control: max-age=315360000
content-encoding: br
x-nc: HIT hhn 2
access-control-allow-methods: GET, HEAD
expires: Thu, 31 Dec 2037 23:55:55 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400, h3=":443"; ma=86400
date: Sat, 07 Dec 2024 07:10:22 GMT
x-ac: 1.hhn _atomic_ams HIT
content-type: application/javascript
last-modified: Thu, 21 Nov 2024 07:47:08 GMT
server: nginx
vary: Accept-Encoding

GET
H3 200 webpack-pro.runtime.min.js Show response
149520725.v2.pressablecdn.com/wp-content/plugins/elementor-pro/assets/js/ 6 KB
3 KB 21ms
18ms Script
application/javascript 192.0.77.39
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://149520725.v2.pressablecdn.com/wp-content/plugins/elementor-pro/assets/js/webpack-pro.runtime.min.js?ver=3.25.4

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/unraveling-malware-encryption-secrets/&

Protocol

Security

QUIC, , AES_128_GCM

Server

192.0.77.39 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

fdc9a433f5b281b04f603b4c887f28ef632a7f5421a160e02f784c7c9bf63041

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://intezer.com/

Response headers

strict-transport-security: max-age=15552000
link: <http://intezer.com/wp-content/plugins/elementor-pro/assets/js/webpack-pro.runtime.min.js>; rel="canonical"
cache-control: max-age=315360000
content-encoding: br
x-nc: HIT hhn 2
access-control-allow-methods: GET, HEAD
expires: Thu, 31 Dec 2037 23:55:55 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400, h3=":443"; ma=86400
date: Sat, 07 Dec 2024 07:10:22 GMT
x-ac: 1.hhn _atomic_ams HIT
content-type: application/javascript
last-modified: Thu, 21 Nov 2024 07:47:08 GMT
server: nginx
vary: Accept-Encoding

GET
H3 200 webpack.runtime.min.js Show response
149520725.v2.pressablecdn.com/wp-content/plugins/elementor/assets/js/ 5 KB
3 KB 21ms
18ms Script
application/javascript 192.0.77.39
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://149520725.v2.pressablecdn.com/wp-content/plugins/elementor/assets/js/webpack.runtime.min.js?ver=3.25.10

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/unraveling-malware-encryption-secrets/&

Protocol

Security

QUIC, , AES_128_GCM

Server

192.0.77.39 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

a542f4b92ca1daa49d452f46578dfb0178939c378da21f7388e75e55575fa69b

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://intezer.com/

Response headers

strict-transport-security: max-age=15552000
link: <http://intezer.com/wp-content/plugins/elementor/assets/js/webpack.runtime.min.js>; rel="canonical"
cache-control: max-age=315360000
content-encoding: br
x-nc: HIT hhn 2
access-control-allow-methods: GET, HEAD
expires: Thu, 31 Dec 2037 23:55:55 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400, h3=":443"; ma=86400
date: Sat, 07 Dec 2024 07:10:22 GMT
x-ac: 1.hhn _atomic_ams MISS
content-type: application/javascript
last-modified: Mon, 25 Nov 2024 09:48:25 GMT
server: nginx
vary: Accept-Encoding

GET
H3 200 frontend-modules.min.js Show response
149520725.v2.pressablecdn.com/wp-content/plugins/elementor/assets/js/ 54 KB
16 KB 22ms
19ms Script
application/javascript 192.0.77.39
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://149520725.v2.pressablecdn.com/wp-content/plugins/elementor/assets/js/frontend-modules.min.js?ver=3.25.10

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/unraveling-malware-encryption-secrets/&

Protocol

Security

QUIC, , AES_128_GCM

Server

192.0.77.39 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

c69c3ed69efdef75400086f66e14917fa9746e39ee23774c055ad25355b5bc7d

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://intezer.com/

Response headers

strict-transport-security: max-age=15552000
link: <http://intezer.com/wp-content/plugins/elementor/assets/js/frontend-modules.min.js>; rel="canonical"
cache-control: max-age=315360000
content-encoding: br
x-nc: HIT hhn 2
access-control-allow-methods: GET, HEAD
expires: Thu, 31 Dec 2037 23:55:55 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400, h3=":443"; ma=86400
date: Sat, 07 Dec 2024 07:10:22 GMT
x-ac: 2.hhn _atomic_ams HIT
content-type: application/javascript
last-modified: Mon, 25 Nov 2024 09:48:25 GMT
server: nginx
vary: Accept-Encoding

GET
H3 200 frontend.min.js Show response
149520725.v2.pressablecdn.com/wp-content/plugins/elementor-pro/assets/js/ 24 KB
7 KB 22ms
19ms Script
application/javascript 192.0.77.39
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://149520725.v2.pressablecdn.com/wp-content/plugins/elementor-pro/assets/js/frontend.min.js?ver=3.25.4

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/unraveling-malware-encryption-secrets/&

Protocol

Security

QUIC, , AES_128_GCM

Server

192.0.77.39 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

5f75229618682b638f81b324b803e9c4752b8eba4a5846daa094c7626e2639d7

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://intezer.com/

Response headers

strict-transport-security: max-age=15552000
link: <http://intezer.com/wp-content/plugins/elementor-pro/assets/js/frontend.min.js>; rel="canonical"
cache-control: max-age=315360000
content-encoding: br
x-nc: HIT hhn 2
access-control-allow-methods: GET, HEAD
expires: Thu, 31 Dec 2037 23:55:55 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400, h3=":443"; ma=86400
date: Sat, 07 Dec 2024 07:10:22 GMT
x-ac: 1.hhn _atomic_ams HIT
content-type: application/javascript
last-modified: Thu, 21 Nov 2024 07:47:08 GMT
server: nginx
vary: Accept-Encoding

GET
H3 200 core.min.js Show response
149520725.v2.pressablecdn.com/wp-includes/js/jquery/ui/ 21 KB
7 KB 22ms
19ms Script
application/javascript 192.0.77.39
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://149520725.v2.pressablecdn.com/wp-includes/js/jquery/ui/core.min.js?ver=1.13.3

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/unraveling-malware-encryption-secrets/&

Protocol

Security

QUIC, , AES_128_GCM

Server

192.0.77.39 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

7e84c9f8d71bc6eb2dac2fce59a6caea62da51ffa8cf56b41806f59386ab1322

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://intezer.com/

Response headers

strict-transport-security: max-age=15552000
link: <http://intezer.com/wp-includes/js/jquery/ui/core.min.js>; rel="canonical"
cache-control: max-age=315360000
content-encoding: br
x-nc: HIT hhn 2
access-control-allow-methods: GET, HEAD
expires: Thu, 31 Dec 2037 23:55:55 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400, h3=":443"; ma=86400
date: Sat, 07 Dec 2024 07:10:22 GMT
x-ac: 2.hhn _atomic_ams MISS
content-type: application/javascript
last-modified: Thu, 27 Jun 2024 12:55:22 GMT
server: nginx
vary: Accept-Encoding

GET
H3 200 frontend.min.js Show response
149520725.v2.pressablecdn.com/wp-content/plugins/elementor/assets/js/ 43 KB
14 KB 22ms
19ms Script
application/javascript 192.0.77.39
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://149520725.v2.pressablecdn.com/wp-content/plugins/elementor/assets/js/frontend.min.js?ver=3.25.10

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/unraveling-malware-encryption-secrets/&

Protocol

Security

QUIC, , AES_128_GCM

Server

192.0.77.39 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

b195b9c5737214bef71cd6405af04b3eb88882acd9c582a0432c18c0561756bd

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://intezer.com/

Response headers

strict-transport-security: max-age=15552000
link: <http://intezer.com/wp-content/plugins/elementor/assets/js/frontend.min.js>; rel="canonical"
cache-control: max-age=315360000
content-encoding: br
x-nc: HIT hhn 2
access-control-allow-methods: GET, HEAD
expires: Thu, 31 Dec 2037 23:55:55 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400, h3=":443"; ma=86400
date: Sat, 07 Dec 2024 07:10:22 GMT
x-ac: 1.hhn _atomic_ams HIT
content-type: application/javascript
last-modified: Mon, 25 Nov 2024 09:48:25 GMT
server: nginx
vary: Accept-Encoding

GET
H3 200 elements-handlers.min.js Show response
149520725.v2.pressablecdn.com/wp-content/plugins/elementor-pro/assets/js/ 42 KB
11 KB 30ms
27ms Script
application/javascript 192.0.77.39
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://149520725.v2.pressablecdn.com/wp-content/plugins/elementor-pro/assets/js/elements-handlers.min.js?ver=3.25.4

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/unraveling-malware-encryption-secrets/&

Protocol

Security

QUIC, , AES_128_GCM

Server

192.0.77.39 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

252ff47bdded7295123a3a968787365824d86c1039686f0153ba50e8e5d9ecc8

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://intezer.com/

Response headers

strict-transport-security: max-age=15552000
link: <http://intezer.com/wp-content/plugins/elementor-pro/assets/js/elements-handlers.min.js>; rel="canonical"
cache-control: max-age=315360000
content-encoding: br
x-nc: HIT hhn 2
access-control-allow-methods: GET, HEAD
expires: Thu, 31 Dec 2037 23:55:55 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400, h3=":443"; ma=86400
date: Sat, 07 Dec 2024 07:10:22 GMT
x-ac: 2.hhn _atomic_ams HIT
content-type: application/javascript
last-modified: Thu, 21 Nov 2024 07:47:08 GMT
server: nginx
vary: Accept-Encoding

GET
H3 200 lazyload.min.js Show response
149520725.v2.pressablecdn.com/wp-content/plugins/wp-rocket/assets/js/lazyload/17.8.3/ 9 KB
3 KB 28ms
26ms Script
application/javascript 192.0.77.39
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://149520725.v2.pressablecdn.com/wp-content/plugins/wp-rocket/assets/js/lazyload/17.8.3/lazyload.min.js

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/unraveling-malware-encryption-secrets/&

Protocol

Security

QUIC, , AES_128_GCM

Server

192.0.77.39 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

f40767552e5e94b2d5f9a65d7f640cfa7d225298023dbd682095e040809a3d1a

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://intezer.com/

Response headers

strict-transport-security: max-age=15552000
link: <http://intezer.com/wp-content/plugins/wp-rocket/assets/js/lazyload/17.8.3/lazyload.min.js>; rel="canonical"
cache-control: max-age=604800
content-encoding: br
x-nc: HIT hhn 2
access-control-allow-methods: GET, HEAD
expires: Sat, 14 Dec 2024 07:10:22 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400, h3=":443"; ma=86400
date: Sat, 07 Dec 2024 07:10:22 GMT
x-ac: 1.hhn _atomic_ams HIT
content-type: application/javascript
last-modified: Wed, 04 Dec 2024 15:36:15 GMT
server: nginx
vary: Accept-Encoding

GET
H3 200 asp-747c7704.min.js Show response
149520725.v2.pressablecdn.com/wp-content/cache/asp/ 111 KB
30 KB 29ms
27ms Script
application/javascript 192.0.77.39
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://149520725.v2.pressablecdn.com/wp-content/cache/asp/asp-747c7704.min.js

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/unraveling-malware-encryption-secrets/&

Protocol

Security

QUIC, , AES_128_GCM

Server

192.0.77.39 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

8eaa54ce71e4999064652bd8cb0d02a14c5b7382f82635efc40faf5920815883

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://intezer.com/

Response headers

strict-transport-security: max-age=15552000
link: <http://intezer.com/wp-content/cache/asp/asp-747c7704.min.js>; rel="canonical"
cache-control: max-age=604800
content-encoding: br
x-nc: HIT hhn 2
access-control-allow-methods: GET, HEAD
expires: Sat, 14 Dec 2024 07:10:22 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400, h3=":443"; ma=86400
date: Sat, 07 Dec 2024 07:10:22 GMT
x-ac: 2.hhn _atomic_ams HIT
content-type: application/javascript
last-modified: Sun, 03 Nov 2024 14:36:19 GMT
server: nginx
vary: Accept-Encoding

GET
H2 200 css2
fonts.googleapis.com/ 18 KB
2 KB 45ms
18ms Stylesheet
text/css 2a00:1450:4001:813::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Open+Sans:wght@400;600;700&display=fallback

Requested by

Host: 149520725.v2.pressablecdn.com
URL: https://149520725.v2.pressablecdn.com/wp-content/themes/intezer-v2/style.css?ver=1733555421

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

5ab1dbb1b0d2d8b6ec9452f21a15ddcc085039da8f4a9fbabd6c07503a79ef81

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://149520725.v2.pressablecdn.com/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Sat, 07 Dec 2024 07:10:22 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 07 Dec 2024 07:10:22 GMT
content-type: text/css; charset=utf-8
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
last-modified: Sat, 07 Dec 2024 07:10:22 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
x-xss-protection: 0
server: ESF

POST
H3 200 collect
www.google.com/ccm/ 0
0 34ms
18ms Ping
text/plain 172.217.18.4
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google.com/ccm/collect?en=page_view&dl=https%3A%2F%2Fintezer.com%2Fblog%2Fresearch%2Funraveling-malware-encryption-secrets%2F%26&scrsrc=www.googletagmanager.com&frm=0&rnd=1474071383.1733555422&auid=322563090.1733555422&npa=1&gtm=45He4c40v9126815961za200&gcd=13l3l3l2l1l1&dma_cps=syphamo&dma=1&tag_exp=101925629~102067555~102067808~102081485&tft=1733555422160&tfd=1128&apve=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WJV4WMH
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.217.18.4 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra02s19-in-f4.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://intezer.com/

Response headers

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 408 KB
131 KB 44ms
41ms Script
application/javascript 2a00:1450:4001:813::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-77ZEDWXEEK&l=dataLayer&cx=c&gtm=45He4c40v9126815961za200

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WJV4WMH

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

52554987e314ced7d4fe93f4716a239f940aa961fa7a0000589479f03ffaed8d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://intezer.com/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Sat, 07 Dec 2024 07:10:22 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 07 Dec 2024 07:10:22 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 134092
x-xss-protection: 0
server: Google Tag Manager

GET
H3 200 0a2b546a-2cdc-4e6f-8031-6303b379fd45.js Show response
cdn.mouseflow.com/projects/ 60 KB
17 KB 62ms
28ms Script
application/javascript 104.18.26.50
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.mouseflow.com/projects/0a2b546a-2cdc-4e6f-8031-6303b379fd45.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WJV4WMH

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.26.50 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9b5cd0471afe0aa08f6097c16c8e2badcb68bdcb9824819a494003cd65659838

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://intezer.com/

Response headers

access-control-expose-headers: *
content-encoding: gzip
cf-cache-status: HIT
etag: W/"2d72f51cbacdd81:0"
age: 418661
x-mf-country: DE
x-content-type-options: nosniff
expires: Sun, 08 Dec 2024 07:10:22 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Sat, 07 Dec 2024 07:10:22 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding, Accept-Encoding
last-modified: Wed, 21 Sep 2022 13:00:24 GMT
priority: u=3,i=?0
x-cache-status: MISS
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-mf-continent: EU
cache-control: public, max-age=86400
cf-ray: 8ee2b20cfc1f974e-FRA
access-control-allow-origin: *
x-mf-script-region: enforced-privacy
server: cloudflare

GET
H2 200 insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 2 KB
1006 B 67ms
8ms Script
application/javascript 2a02:26f0:3500:10::210:a99
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to

Full URL

https://snap.licdn.com/li.lms-analytics/insight.min.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WJV4WMH

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:3500:10::210:a99 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

Software

Resource Hash

c57865ec6a6956797b18dc7d23a3ade16e7ced5271f4dc0796b2ed0a10f934dc

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://intezer.com/

Response headers

cache-control: max-age=40551
content-encoding: gzip
x-cdn: AKAM
x-content-type-options: nosniff
accept-ranges: bytes
content-length: 796
date: Sat, 07 Dec 2024 07:10:22 GMT
last-modified: Mon, 02 Dec 2024 19:28:43 GMT
content-type: application/javascript;charset=utf-8
vary: Accept-Encoding
x-amz-server-side-encryption: AES256

GET
H2 200 bat.js Show response
bat.bing.com/ 50 KB
15 KB 90ms
32ms Script
application/javascript 2620:1ec:33:1::10
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/bat.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WJV4WMH

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2620:1ec:33:1::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

aabc88a6db8b22022f96ca88e4f0a7be426abef2b35169a71515a2d55246402a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://intezer.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: private,max-age=1800
content-encoding: gzip
etag: "028e0691d20db1:0"
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: F3021FEE27A947EA9459014FA4451089 Ref B: FRA31EDGE0709 Ref C: 2024-12-07T07:10:22Z
accept-ranges: bytes
x-cache: CONFIG_NOCACHE
content-length: 14570
date: Sat, 07 Dec 2024 07:10:22 GMT
content-type: application/javascript
last-modified: Wed, 16 Oct 2024 22:47:44 GMT
vary: Accept-Encoding

GET
H2 200 destination Show response
www.googletagmanager.com/gtag/ 283 KB
98 KB 40ms
38ms Script
application/javascript 2a00:1450:4001:813::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/destination?id=AW-725468766&l=dataLayer&cx=c&gtm=45He4c40v9126815961za200

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WJV4WMH

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

780bf1d57077da9fbb446797a41963f635fd1ac256a87c0da9cf14b29c9dc5e5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://intezer.com/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcysghrgc:42:0"}],}
expires: Sat, 07 Dec 2024 07:10:22 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 07 Dec 2024 07:10:22 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Sat, 07 Dec 2024 06:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcysghrgc:42:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 99806
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 52 KB
21 KB 56ms
8ms Script
text/javascript 2a00:1450:4001:828::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WJV4WMH

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://intezer.com/

Response headers

content-encoding: gzip
age: 1737
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:225:0"}],}
x-content-type-options: nosniff
expires: Sat, 07 Dec 2024 08:41:25 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 07 Dec 2024 06:41:25 GMT
last-modified: Tue, 12 Dec 2023 18:09:08 GMT
content-type: text/javascript
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:225:0
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 20994
server: Golfe2

GET
H2 200 sw_iframe.html
www.googletagmanager.com/static/service_worker/4c30/ Frame E8D3 0
0 41ms
16ms Document
text/html 2a00:1450:4001:813::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/static/service_worker/4c30/sw_iframe.html?origin=https%3A%2F%2Fintezer.com

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WJV4WMH

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 292603
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 1476
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="analytics-container-tag-serving"
cross-origin-resource-policy: cross-origin
date: Tue, 03 Dec 2024 21:53:39 GMT
expires: Wed, 03 Dec 2025 21:53:39 GMT
last-modified: Tue, 03 Dec 2024 10:18:00 GMT
report-to: {"group":"analytics-container-tag-serving","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/analytics-container-tag-serving"}]}
server: sffe
service-worker-allowed: /static/service_worker
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 283 KB
98 KB 47ms
44ms Script
application/javascript 2a00:1450:4001:813::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-725468766&l=dataLayer&cx=c&gtm=45He4c40v9126815961za200

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WJV4WMH

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

3c7b82e29d5b73c5e056347bbd93505b42ab550ca948429364cd3a398eb6a205

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://intezer.com/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Sat, 07 Dec 2024 07:10:22 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 07 Dec 2024 07:10:22 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Sat, 07 Dec 2024 06:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 99884
x-xss-protection: 0
server: Google Tag Manager

GET
H3 200 memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v40/ 47 KB
47 KB 38ms
17ms Font
font/woff2 142.250.74.195
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Open+Sans:wght@400;600;700&display=fallback

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.74.195 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s02-in-f3.1e100.net

Software

sffe /

Resource Hash

3c4d6a1421c7ddb7e404521fe8c4cd5be5af446d7689cd880be26612eaad3cfa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://intezer.com
Referer: https://fonts.googleapis.com/

Response headers

age: 294732
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Wed, 03 Dec 2025 21:18:10 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 03 Dec 2024 21:18:10 GMT
last-modified: Thu, 14 Dec 2023 02:08:40 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 48236
x-xss-protection: 0
server: sffe

GET
H3 200 fontawesome-webfont.woff
149520725.v2.pressablecdn.com/wp-content/themes/intezer-v2/fonts/ 96 KB
96 KB 37ms
17ms Font
application/font-woff 192.0.77.39
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://149520725.v2.pressablecdn.com/wp-content/themes/intezer-v2/fonts/fontawesome-webfont.woff

Requested by

Host: 149520725.v2.pressablecdn.com
URL: https://149520725.v2.pressablecdn.com/wp-content/themes/intezer-v2/style.css?ver=1733555421

Protocol

Security

QUIC, , AES_128_GCM

Server

192.0.77.39 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

ba0c59deb5450f5cb41b3f93609ee2d0d995415877ddfa223e8a8a7533474f07

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://intezer.com
Referer: https://149520725.v2.pressablecdn.com/wp-content/themes/intezer-v2/style.css?ver=1733555421

Response headers

strict-transport-security: max-age=15552000
link: <http://intezer.com/wp-content/themes/intezer-v2/fonts/fontawesome-webfont.woff>; rel="canonical"
cache-control: max-age=604800
x-nc: HIT hhn 2
access-control-allow-methods: GET, HEAD
expires: Sat, 14 Dec 2024 07:10:22 GMT
accept-ranges: bytes
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400, h3=":443"; ma=86400
content-length: 98024
date: Sat, 07 Dec 2024 07:10:22 GMT
x-ac: 1.hhn _atomic_ams BYPASS
content-type: application/font-woff
last-modified: Sun, 13 Dec 2020 07:21:26 GMT
server: nginx

GET
H3 200 footer-logo.svg
intezer.com/wp-content/themes/intezer-v2/images/footer/ 3 KB
1 KB 27ms
25ms Image
image/svg+xml 199.16.172.82
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://intezer.com/wp-content/themes/intezer-v2/images/footer/footer-logo.svg

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/unraveling-malware-encryption-secrets/&

Protocol

Security

QUIC, , AES_128_GCM

Server

199.16.172.82 , United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

81816d809b5350c4b66fa291879624b5444607134133ad99ad0994dda3fcea20

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://intezer.com/blog/research/unraveling-malware-encryption-secrets/&

Response headers

strict-transport-security: max-age=31536000
cache-control: max-age=31536000
content-encoding: br
etag: W/"6399961e-d46"
access-control-allow-methods: GET, HEAD
expires: Sat, 06 Dec 2025 02:47:42 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
date: Sat, 07 Dec 2024 07:10:22 GMT
x-ac: 1.hhn _atomic_ams HIT
content-type: image/svg+xml
last-modified: Wed, 14 Dec 2022 09:23:42 GMT
server: nginx
vary: Accept-Encoding

GET
H2 200 hqgzhl24ye Show response
www.clarity.ms/tag/ 553 B
809 B 161ms
111ms Script
application/x-javascript 2620:1ec:bdf::45
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.clarity.ms/tag/hqgzhl24ye
Requested by: Host: intezer.com
URL: https://intezer.com/blog/research/unraveling-malware-encryption-secrets/&
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2620:1ec:bdf::45 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: ea6260ff44181045f8ba433a18b308e9aa05be9ca0b9519eb27aae0e4f839131

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://intezer.com/

Response headers

cache-control: no-cache, no-store
request-context: appId=cid-v1:3d284f99-f285-495c-ac33-dedd7ecf1ac8
expires: -1
accept-ranges: bytes
x-cache: CONFIG_NOCACHE
content-length: 553
date: Sat, 07 Dec 2024 07:10:22 GMT
content-type: application/x-javascript
x-azure-ref: 20241207T071022Z-15b54885d96gb6rwhC1FRAx2vs0000000e1000000000evxy

GET
H2 200 sdk.js Show response
cdn.getkoala.com/v1/pk_6c50e30c08715cfa57e9d6fd33965720122a/ 70 KB
23 KB 76ms
32ms Script
text/javascript 2606:4700:20::681a:bc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.getkoala.com/v1/pk_6c50e30c08715cfa57e9d6fd33965720122a/sdk.js
Requested by: Host: intezer.com
URL: https://intezer.com/blog/research/unraveling-malware-encryption-secrets/&
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:bc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a468e000e9ecb3d535f15b465f476944047e8a0fe16d9f2c20a6d7c4014afc90

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://intezer.com/

Response headers

content-encoding: br
cf-cache-status: HIT
etag: W/"e184720646499c72a3ccae0475e1ded0"
age: 400
x-amz-meta-version: 1.22.1
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=62HVq9FJNPNQdIDzGK0swssjZH7cQ1gEfTkhZvPrTUMskUCRmagqav5%2FZX9xejjoYwjC9mJUMS%2Bz9cZrq1uVVVv%2FNAKuTtSwp4%2F2dcDPCz92z7uQtSJM2uUl11LVAI9GRch3oXPcoI0G813NFlY%3D"}],"group":"cf-nel","max_age":604800}
server-timing: cfL4;desc="?proto=TCP&rtt=7201&min_rtt=6731&rtt_var=1453&sent=8&recv=11&lost=0&retrans=0&sent_bytes=4078&recv_bytes=2193&delivery_rate=573724&cwnd=253&unsent_bytes=0&cid=5304b20452e0e20d&ts=38&x=0"
date: Sat, 07 Dec 2024 07:10:22 GMT
content-type: text/javascript
last-modified: Fri, 11 Oct 2024 22:11:18 GMT
vary: Accept-Encoding
x-amz-id-2: 9fC45W+dRUC4K1jtAGsHUHGehOaEF+3mUtEeSOmiNvHL+l7NZcY9+7yQx4Ihhbdh7zvKNUoOzuQ=
cache-control: public,max-age=900
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 8ee2b20d1ca4972c-FRA
x-amz-request-id: 5YJ5A71E362A5GEG
server: cloudflare
x-amz-meta-sha: 77a9eb25d
x-amz-server-side-encryption: AES256

GET
H/1.1 200
OK reb2b.js.gz Show response
s3-us-west-2.amazonaws.com/b2bjsstore/b/GNLKQHEMX96Q/ 34 KB
12 KB 608ms
219ms Script
application/javascript 52.218.242.224
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s3-us-west-2.amazonaws.com/b2bjsstore/b/GNLKQHEMX96Q/reb2b.js.gz
Requested by: Host: intezer.com
URL: https://intezer.com/blog/research/unraveling-malware-encryption-secrets/&
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 52.218.242.224 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-us-west-2.amazonaws.com
Software: AmazonS3 /
Resource Hash: d61aa264cb691fd2580171c2b9ceba787fe15609fe1061bbef079ac64c48751f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://intezer.com/

Response headers

x-amz-id-2: PisBhPwGHiS4k9BRye+HJBTEtkNIP2gk4w6vsOzp+jM5AjtRZ0dOdceoQUTkPkI5ZXKd+xNszek=
Cache-Control: max-age=172800
Content-Encoding: gzip
ETag: "6dae19fa95d6e9cc4f2e6a451a6b4c74"
x-amz-request-id: CE2P1CPHVVRE2Q2K
Expires: Sun, 03 Nov 2024 18:53:08 GMT
Accept-Ranges: bytes
Content-Length: 11291
Date: Sat, 07 Dec 2024 07:10:23 GMT
Last-Modified: Fri, 01 Nov 2024 18:53:09 GMT
Content-Type: application/javascript
Server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 5450.js Show response
tracking.g2crowd.com/attribution_tracking/conversions/ 2 KB
2 KB 211ms
181ms Script
text/javascript 2606:4700::6812:1fb0
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://tracking.g2crowd.com/attribution_tracking/conversions/5450.js?p=https://intezer.com/blog/research/unraveling-malware-encryption-secrets/&

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/unraveling-malware-encryption-secrets/&

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:1fb0 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

91bafd41ccba74de6c83744afa560e15157f482b9f6b02a34e4b3c5c867d2a86

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://intezer.com/

Response headers

content-encoding: br
x-permitted-cross-domain-policies: none
x-content-type-options: nosniff
date: Sat, 07 Dec 2024 07:10:22 GMT
content-type: text/javascript;charset=UTF-8
content-disposition: inline
vary: Origin, Accept-Encoding
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=15552000; includeSubDomains
x-dns-prefetch-control: off
cross-origin-opener-policy: same-origin
cross-origin-resource-policy: cross-origin
referrer-policy: no-referrer
x-download-options: noopen
cf-ray: 8ee2b20d3b78db10-FRA
access-control-allow-origin: *
x-xss-protection: 0
origin-agent-cluster: ?1
server: cloudflare

GET tracker.iife.js
assets.apollo.io/micro/website-tracker/ 0
0

GET
H2 200 /
tr-rc.lfeeder.com/ 43 B
339 B 97ms
63ms Image
image/gif 18.173.187.127
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tr-rc.lfeeder.com/?sid=YEgkB8lPLLw8ep3Z&data=eyJnYVRyYWNraW5nSWRzIjpbXSwiZ2FNZWFzdXJlbWVudElkcyI6WyJBVy03MjU0Njg3NjYiXSwiZ2FDbGllbnRJZHMiOltdLCJjb250ZXh0Ijp7ImxpYnJhcnkiOnsibmFtZSI6ImxmdHJhY2tlciIsInZlcnNpb24iOiIyLjY0LjEifSwicGFnZVVybCI6Imh0dHBzOi8vaW50ZXplci5jb20vYmxvZy9yZXNlYXJjaC91bnJhdmVsaW5nLW1hbHdhcmUtZW5jcnlwdGlvbi1zZWNyZXRzLyYjODIyMSIsInBhZ2VUaXRsZSI6IlBhZ2Ugbm90IGZvdW5kIC0gSW50ZXplciIsInJlZmVycmVyIjoiIn0sImV2ZW50IjoidHJhY2tpbmctZXZlbnQiLCJjbGllbnRFdmVudElkIjoiOWM4NzAwY2RlNTMwOGEwYyIsInNjcmlwdElkIjoiWUVna0I4bFBMTHc4ZXAzWiIsImNvb2tpZXNFbmFibGVkIjp0cnVlLCJjb25zZW50TGV2ZWwiOiJub25lIiwiYW5vbnltaXplSXAiOmZhbHNlLCJsZkNsaWVudElkIjoiTEYxLjEuZDgwNWZhMDYxOGRkMzg2Zi4xNzMzNTU1NDIyMjI3IiwiZm9yZWlnbkNvb2tpZXMiOltdLCJwcm9wZXJ0aWVzIjp7fSwiYXV0b1RyYWNraW5nRW5hYmxlZCI6dHJ1ZSwiYXV0b1RyYWNraW5nTW9kZSI6Im9uX3NjcmlwdF9sb2FkIn0=
Requested by: Host: intezer.com
URL: https://intezer.com/blog/research/unraveling-malware-encryption-secrets/&
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.173.187.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-173-187-127.muc50.r.cloudfront.net
Software: CloudFront /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://intezer.com/

Response headers

cross-origin-resource-policy: cross-origin
via: 1.1 46d62d4755f0b1a587a0581348e41608.cloudfront.net (CloudFront)
x-cache: LambdaGeneratedResponse from cloudfront
content-length: 43
x-amz-cf-id: sATqRhsNd4qd1BvF9WPgzIq_2fFqrK-HIY0H4poNZH5pXIgTKwl9gw==
date: Sat, 07 Dec 2024 07:10:22 GMT
content-type: image/gif
x-amz-cf-pop: MUC50-P4
server: CloudFront
vary: Origin

GET
H2 200 insight.old.min.js Show response
snap.licdn.com/li.lms-analytics/ 40 KB
14 KB 9ms
9ms Script
application/javascript 2a02:26f0:3500:10::210:a99
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to

Full URL

https://snap.licdn.com/li.lms-analytics/insight.old.min.js

Requested by

Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:3500:10::210:a99 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

Software

Resource Hash

8a27dc7b44ebe886390bfa0a9beeea36ea5a3f37479f0e0836b6c9b80d9b35ed

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://intezer.com/

Response headers

cache-control: max-age=25507
content-encoding: gzip
x-cdn: AKAM
x-content-type-options: nosniff
accept-ranges: bytes
content-length: 14628
date: Sat, 07 Dec 2024 07:10:22 GMT
last-modified: Mon, 02 Dec 2024 10:13:56 GMT
content-type: application/javascript;charset=utf-8
vary: Accept-Encoding
x-amz-server-side-encryption: AES256

POST
H2 200 collect Show response
www.google-analytics.com/j/ 3 B
418 B 17ms
16ms XHR
text/plain 2a00:1450:4001:828::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=1276016587&t=pageview&_s=1&dl=https%3A%2F%2Fintezer.com%2Fblog%2Fresearch%2Funraveling-malware-encryption-secrets%2F%26&ul=de-de&de=UTF-8&dt=Page%20not%20found%20-%20Intezer&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YGBAgEABAAAAACAAI~&jid=1040719708&gjid=1738412233&cid=573645210.1733555422&tid=UA-97741055-8&_gid=198834945.1733555422&_slc=1&gtm=45He4c40n81WJV4WMHv9126815961za200&gcd=13l3l3l2l1l1&dma_cps=syphamo&dma=1&tag_exp=101925629~102067555~102067808~102081485&npa=1&z=1342518663

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

1cffc2b3146584685cd72751d7f28aa030ab9ae2f1bc78f2c27909f8d8287b26

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://intezer.com/

Response headers

report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:175:0"}],}
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 07 Dec 2024 07:10:22 GMT
last-modified: Sun, 17 May 1998 03:00:00 GMT
content-type: text/plain
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:175:0
access-control-allow-origin: https://intezer.com
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 3
server: Golfe2

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 1 B
643 B 64ms
20ms XHR
text/plain 2a00:1450:400c:c07::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-97741055-8&cid=573645210.1733555422&jid=1040719708&gjid=1738412233&_gid=198834945.1733555422&npa=1&_u=YGBAgEABAAAAAGAAI~&z=1299032105

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c07::9a Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://intezer.com/

Response headers

report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgdc:149:0"}],}
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 07 Dec 2024 07:10:22 GMT
last-modified: Sun, 17 May 1998 03:00:00 GMT
content-type: text/plain
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgdc:149:0
access-control-allow-origin: https://intezer.com
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 1
server: Golfe2

POST
H2 204 / Show response
px.ads.linkedin.com/wa/ 0
436 B 235ms
188ms XHR
text/plain 2620:1ec:21::14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://px.ads.linkedin.com/wa/
Requested by: Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.old.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://intezer.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Accept: *
Content-Type: text/plain;charset=UTF-8

Response headers

linkedin-action: 1
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: 790121B849C3445DA1462301B73742F9 Ref B: FRAEDGE2016 Ref C: 2024-12-07T07:10:22Z
x-li-fabric: prod-lor1
access-control-allow-credentials: true
x-li-uuid: AAYoqNMmQQupywe4+Alpyg==
x-li-proto: http/2
access-control-allow-origin: https://intezer.com
x-cache: CONFIG_NOCACHE
x-li-source-fabric: prod-lva1
date: Sat, 07 Dec 2024 07:10:22 GMT
vary: Origin

GET
H2 200 attribution_trigger Show response
px.ads.linkedin.com/ 2 B
814 B 190ms
150ms XHR
application/json 2620:1ec:21::14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://px.ads.linkedin.com/attribution_trigger?pid=1327356&time=1733555422288&url=https%3A%2F%2Fintezer.com%2Fblog%2Fresearch%2Funraveling-malware-encryption-secrets%2F%26%238221&tm=gtmv2
Requested by: Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.old.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Accept: *
Referer: https://intezer.com/

Response headers

x-li-pop: afd-prod-ltx1-x
content-encoding: gzip
x-fs-uuid: 000628a8d326804ca044b618ee1b88d2
x-msedge-ref: Ref A: A6FBAAB69CE74F2298D3FCA65580750F Ref B: FRAEDGE1518 Ref C: 2024-12-07T07:10:22Z
x-li-fabric: prod-ltx1
x-restli-protocol-version: 1.0.0
access-control-allow-methods: GET, OPTIONS
x-li-uuid: AAYoqNMmgEygRLYY7huI0g==
x-li-proto: http/2
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
date: Sat, 07 Dec 2024 07:10:22 GMT
content-type: application/json
access-control-allow-headers: *

GET
H2

200

collect
px4.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1327356&time=1733555422288&url=https%3A%2F%2Fintezer.com%2Fblog%2Fresearch%2Funraveling-malware-encryption-secrets%2F%26%238221&tm=gtmv2
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=1327356&time=1733555422288&url=https%3A%2F%2Fintezer.com%2Fblog%2Fresearch%2Funraveling-malware-encryption-secrets%2F%26%238221&tm=gtmv2&e_ipv6=A...

0
264 B

212ms
174ms

Image
application/javascript

13.107.42.14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=1327356&time=1733555422288&url=https%3A%2F%2Fintezer.com%2Fblog%2Fresearch%2Funraveling-malware-encryption-secrets%2F%26%238221&tm=gtmv2&e_ipv6=AQKDL9FCST9bfgAAAZOf9ITSL8B6T4x8jXnyw0dLNlj4Ab_a81C2gL33dIWMpsqi
Requested by: Host: intezer.com
URL: https://intezer.com/blog/research/unraveling-malware-encryption-secrets/&
Protocol: H2
Server: 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://intezer.com/

Response headers

linkedin-action: 1
x-li-pop: afd-prod-lor1-x
x-msedge-ref: Ref A: 93493C44D7004E2A82C6F6601D0ABCB4 Ref B: FRAEDGE2017 Ref C: 2024-12-07T07:10:22Z
x-li-fabric: prod-lor1
x-li-uuid: AAYoqNMqE4DTIO9YlpMk9A==
x-li-proto: http/2
x-cache: CONFIG_NOCACHE
content-length: 0
date: Sat, 07 Dec 2024 07:10:22 GMT
content-type: application/javascript

Redirect headers

linkedin-action: 1
x-li-pop: afd-prod-lva1-x
location: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=1327356&time=1733555422288&url=https%3A%2F%2Fintezer.com%2Fblog%2Fresearch%2Funraveling-malware-encryption-secrets%2F%26%238221&tm=gtmv2&e_ipv6=AQKDL9FCST9bfgAAAZOf9ITSL8B6T4x8jXnyw0dLNlj4Ab_a81C2gL33dIWMpsqi
x-msedge-ref: Ref A: 00A11D0D2D1C41D988988C70D998C36E Ref B: FRAEDGE2016 Ref C: 2024-12-07T07:10:22Z
x-li-fabric: prod-lor1
x-li-uuid: AAYoqNMmP9PuJ2KEDG3rEw==
x-li-proto: http/2
x-cache: CONFIG_NOCACHE
content-length: 0
x-li-source-fabric: prod-lva1
date: Sat, 07 Dec 2024 07:10:22 GMT

GET
H2 200 187039661.js Show response
bat.bing.com/p/action/ 4 KB
2 KB 34ms
33ms Script
application/javascript 2620:1ec:33:1::10
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/p/action/187039661.js

Requested by

Host: bat.bing.com
URL: https://bat.bing.com/bat.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2620:1ec:33:1::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

1bca3dda2c4bda005185f8f80efe4888c8fa4819c61afd5d3705828c55d10b05

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://intezer.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: private,max-age=60
content-encoding: br
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 68BE4961B541444880FCE40952046D3C Ref B: FRA31EDGE0709 Ref C: 2024-12-07T07:10:22Z
x-cache: CONFIG_NOCACHE
date: Sat, 07 Dec 2024 07:10:22 GMT
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding

GET
H2 200 pk_6c50e30c08715cfa57e9d6fd33965720122a Show response
api.getkoala.com/web/projects/ 856 B
1 KB 577ms
549ms Fetch
application/json 2606:4700:20::681a:bc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://api.getkoala.com/web/projects/pk_6c50e30c08715cfa57e9d6fd33965720122a

Requested by

Host: cdn.getkoala.com
URL: https://cdn.getkoala.com/v1/pk_6c50e30c08715cfa57e9d6fd33965720122a/sdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:bc , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c873089757f55c85861c805ebb1f51bffff5c024f9151b72e2a56a9bf247ae86

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Frame-Options	ALLOWALL

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://intezer.com/

Response headers

access-control-max-age: 7200
x-request-id: 254292a6-c1bf-4eaf-ae95-236e070ea467
access-control-expose-headers
content-encoding: gzip
cf-cache-status: DYNAMIC
etag: W/"a94eb1439c29a7392b0c6de212f74edd"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Rw%2B%2BEYu1bMOGnz%2FSZq1yd1XzYvbkWQbxCSCT7t7NsCikVk6YDAA9cF0fsrRvhoXyebdl%2Bo5iZ%2FXnXSUay8%2BHguV0PSriNKvH1SGz7sDBX630Ar8llbu9br3k%2FPdSTsB9aB4ot5943LyROks47pw%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-methods: GET, POST, PATCH, PUT, OPTIONS, HEAD
server-timing: cfL4;desc="?proto=TCP&rtt=11256&min_rtt=6187&rtt_var=10819&sent=8&recv=12&lost=0&retrans=0&sent_bytes=4076&recv_bytes=2228&delivery_rate=619882&cwnd=254&unsent_bytes=0&cid=ec55136fed2d7f6d&ts=553&x=0"
date: Sat, 07 Dec 2024 07:10:22 GMT
content-type: application/json; charset=utf-8
last-modified: Mon, 23 Oct 2023 15:11:19 GMT
vary: Accept, Accept-Encoding, Origin
x-runtime: 0.005853
x-frame-options: ALLOWALL
strict-transport-security: max-age=63072000; includeSubDomains
cache-control: public
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 8ee2b20d9f6003c4-FRA
access-control-allow-origin: *
server: cloudflare

POST
H2 204 collect
region1.analytics.google.com/g/ 0
0 43ms
16ms Fetch
text/plain 2001:4860:4802:32::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.analytics.google.com/g/collect?v=2&tid=G-77ZEDWXEEK&gtm=45je4c40v890741055z89126815961za200zb9126815961&_p=1733555422054&_gaz=1&gcd=13l3lPl2l1l1&npa=1&dma_cps=syphamo&dma=1&tag_exp=101925629~102067555~102067808~102081485&cid=573645210.1733555422&ul=de-de&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&sid=1733555422&sct=1&seg=0&dl=https%3A%2F%2Fintezer.com%2Fblog%2Fresearch%2Funraveling-malware-encryption-secrets%2F%26&dt=Page%20not%20found%20-%20Intezer&en=page_view&_fv=1&_ss=1&tfd=1326
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-77ZEDWXEEK&l=dataLayer&cx=c&gtm=45He4c40v9126815961za200
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://intezer.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:136:0
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:136:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://intezer.com
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 07 Dec 2024 07:10:22 GMT
content-type: text/plain
server: Golfe2

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
269 B 20ms
19ms Ping
text/plain 2a00:1450:400c:c07::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-77ZEDWXEEK&cid=573645210.1733555422&gtm=45je4c40v890741055z89126815961za200zb9126815961&aip=1&dma=1&dma_cps=syphamo&gcd=13l3lPl2l1l1&npa=1&frm=0&tag_exp=101925629~102067555~102067808~102081485
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-77ZEDWXEEK&l=dataLayer&cx=c&gtm=45He4c40v9126815961za200
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:400c:c07::9a Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://intezer.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:111:0
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:111:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://intezer.com
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 07 Dec 2024 07:10:22 GMT
content-type: text/plain
server: Golfe2

GET
H3 200 ga-audiences
www.google.de/ads/ 42 B
63 B 35ms
19ms Image
image/gif 142.250.186.35
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-77ZEDWXEEK&cid=573645210.1733555422&gtm=45je4c40v890741055z89126815961za200zb9126815961&aip=1&dma=1&dma_cps=syphamo&gcd=13l3lPl2l1l1&npa=1&frm=0&tag_exp=101925629~102067555~102067808~102081485&tag_exp=101925629~102067555~102067808~102081485&z=1783640347

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/unraveling-malware-encryption-secrets/&

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.35 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f3.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://intezer.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Sat, 07 Dec 2024 07:10:22 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

POST
H2 204 0
bat.bing.net/actionp/ 0
120 B 97ms
60ms Ping
text/plain 2620:1ec:c11::237
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://bat.bing.net/actionp/0?ti=187039661&tm=gtm002&Ver=2&mid=7f0ae8f1-6af7-4845-b6f0-5707a507dddb&bo=1&evt=consent&src=enforced&cdb=AQAI&asc=D
Requested by: Host: bat.bing.com
URL: https://bat.bing.com/bat.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2620:1ec:c11::237 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://intezer.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: B9C84C54493F4EA899FF9AAED60AF46F Ref B: FRA31EDGE0119 Ref C: 2024-12-07T07:10:22Z
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
date: Sat, 07 Dec 2024 07:10:21 GMT

GET
H2 200 187039661 Show response
www.clarity.ms/tag/uet/ 727 B
981 B 100ms
100ms Script
application/x-javascript 2620:1ec:bdf::45
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.clarity.ms/tag/uet/187039661
Requested by: Host: bat.bing.com
URL: https://bat.bing.com/p/action/187039661.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2620:1ec:bdf::45 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 673ce1fc727c061b5b5561051ed3dbdbb45fa28a83e42cea9cb66f8e4dfbf9c7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://intezer.com/

Response headers

cache-control: no-cache, no-store
request-context: appId=cid-v1:9c7c879b-c51a-427e-9701-218438da5f81
expires: -1
accept-ranges: bytes
x-cache: CONFIG_NOCACHE
content-length: 727
date: Sat, 07 Dec 2024 07:10:22 GMT
content-type: application/x-javascript
x-azure-ref: 20241207T071022Z-15b54885d96gb6rwhC1FRAx2vs0000000e1000000000evya

GET
H2 200 5492986.js Show response
js.hs-analytics.net/analytics/1733555400000/ 68 KB
25 KB 209ms
183ms Script
text/javascript 2606:4700::6810:a0a8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hs-analytics.net/analytics/1733555400000/5492986.js
Requested by: Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/5492986.js?integration=WordPress&ver=11.1.75
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:a0a8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2b4f7f35c2e4781c145dd989fdc551f3bc94ca7de9a9d759e99092abf23d9277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://intezer.com/

Response headers

x-amz-server-side-encryption: AES256
x-request-id: bfe5d569-7ebe-43a4-a5e7-b9d38d934006
content-encoding: gzip
cf-cache-status: MISS
etag: W/"37c177f92f4285822c76802f4bfa188f"
x-amz-version-id: null
expires: Sat, 07 Dec 2024 07:15:22 GMT
x-evy-trace-listener: listener_https
date: Sat, 07 Dec 2024 07:10:22 GMT
x-hubspot-correlation-id: bfe5d569-7ebe-43a4-a5e7-b9d38d934006
content-type: text/javascript
last-modified: Tue, 22 Oct 2024 20:45:15 GMT
vary: origin, Accept-Encoding
x-amz-id-2: Apw1DFD8Ak7YmAVn8lzA5l8+/sIF6Kj/TopJtTxRt/XLnA59rniobpx4N0EoOWA5wU+SkFInrQ5k2XKtcAmj44rOXArnjhf0rZ+iLIa2JHk=
x-evy-trace-route-service-name: envoyset-translator
cache-control: max-age=300,public
x-evy-trace-served-by-pod: iad02/analytics-js-proxy-td/envoy-proxy-8586d94f84-nm6jr
x-envoy-upstream-service-time: 41
access-control-allow-credentials: false
x-amz-request-id: CE2QJWKQRMAKWZBS
cf-ray: 8ee2b20df8a5dbf7-FRA
x-evy-trace-route-configuration: listener_https/all
server: cloudflare
x-evy-trace-virtual-host: all

GET
H2 200 5492986.js Show response
js.hs-banner.com/ 63 KB
19 KB 411ms
385ms Script
text/javascript 2606:4700:4400::ac40:9310
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hs-banner.com/5492986.js
Requested by: Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/5492986.js?integration=WordPress&ver=11.1.75
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::ac40:9310 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6b4747fb204e26cc280177fd6dd95f4be5b7a08f70e04aa3b8e25e6e0397ccbe

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://intezer.com/

Response headers

x-evy-trace-virtual-host: all
access-control-max-age: 604800
x-request-id: 55e9af4b-2666-4fa4-96a6-549ef6ab5bc4
access-control-expose-headers: x-last-modified-timestamp, X-HubSpot-NotFound, X-HS-User-Request, Link, Server-Timing
content-encoding: gzip
cf-cache-status: REVALIDATED
etag: W/"4a083610608ce24ae4d0b85745ce4575"
x-amz-version-id: tKlQO9YCCJUhOtyKzr1iyNoNrvFeIrvd
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
expires: Sat, 07 Dec 2024 07:15:22 GMT
x-evy-trace-listener: listener_https
date: Sat, 07 Dec 2024 07:10:22 GMT
x-hubspot-correlation-id: 55e9af4b-2666-4fa4-96a6-549ef6ab5bc4
content-type: text/javascript; charset=UTF-8
last-modified: Mon, 29 Jul 2024 05:47:19 GMT
vary: origin, Accept-Encoding
x-amz-id-2: +d0o/ZA+gB6qYNEUBXj+7wnfYMJkE/MbaBnoVrKgUAj2YQ/Xtfaiy2UQ96vV21JPXo2zQacU1I8=
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Accept-Charset, Accept-Encoding, X-Override-Internal-Permissions, X-Properties-Source, X-Properties-SourceId, X-Properties-Flag, X-Hubspot-User-Id, X-Hubspot-Trace, X-Hubspot-Callee, X-Hubspot-Offset, X-Hubspot-No-Trace, X-HubSpot-Static-App-Info, X-HubSpot-Messages-Uri, X-HubSpot-Request-Source, X-HubSpot-Request-Reason, Subscription-Billing-Auth-Token, X-App-CSRF, X-Tools-CSRF, Online-Payment-Signing-UUID, X-Source, X-SourceId, X-Origin-UserId, X-Biden-Request-Source, X-HubSpot-CSRF-hubspotapi, X-Force-Cookie-Refresh, X-Force-Cookie-Refresh-No-Cache, X-HS-User-Request, X-Application-Id, X-HS-Referer, X-HubSpot-Correlation-Id
x-evy-trace-route-service-name: envoyset-translator
cache-control: max-age=300,public
timing-allow-origin: *
x-evy-trace-served-by-pod: iad02/analytics-js-proxy-td/envoy-proxy-75d7846cb8-48kw6
x-envoy-upstream-service-time: 33
access-control-allow-credentials: true
x-amz-request-id: HSK7CP9KDK42VFGF
cf-ray: 8ee2b20dfaa2d2ee-FRA
access-control-allow-origin: https://intezer.com
x-evy-trace-route-configuration: listener_https/all
server: cloudflare
x-amz-server-side-encryption: AES256

GET
H2 200 recaptcha__de.js Show response
www.gstatic.com/recaptcha/releases/pPK749sccDmVW_9DSeTMVvh2/ 549 KB
218 KB 35ms
7ms Script
text/javascript 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/pPK749sccDmVW_9DSeTMVvh2/recaptcha__de.js

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api.js?render=6LewXc8UAAAAADEYz8dYpHTk55uH2MjKqbyc1sXD&ver=3.0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6e79aeee4cbc317a3b6e18c8887ed2c1659ad8eb27431d1896a075ed935a9149

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://intezer.com
Referer: https://intezer.com/

Response headers

content-encoding: gzip
age: 2368
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
x-content-type-options: nosniff
expires: Sun, 07 Dec 2025 06:30:54 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 07 Dec 2024 06:30:54 GMT
last-modified: Mon, 11 Nov 2024 05:00:22 GMT
content-type: text/javascript
vary: Accept-Encoding
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
accept-ranges: bytes
access-control-allow-origin: *
content-length: 222835
x-xss-protection: 0
server: sffe

GET
H2 200 g.gif
pixel.wp.com/ 50 B
177 B 12ms
7ms Image
image/gif 192.0.76.3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.wp.com/g.gif?v=ext&blog=186808338&post=0&tz=-5&srv=intezer.com&hp=atomic&ac=3&amp=0&j=1%3A14.1&host=intezer.com&ref=&fcp=1180&rand=0.8828918021686938
Requested by: Host: intezer.com
URL: https://intezer.com/blog/research/unraveling-malware-encryption-secrets/&
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://intezer.com/

Response headers

cache-control: no-cache
access-control-allow-origin: *
content-length: 50
alt-svc: h3=":443"; ma=86400
date: Sat, 07 Dec 2024 07:10:22 GMT
content-type: image/gif
server: nginx

GET
H/1.1 200
OK track.js Show response
secure.gaug.es/ 4 KB
4 KB 385ms
92ms Script
application/javascript 3.215.198.72
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.gaug.es/track.js
Requested by: Host: intezer.com
URL: https://intezer.com/blog/research/unraveling-malware-encryption-secrets/&
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.215.198.72 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-215-198-72.compute-1.amazonaws.com
Software: nginx/1.10.3 (Ubuntu) /
Resource Hash: df2698e6cf74ed890afa92da10051f880df2ce0b3257b73c5d9ae2f6bea82d3c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://intezer.com/

Response headers

ETag: "65f04ae5-ef5"
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 3829
Date: Sat, 07 Dec 2024 07:10:22 GMT
Content-Type: application/javascript
Last-Modified: Tue, 12 Mar 2024 12:30:29 GMT
Server: nginx/1.10.3 (Ubuntu)

GET
H2 200 clarity.js Show response
www.clarity.ms/s/0.7.56/ 66 KB
28 KB 14ms
14ms Script
application/javascript 2620:1ec:bdf::45
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.clarity.ms/s/0.7.56/clarity.js
Requested by: Host: www.clarity.ms
URL: https://www.clarity.ms/tag/hqgzhl24ye
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2620:1ec:bdf::45 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: dc1da692990307185621fd661b7305e29d3a0a5ba0f0d998e5a1463a17c57044

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://intezer.com/

Response headers

x-azure-ref: 20241207T071022Z-15b54885d96gb6rwhC1FRAx2vs0000000e1000000000evye
cache-control: public, max-age=86400
x-ms-version: 2018-03-28
content-encoding: br
etag: W/"0x8DD0EDC462F0477"
x-fd-int-roxy-purgeid: 79034942
x-ms-request-id: 8f1342ab-301e-0000-7bc1-442edb000000
access-control-allow-origin: *
x-cache: TCP_HIT
date: Sat, 07 Dec 2024 07:10:22 GMT
content-type: application/javascript;charset=utf-8
vary: Accept-Encoding
last-modified: Wed, 27 Nov 2024 12:08:58 GMT

GET
H3 200 sm.25.html
static.addtoany.com/menu/ Frame 6CF1 0
0 29ms
20ms Document
text/html 172.67.39.148
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.addtoany.com/menu/sm.25.html

Requested by

Host: static.addtoany.com
URL: https://static.addtoany.com/menu/page.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.39.148 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://intezer.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

access-control-allow-origin: *
age: 7662
alt-svc: h3=":443"; ma=86400
cache-control: max-age=315360000, immutable
cf-cache-status: HIT
cf-ray: 8ee2b20e0d292c5b-FRA
content-encoding: br
content-type: text/html; charset=utf-8
date: Sat, 07 Dec 2024 07:10:22 GMT
last-modified: Sat, 07 Dec 2024 05:02:40 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
priority: u=0,i
referrer-policy: strict-origin-when-cross-origin
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DHedGutrpWV1v6HfRglT89RhIavdu2l0Xia6F%2FW7XrN%2BJhiYulKhVTHqxGdtMz4KuNy1Q810d2IfY9tiz8d7RU9X2OeKosfKt2hG18njZW89bn36WjJby5WL6UMcfyRfFU%2FMJMHg"}],"group":"cf-nel","max_age":604800}
server: cloudflare
server-timing: cfExtPri
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Accept-Encoding
x-content-type-options: nosniff

GET
H3 200 core.junnp81e.js Show response
static.addtoany.com/menu/modules/ 70 KB
26 KB 25ms
17ms Script
application/javascript 172.67.39.148
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.addtoany.com/menu/modules/core.junnp81e.js

Requested by

Host: static.addtoany.com
URL: https://static.addtoany.com/menu/page.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.39.148 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0570581bf787cbb4a26d1508cf4ed96ef19d1a2465df5b9d5c4003813a2ebd35

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://intezer.com
Referer: https://intezer.com/

Response headers

content-encoding: br
cf-cache-status: HIT
etag: W/"e6e4834d2c3691bbe81e6cdbd5ea9b75"
age: 17233
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SYqFwwrAJhBIcNhgzQHOyANFb3MGqUQtp57LAmIFFoRTVxCWd2%2FDG%2BIW3Ez9YnO6C7qWoYSZ7ZDpsZRdfrFOKdtmYLI2d%2B%2FMOqSFtvXxBQ3GUMBccGcFu8K3qZR0CsMvangmgxgdCDlp4AqBpixqAI1B"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Sat, 07 Dec 2024 07:10:22 GMT
content-type: application/javascript
vary: Accept-Encoding
priority: u=1,i=?0
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=315360000, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8ee2b20e0990d37a-FRA
access-control-allow-origin: *
server: cloudflare

GET
H3 200 dialog.min.js Show response
intezer.com/wp-content/plugins/elementor/assets/lib/dialog/ 11 KB
4 KB 7ms
7ms Script
application/javascript 199.16.172.82
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://intezer.com/wp-content/plugins/elementor/assets/lib/dialog/dialog.min.js?ver=4.9.3

Requested by

Host: 149520725.v2.pressablecdn.com
URL: https://149520725.v2.pressablecdn.com/wp-content/plugins/elementor/assets/js/frontend.min.js?ver=3.25.10

Protocol

Security

QUIC, , AES_128_GCM

Server

199.16.172.82 , United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

061918d0a4f95724e73ed3469513a4cf4bc92a27e768eadf4fd0c48e307e0dcd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://intezer.com/blog/research/unraveling-malware-encryption-secrets/&

Response headers

strict-transport-security: max-age=31536000
cache-control: max-age=315360000
content-encoding: br
etag: W/"674447e9-2c16"
access-control-allow-methods: GET, HEAD
expires: Thu, 31 Dec 2037 23:55:55 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
date: Sat, 07 Dec 2024 07:10:22 GMT
x-ac: 1.hhn _atomic_ams HIT
content-type: application/javascript
last-modified: Mon, 25 Nov 2024 09:48:25 GMT
server: nginx
vary: Accept-Encoding

GET
H2 204 0
bat.bing.net/action/ 0
346 B 63ms
61ms Image
text/plain 2620:1ec:c11::237
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bat.bing.net/action/0?ti=187039661&tm=gtm002&Ver=2&mid=7f0ae8f1-6af7-4845-b6f0-5707a507dddb&bo=2&pi=918639831&lg=de-DE&sw=1600&sh=1200&sc=24&tl=Page%20not%20found%20-%20Intezer&p=https%3A%2F%2Fintezer.com%2Fblog%2Fresearch%2Funraveling-malware-encryption-secrets%2F%26%238221&r=&lt=1358&evt=pageLoad&sv=1&asc=D&cdb=AQAY&rn=749305
Requested by: Host: intezer.com
URL: https://intezer.com/blog/research/unraveling-malware-encryption-secrets/&
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2620:1ec:c11::237 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://intezer.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 0C260ADF0D4348C9BE35EEDF5A4F3F4C Ref B: FRA31EDGE0119 Ref C: 2024-12-07T07:10:22Z
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
date: Sat, 07 Dec 2024 07:10:21 GMT

GET
H3 200 load-more.8b46f464e573feab5dd7.bundle.min.js Show response
intezer.com/wp-content/plugins/elementor-pro/assets/js/ 5 KB
2 KB 8ms
7ms Script
application/javascript 199.16.172.82
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://intezer.com/wp-content/plugins/elementor-pro/assets/js/load-more.8b46f464e573feab5dd7.bundle.min.js

Requested by

Host: 149520725.v2.pressablecdn.com
URL: https://149520725.v2.pressablecdn.com/wp-content/plugins/elementor-pro/assets/js/webpack-pro.runtime.min.js?ver=3.25.4

Protocol

Security

QUIC, , AES_128_GCM

Server

199.16.172.82 , United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

bd60836ecc4909c913a394e7e9a2566966e1594a5a43415447f7379377f132ed

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://intezer.com/blog/research/unraveling-malware-encryption-secrets/&

Response headers

strict-transport-security: max-age=31536000
cache-control: max-age=31536000
content-encoding: br
etag: W/"673ee57c-14e2"
access-control-allow-methods: GET, HEAD
expires: Fri, 05 Dec 2025 10:25:34 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
date: Sat, 07 Dec 2024 07:10:22 GMT
x-ac: 1.hhn _atomic_ams HIT
content-type: application/javascript
last-modified: Thu, 21 Nov 2024 07:47:08 GMT
server: nginx
vary: Accept-Encoding

GET
H3 200 posts.aec59265318492b89cb5.bundle.min.js Show response
intezer.com/wp-content/plugins/elementor-pro/assets/js/ 3 KB
2 KB 10ms
9ms Script
application/javascript 199.16.172.82
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://intezer.com/wp-content/plugins/elementor-pro/assets/js/posts.aec59265318492b89cb5.bundle.min.js

Requested by

Host: 149520725.v2.pressablecdn.com
URL: https://149520725.v2.pressablecdn.com/wp-content/plugins/elementor-pro/assets/js/webpack-pro.runtime.min.js?ver=3.25.4

Protocol

Security

QUIC, , AES_128_GCM

Server

199.16.172.82 , United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

7ea4ecc6e5b3e40546eee8d458437577958b920c4e2d72e395c8dd1631633ad8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://intezer.com/blog/research/unraveling-malware-encryption-secrets/&

Response headers

strict-transport-security: max-age=31536000
cache-control: max-age=31536000
content-encoding: br
etag: W/"673ee57c-cf5"
access-control-allow-methods: GET, HEAD
expires: Fri, 05 Dec 2025 10:25:34 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
date: Sat, 07 Dec 2024 07:10:22 GMT
x-ac: 1.hhn _atomic_ams HIT
content-type: application/javascript
last-modified: Thu, 21 Nov 2024 07:47:08 GMT
server: nginx
vary: Accept-Encoding

GET
H3 200 text-editor.2c35aafbe5bf0e127950.bundle.min.js Show response
intezer.com/wp-content/plugins/elementor/assets/js/ 1 KB
983 B 9ms
8ms Script
application/javascript 199.16.172.82
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://intezer.com/wp-content/plugins/elementor/assets/js/text-editor.2c35aafbe5bf0e127950.bundle.min.js

Requested by

Host: 149520725.v2.pressablecdn.com
URL: https://149520725.v2.pressablecdn.com/wp-content/plugins/elementor/assets/js/webpack.runtime.min.js?ver=3.25.10

Protocol

Security

QUIC, , AES_128_GCM

Server

199.16.172.82 , United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

8639604f6b9525e4e14c0dec40129920dc99d2ce640ccd0d5906a142ddd0e248

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://intezer.com/blog/research/unraveling-malware-encryption-secrets/&

Response headers

strict-transport-security: max-age=31536000
cache-control: max-age=31536000
content-encoding: br
etag: W/"674447e9-550"
access-control-allow-methods: GET, HEAD
expires: Fri, 05 Dec 2025 10:25:34 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
date: Sat, 07 Dec 2024 07:10:22 GMT
x-ac: 1.hhn _atomic_ams HIT
content-type: application/javascript
last-modified: Mon, 25 Nov 2024 09:48:25 GMT
server: nginx
vary: Accept-Encoding

GET
H3 200 nav-menu.7e665d03657d48aef483.bundle.min.js Show response
intezer.com/wp-content/plugins/elementor-pro/assets/js/ 5 KB
2 KB 9ms
8ms Script
application/javascript 199.16.172.82
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://intezer.com/wp-content/plugins/elementor-pro/assets/js/nav-menu.7e665d03657d48aef483.bundle.min.js

Requested by

Host: 149520725.v2.pressablecdn.com
URL: https://149520725.v2.pressablecdn.com/wp-content/plugins/elementor-pro/assets/js/webpack-pro.runtime.min.js?ver=3.25.4

Protocol

Security

QUIC, , AES_128_GCM

Server

199.16.172.82 , United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

dffb23ac733265f078f3825ef26903523fa198c9fc528c5ba72034baeeee5d33

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://intezer.com/blog/research/unraveling-malware-encryption-secrets/&

Response headers

strict-transport-security: max-age=31536000
cache-control: max-age=31536000
content-encoding: br
etag: W/"673ee57c-14d9"
access-control-allow-methods: GET, HEAD
expires: Fri, 05 Dec 2025 10:25:34 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
date: Sat, 07 Dec 2024 07:10:22 GMT
x-ac: 1.hhn _atomic_ams HIT
content-type: application/javascript
last-modified: Thu, 21 Nov 2024 07:47:08 GMT
server: nginx
vary: Accept-Encoding

GET
H3 200 anchor
www.google.com/recaptcha/api2/ Frame D223 0
0 52ms
38ms Document
text/html 172.217.18.4
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LewXc8UAAAAADEYz8dYpHTk55uH2MjKqbyc1sXD&co=aHR0cHM6Ly9pbnRlemVyLmNvbTo0NDM.&hl=de&v=pPK749sccDmVW_9DSeTMVvh2&size=invisible&cb=4ulks2j839ld

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/pPK749sccDmVW_9DSeTMVvh2/recaptcha__de.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.4 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra02s19-in-f4.1e100.net

Software

ESF /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-Jgia6-q35FEG8khEG1aDzQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://intezer.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-Jgia6-q35FEG8khEG1aDzQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-opener-policy-report-only: same-origin; report-to="coop_38fac9d5b82543fc4729580d18ff2d3d"
cross-origin-resource-policy: cross-origin
date: Sat, 07 Dec 2024 07:10:22 GMT
expires: Mon, 01 Jan 1990 00:00:00 GMT
pragma: no-cache
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} {"group":"coop_38fac9d5b82543fc4729580d18ff2d3d","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/38fac9d5b82543fc4729580d18ff2d3d"}]}
server: ESF
x-content-type-options: nosniff
x-xss-protection: 0

POST
H2 200 assign
tracking.g2crowd.com/attribution_tracking/conversions/ 0
0 117ms
116ms Ping
text/html 2606:4700::6812:1fb0
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://tracking.g2crowd.com/attribution_tracking/conversions/assign
Requested by: Host: tracking.g2crowd.com
URL: https://tracking.g2crowd.com/attribution_tracking/conversions/5450.js?p=https://intezer.com/blog/research/unraveling-malware-encryption-secrets/&
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1fb0 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarycIT03BwlNcm4cU9S
Referer: https://intezer.com/

Response headers

POST
H/1.1 204
No Content collect Show response
k.clarity.ms/ 0
275 B 413ms
200ms XHR
text/plain 172.175.38.6
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://k.clarity.ms/collect
Requested by: Host: www.clarity.ms
URL: https://www.clarity.ms/s/0.7.56/clarity.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 172.175.38.6 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Accept: application/x-clarity-gzip
Referer: https://intezer.com/

Response headers

Request-Context: appId=cid-v1:e97341f6-8fff-46a6-9229-fbbfe0892c78
Access-Control-Allow-Origin: https://intezer.com
Date: Sat, 07 Dec 2024 07:10:22 GMT
Vary: Origin
Server: nginx
Connection: keep-alive
Access-Control-Allow-Credentials: true

GET
H/1.1 200
OK track.gif
secure.gaug.es/ 35 B
389 B 100ms
100ms Image
image/gif 3.215.198.72
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://secure.gaug.es/track.gif?h[site_id]=5fd5ade352684d3c97554910&h[resource]=https%3A%2F%2Fintezer.com%2Fblog%2Fresearch%2Funraveling-malware-encryption-secrets%2F%26%238221&h[referrer]=&h[title]=Page%20not%20found%20-%20Intezer&h[user_agent]=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F131.0.0.0%20Safari%2F537.36&h[unique]=1&h[unique_hour]=1&h[unique_day]=1&h[unique_month]=1&h[unique_year]=1&h[screenx]=1600&h[browserx]=1600&h[browsery]=1200&timestamp=1733555422775

Requested by

Host: intezer.com
URL: https://intezer.com/blog/research/unraveling-malware-encryption-secrets/&

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.215.198.72 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-215-198-72.compute-1.amazonaws.com

Software

nginx/1.10.3 (Ubuntu) /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://intezer.com/

Response headers

Cache-Control: no-store, no-cache, must-revalidate, private
Pragma: no-cache
Connection: keep-alive
X-Content-Type-Options: nosniff
Expires: Sat, 25 Nov 2000 05:00:00 GMT
Content-Length: 35
Date: Sat, 07 Dec 2024 07:10:22 GMT
Content-Type: image/gif
Last-Modified: Sat, 07 Dec 2024 07:10:22 GMT
Server: nginx/1.10.3 (Ubuntu)

GET
H/1.1 200
OK json Show response
pro.ip-api.com/ 225 B
381 B 35ms
8ms Fetch
application/json 51.77.64.70
OVH OVH SAS

General

Check archive.org

Show headers Download Go to

Full URL: https://pro.ip-api.com/json?key=zPwv6i0dpmS2yR5&fields=proxy,hosting,isp,lat,long,zip,city,region,status,country,timezone,regionName,countryCode
Requested by: Host: s3-us-west-2.amazonaws.com
URL: https://s3-us-west-2.amazonaws.com/b2bjsstore/b/GNLKQHEMX96Q/reb2b.js.gz
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 51.77.64.70 , Germany, ASN16276 (OVH OVH SAS, FR),
Reverse DNS: de-fra-1.pro.ip-api.com
Software: /
Resource Hash: badadad2a49d1366c339f0c0d7348393af7980850881b8a63863ff4ef9e34fb9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://intezer.com/

Response headers

Access-Control-Allow-Origin: *
Content-Length: 225
Date: Sat, 07 Dec 2024 07:10:22 GMT
Content-Type: application/json; charset=utf-8

GET
H2 200 5492986.js Show response
js-na1.hs-scripts.com/ 1000 B
670 B 151ms
141ms Script
application/javascript 2606:4700::6810:8dd1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js-na1.hs-scripts.com/5492986.js

Requested by

Host: js.hs-analytics.net
URL: https://js.hs-analytics.net/analytics/1733555400000/5492986.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:8dd1 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a7956b6f88a8ca3e495027f907e665c8249fd3b0e8da7553abe370b65636c61a

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://intezer.com/

Response headers

access-control-max-age: 3600
content-encoding: gzip
cf-cache-status: EXPIRED
access-control-allow-credentials: true
x-content-type-options: nosniff
cf-ray: 8ee2b2111b43a5f4-FRA
accept-ranges: bytes
access-control-allow-origin: https://intezer.com
content-length: 532
date: Sat, 07 Dec 2024 07:10:23 GMT
x-hubspot-correlation-id: da018672-16fd-4470-bc9a-c9f5ffbe7ad9
content-type: application/javascript;charset=utf-8
vary: origin, Accept-Encoding
server: cloudflare
last-modified: Sat, 07 Dec 2024 07:10:23 GMT

GET
H2 200 __ptq.gif
track.hubspot.com/ 45 B
1 KB 171ms
143ms Image
image/gif 2606:4700::6810:7674
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://track.hubspot.com/__ptq.gif?k=1&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=de-de&bfp=930271884&v=1.1&a=5492986&ct=standard-page&pu=https%3A%2F%2Fintezer.com%2Fblog%2Fresearch%2Funraveling-malware-encryption-secrets%2F%26%238221&t=Page+not+found+-+Intezer&cts=1733555422879&vi=12762fb2d8d79e6d2bdc724526af6717&nc=true&u=193884914.12762fb2d8d79e6d2bdc724526af6717.1733555422878.1733555422878.1733555422878.1&b=193884914.1.1733555422878&pt=0&cc=15

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7674 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://intezer.com/

Response headers

x-robots-tag: none
x-request-id: 0b207d78-41ad-4c95-8264-c418d8d3ff79
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3o3oOLcSJocQ29FuzDHwpudrFdsE5gu9Dt49T7TgM5%2FeTgTM7I9ivkZRmylklMOYpxcQVNHtLC3OZjKZj5sQxCuv2mdsVqw4QRWlG0A0%2FMMqb6jt2TVnii9uBdsMJYLC2mF4fbobstv%2F3dgg1adU"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
x-evy-trace-listener: listener_https
p3p: CP="NOI CUR ADM OUR NOR STA NID"
date: Sat, 07 Dec 2024 07:10:23 GMT
x-hubspot-correlation-id: 0b207d78-41ad-4c95-8264-c418d8d3ff79
content-type: image/gif
vary: origin, Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-evy-trace-route-service-name: envoyset-translator
cache-control: no-cache, no-store, no-transform
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/analytics-tracking-td/envoy-proxy-c658cb6d4-qtkxw
x-envoy-upstream-service-time: 5
access-control-allow-credentials: false
cf-ray: 8ee2b2113c675d7c-FRA
x-evy-trace-route-configuration: listener_https/all
content-length: 45
server: cloudflare
x-evy-trace-virtual-host: all

POST
H2 204 collect
region1.analytics.google.com/g/ 0
0 15ms
13ms Fetch
text/plain 2001:4860:4802:32::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.analytics.google.com/g/collect?v=2&tid=G-77ZEDWXEEK&gtm=45je4c40v890741055za200zb9126815961&_p=1733555422054&gcd=13l3lPl2l1l1&npa=1&dma_cps=syphamo&dma=1&tag_exp=101925629~102067555~102067808~102081485&cid=573645210.1733555422&ul=de-de&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_eu=AEA&_s=2&sid=1733555422&sct=1&seg=0&dl=https%3A%2F%2Fintezer.com%2Fblog%2Fresearch%2Funraveling-malware-encryption-secrets%2F%26&dt=Page%20not%20found%20-%20Intezer&en=scroll&epn.percent_scrolled=90&_et=8&tfd=1856
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-77ZEDWXEEK&l=dataLayer&cx=c&gtm=45He4c40v9126815961za200
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://intezer.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:136:0
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:136:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://intezer.com
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 07 Dec 2024 07:10:22 GMT
content-type: text/plain
server: Golfe2

GET
H3 200 fav.png
149520725.v2.pressablecdn.com/wp-content/themes/intezer-v2/ 1 KB
2 KB 7ms
7ms Other
image/png 192.0.77.39
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://149520725.v2.pressablecdn.com/wp-content/themes/intezer-v2/fav.png

Protocol

Security

QUIC, , AES_128_GCM

Server

192.0.77.39 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

9fa0dee7fee94f4af608cd5b31b0228958481d83153369343a7d015fcdd1e649

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://intezer.com/

Response headers

strict-transport-security: max-age=15552000
link: <http://intezer.com/wp-content/themes/intezer-v2/fav.png>; rel="canonical"
cache-control: max-age=604800
x-nc: HIT hhn 2
access-control-allow-methods: GET, HEAD
expires: Sat, 14 Dec 2024 07:10:22 GMT
accept-ranges: bytes
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400, h3=":443"; ma=86400
content-length: 1516
date: Sat, 07 Dec 2024 07:10:22 GMT
x-ac: 2.hhn _atomic_ams HIT
content-type: image/png
last-modified: Wed, 15 Dec 2021 14:29:17 GMT
server: nginx

POST
H2 204 utk
api.getkoala.com/web/projects/pk_6c50e30c08715cfa57e9d6fd33965720122a/ 0
666 B 203ms
203ms Ping
text/plain 2606:4700:20::681a:bc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://api.getkoala.com/web/projects/pk_6c50e30c08715cfa57e9d6fd33965720122a/utk

Requested by

Host: cdn.getkoala.com
URL: https://cdn.getkoala.com/v1/pk_6c50e30c08715cfa57e9d6fd33965720122a/sdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:bc , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Frame-Options	ALLOWALL

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://intezer.com/

Response headers

access-control-max-age: 7200
x-request-id: e74b4b7d-9a75-4979-8f8e-160f6d16dc69
access-control-expose-headers
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=l79E5bYH%2F9OEPLucNCMUm0RbnC26ifokfWEBhoKKAOP%2FfrCLw11iurTHE%2BSjozqQlIPvHREj3uVsyGzkwTdKrE4RcKmT%2BPJ32MJa%2Fk2l%2FU%2FSvU1MiVFpLqEq09FKTibbvUB8txHl9xHP8RxTgfM%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-methods: GET, POST, PATCH, PUT, OPTIONS, HEAD
server-timing: cfL4;desc="?proto=TCP&rtt=7432&min_rtt=6292&rtt_var=1557&sent=37&recv=27&lost=0&retrans=0&sent_bytes=28400&recv_bytes=3367&delivery_rate=1286068&cwnd=257&unsent_bytes=0&cid=5304b20452e0e20d&ts=868&x=0"
date: Sat, 07 Dec 2024 07:10:23 GMT
vary: Origin
x-runtime: 0.007867
x-frame-options: ALLOWALL
strict-transport-security: max-age=63072000; includeSubDomains
cache-control: no-cache
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 8ee2b2113899972c-FRA
access-control-allow-origin: *
server: cloudflare

POST
H2 204 batch
api.getkoala.com/web/projects/pk_6c50e30c08715cfa57e9d6fd33965720122a/ 0
456 B 204ms
203ms Ping
text/plain 2606:4700:20::681a:bc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://api.getkoala.com/web/projects/pk_6c50e30c08715cfa57e9d6fd33965720122a/batch

Requested by

Host: cdn.getkoala.com
URL: https://cdn.getkoala.com/v1/pk_6c50e30c08715cfa57e9d6fd33965720122a/sdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:bc , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Frame-Options	ALLOWALL

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://intezer.com/

Response headers

access-control-max-age: 7200
x-request-id: a965f88b-5712-42a7-9c50-9ca98a71662d
access-control-expose-headers
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kaNMI4JoSSfwwGnHZZik8RaSSE1j6PqXuohAHj33D8S3F%2FpvkA1NiAL6zFA3wyOvzuENrJjl%2Fr8m5dRs9t3SkSklGZaqr5BB%2F55go%2FuqCuG5KR2ulRY1BsXMmjgWbfXjyDwAkrBN1CXn5aapiOA%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-methods: GET, POST, PATCH, PUT, OPTIONS, HEAD
server-timing: cfL4;desc="?proto=TCP&rtt=7432&min_rtt=6292&rtt_var=1557&sent=38&recv=27&lost=0&retrans=0&sent_bytes=29088&recv_bytes=3367&delivery_rate=1286068&cwnd=257&unsent_bytes=0&cid=5304b20452e0e20d&ts=871&x=0"
date: Sat, 07 Dec 2024 07:10:23 GMT
vary: Origin
x-runtime: 0.011500
x-frame-options: ALLOWALL
strict-transport-security: max-age=63072000; includeSubDomains
cache-control: no-cache
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 8ee2b211389a972c-FRA
access-control-allow-origin: *
server: cloudflare

GET
H3 200 cropped-intezer-blue-1-50x50.png
149520725.v2.pressablecdn.com/wp-content/uploads/2020/05/ 2 KB
2 KB 8ms
7ms Other
image/png 192.0.77.39
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://149520725.v2.pressablecdn.com/wp-content/uploads/2020/05/cropped-intezer-blue-1-50x50.png

Protocol

Security

QUIC, , AES_128_GCM

Server

192.0.77.39 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

73b6ff97f4e5641c8e38a3824048095323fab8f237012307a25b08b58ff1c27c

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://intezer.com/

Response headers

strict-transport-security: max-age=15552000
link: <http://intezer.com/wp-content/uploads/2020/05/cropped-intezer-blue-1-50x50.png>; rel="canonical"
cache-control: max-age=604800
x-nc: HIT hhn 2
access-control-allow-methods: GET, HEAD
expires: Sat, 14 Dec 2024 07:10:22 GMT
accept-ranges: bytes
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400, h3=":443"; ma=86400
content-length: 1642
date: Sat, 07 Dec 2024 07:10:22 GMT
x-ac: 2.hhn _atomic_ams MISS
content-type: image/png
last-modified: Wed, 10 Aug 2022 12:41:33 GMT
server: nginx

POST
H/1.1 204
No Content collect Show response
k.clarity.ms/ 0
275 B 101ms
99ms XHR
text/plain 172.175.38.6
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://k.clarity.ms/collect
Requested by: Host: www.clarity.ms
URL: https://www.clarity.ms/s/0.7.56/clarity.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 172.175.38.6 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Accept: application/x-clarity-gzip
Referer: https://intezer.com/

Response headers

Request-Context: appId=cid-v1:e97341f6-8fff-46a6-9229-fbbfe0892c78
Access-Control-Allow-Origin: https://intezer.com
Date: Sat, 07 Dec 2024 07:10:23 GMT
Vary: Origin
Server: nginx
Connection: keep-alive
Access-Control-Allow-Credentials: true

POST
H2 204 metrics
api.getkoala.com/web/projects/pk_6c50e30c08715cfa57e9d6fd33965720122a/ 0
479 B 197ms
196ms Ping
text/plain 2606:4700:20::681a:bc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://api.getkoala.com/web/projects/pk_6c50e30c08715cfa57e9d6fd33965720122a/metrics

Requested by

Host: cdn.getkoala.com
URL: https://cdn.getkoala.com/v1/pk_6c50e30c08715cfa57e9d6fd33965720122a/sdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:bc , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Frame-Options	ALLOWALL

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://intezer.com/

Response headers

access-control-max-age: 7200
x-request-id: 492dd389-810c-48a3-83ed-3a0807200f15
access-control-expose-headers
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jA9EEV6cHGj0OhFwXf%2BszemFWSzief2urX00bDd1Qhpdx9jEy%2BFXTRSH8yFXcwkUAuDOxLrYbtuyW0uRS70gcar7CXOCiwIENjc1TCBZxK5orVdIkVvRE3OfaaYgS3Yh%2BnJJOGhU6lIgKIurPhE%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-methods: GET, POST, PATCH, PUT, OPTIONS, HEAD
server-timing: cfL4;desc="?proto=TCP&rtt=7554&min_rtt=6292&rtt_var=1413&sent=40&recv=30&lost=0&retrans=0&sent_bytes=29566&recv_bytes=4293&delivery_rate=1286068&cwnd=257&unsent_bytes=0&cid=5304b20452e0e20d&ts=1862&x=0"
date: Sat, 07 Dec 2024 07:10:24 GMT
vary: Origin
x-runtime: 0.005863
x-frame-options: ALLOWALL
strict-transport-security: max-age=63072000; includeSubDomains
cache-control: no-cache
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 8ee2b2177e4e972c-FRA
access-control-allow-origin: *
server: cloudflare

POST
H/1.1 204
No Content collect Show response
k.clarity.ms/ 0
275 B 103ms
102ms XHR
text/plain 172.175.38.6
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://k.clarity.ms/collect
Requested by: Host: www.clarity.ms
URL: https://www.clarity.ms/s/0.7.56/clarity.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 172.175.38.6 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Accept: application/x-clarity-gzip
Referer: https://intezer.com/

Response headers

Request-Context: appId=cid-v1:e97341f6-8fff-46a6-9229-fbbfe0892c78
Access-Control-Allow-Origin: https://intezer.com
Date: Sat, 07 Dec 2024 07:10:26 GMT
Vary: Origin
Server: nginx
Connection: keep-alive
Access-Control-Allow-Credentials: true

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: assets.apollo.io
URL: https://assets.apollo.io/micro/website-tracker/tracker.iife.js?nocache=8yjng

Verdicts & Comments Add Verdict or Comment

108 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

27 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
www.google.com/recaptcha	1970-01-21 05:51:47	Name: _GRECAPTCHA Value: 09ANOXeZxnM8eh2v3hkYcUYDx28xTRe6py4kgseMxM5NhDcsEPuez9QJNtRSrnKfC1OCFKKGhFklqGl-_ialZkaXo
.intezer.com/	1970-01-21 03:42:11	Name: _gcl_au Value: 1.1.322563090.1733555422
.intezer.com/	1970-01-21 10:18:11	Name: _lfa Value: LF1.1.d805fa0618dd386f.1733555422227
.intezer.com/	1970-01-21 01:34:01	Name: _gid Value: GA1.2.198834945.1733555422
.intezer.com/	1970-01-21 01:32:35	Name: _dc_gtm_UA-97741055-8 Value: 1
.intezer.com/	1970-01-21 11:08:35	Name: _ga Value: GA1.1.573645210.1733555422
.g2crowd.com/	1970-01-21 01:32:37	Name: __cf_bm Value: 7svQ5wEUQk5QOudcdc9OSLoKBOPlIVSpjvyeFwgHaVk-1733555422-1.0.1.1-eyhu9.E7gsKQuZmO2hKQTGfy9CnCwjOb6rTsGX94W95fWU4EF.3h9Mw8Pe45_q4e_S92zxPNF4fcVEy6fri8rg
.linkedin.com/	1970-01-21 01:34:01	Name: lidc Value: "b=OGST01:s=O:r=O:a=O:p=O:g=3468:u=1:x=1:i=1733555422:t=1733641822:v=2:sig=AQGPqG1Fz7jhs8O1UlSxNXDCGbQAc80J"
.linkedin.com/	1970-01-21 10:18:11	Name: bcookie Value: "v=2&8ed96c09-fd7d-4451-86c7-884b26d74cfa"
.linkedin.com/	1970-01-21 05:51:47	Name: li_gc Value: MTswOzE3MzM1NTU0MjI7MjswMjErqopm0s/O7Ll4Pp6BSGD5YbvKO2ktBcTXkkWlz+dlbA==
intezer.com/	1970-01-21 01:32:39	Name: _gauges_unique_hour Value: 1
intezer.com/	1970-01-21 01:34:01	Name: _gauges_unique_day Value: 1
intezer.com/	1970-01-21 02:17:13	Name: _gauges_unique_month Value: 1
intezer.com/	1970-01-21 10:18:11	Name: _gauges_unique_year Value: 1
intezer.com/	1970-01-21 10:18:11	Name: _gauges_unique Value: 1
intezer.com/	1970-01-21 10:10:59	Name: _reb2buid Value: a09ca330-a8f5-4d63-aadd-c8dda8338495-1733555422819
intezer.com/	1970-01-21 01:32:37	Name: _reb2bsessionID Value: QHsRBgNpXPG1b2HFnDsvORB2
intezer.com/	1970-01-21 02:01:23	Name: _reb2bgeo Value: %7B%22city%22%3A%22Nuremberg%22%2C%22country%22%3A%22Germany%22%2C%22countryCode%22%3A%22DE%22%2C%22hosting%22%3Atrue%2C%22isp%22%3A%22Core-Backbone%20GmbH%22%2C%22lat%22%3A49.4521%2C%22proxy%22%3Atrue%2C%22region%22%3A%22BY%22%2C%22regionName%22%3A%22Bavaria%22%2C%22status%22%3A%22success%22%2C%22timezone%22%3A%22Europe%2FBerlin%22%2C%22zip%22%3A%2290403%22%7D
.intezer.com/	1970-01-21 05:51:47	Name: __hstc Value: 193884914.12762fb2d8d79e6d2bdc724526af6717.1733555422878.1733555422878.1733555422878.1
.intezer.com/	1970-01-21 05:51:47	Name: hubspotutk Value: 12762fb2d8d79e6d2bdc724526af6717
.intezer.com/	1969-12-31 23:59:59	Name: __hssrc Value: 1
.intezer.com/	1970-01-21 01:32:37	Name: __hssc Value: 193884914.1.1733555422878
.intezer.com/	1970-01-21 11:08:35	Name: _ga_77ZEDWXEEK Value: GS1.1.1733555422.1.0.1733555422.60.0.0
.intezer.com/	1970-01-21 10:18:11	Name: ko_id Value: 638c90e1-a1a9-4e6c-9125-28de60603a0d
.intezer.com/	1970-01-21 01:34:01	Name: ko_sid Value: {%22id%22:%221733555422909%22%2C%22lastTouched%22:1733555422911}
.hubspot.com/	1970-01-21 01:32:37	Name: __cf_bm Value: 5HUp0Kr2YRi23GE6s0r5BrxszIk8rko0HPvEd.EpHmM-1733555423-1.0.1.1-pguJE4grObQ01xJ76.gipTAuiITZ7u0yESDGd16d9HQVkCD.JN1R3PnHyH3JvwytXKiEOrgImuucJSp8X9..bw
.hubspot.com/	1969-12-31 23:59:59	Name: _cfuvid Value: d.rijMGTC2E3HMyL6.aNhO_fvzafkWH5Gnmr2gf_rns-1733555423046-0.0.1.1-604800000

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://intezer.com/blog/research/unraveling-malware-encryption-secrets/&#8221 Message: Failed to load resource: the server responded with a status of 404 ()
security	error	Message: Refused to load the script 'https://assets.apollo.io/micro/website-tracker/tracker.iife.js?nocache=8yjng' because it violates the following Content Security Policy directive: "script-src 'self' 'report-sample' 'unsafe-inline' 'unsafe-eval' data: interactive-img.com/js/include.js .datatables.net .salesforce.com salesforce.com yoast.com stylemixthemes.com .bootstrapcdn.com .chilipiper.com .na.chilipiper.com .wp-rocket.me .storylane.io .clearbitscripts.com .clearbitjs.com .clarity.ms .googleoptimize.com .mouseflow.com .lfeeder.com .addtoany.com .google.com .googleapis.com .intezer.com .youtube.com googletagmanager.com .opendns.com .hsappstatic.net .hsforms.net .js-hsforms.net .cloudflare.com .comeet.co .twitter.com .gaug.es .wp.com .hsleadflows.net .gstatic.com .usemessages.com .hs-banner.com .licdn.com .hs-analytics.net .ads-twitter.com .hs-scripts.com .googleadservices.com .hotjar.com .hotjar.io .bing.com .microsoft.com .clarity.ms .googletagmanager.com .doubleclick.net .addtoany.com .facebook.net .google-analytics.com .pressablecdn.com .redditstatic.com .getkoala.com .cookieyes.com .cdn-cookieyes.com .hubspot.com *.g2crowd.com s3-us-west-2.amazonaws.com/b2bjsstore/b/GNLKQHEMX96Q/reb2b.js.gz". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header

Value

Content-Security-Policy

Strict-Transport-Security

max-age=31536000

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

149520725.v2.pressablecdn.com
api.getkoala.com
assets.apollo.io
bat.bing.com
bat.bing.net
cdn.getkoala.com
cdn.mouseflow.com
fonts.googleapis.com
fonts.gstatic.com
intezer.com
js-na1.hs-scripts.com
js.hs-analytics.net
js.hs-banner.com
js.hs-scripts.com
k.clarity.ms
pixel.wp.com
pro.ip-api.com
px.ads.linkedin.com
px4.ads.linkedin.com
region1.analytics.google.com
s3-us-west-2.amazonaws.com
sc.lfeeder.com
secure.gaug.es
snap.licdn.com
static.addtoany.com
stats.g.doubleclick.net
stats.wp.com
tr-rc.lfeeder.com
track.hubspot.com
tracking.g2crowd.com
www.clarity.ms
www.google-analytics.com
www.google.com
www.google.de
www.googletagmanager.com
www.gstatic.com
assets.apollo.io
104.18.26.50
13.107.42.14
142.250.186.35
142.250.74.195
172.175.38.6
172.217.18.4
172.67.39.148
18.173.187.127
192.0.76.3
192.0.77.39
199.16.172.82
2001:4860:4802:32::36
2600:9000:26da:7800:4:d7e1:700:93a1
2606:4700:20::681a:bc
2606:4700:4400::ac40:9310
2606:4700::6810:7674
2606:4700::6810:8dd1
2606:4700::6810:a0a8
2606:4700::6812:1fb0
2620:1ec:21::14
2620:1ec:33:1::10
2620:1ec:bdf::45
2620:1ec:c11::237
2a00:1450:4001:813::2008
2a00:1450:4001:813::200a
2a00:1450:4001:828::200e
2a00:1450:4001:830::2003
2a00:1450:400c:c07::9a
2a02:26f0:3500:10::210:a99
3.215.198.72
51.77.64.70
52.218.242.224
0570581bf787cbb4a26d1508cf4ed96ef19d1a2465df5b9d5c4003813a2ebd35
061918d0a4f95724e73ed3469513a4cf4bc92a27e768eadf4fd0c48e307e0dcd
07c5f537fe8fe8730f255bdbca90e77ef6b5612d396ed8dcabbd1888dd2776a0
0cd088147551ecae9b1e29c2ac532c56bb99132973e1310f4911d7fa31997a12
104a8d629d83b0015aceaccb0ccff6178efeff33c99a132a148728f800431b93
126add89639e7ac92dff67c061c2e32486ecca91d0d1d1ed8f1bc5ee34596a27
149e18d6d030d14062baa104ab746d3b68558350a284b90d2867f78deacad286
1bca3dda2c4bda005185f8f80efe4888c8fa4819c61afd5d3705828c55d10b05
1cffc2b3146584685cd72751d7f28aa030ab9ae2f1bc78f2c27909f8d8287b26
209cf774eba62c66b53a6fa3d37bfeed07d856422de590b973352a0bb85e86dc
2471f4232ccca845a9da8b10e5be81e7323faa5891b9715f425661505f183434
252ff47bdded7295123a3a968787365824d86c1039686f0153ba50e8e5d9ecc8
2b4f7f35c2e4781c145dd989fdc551f3bc94ca7de9a9d759e99092abf23d9277
2e10d353ff038c2cad3492fc17801af3e6ef2669c9e9713bdb78b1dcb104c4fe
3bb38d0f302677ff4104564454f60f495133579d6e6dfb722b3de850df596502
3c4d6a1421c7ddb7e404521fe8c4cd5be5af446d7689cd880be26612eaad3cfa
3c7b82e29d5b73c5e056347bbd93505b42ab550ca948429364cd3a398eb6a205
3da4a3da0a8fdf3a5c534b4ec332e85a42f2115e7c96a240216ee8fbf18d0aae
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
4be59303a71dba6e02707efdaf510e858b5a703d09811680dbc3fada6c2111c5
4d52bfae84f573b802b6e5c12064b9c26b218755751bac6fdbc0325398419143
4edbb30d40d6fbee57e7f3dd7ce40167ef6d6cb5daacbcebc14c89d49848312c
50679e0e3933c945348a2db0cc128bb14b57a60a74fabf8cae13acc14efbb2e1
5154ce99fedfb9c89a77c87343782bd79fedcc4296f230416194353b378fe2bd
52554987e314ced7d4fe93f4716a239f940aa961fa7a0000589479f03ffaed8d
530caf71534c7f8a0673a1ad3cbceb6e7ae061953f850d0102b6b68fd9e17a5d
5ab1dbb1b0d2d8b6ec9452f21a15ddcc085039da8f4a9fbabd6c07503a79ef81
5badd609a51ede5bab5b89534fc3011a4dd1ab487cc7081d7cf38479bcbab855
5e03f3d3ed70ec769c840d5108bc0f3eb4c008a8054b93063aaea46c9fc0cb33
5f75229618682b638f81b324b803e9c4752b8eba4a5846daa094c7626e2639d7
673ce1fc727c061b5b5561051ed3dbdbb45fa28a83e42cea9cb66f8e4dfbf9c7
6b4747fb204e26cc280177fd6dd95f4be5b7a08f70e04aa3b8e25e6e0397ccbe
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
6d60e3b25e56d35148888b5a08c8eb0ff3806f9698d4f6f54a35eab7d27f4c2f
6e79aeee4cbc317a3b6e18c8887ed2c1659ad8eb27431d1896a075ed935a9149
73b6ff97f4e5641c8e38a3824048095323fab8f237012307a25b08b58ff1c27c
751d5192326ddefce3e87157f7c9355217cdad7b4a969b5dd3161b4453671389
75787e3c30ea0cc0ba8fca298cc258dfc3b0c251a93eb1c77adb7d6377a9d4e6
768ce279895a5bf92b52e3fd9141ec2e700dd614070e7f6f56ba0e75533fd08b
76b80d7b9fdc1017c678cc0a4562b0126dc049fb6f310f4fe812dfb959590bfd
780bf1d57077da9fbb446797a41963f635fd1ac256a87c0da9cf14b29c9dc5e5
79686b4ccd4520cc65e78f229a2d31730654977827ca8986b4a4193626bc724c
7e84c9f8d71bc6eb2dac2fce59a6caea62da51ffa8cf56b41806f59386ab1322
7ea4ecc6e5b3e40546eee8d458437577958b920c4e2d72e395c8dd1631633ad8
80bd626eb6d57112072a508ee4e5ce3c2fe5673fe0a5d029810033b24aaa5e9f
81816d809b5350c4b66fa291879624b5444607134133ad99ad0994dda3fcea20
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
8639604f6b9525e4e14c0dec40129920dc99d2ce640ccd0d5906a142ddd0e248
8774a849519bd33b973e8b0deb311ce92a48e0803fb8c78fccd5e06251ef0623
8a27dc7b44ebe886390bfa0a9beeea36ea5a3f37479f0e0836b6c9b80d9b35ed
8eaa54ce71e4999064652bd8cb0d02a14c5b7382f82635efc40faf5920815883
8f5d8fdb9ab7ad2cdd14072ba8d7d306459e2e01bcb4e87b44f4b0f0fa835f27
91bafd41ccba74de6c83744afa560e15157f482b9f6b02a34e4b3c5c867d2a86
98c01c3c72f888b1324c87f42945175edea1b2bc790cfb7c7d6cdcd093b27a16
9a1e0d38b691f1d22a92cff65ec0439b428170ac39a4493c7ecb06d5585f56a3
9ad1e9379d36751705965bcb5922f2970726c627d0ab441a380d0d7731c73db5
9b5cd0471afe0aa08f6097c16c8e2badcb68bdcb9824819a494003cd65659838
9bc52b3c4e9973d64baa482f332ed895f80d0cd2be37e6a49bf1a2e831eb5ac9
9fa0dee7fee94f4af608cd5b31b0228958481d83153369343a7d015fcdd1e649
a468e000e9ecb3d535f15b465f476944047e8a0fe16d9f2c20a6d7c4014afc90
a542f4b92ca1daa49d452f46578dfb0178939c378da21f7388e75e55575fa69b
a7956b6f88a8ca3e495027f907e665c8249fd3b0e8da7553abe370b65636c61a
aabc88a6db8b22022f96ca88e4f0a7be426abef2b35169a71515a2d55246402a
ae10c69ed7139158b505d4afa75c19376a69586da56868cadd61532889930c15
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b195b9c5737214bef71cd6405af04b3eb88882acd9c582a0432c18c0561756bd
b65b3de1bc923b9355248a0d941a0eaee15dfb9a6b8eadb51323a8df6189dcd1
b7908a015a567ec2363011df2475368dbff34360e9da3fdff50604d6395fb646
ba0c59deb5450f5cb41b3f93609ee2d0d995415877ddfa223e8a8a7533474f07
badadad2a49d1366c339f0c0d7348393af7980850881b8a63863ff4ef9e34fb9
bd60836ecc4909c913a394e7e9a2566966e1594a5a43415447f7379377f132ed
c19e3e4151ea4933fa9ba9703c51fe20ad469237771214b1c5001d1b107ddef5
c40a0cdd5ab5dcc4da78066f70839808bb4ee8fb2f3360dec64fde438770b099
c57865ec6a6956797b18dc7d23a3ade16e7ced5271f4dc0796b2ed0a10f934dc
c57e64fcb72bddafa9c38de574441c3e69ac6c961df96b0cad34da83658bd196
c69c3ed69efdef75400086f66e14917fa9746e39ee23774c055ad25355b5bc7d
c873089757f55c85861c805ebb1f51bffff5c024f9151b72e2a56a9bf247ae86
c96637576deebc6e435e2c5a65868b0db2d57b477009d704f050c51a50abd4a1
ce22146374a9ffdf8e2120212e21cf01990aa5df3d13e25b27627c00783b2638
cedc9155263d1f634191e71f3c9ce256b315f833e375739ed0e65087996428cc
d61aa264cb691fd2580171c2b9ceba787fe15609fe1061bbef079ac64c48751f
d8ee8979b5cc9f40d08ebb95ed4755334afb6b9718434591d5e85a3e2a721c77
d9c370831c74b1850d70f5b1c99453d6cda21e5099428a3f21c43bd96c3acb5d
dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4
dc1da692990307185621fd661b7305e29d3a0a5ba0f0d998e5a1463a17c57044
ddcce687729cb358abf9d0d8e1217a097859be2b0d18c23d7c851b38c87bc9c0
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
df0ec8330290d184b1084527076cb87d41b33ba706ff5ab579d761f0cb6a744b
df2698e6cf74ed890afa92da10051f880df2ce0b3257b73c5d9ae2f6bea82d3c
dffb23ac733265f078f3825ef26903523fa198c9fc528c5ba72034baeeee5d33
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e85052e09a7415a2ab775cc198a96dc956d9de42b90541a5cdc9c5c176725745
ea6260ff44181045f8ba433a18b308e9aa05be9ca0b9519eb27aae0e4f839131
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f00c690f9ac9a7bbd3f1a4346472c52ff3329d51a5cc7823c2277b0aa041c443
f313d12ea6124bd28fc4a6b7163d253bb83d5aeab5edce594880c5c3df475cbc
f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1
f40767552e5e94b2d5f9a65d7f640cfa7d225298023dbd682095e040809a3d1a
f825cbeb2a8aa255d837ad9d53514b6dcd0338ce353d817af7a64e80fb5203ec
f859a8cc18d7cd132b29e699b4ffb33b7ff83f74b4c73df293c806d18bc7c231
f9b60ae2f2938c589960ef00d9b9a644f0847f7183f597cdc3fbf8cfe904c552
f9b907ed9da65ad0737a8dbdad9bfbf9019e2ae0526953b38a934d8c1a31e76b
fa421b6ebbd2fb474d3a3866409ce6c1efd120b47ff256fffb8f8f50d556d3d9
fdc9a433f5b281b04f603b4c887f28ef632a7f5421a160e02f784c7c9bf63041
ffb13661f2156df8aae98bba71c9d9f56c4ba06b296f6e1e6e46768ad77fb44b

intezer.com Open in urlscan Pro 199.16.172.82 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

123 Requests

98 %HTTPS

56 %IPv6

28 Domains

36 Subdomains

33 IPs

4 Countries

1591 kBTransfer

4787 kBSize

27 Cookies

8 Outgoing links

Redirected requests

123 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

intezer.com Open in urlscan Pro
199.16.172.82 Public Scan

Screenshot
Live screenshot

Full Image

123
Requests

98 %
HTTPS

56 %
IPv6

28
Domains

36
Subdomains

33
IPs

4
Countries

1591 kB
Transfer

4787 kB
Size

27
Cookies

123 HTTP transactions
0 data transactions