urlscan.io logo urlscan.io
SecurityTrails logo

www.andreafortuna.org Open in urlscan Pro
104.27.154.184  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://www.andreafortuna.org/2018/03/28/what-is-the-china-chopper-websh=
Effective URL: https://www.andreafortuna.org/2018/03/28/what-is-the-china-chopper-webshell-and-how-to-find-it-on-a-compromized-system/
Submission: On December 05 via api from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 15 IPs in 4 countries across 13 domains to perform 37 HTTP transactions. The main IP is 104.27.154.184, located in United States and belongs to CLOUDFLARENET - Cloudflare, Inc., US. The main domain is www.andreafortuna.org.
TLS certificate: Issued by CloudFlare Inc ECC CA-2 on November 8th 2019. Valid for: a year.
This is the only time www.andreafortuna.org was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 12 104.27.154.184 13335 (CLOUDFLAR...)
2 52.222.170.133 16509 (AMAZON-02)
1 192.0.78.33 2635 (AUTOMATTIC)
1 2606:4700::68... 13335 (CLOUDFLAR...)
2 52.46.141.211 16509 (AMAZON-02)
1 192.0.77.32 2635 (AUTOMATTIC)
5 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
2 143.204.102.74 16509 (AMAZON-02)
5 2a00:1450:400... 15169 (GOOGLE)
1 2 2a00:1450:400... 15169 (GOOGLE)
1 2a03:2880:f01... 32934 (FACEBOOK)
3 192.0.77.2 2635 (AUTOMATTIC)
1 1 2a00:1450:400... 15169 (GOOGLE)
1 1 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
37 15
12    104.27.154.184 (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
www.andreafortuna.org
2    52.222.170.133 (Seattle, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-52-222-170-133.fra54.r.cloudfront.net
z-na.amazon-adsystem.com
1    192.0.78.33 (San Francisco, United States)

ASN2635 (AUTOMATTIC - Automattic, Inc, US)
jetpack.wordpress.com
1    2606:4700::6811:4004 (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
ajax.cloudflare.com
2    52.46.141.211 (Ashburn, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
aax-us-east.amazon-adsystem.com
1    192.0.77.32 (San Francisco, United States)

ASN2635 (AUTOMATTIC - Automattic, Inc, US)
PTR: wordpress.com
s0.wp.com
5    2a00:1450:4001:808::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)
pagead2.googlesyndication.com
adservice.google.de
adservice.google.com
www.googletagservices.com
1    2a00:1450:4001:806::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)
www.googletagmanager.com
2    143.204.102.74 (Seattle, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-143-204-102-74.fra50.r.cloudfront.net
wms-na.amazon-adsystem.com
5    2a00:1450:4001:819::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)
googleads.g.doubleclick.net
2    2a00:1450:4001:81b::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)
www.google-analytics.com
1    2a03:2880:f01c:800e:face:b00c:0:2 (Ireland)

ASN32934 (FACEBOOK - Facebook, Inc., US)
graph.facebook.com
3    192.0.77.2 (San Francisco, United States)

ASN2635 (AUTOMATTIC - Automattic, Inc, US)
PTR: i1.wp.com
i2.wp.com
i1.wp.com
1    2a00:1450:400c:c0b::9d (Brussels, Belgium)

ASN15169 (GOOGLE - Google LLC, US)
stats.g.doubleclick.net
1    2a00:1450:4001:825::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)
www.google.com
1    2a00:1450:4001:80b::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)
www.google.de
Domain Requested by
12 www.andreafortuna.org 1 redirects www.andreafortuna.org
ajax.cloudflare.com
5 googleads.g.doubleclick.net pagead2.googlesyndication.com
2 i2.wp.com
2 www.google-analytics.com 1 redirects www.googletagmanager.com
2 wms-na.amazon-adsystem.com
2 pagead2.googlesyndication.com ajax.cloudflare.com
pagead2.googlesyndication.com
2 aax-us-east.amazon-adsystem.com z-na.amazon-adsystem.com
2 z-na.amazon-adsystem.com www.andreafortuna.org
ajax.cloudflare.com
1 i1.wp.com
1 www.google.de
1 www.google.com 1 redirects
1 stats.g.doubleclick.net 1 redirects
1 www.googletagservices.com pagead2.googlesyndication.com
1 graph.facebook.com www.andreafortuna.org
1 adservice.google.com pagead2.googlesyndication.com
1 adservice.google.de pagead2.googlesyndication.com
1 www.googletagmanager.com ajax.cloudflare.com
1 s0.wp.com ajax.cloudflare.com
1 ajax.cloudflare.com www.andreafortuna.org
1 jetpack.wordpress.com www.andreafortuna.org
37 20
Subject Issuer Validity Valid
sni.cloudflaressl.com
CloudFlare Inc ECC CA-2		 2019-11-08 -
2020-10-09		 a year crt.sh
z-na.amazon-adsystem.com
Amazon		 2019-06-12 -
2020-06-07		 a year crt.sh
*.wordpress.com
COMODO RSA Domain Validation Secure Server CA		 2018-09-06 -
2020-09-05		 2 years crt.sh
ssl412106.cloudflaressl.com
COMODO ECC Domain Validation Secure Server CA 2		 2019-12-05 -
2020-06-12		 6 months crt.sh
aax-us-east.amazon-adsystem.com
Amazon		 2019-12-03 -
2020-11-13		 a year crt.sh
*.wp.com
Go Daddy Secure Certificate Authority - G2		 2018-04-10 -
2020-05-11		 2 years crt.sh
*.g.doubleclick.net
GTS CA 1O1		 2019-11-05 -
2020-01-28		 3 months crt.sh
*.google-analytics.com
GTS CA 1O1		 2019-11-05 -
2020-01-28		 3 months crt.sh
wms-na.assoc-amazon.com
Amazon		 2019-06-11 -
2020-05-29		 a year crt.sh
*.google.com
GTS CA 1O1		 2019-11-05 -
2020-01-28		 3 months crt.sh
*.facebook.com
DigiCert SHA2 High Assurance Server CA		 2019-11-06 -
2020-02-04		 3 months crt.sh
www.google.de
GTS CA 1O1		 2019-11-05 -
2020-01-28		 3 months crt.sh

This page contains 7 frames:

Primary Page: https://www.andreafortuna.org/2018/03/28/what-is-the-china-chopper-webshell-and-how-to-find-it-on-a-compromized-system/
Frame ID: F9DB1B961EDB567F2B72E57459A78D32
Requests: 33 HTTP requests in this frame

Frame: https://jetpack.wordpress.com/jetpack-comment/?blogid=137844517&postid=2855&comment_registration=0&require_name_email=1&stc_enabled=1&stb_enabled=1&show_avatars=0&avatar_default=mystery&greeting=Comments&greeting_reply=Leave+a+Reply+to+%25s&color_scheme=light&lang=en_US&jetpack_version=8.0&show_cookie_consent=10&has_cookie_consent=0&token_key=%3Bnormal%3B&sig=e8b4c4afebe632c9953506f954a3f7959cb336b0
Frame ID: 6CBDA1C7FE11F762537D09F624ABEC2F
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20191203/r20190131/zrt_lookup.html
Frame ID: C37CCAF514D490FC36D6E69C70F72504
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9618060664237110&output=html&adk=1812271804&adf=3025194257&lmt=1575562107&plat=1%3A32776%2C2%3A32776%2C8%3A134250504%2C9%3A134250504%2C16%3A8388608%2C30%3A1081344%2C40%3A32&tp=site_kit&guci=1.2.0.0.2.2.0.0&format=0x0&url=https%3A%2F%2Fwww.andreafortuna.org%2F2018%2F03%2F28%2Fwhat-is-the-china-chopper-webshell-and-how-to-find-it-on-a-compromized-system%2F&ea=0&flash=0&pra=5&wgl=1&adsid=NT&dt=1575562107004&bpp=24&bdt=1105&fdt=104&idt=104&shv=r20191203&cbv=r20190131&saldr=aa&abxe=1&nras=1&correlator=5502395520236&frm=20&pv=2&ga_vid=324401252.1575562107&ga_sid=1575562107&ga_hid=1603263096&ga_fc=0&iag=0&icsg=731651&dssz=28&mdo=0&mso=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=1585&bih=1200&scr_x=0&scr_y=0&eid=21065126&oid=3&pvsid=2888578744142994&rx=0&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=16&bc=31&ifi=0&uci=a!0&fsb=1&dtd=126
Frame ID: 3414639095E161F999995F6F7310EA02
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9618060664237110&output=html&h=250&adk=4184210696&adf=1126500945&w=331&fwrn=4&fwrnh=100&lmt=1575562107&rafmt=1&to=qs&pwprc=1462017320&tp=site_kit&psa=0&guci=1.2.0.0.2.2.0.0&format=331x250&url=https%3A%2F%2Fwww.andreafortuna.org%2F2018%2F03%2F28%2Fwhat-is-the-china-chopper-webshell-and-how-to-find-it-on-a-compromized-system%2F&flash=0&fwr=0&rpe=1&resp_fmts=3&wgl=1&adsid=NT&dt=1575562107352&bpp=10&bdt=1453&fdt=11&idt=11&shv=r20191203&cbv=r20190131&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=5502395520236&frm=20&pv=1&ga_vid=324401252.1575562107&ga_sid=1575562107&ga_hid=1603263096&ga_fc=0&iag=0&icsg=34286083&dssz=28&mdo=0&mso=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1070&ady=1501&biw=1585&bih=1200&scr_x=0&scr_y=0&eid=21065126&oid=3&pvsid=2888578744142994&rx=0&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=144&bc=31&ifi=1&uci=a!1&btvi=1&fsb=1&xpc=NFlf78CcuL&p=https%3A//www.andreafortuna.org&dtd=20
Frame ID: 12DCDFCC6D33A21A43EEA213446DADC1
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9618060664237110&output=html&h=250&adk=4184210696&adf=3633414696&w=331&fwrn=4&fwrnh=100&lmt=1575562107&rafmt=1&to=qs&pwprc=1462017320&tp=site_kit&psa=0&guci=1.2.0.0.2.2.0.0&format=331x250&url=https%3A%2F%2Fwww.andreafortuna.org%2F2018%2F03%2F28%2Fwhat-is-the-china-chopper-webshell-and-how-to-find-it-on-a-compromized-system%2F&flash=0&fwr=0&rpe=1&resp_fmts=3&wgl=1&adsid=NT&dt=1575562107388&bpp=6&bdt=1489&fdt=8&idt=8&shv=r20191203&cbv=r20190131&saldr=aa&abxe=1&prev_fmts=0x0%2C331x250&nras=1&correlator=5502395520236&frm=20&pv=1&ga_vid=324401252.1575562107&ga_sid=1575562107&ga_hid=1603263096&ga_fc=0&iag=0&icsg=34286083&dssz=28&mdo=0&mso=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1070&ady=2377&biw=1585&bih=1200&scr_x=0&scr_y=0&eid=21065126&oid=3&pvsid=2888578744142994&rx=0&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=144&bc=31&ifi=2&uci=a!2&btvi=2&fsb=1&xpc=YBguogXveT&p=https%3A//www.andreafortuna.org&dtd=13
Frame ID: 8485E85E89A7D7AFCC3EADA3D2631544
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9618060664237110&output=html&h=280&adk=2767623100&adf=1730821504&w=1200&fwrn=4&fwrnh=100&lmt=1575562107&rafmt=1&to=qs&pwprc=1462017320&tp=site_kit&psa=0&guci=1.2.0.0.2.2.0.0&format=1200x280&url=https%3A%2F%2Fwww.andreafortuna.org%2F2018%2F03%2F28%2Fwhat-is-the-china-chopper-webshell-and-how-to-find-it-on-a-compromized-system%2F&flash=0&fwr=0&rpe=1&resp_fmts=3&wgl=1&adsid=NT&dt=1575562107410&bpp=5&bdt=1511&fdt=6&idt=6&shv=r20191203&cbv=r20190131&saldr=aa&abxe=1&prev_fmts=0x0%2C331x250%2C331x250&nras=1&correlator=5502395520236&frm=20&pv=1&ga_vid=324401252.1575562107&ga_sid=1575562107&ga_hid=1603263096&ga_fc=0&iag=0&icsg=34286083&dssz=28&mdo=0&mso=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=193&ady=4776&biw=1585&bih=1200&scr_x=0&scr_y=0&eid=21065126&oid=3&pvsid=2888578744142994&rx=0&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=144&bc=31&ifi=3&uci=a!3&btvi=3&fsb=1&xpc=yjpjQfE0Sq&p=https%3A//www.andreafortuna.org&dtd=11
Frame ID: 22EF8F7D4F692F4F51128DD3311573FA
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. https://www.andreafortuna.org/2018/03/28/what-is-the-china-chopper-websh= HTTP 301
    https://www.andreafortuna.org/2018/03/28/what-is-the-china-chopper-webshell-and-how-to-find-it-on-a-compro... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers link /rel="https:\/\/api\.w\.org\/"/i
Overall confidence: 100%
Detected patterns
  • headers link /rel="https:\/\/api\.w\.org\/"/i
Overall confidence: 100%
Detected patterns
  • headers link /rel="https:\/\/api\.w\.org\/"/i
Overall confidence: 100%
Detected patterns
  • headers server /^cloudflare$/i

Page Statistics

37
Requests

100 %
HTTPS

56 %
IPv6

13
Domains

20
Subdomains

15
IPs

4
Countries

538 kB
Transfer

1432 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://www.andreafortuna.org/2018/03/28/what-is-the-china-chopper-websh= HTTP 301
    https://www.andreafortuna.org/2018/03/28/what-is-the-china-chopper-webshell-and-how-to-find-it-on-a-compromized-system/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 31
  • https://www.google-analytics.com/r/collect?v=1&_v=j79&a=1603263096&t=pageview&_s=1&dl=https%3A%2F%2Fwww.andreafortuna.org%2F2018%2F03%2F28%2Fwhat-is-the-china-chopper-webshell-and-how-to-find-it-on-a-compromized-system%2F&ul=en-us&de=UTF-8&dt=What%20is%20the%20China%20Chopper%20Webshell%2C%20and%20how%20to%20find%20it%20on%20a%20compromised%20system%3F%20%7C%20So%20Long%2C%20and%20Thanks%20for%20All%20the%20Fish&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&_u=IAhAAUAB~&jid=833843598&gjid=1865401587&cid=324401252.1575562107&tid=UA-131216-28&_gid=718463853.1575562107&_r=1&gtm=2ouav9&z=1919828374 HTTP 302
  • https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-131216-28&cid=324401252.1575562107&jid=833843598&_gid=718463853.1575562107&gjid=1865401587&_v=j79&z=1919828374 HTTP 302
  • https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-131216-28&cid=324401252.1575562107&jid=833843598&_v=j79&z=1919828374 HTTP 302
  • https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-131216-28&cid=324401252.1575562107&jid=833843598&_v=j79&z=1919828374&slf_rd=1&random=2150667512

37 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
www.andreafortuna.org/2018/03/28/what-is-the-china-chopper-webshell-and-how-to-find-it-on-a-compromized-system/
Redirect Chain
  • https://www.andreafortuna.org/2018/03/28/what-is-the-china-chopper-websh=
  • https://www.andreafortuna.org/2018/03/28/what-is-the-china-chopper-webshell-and-how-to-find-it-on-a-compromized-system/
89 KB
29 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.andreafortuna.org/2018/03/28/what-is-the-china-chopper-webshell-and-how-to-find-it-on-a-compromized-system/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.27.154.184 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
ee3edad57a717a1b9ed1c3d5cb5d384145027c4e59f3af52322123bfc1fbca8b

Request headers

:method
GET
:authority
www.andreafortuna.org
:scheme
https
:path
/2018/03/28/what-is-the-china-chopper-webshell-and-how-to-find-it-on-a-compromized-system/
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-user
?1
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
none
sec-fetch-mode
navigate
accept-encoding
gzip, deflate, br
cookie
__cfduid=dadae95560d43e2237dc5aaaf4daf2cc71575562103
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-User
?1

Response headers

status
200
date
Thu, 05 Dec 2019 16:08:25 GMT
content-type
text/html; charset=UTF-8
cf-ray
540747547d03d8fd-AMS
cf-cache-status
DYNAMIC
link
<https://www.andreafortuna.org/wp-json/>; rel="https://api.w.org/", <https://www.andreafortuna.org/?p=2855>; rel=shortlink
vary
Accept-Encoding
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-html-edge-cache
cache,bypass-cookies=wp-|wordpress|comment_|woocommerce_
x-html-edge-cache-status
Bypass for Reload, Cached
x-pingback
https://www.andreafortuna.org/xmlrpc.php
x-servername
ipvsproxy114.ad.aruba.it
alt-svc
h3-23=":443"; ma=86400
server
cloudflare
content-encoding
br

Redirect headers

status
301
date
Thu, 05 Dec 2019 16:08:25 GMT
content-type
text/html; charset=UTF-8
set-cookie
__cfduid=dadae95560d43e2237dc5aaaf4daf2cc71575562103; expires=Sat, 04-Jan-20 16:08:23 GMT; path=/; domain=.andreafortuna.org; HttpOnly
location
https://www.andreafortuna.org/2018/03/28/what-is-the-china-chopper-webshell-and-how-to-find-it-on-a-compromized-system/
cf-ray
5407474acdc8d8fd-AMS
cf-cache-status
DYNAMIC
cache-control
no-cache, must-revalidate, max-age=0
expires
Wed, 11 Jan 1984 05:00:00 GMT
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-html-edge-cache
cache,bypass-cookies=wp-|wordpress|comment_|woocommerce_
x-redirect-by
WordPress
x-servername
ipvsproxy114.ad.aruba.it
alt-svc
h3-23=":443"; ma=86400
vary
Accept-Encoding
server
cloudflare
autoptimize_bfd143a5e3968ca54d12148b6efa010c.css
www.andreafortuna.org/wp-content/cache/autoptimize/css/ 		180 KB
43 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.andreafortuna.org/wp-content/cache/autoptimize/css/autoptimize_bfd143a5e3968ca54d12148b6efa010c.css
Requested by
Host: www.andreafortuna.org
URL: https://www.andreafortuna.org/2018/03/28/what-is-the-china-chopper-webshell-and-how-to-find-it-on-a-compromized-system/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.27.154.184 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
8a7324b76945d411582c2006f74e644ba0d0507320ba669ffadeb685a5e42fc6

Request headers

Referer
https://www.andreafortuna.org/2018/03/28/what-is-the-china-chopper-webshell-and-how-to-find-it-on-a-compromized-system/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-servername
ipvsproxy114.ad.aruba.it
date
Thu, 05 Dec 2019 16:08:25 GMT
content-encoding
br
cf-cache-status
HIT
age
8242
cf-polished
origSize=184049
status
200
last-modified
Tue, 03 Dec 2019 14:17:31 GMT
alt-svc
h3-23=":443"; ma=86400
x-html-edge-cache-status
Bypass for Reload, Cached
cf-bgj
minify
server
cloudflare
etag
W/"2cef1-598cd5b546d43-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/css
cache-control
public, max-age=31536000, immutable
cf-ray
54074759fdb5d8fd-AMS
expires
Tue, 24 Nov 2020 13:51:03 GMT
onejs
z-na.amazon-adsystem.com/widgets/ 		24 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://z-na.amazon-adsystem.com/widgets/onejs?MarketPlace=US
Requested by
Host: www.andreafortuna.org
URL: https://www.andreafortuna.org/2018/03/28/what-is-the-china-chopper-webshell-and-how-to-find-it-on-a-compromized-system/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.222.170.133 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-52-222-170-133.fra54.r.cloudfront.net
Software
Server /
Resource Hash
cbdd5dec595ff9a47f0d3632c2fb563b0b504a9b6033192e2289a054e4ba1b9d

Request headers

Referer
https://www.andreafortuna.org/2018/03/28/what-is-the-china-chopper-webshell-and-how-to-find-it-on-a-compromized-system/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 05 Dec 2019 07:28:53 GMT
content-encoding
gzip
age
30683
x-cache
Hit from cloudfront
status
200
cneonction
close
content-length
7923
via
1.1 b454a0b154ae18408006bc2a9abd88ec.cloudfront.net (CloudFront)
pragma
Public
server
Server
content-type
application/javascript;charset=UTF-8
access-control-allow-origin
*
charset
UTF-8
cache-control
public,max-age=86400,s-maxage=86400,no-transform
x-amz-cf-pop
FRA54
x-amz-cf-id
pQgyNYHBeM4nrI1ImrGHO3U7HeQhRo4tJb8BBtMrFiWXLYZnYpMCGw==
expires
Fri, 06 Dec 2019 07:28:53 GMT
/
jetpack.wordpress.com/jetpack-comment/ Frame 6CBD 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://jetpack.wordpress.com/jetpack-comment/?blogid=137844517&postid=2855&comment_registration=0&require_name_email=1&stc_enabled=1&stb_enabled=1&show_avatars=0&avatar_default=mystery&greeting=Comments&greeting_reply=Leave+a+Reply+to+%25s&color_scheme=light&lang=en_US&jetpack_version=8.0&show_cookie_consent=10&has_cookie_consent=0&token_key=%3Bnormal%3B&sig=e8b4c4afebe632c9953506f954a3f7959cb336b0
Requested by
Host: www.andreafortuna.org
URL: https://www.andreafortuna.org/2018/03/28/what-is-the-china-chopper-webshell-and-how-to-find-it-on-a-compromized-system/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.78.33 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
Software
nginx /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=15552000

Request headers

:method
GET
:authority
jetpack.wordpress.com
:scheme
https
:path
/jetpack-comment/?blogid=137844517&postid=2855&comment_registration=0&require_name_email=1&stc_enabled=1&stb_enabled=1&show_avatars=0&avatar_default=mystery&greeting=Comments&greeting_reply=Leave+a+Reply+to+%25s&color_scheme=light&lang=en_US&jetpack_version=8.0&show_cookie_consent=10&has_cookie_consent=0&token_key=%3Bnormal%3B&sig=e8b4c4afebe632c9953506f954a3f7959cb336b0
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
cross-site
sec-fetch-mode
nested-navigate
referer
https://www.andreafortuna.org/2018/03/28/what-is-the-china-chopper-webshell-and-how-to-find-it-on-a-compromized-system/
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer
https://www.andreafortuna.org/2018/03/28/what-is-the-china-chopper-webshell-and-how-to-find-it-on-a-compromized-system/

Response headers

status
200
server
nginx
date
Thu, 05 Dec 2019 16:08:26 GMT
content-type
text/html; charset=UTF-8
vary
Accept-Encoding
x-hacker
If you're reading this, you should visit automattic.com/jobs and apply to join the fun, mention this header.
content-encoding
gzip
x-ac
4.ams _dca
strict-transport-security
max-age=15552000
truncated
/ 		42 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/gif
genericons-neue.svg
www.andreafortuna.org/wp-content/themes/chronus/assets/icons/ 		27 KB
8 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://www.andreafortuna.org/wp-content/themes/chronus/assets/icons/genericons-neue.svg
Requested by
Host: www.andreafortuna.org
URL: https://www.andreafortuna.org/2018/03/28/what-is-the-china-chopper-webshell-and-how-to-find-it-on-a-compromized-system/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.27.154.184 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
1ef564b89fc8b8baa6609f30535c85a5f7e793f16879169cbf7a8987fd85405d

Request headers

Referer
https://www.andreafortuna.org/2018/03/28/what-is-the-china-chopper-webshell-and-how-to-find-it-on-a-compromized-system/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-servername
ipvsproxy113.ad.aruba.it
date
Thu, 05 Dec 2019 16:08:25 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Mon, 18 Nov 2019 14:58:55 GMT
server
cloudflare
age
271
etag
W/"6d66-597a02fc2836d"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/svg+xml
status
200
cache-control
max-age=31536000
cf-ray
54074759fdc4d8fd-AMS
alt-svc
h3-23=":443"; ma=86400
rocket-loader.min.js
ajax.cloudflare.com/cdn-cgi/scripts/7089c43e/cloudflare-static/ 		12 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ajax.cloudflare.com/cdn-cgi/scripts/7089c43e/cloudflare-static/rocket-loader.min.js
Requested by
Host: www.andreafortuna.org
URL: https://www.andreafortuna.org/2018/03/28/what-is-the-china-chopper-webshell-and-how-to-find-it-on-a-compromized-system/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:4004 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
b08cdbc2d30e656a86b20f8342428d5863f70f4b30135b4f4061f754ce932f5e
Security Headers
Name Value
Strict-Transport-Security max-age=15780000; includeSubDomains
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://www.andreafortuna.org/2018/03/28/what-is-the-china-chopper-webshell-and-how-to-find-it-on-a-compromized-system/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 05 Dec 2019 16:08:25 GMT
content-encoding
gzip
vary
Accept-Encoding
last-modified
Fri, 29 Nov 2019 12:27:58 GMT
server
cloudflare
etag
W/"5de10ece-3016"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options
SAMEORIGIN
content-type
application/javascript
status
200
cache-control
max-age=172800, public
strict-transport-security
max-age=15780000; includeSubDomains
cf-ray
5407475a0fc55952-VIE
alt-svc
h3-23=":443"; ma=86400
expires
Sat, 07 Dec 2019 16:08:25 GMT
raleway-v12-latin-ext_latin-regular.woff2
www.andreafortuna.org/wp-content/themes/chronus/assets/fonts/ 		31 KB
31 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://www.andreafortuna.org/wp-content/themes/chronus/assets/fonts/raleway-v12-latin-ext_latin-regular.woff2
Requested by
Host: www.andreafortuna.org
URL: https://www.andreafortuna.org/2018/03/28/what-is-the-china-chopper-webshell-and-how-to-find-it-on-a-compromized-system/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.27.154.184 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
704d418b7b3efa6f1870d409134b9c6b80fc5f5f38b46a68aee496388a6bbd48

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer
https://www.andreafortuna.org/wp-content/cache/autoptimize/css/autoptimize_bfd143a5e3968ca54d12148b6efa010c.css
Origin
https://www.andreafortuna.org

Response headers

x-servername
ipvsproxy114.ad.aruba.it
date
Thu, 05 Dec 2019 16:08:25 GMT
cf-cache-status
HIT
age
271
status
200
alt-svc
h3-23=":443"; ma=86400
content-length
32100
x-html-edge-cache-status
Bypass for Reload, Cached
last-modified
Mon, 18 Nov 2019 14:58:55 GMT
server
cloudflare
etag
"7d64-597a02fc2295d"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
font/woff2
cache-control
max-age=31536000
accept-ranges
bytes
cf-ray
5407475a5ee7d8fd-AMS
rambla-v5-latin-ext_latin-700.woff2
www.andreafortuna.org/wp-content/themes/chronus/assets/fonts/ 		11 KB
11 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://www.andreafortuna.org/wp-content/themes/chronus/assets/fonts/rambla-v5-latin-ext_latin-700.woff2
Requested by
Host: www.andreafortuna.org
URL: https://www.andreafortuna.org/2018/03/28/what-is-the-china-chopper-webshell-and-how-to-find-it-on-a-compromized-system/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.27.154.184 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
f3cf89971def70af97ab61a3acceedcad79d31d6f462fccda577e55723d2b647

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer
https://www.andreafortuna.org/wp-content/cache/autoptimize/css/autoptimize_bfd143a5e3968ca54d12148b6efa010c.css
Origin
https://www.andreafortuna.org

Response headers

x-servername
ipvsproxy114.ad.aruba.it
date
Thu, 05 Dec 2019 16:08:26 GMT
cf-cache-status
HIT
age
272
status
200
alt-svc
h3-23=":443"; ma=86400
content-length
11204
x-html-edge-cache-status
Bypass for Reload, Cached
last-modified
Mon, 18 Nov 2019 14:58:55 GMT
server
cloudflare
etag
"2bc4-597a02fc23cc4"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
font/woff2
cache-control
max-age=31536000
accept-ranges
bytes
cf-ray
5407475a5eeed8fd-AMS
rambla-v5-latin-ext_latin-regular.woff2
www.andreafortuna.org/wp-content/themes/chronus/assets/fonts/ 		11 KB
11 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://www.andreafortuna.org/wp-content/themes/chronus/assets/fonts/rambla-v5-latin-ext_latin-regular.woff2
Requested by
Host: www.andreafortuna.org
URL: https://www.andreafortuna.org/2018/03/28/what-is-the-china-chopper-webshell-and-how-to-find-it-on-a-compromized-system/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.27.154.184 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
8bac2f32e4d08efd7175b1b892ca189767507bfeef9372d6881e0419542e78d9

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer
https://www.andreafortuna.org/wp-content/cache/autoptimize/css/autoptimize_bfd143a5e3968ca54d12148b6efa010c.css
Origin
https://www.andreafortuna.org

Response headers

x-servername
ipvsproxy114.ad.aruba.it
date
Thu, 05 Dec 2019 16:08:25 GMT
cf-cache-status
HIT
age
271
status
200
alt-svc
h3-23=":443"; ma=86400
content-length
11112
x-html-edge-cache-status
Bypass for Reload, Cached
last-modified
Mon, 18 Nov 2019 14:58:55 GMT
server
cloudflare
etag
"2b68-597a02fc26fd3"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
font/woff2
cache-control
max-age=31536000
accept-ranges
bytes
cf-ray
5407475a5ef0d8fd-AMS
raleway-v12-latin-ext_latin-700.woff2
www.andreafortuna.org/wp-content/themes/chronus/assets/fonts/ 		32 KB
32 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://www.andreafortuna.org/wp-content/themes/chronus/assets/fonts/raleway-v12-latin-ext_latin-700.woff2
Requested by
Host: www.andreafortuna.org
URL: https://www.andreafortuna.org/2018/03/28/what-is-the-china-chopper-webshell-and-how-to-find-it-on-a-compromized-system/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.27.154.184 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
b2b6ba4b6ceeeae0efb23f67b9ae53bdc72ffb7bd149e0f63104d855712a506c

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer
https://www.andreafortuna.org/wp-content/cache/autoptimize/css/autoptimize_bfd143a5e3968ca54d12148b6efa010c.css
Origin
https://www.andreafortuna.org

Response headers

x-servername
ipvsproxy114.ad.aruba.it
date
Thu, 05 Dec 2019 16:08:25 GMT
cf-cache-status
HIT
age
271
status
200
alt-svc
h3-23=":443"; ma=86400
content-length
32548
x-html-edge-cache-status
Bypass for Reload, Cached
last-modified
Mon, 18 Nov 2019 14:58:55 GMT
server
cloudflare
etag
"7f24-597a02fc1eacb"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
font/woff2
cache-control
max-age=31536000
accept-ranges
bytes
cf-ray
5407475a6f00d8fd-AMS
truncated
/ 		18 KB
18 KB 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
895964971ebdb56ee76d08850bcb4c5a88ec4c65e6a235882304e8ff6767cd7c

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Origin
https://www.andreafortuna.org

Response headers

Content-Type
application/font-woff;charset=utf-8
getad
aax-us-east.amazon-adsystem.com/x/ 		104 KB
22 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://aax-us-east.amazon-adsystem.com/x/getad?src=330&c=100&sz=1x1&apiVersion=2.0&pj=%7B%22placement%22%3A%22adunit0%22%2C%22search_bar%22%3A%22false%22%2C%22tracking_id%22%3A%22andreafortuna-20%22%2C%22ad_mode%22%3A%22manual%22%2C%22ad_type%22%3A%22smart%22%2C%22marketplace%22%3A%22amazon%22%2C%22region%22%3A%22US%22%2C%22title%22%3A%22My%20Bookshop%22%2C%22linkid%22%3A%22e0f0ba6a17e1b854c15a8881be6ff76e%22%2C%22asins%22%3A%221070753815%2C1791650201%2C1798027402%2C1730914101%2C172860947X%22%2C%22viewerCountry%22%3A%22RO%22%2C%22textlinks%22%3A%22%22%2C%22debug%22%3A%22false%22%2C%22acap_publisherId%22%3A%22andreafortuna-20%22%2C%22slotNum%22%3A0%2C%22ead%22%3A4%7D&u=https%3A%2F%2Fwww.andreafortuna.org%2F2018%2F03%2F28%2Fwhat-is-the-china-chopper-webshell-and-how-to-find-it-on-a-compromized-system%2F&jscb=amzn_assoc_jsonp_callback_adunit0_0
Requested by
Host: z-na.amazon-adsystem.com
URL: https://z-na.amazon-adsystem.com/widgets/onejs?MarketPlace=US
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.46.141.211 Ashburn, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
Server /
Resource Hash
41d8cf7fb294fd883ec51e65efb3d63f153ef62fc9d3f29993822d92dc01d44f

Request headers

Referer
https://www.andreafortuna.org/2018/03/28/what-is-the-china-chopper-webshell-and-how-to-find-it-on-a-compromized-system/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Thu, 05 Dec 2019 16:08:26 GMT
Content-Encoding
gzip
Vary
Accept-Encoding,User-Agent
Server
Server
Connection
keep-alive
Transfer-Encoding
chunked
Content-Type
text/javascript;charset=UTF-8
autoptimize_b1198eb09f3617a8760d9baf4100bf94.js
www.andreafortuna.org/wp-content/cache/autoptimize/js/ 		42 KB
14 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.andreafortuna.org/wp-content/cache/autoptimize/js/autoptimize_b1198eb09f3617a8760d9baf4100bf94.js
Requested by
Host: ajax.cloudflare.com
URL: https://ajax.cloudflare.com/cdn-cgi/scripts/7089c43e/cloudflare-static/rocket-loader.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.27.154.184 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
363aee73e3a1fea507ec69cf6a9b74ee2ca3a6c46f4839f6c2771a4631c2960d

Request headers

Referer
https://www.andreafortuna.org/2018/03/28/what-is-the-china-chopper-webshell-and-how-to-find-it-on-a-compromized-system/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-servername
ipvsproxy114.ad.aruba.it
date
Thu, 05 Dec 2019 16:08:26 GMT
content-encoding
br
cf-cache-status
HIT
age
8243
cf-polished
origSize=43615
status
200
last-modified
Mon, 25 Nov 2019 18:03:33 GMT
alt-svc
h3-23=":443"; ma=86400
x-html-edge-cache-status
Bypass for Reload, Cached
cf-bgj
minify
server
cloudflare
etag
W/"aa5f-5982f94f35d91-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=31536000, immutable
cf-ray
5407475af977d8fd-AMS
expires
Tue, 24 Nov 2020 13:51:03 GMT
devicepx-jetpack.js
s0.wp.com/wp-content/js/ 		10 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s0.wp.com/wp-content/js/devicepx-jetpack.js?ver=201949
Requested by
Host: ajax.cloudflare.com
URL: https://ajax.cloudflare.com/cdn-cgi/scripts/7089c43e/cloudflare-static/rocket-loader.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
f32d41f2099a0be20e6b57c5e0d1b71c079d3e1345827b0f5c5b97c6e5e3f78d

Request headers

Referer
https://www.andreafortuna.org/2018/03/28/what-is-the-china-chopper-webshell-and-how-to-find-it-on-a-compromized-system/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-nc
HIT ams 1
date
Thu, 05 Dec 2019 16:08:26 GMT
content-encoding
gzip
server
nginx
etag
W/"5c32dc59-52b6"
vary
Accept-Encoding
content-type
application/x-javascript
status
200
cache-control
max-age=31536000
x-ac
3.ams _dfw
expires
Sun, 29 Nov 2020 20:40:38 GMT
onejs
z-na.amazon-adsystem.com/widgets/ 		25 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://z-na.amazon-adsystem.com/widgets/onejs?MarketPlace=US&adInstanceId=2a818c3a-b616-4488-adbe-66363f272bae
Requested by
Host: ajax.cloudflare.com
URL: https://ajax.cloudflare.com/cdn-cgi/scripts/7089c43e/cloudflare-static/rocket-loader.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.222.170.133 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-52-222-170-133.fra54.r.cloudfront.net
Software
Server /
Resource Hash
634b31cde658e26109972f378e0086a4aa49ac218f019302b6edf3caeda483c1

Request headers

Referer
https://www.andreafortuna.org/2018/03/28/what-is-the-china-chopper-webshell-and-how-to-find-it-on-a-compromized-system/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 04 Dec 2019 23:26:02 GMT
content-encoding
gzip
x-amz-cf-pop
FRA54
x-cache
Hit from cloudfront
status
200
cneonction
close
content-length
8122
via
1.1 b454a0b154ae18408006bc2a9abd88ec.cloudfront.net (CloudFront)
pragma
Public
server
Server
content-type
application/javascript;charset=UTF-8
access-control-allow-origin
*
charset
UTF-8
cache-control
public,max-age=300,s-maxage=300,no-transform
x-amz-cf-id
Fq8PUr7jfXmNapyGxncillEByhsYdsFOhNwXcwYBle0gvVbWy06Esg==
expires
Wed, 04 Dec 2019 23:31:02 GMT
adsbygoogle.js
pagead2.googlesyndication.com/pagead/js/ 		103 KB
37 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js
Requested by
Host: ajax.cloudflare.com
URL: https://ajax.cloudflare.com/cdn-cgi/scripts/7089c43e/cloudflare-static/rocket-loader.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
99cdbced720885e7fb45eb13fc9fff73125468f7b89d60832443bbc97a6080b8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.andreafortuna.org/2018/03/28/what-is-the-china-chopper-webshell-and-how-to-find-it-on-a-compromized-system/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 05 Dec 2019 16:08:26 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
37816
x-xss-protection
0
server
cafe
etag
15178536836607211507
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600
timing-allow-origin
*
expires
Thu, 05 Dec 2019 16:08:26 GMT
js
www.googletagmanager.com/gtag/ 		73 KB
27 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=UA-131216-28
Requested by
Host: ajax.cloudflare.com
URL: https://ajax.cloudflare.com/cdn-cgi/scripts/7089c43e/cloudflare-static/rocket-loader.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
3199a4d61799975495556a5411907a67f2e82ee0e598ed97e96ea6a4db889289
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://www.andreafortuna.org/2018/03/28/what-is-the-china-chopper-webshell-and-how-to-find-it-on-a-compromized-system/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 05 Dec 2019 16:08:26 GMT
content-encoding
br
last-modified
Thu, 05 Dec 2019 15:00:00 GMT
server
Google Tag Manager
access-control-allow-origin
http://www.googletagmanager.com
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
content-length
27664
x-xss-protection
0
expires
Thu, 05 Dec 2019 16:08:26 GMT
jquery.js
www.andreafortuna.org/wp-includes/js/jquery/ 		95 KB
33 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.andreafortuna.org/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp
Requested by
Host: ajax.cloudflare.com
URL: https://ajax.cloudflare.com/cdn-cgi/scripts/7089c43e/cloudflare-static/rocket-loader.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.27.154.184 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
8c7ee0238fa5cd80a02ef9870a7fff498ef52097181cb73edb9219dc022fd919

Request headers

Referer
https://www.andreafortuna.org/2018/03/28/what-is-the-china-chopper-webshell-and-how-to-find-it-on-a-compromized-system/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-servername
ipvsproxy114.ad.aruba.it
date
Thu, 05 Dec 2019 16:08:26 GMT
content-encoding
br
cf-cache-status
HIT
age
272
cf-polished
origSize=96873
status
200
alt-svc
h3-23=":443"; ma=86400
x-html-edge-cache-status
Bypass for Reload, Cached
last-modified
Wed, 22 May 2019 02:06:11 GMT
server
cloudflare
etag
W/"17a69-5897068ca8ac0"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
cache-control
max-age=31536000
cf-ray
5407475af97cd8fd-AMS
cf-bgj
minify
amzn-nsa-sprite-2x.png
wms-na.amazon-adsystem.com/panda/20070822/US/img/ 		4 KB
5 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://wms-na.amazon-adsystem.com/panda/20070822/US/img/amzn-nsa-sprite-2x.png
Requested by
Host:
URL: dynscript-1.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
143.204.102.74 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-143-204-102-74.fra50.r.cloudfront.net
Software
Server /
Resource Hash
3d363721e733cd455560f59c74cffdb28148623c7c716a23403bd6b85696b4fa

Request headers

Referer
https://www.andreafortuna.org/2018/03/28/what-is-the-china-chopper-webshell-and-how-to-find-it-on-a-compromized-system/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Sat, 16 Nov 2019 01:10:46 GMT
via
1.1 80c1ad5f9352d00b95a9da73eb6b6be5.cloudfront.net (CloudFront)
age
1695459
x-cache
Hit from cloudfront
status
200
content-length
4335
last-modified
Thu, 20 Jun 2019 05:40:26 GMT
server
Server
etag
"10ef-58bbac8710c8d"
content-type
image/png
charset
UTF-8
cache-control
max-age=2592000
x-amz-cf-pop
FRA50-C1
accept-ranges
bytes
x-amz-cf-id
s01bSAN_ly_Hagi4HUs1CaeaUei4Ya1jqoM-_lXibG82wQ3CeNFSdg==
expires
Sat, 23 Nov 2019 01:10:46 GMT
integrator.js
adservice.google.de/adsid/ 		109 B
171 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adservice.google.de/adsid/integrator.js?domain=www.andreafortuna.org
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.andreafortuna.org/2018/03/28/what-is-the-china-chopper-webshell-and-how-to-find-it-on-a-compromized-system/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 05 Dec 2019 16:08:27 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-type
application/javascript; charset=UTF-8
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
104
x-xss-protection
0
integrator.js
adservice.google.com/adsid/ 		109 B
171 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adservice.google.com/adsid/integrator.js?domain=www.andreafortuna.org
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.andreafortuna.org/2018/03/28/what-is-the-china-chopper-webshell-and-how-to-find-it-on-a-compromized-system/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 05 Dec 2019 16:08:27 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-type
application/javascript; charset=UTF-8
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
104
x-xss-protection
0
show_ads_impl_fy2019.js
pagead2.googlesyndication.com/pagead/js/r20191203/r20190131/ 		225 KB
84 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/js/r20191203/r20190131/show_ads_impl_fy2019.js
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
1593483d88f332166a4f663bbb8a7ee690cbe3480abb65a9eb930a223d1e7669
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.andreafortuna.org/2018/03/28/what-is-the-china-chopper-webshell-and-how-to-find-it-on-a-compromized-system/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 05 Dec 2019 16:08:27 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
86327
x-xss-protection
0
server
cafe
etag
15592190861915360342
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=1209600
timing-allow-origin
*
expires
Thu, 05 Dec 2019 16:08:27 GMT
zrt_lookup.html
googleads.g.doubleclick.net/pagead/html/r20191203/r20190131/ Frame C37C 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/html/r20191203/r20190131/zrt_lookup.html
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:819::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
googleads.g.doubleclick.net
:scheme
https
:path
/pagead/html/r20191203/r20190131/zrt_lookup.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
cross-site
sec-fetch-mode
nested-navigate
referer
https://www.andreafortuna.org/2018/03/28/what-is-the-china-chopper-webshell-and-how-to-find-it-on-a-compromized-system/
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer
https://www.andreafortuna.org/2018/03/28/what-is-the-china-chopper-webshell-and-how-to-find-it-on-a-compromized-system/

Response headers

status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
vary
Accept-Encoding
date
Tue, 03 Dec 2019 21:42:15 GMT
expires
Tue, 17 Dec 2019 21:42:15 GMT
content-type
text/html; charset=UTF-8
etag
9688732929695215001
x-content-type-options
nosniff
content-encoding
gzip
server
cafe
content-length
6504
x-xss-protection
0
cache-control
public, max-age=1209600
age
152772
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
getad
aax-us-east.amazon-adsystem.com/x/ 		139 KB
26 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://aax-us-east.amazon-adsystem.com/x/getad?src=308&c=100&sz=1x1&apiVersion=2.0&pj=%7B%22placement%22%3A%22adunit0%22%2C%22enable_interest_ads%22%3A%22true%22%2C%22div_name%22%3A%22amzn-assoc-ad-2a818c3a-b616-4488-adbe-66363f272bae%22%2C%22tracking_id%22%3A%22andreafortuna-20%22%2C%22fallback_mode%22%3A%7B%22type%22%3A%22search%22%2C%22value%22%3A%22smartphone%22%7D%2C%22ad_mode%22%3A%22auto%22%2C%22ad_type%22%3A%22smart%22%2C%22marketplace%22%3A%22amazon%22%2C%22region%22%3A%22US%22%2C%22linkid%22%3A%223601d80acfdbf3755ce2ac2f223b8b2d%22%2C%22default_category%22%3A%22All%22%2C%22viewerCountry%22%3A%22RO%22%2C%22textlinks%22%3A%22%22%2C%22debug%22%3A%22false%22%2C%22acap_publisherId%22%3A%22andreafortuna-20%22%2C%22slotNum%22%3A1%2C%22ead%22%3A4%7D&u=https%3A%2F%2Fwww.andreafortuna.org%2F2018%2F03%2F28%2Fwhat-is-the-china-chopper-webshell-and-how-to-find-it-on-a-compromized-system%2F&jscb=amzn_assoc_jsonp_callback_adunit0_1
Requested by
Host: z-na.amazon-adsystem.com
URL: https://z-na.amazon-adsystem.com/widgets/onejs?MarketPlace=US&adInstanceId=2a818c3a-b616-4488-adbe-66363f272bae
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.46.141.211 Ashburn, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
Server /
Resource Hash
9cb13e171afddebbef4bb1ef84c79ec9937b45367ab971086856771ab0a7dd94

Request headers

Referer
https://www.andreafortuna.org/2018/03/28/what-is-the-china-chopper-webshell-and-how-to-find-it-on-a-compromized-system/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Thu, 05 Dec 2019 16:08:27 GMT
Content-Encoding
gzip
Vary
Accept-Encoding,User-Agent
Server
Server
Connection
keep-alive
Transfer-Encoding
chunked
Content-Type
text/javascript;charset=UTF-8
analytics.js
www.google-analytics.com/ 		43 KB
17 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-131216-28
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
dbb67c620eaabf6679a314db18d3ae43037aef71ab27422e6feec08ee987cc0a
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.andreafortuna.org/2018/03/28/what-is-the-china-chopper-webshell-and-how-to-find-it-on-a-compromized-system/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Mon, 19 Aug 2019 17:22:41 GMT
server
Golfe2
age
5690
date
Thu, 05 Dec 2019 14:33:37 GMT
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=7200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
17803
expires
Thu, 05 Dec 2019 16:33:37 GMT
/
www.andreafortuna.org/2018/03/28/what-is-the-china-chopper-webshell-and-how-to-find-it-on-a-compromized-system/ 		2 KB
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.andreafortuna.org/2018/03/28/what-is-the-china-chopper-webshell-and-how-to-find-it-on-a-compromized-system/?relatedposts=1
Requested by
Host: www.andreafortuna.org
URL: https://www.andreafortuna.org/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.27.154.184 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
46f1ffd1a4fdd526f53821fb907878b0245a5dff13e6338ddd3fb5d7f9e343d4
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Accept
application/json, text/javascript, */*; q=0.01
Referer
https://www.andreafortuna.org/2018/03/28/what-is-the-china-chopper-webshell-and-how-to-find-it-on-a-compromized-system/
X-Requested-With
XMLHttpRequest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-servername
ipvsproxy114.ad.aruba.it
date
Thu, 05 Dec 2019 16:08:28 GMT
x-html-edge-cache-status
Bypass for Reload, Cached
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
alt-svc
h3-23=":443"; ma=86400
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-pingback
https://www.andreafortuna.org/xmlrpc.php
content-type
application/json; charset=utf-8
status
200
cf-ray
54074761589ed8fd-AMS
content-encoding
br
vary
Accept-Encoding
x-html-edge-cache
cache,bypass-cookies=wp-|wordpress|comment_|woocommerce_
genericons-neue.svg
www.andreafortuna.org/wp-content/themes/chronus/assets/icons/ 		27 KB
8 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://www.andreafortuna.org/wp-content/themes/chronus/assets/icons/genericons-neue.svg
Requested by
Host: www.andreafortuna.org
URL: https://www.andreafortuna.org/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.27.154.184 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
1ef564b89fc8b8baa6609f30535c85a5f7e793f16879169cbf7a8987fd85405d

Request headers

Referer
https://www.andreafortuna.org/2018/03/28/what-is-the-china-chopper-webshell-and-how-to-find-it-on-a-compromized-system/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-servername
ipvsproxy113.ad.aruba.it
date
Thu, 05 Dec 2019 16:08:27 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Mon, 18 Nov 2019 14:58:55 GMT
server
cloudflare
age
273
etag
W/"6d66-597a02fc2836d"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/svg+xml
status
200
cache-control
max-age=31536000
cf-ray
5407476158b1d8fd-AMS
alt-svc
h3-23=":443"; ma=86400
/
graph.facebook.com/ 		312 B
642 B 		Script
General
Check archive.org
Download Go to
Full URL
https://graph.facebook.com/?callback=WPCOMSharing.update_facebook_count&ids=https%3A%2F%2Fwww.andreafortuna.org%2F2018%2F03%2F28%2Fwhat-is-the-china-chopper-webshell-and-how-to-find-it-on-a-compromized-system%2F&_=1575562106989
Requested by
Host: www.andreafortuna.org
URL: https://www.andreafortuna.org/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f01c:800e:face:b00c:0:2 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),
Reverse DNS
Software
/
Resource Hash
08839c3f1d1ee00b43533391492dfeff7f3969a526ac2a8bd4f45c9b349d8dd2
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload

Request headers

Referer
https://www.andreafortuna.org/2018/03/28/what-is-the-china-chopper-webshell-and-how-to-find-it-on-a-compromized-system/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
content-encoding
br
x-app-usage
{"call_count":0,"total_cputime":0,"total_time":0}
status
200
date
Thu, 05 Dec 2019 16:08:27 GMT
x-fb-rev
1001500851
alt-svc
h3-23=":443"; ma=3600
content-length
168
pragma
no-cache
x-fb-debug
NJP9E33PPRhq1H7CuvXDG7UPUMml67AjJRaST/ynN0C0kpv4ynikc7pYl1YjkKQ9SubKb5xUjHzc3Oe9RRx4Vw==
x-fb-trace-id
DIyM8bPZNsp
etag
"497cd02206c3de3f1ed23c2a5ed10c4d7d94d609"
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
x-fb-request-id
AjxShi6brZl7IECi7r3zexn
cache-control
private, no-cache, no-store, must-revalidate
facebook-api-version
v2.11
expires
Sat, 01 Jan 2000 00:00:00 GMT
CCOpened.jpg
i2.wp.com/www.andreafortuna.org/wp-content/uploads/2018/03/ 		9 KB
9 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://i2.wp.com/www.andreafortuna.org/wp-content/uploads/2018/03/CCOpened.jpg?zoom=2&resize=840%2C505&ssl=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
i1.wp.com
Software
nginx /
Resource Hash
d6037e48944d3cda596cfc09c92c0a829dda34d3529d14b78f3d3b8af54f0ecf
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.andreafortuna.org/2018/03/28/what-is-the-china-chopper-webshell-and-how-to-find-it-on-a-compromized-system/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-nc
HIT ams 5
date
Thu, 05 Dec 2019 16:08:27 GMT
x-content-type-options
nosniff
x-bytes-saved
15960
last-modified
Sun, 01 Dec 2019 22:21:49 GMT
server
nginx
etag
"dc7b5c563ed93cc5"
vary
Accept
content-type
image/webp
status
200
cache-control
public, max-age=63115200
link
<https://www.andreafortuna.org/wp-content/uploads/2018/03/CCOpened.jpg>; rel="canonical"
content-length
9394
expires
Wed, 01 Dec 2021 10:21:49 GMT
ads
googleads.g.doubleclick.net/pagead/ Frame 3414 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9618060664237110&output=html&adk=1812271804&adf=3025194257&lmt=1575562107&plat=1%3A32776%2C2%3A32776%2C8%3A134250504%2C9%3A134250504%2C16%3A8388608%2C30%3A1081344%2C40%3A32&tp=site_kit&guci=1.2.0.0.2.2.0.0&format=0x0&url=https%3A%2F%2Fwww.andreafortuna.org%2F2018%2F03%2F28%2Fwhat-is-the-china-chopper-webshell-and-how-to-find-it-on-a-compromized-system%2F&ea=0&flash=0&pra=5&wgl=1&adsid=NT&dt=1575562107004&bpp=24&bdt=1105&fdt=104&idt=104&shv=r20191203&cbv=r20190131&saldr=aa&abxe=1&nras=1&correlator=5502395520236&frm=20&pv=2&ga_vid=324401252.1575562107&ga_sid=1575562107&ga_hid=1603263096&ga_fc=0&iag=0&icsg=731651&dssz=28&mdo=0&mso=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=1585&bih=1200&scr_x=0&scr_y=0&eid=21065126&oid=3&pvsid=2888578744142994&rx=0&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=16&bc=31&ifi=0&uci=a!0&fsb=1&dtd=126
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20191203/r20190131/show_ads_impl_fy2019.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:819::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
googleads.g.doubleclick.net
:scheme
https
:path
/pagead/ads?client=ca-pub-9618060664237110&output=html&adk=1812271804&adf=3025194257&lmt=1575562107&plat=1%3A32776%2C2%3A32776%2C8%3A134250504%2C9%3A134250504%2C16%3A8388608%2C30%3A1081344%2C40%3A32&tp=site_kit&guci=1.2.0.0.2.2.0.0&format=0x0&url=https%3A%2F%2Fwww.andreafortuna.org%2F2018%2F03%2F28%2Fwhat-is-the-china-chopper-webshell-and-how-to-find-it-on-a-compromized-system%2F&ea=0&flash=0&pra=5&wgl=1&adsid=NT&dt=1575562107004&bpp=24&bdt=1105&fdt=104&idt=104&shv=r20191203&cbv=r20190131&saldr=aa&abxe=1&nras=1&correlator=5502395520236&frm=20&pv=2&ga_vid=324401252.1575562107&ga_sid=1575562107&ga_hid=1603263096&ga_fc=0&iag=0&icsg=731651&dssz=28&mdo=0&mso=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=1585&bih=1200&scr_x=0&scr_y=0&eid=21065126&oid=3&pvsid=2888578744142994&rx=0&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=16&bc=31&ifi=0&uci=a!0&fsb=1&dtd=126
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
cross-site
sec-fetch-mode
nested-navigate
referer
https://www.andreafortuna.org/2018/03/28/what-is-the-china-chopper-webshell-and-how-to-find-it-on-a-compromized-system/
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer
https://www.andreafortuna.org/2018/03/28/what-is-the-china-chopper-webshell-and-how-to-find-it-on-a-compromized-system/

Response headers

status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
br
date
Thu, 05 Dec 2019 16:08:27 GMT
server
cafe
content-length
1325
x-xss-protection
0
set-cookie
test_cookie=CheckForPermission; expires=Thu, 05-Dec-2019 16:23:27 GMT; path=/; domain=.doubleclick.net
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
expires
Thu, 05 Dec 2019 16:08:27 GMT
cache-control
private
osd.js
www.googletagservices.com/activeview/js/current/ 		78 KB
29 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20191203/r20190131/show_ads_impl_fy2019.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
ddeda14a0a3fa1b9696f3bbe5907edf2f254e0ca9e2987e835923464ea8f2627
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.andreafortuna.org/2018/03/28/what-is-the-china-chopper-webshell-and-how-to-find-it-on-a-compromized-system/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 05 Dec 2019 16:08:27 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1575306155122023"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
29365
x-xss-protection
0
expires
Thu, 05 Dec 2019 16:08:27 GMT
ga-audiences
www.google.de/ads/
Redirect Chain
  • https://www.google-analytics.com/r/collect?v=1&_v=j79&a=1603263096&t=pageview&_s=1&dl=https%3A%2F%2Fwww.andreafortuna.org%2F2018%2F03%2F28%2Fwhat-is-the-china-chopper-webshell-and-how-to-find-it-on...
  • https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-131216-28&cid=324401252.1575562107&jid=833843598&_gid=718463853.1575562107&gjid=1865401587&_v=j79&z=1919828374
  • https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-131216-28&cid=324401252.1575562107&jid=833843598&_v=j79&z=1919828374
  • https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-131216-28&cid=324401252.1575562107&jid=833843598&_v=j79&z=1919828374&slf_rd=1&random=2150667512
42 B
109 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-131216-28&cid=324401252.1575562107&jid=833843598&_v=j79&z=1919828374&slf_rd=1&random=2150667512
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.andreafortuna.org/2018/03/28/what-is-the-china-chopper-webshell-and-how-to-find-it-on-a-compromized-system/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 05 Dec 2019 16:08:27 GMT
x-content-type-options
nosniff
content-type
image/gif
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
no-cache, no-store, must-revalidate
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Thu, 05 Dec 2019 16:08:27 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
location
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-131216-28&cid=324401252.1575562107&jid=833843598&_v=j79&z=1919828374&slf_rd=1&random=2150667512
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
302
cache-control
no-cache, no-store, must-revalidate
content-type
text/html; charset=UTF-8
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ads
googleads.g.doubleclick.net/pagead/ Frame 12DC 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9618060664237110&output=html&h=250&adk=4184210696&adf=1126500945&w=331&fwrn=4&fwrnh=100&lmt=1575562107&rafmt=1&to=qs&pwprc=1462017320&tp=site_kit&psa=0&guci=1.2.0.0.2.2.0.0&format=331x250&url=https%3A%2F%2Fwww.andreafortuna.org%2F2018%2F03%2F28%2Fwhat-is-the-china-chopper-webshell-and-how-to-find-it-on-a-compromized-system%2F&flash=0&fwr=0&rpe=1&resp_fmts=3&wgl=1&adsid=NT&dt=1575562107352&bpp=10&bdt=1453&fdt=11&idt=11&shv=r20191203&cbv=r20190131&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=5502395520236&frm=20&pv=1&ga_vid=324401252.1575562107&ga_sid=1575562107&ga_hid=1603263096&ga_fc=0&iag=0&icsg=34286083&dssz=28&mdo=0&mso=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1070&ady=1501&biw=1585&bih=1200&scr_x=0&scr_y=0&eid=21065126&oid=3&pvsid=2888578744142994&rx=0&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=144&bc=31&ifi=1&uci=a!1&btvi=1&fsb=1&xpc=NFlf78CcuL&p=https%3A//www.andreafortuna.org&dtd=20
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20191203/r20190131/show_ads_impl_fy2019.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:819::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
googleads.g.doubleclick.net
:scheme
https
:path
/pagead/ads?client=ca-pub-9618060664237110&output=html&h=250&adk=4184210696&adf=1126500945&w=331&fwrn=4&fwrnh=100&lmt=1575562107&rafmt=1&to=qs&pwprc=1462017320&tp=site_kit&psa=0&guci=1.2.0.0.2.2.0.0&format=331x250&url=https%3A%2F%2Fwww.andreafortuna.org%2F2018%2F03%2F28%2Fwhat-is-the-china-chopper-webshell-and-how-to-find-it-on-a-compromized-system%2F&flash=0&fwr=0&rpe=1&resp_fmts=3&wgl=1&adsid=NT&dt=1575562107352&bpp=10&bdt=1453&fdt=11&idt=11&shv=r20191203&cbv=r20190131&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=5502395520236&frm=20&pv=1&ga_vid=324401252.1575562107&ga_sid=1575562107&ga_hid=1603263096&ga_fc=0&iag=0&icsg=34286083&dssz=28&mdo=0&mso=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1070&ady=1501&biw=1585&bih=1200&scr_x=0&scr_y=0&eid=21065126&oid=3&pvsid=2888578744142994&rx=0&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=144&bc=31&ifi=1&uci=a!1&btvi=1&fsb=1&xpc=NFlf78CcuL&p=https%3A//www.andreafortuna.org&dtd=20
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
cross-site
sec-fetch-mode
nested-navigate
referer
https://www.andreafortuna.org/2018/03/28/what-is-the-china-chopper-webshell-and-how-to-find-it-on-a-compromized-system/
accept-encoding
gzip, deflate, br
cookie
test_cookie=CheckForPermission
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer
https://www.andreafortuna.org/2018/03/28/what-is-the-china-chopper-webshell-and-how-to-find-it-on-a-compromized-system/

Response headers

status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
br
date
Thu, 05 Dec 2019 16:08:27 GMT
server
cafe
content-length
26102
x-xss-protection
0
set-cookie
IDE=AHWqTUk-TJH00Rsizh0KEG9AAjRHrGzFRwPfJmOEUE4XqNeWbEVbrFr1ZPknnIqM; expires=Tue, 29-Dec-2020 16:08:27 GMT; path=/; domain=.doubleclick.net; HttpOnly test_cookie=; domain=.doubleclick.net; path=/; expires=Mon, 21 Jul 2008 23:59:00 GMT
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
expires
Thu, 05 Dec 2019 16:08:27 GMT
cache-control
private
ads
googleads.g.doubleclick.net/pagead/ Frame 8485 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9618060664237110&output=html&h=250&adk=4184210696&adf=3633414696&w=331&fwrn=4&fwrnh=100&lmt=1575562107&rafmt=1&to=qs&pwprc=1462017320&tp=site_kit&psa=0&guci=1.2.0.0.2.2.0.0&format=331x250&url=https%3A%2F%2Fwww.andreafortuna.org%2F2018%2F03%2F28%2Fwhat-is-the-china-chopper-webshell-and-how-to-find-it-on-a-compromized-system%2F&flash=0&fwr=0&rpe=1&resp_fmts=3&wgl=1&adsid=NT&dt=1575562107388&bpp=6&bdt=1489&fdt=8&idt=8&shv=r20191203&cbv=r20190131&saldr=aa&abxe=1&prev_fmts=0x0%2C331x250&nras=1&correlator=5502395520236&frm=20&pv=1&ga_vid=324401252.1575562107&ga_sid=1575562107&ga_hid=1603263096&ga_fc=0&iag=0&icsg=34286083&dssz=28&mdo=0&mso=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1070&ady=2377&biw=1585&bih=1200&scr_x=0&scr_y=0&eid=21065126&oid=3&pvsid=2888578744142994&rx=0&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=144&bc=31&ifi=2&uci=a!2&btvi=2&fsb=1&xpc=YBguogXveT&p=https%3A//www.andreafortuna.org&dtd=13
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20191203/r20190131/show_ads_impl_fy2019.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:819::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
googleads.g.doubleclick.net
:scheme
https
:path
/pagead/ads?client=ca-pub-9618060664237110&output=html&h=250&adk=4184210696&adf=3633414696&w=331&fwrn=4&fwrnh=100&lmt=1575562107&rafmt=1&to=qs&pwprc=1462017320&tp=site_kit&psa=0&guci=1.2.0.0.2.2.0.0&format=331x250&url=https%3A%2F%2Fwww.andreafortuna.org%2F2018%2F03%2F28%2Fwhat-is-the-china-chopper-webshell-and-how-to-find-it-on-a-compromized-system%2F&flash=0&fwr=0&rpe=1&resp_fmts=3&wgl=1&adsid=NT&dt=1575562107388&bpp=6&bdt=1489&fdt=8&idt=8&shv=r20191203&cbv=r20190131&saldr=aa&abxe=1&prev_fmts=0x0%2C331x250&nras=1&correlator=5502395520236&frm=20&pv=1&ga_vid=324401252.1575562107&ga_sid=1575562107&ga_hid=1603263096&ga_fc=0&iag=0&icsg=34286083&dssz=28&mdo=0&mso=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1070&ady=2377&biw=1585&bih=1200&scr_x=0&scr_y=0&eid=21065126&oid=3&pvsid=2888578744142994&rx=0&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=144&bc=31&ifi=2&uci=a!2&btvi=2&fsb=1&xpc=YBguogXveT&p=https%3A//www.andreafortuna.org&dtd=13
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
cross-site
sec-fetch-mode
nested-navigate
referer
https://www.andreafortuna.org/2018/03/28/what-is-the-china-chopper-webshell-and-how-to-find-it-on-a-compromized-system/
accept-encoding
gzip, deflate, br
cookie
test_cookie=CheckForPermission
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer
https://www.andreafortuna.org/2018/03/28/what-is-the-china-chopper-webshell-and-how-to-find-it-on-a-compromized-system/

Response headers

status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
br
date
Thu, 05 Dec 2019 16:08:27 GMT
server
cafe
content-length
26359
x-xss-protection
0
set-cookie
IDE=AHWqTUnw_x72UdqiMi3k8M5qZsDxiQHa1kTpQQ6q25Ew9yNHCZnvBthi_y3ft-LK; expires=Tue, 29-Dec-2020 16:08:27 GMT; path=/; domain=.doubleclick.net; HttpOnly test_cookie=; domain=.doubleclick.net; path=/; expires=Mon, 21 Jul 2008 23:59:00 GMT
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
expires
Thu, 05 Dec 2019 16:08:27 GMT
cache-control
private
ads
googleads.g.doubleclick.net/pagead/ Frame 22EF 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9618060664237110&output=html&h=280&adk=2767623100&adf=1730821504&w=1200&fwrn=4&fwrnh=100&lmt=1575562107&rafmt=1&to=qs&pwprc=1462017320&tp=site_kit&psa=0&guci=1.2.0.0.2.2.0.0&format=1200x280&url=https%3A%2F%2Fwww.andreafortuna.org%2F2018%2F03%2F28%2Fwhat-is-the-china-chopper-webshell-and-how-to-find-it-on-a-compromized-system%2F&flash=0&fwr=0&rpe=1&resp_fmts=3&wgl=1&adsid=NT&dt=1575562107410&bpp=5&bdt=1511&fdt=6&idt=6&shv=r20191203&cbv=r20190131&saldr=aa&abxe=1&prev_fmts=0x0%2C331x250%2C331x250&nras=1&correlator=5502395520236&frm=20&pv=1&ga_vid=324401252.1575562107&ga_sid=1575562107&ga_hid=1603263096&ga_fc=0&iag=0&icsg=34286083&dssz=28&mdo=0&mso=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=193&ady=4776&biw=1585&bih=1200&scr_x=0&scr_y=0&eid=21065126&oid=3&pvsid=2888578744142994&rx=0&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=144&bc=31&ifi=3&uci=a!3&btvi=3&fsb=1&xpc=yjpjQfE0Sq&p=https%3A//www.andreafortuna.org&dtd=11
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20191203/r20190131/show_ads_impl_fy2019.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:819::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
googleads.g.doubleclick.net
:scheme
https
:path
/pagead/ads?client=ca-pub-9618060664237110&output=html&h=280&adk=2767623100&adf=1730821504&w=1200&fwrn=4&fwrnh=100&lmt=1575562107&rafmt=1&to=qs&pwprc=1462017320&tp=site_kit&psa=0&guci=1.2.0.0.2.2.0.0&format=1200x280&url=https%3A%2F%2Fwww.andreafortuna.org%2F2018%2F03%2F28%2Fwhat-is-the-china-chopper-webshell-and-how-to-find-it-on-a-compromized-system%2F&flash=0&fwr=0&rpe=1&resp_fmts=3&wgl=1&adsid=NT&dt=1575562107410&bpp=5&bdt=1511&fdt=6&idt=6&shv=r20191203&cbv=r20190131&saldr=aa&abxe=1&prev_fmts=0x0%2C331x250%2C331x250&nras=1&correlator=5502395520236&frm=20&pv=1&ga_vid=324401252.1575562107&ga_sid=1575562107&ga_hid=1603263096&ga_fc=0&iag=0&icsg=34286083&dssz=28&mdo=0&mso=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=193&ady=4776&biw=1585&bih=1200&scr_x=0&scr_y=0&eid=21065126&oid=3&pvsid=2888578744142994&rx=0&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=144&bc=31&ifi=3&uci=a!3&btvi=3&fsb=1&xpc=yjpjQfE0Sq&p=https%3A//www.andreafortuna.org&dtd=11
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
cross-site
sec-fetch-mode
nested-navigate
referer
https://www.andreafortuna.org/2018/03/28/what-is-the-china-chopper-webshell-and-how-to-find-it-on-a-compromized-system/
accept-encoding
gzip, deflate, br
cookie
test_cookie=CheckForPermission
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer
https://www.andreafortuna.org/2018/03/28/what-is-the-china-chopper-webshell-and-how-to-find-it-on-a-compromized-system/

Response headers

status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
br
date
Thu, 05 Dec 2019 16:08:27 GMT
server
cafe
content-length
205
x-xss-protection
0
set-cookie
IDE=AHWqTUn3-7SV8MCmVlISegBvcgdMc8Cp6Vhy47Dqgqfa_2KKJKs9Ouh4UYbCMpFc; expires=Tue, 29-Dec-2020 16:08:27 GMT; path=/; domain=.doubleclick.net; HttpOnly test_cookie=; domain=.doubleclick.net; path=/; expires=Mon, 21 Jul 2008 23:59:00 GMT
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
expires
Thu, 05 Dec 2019 16:08:27 GMT
cache-control
private
amzn-nsa-sprite-2x.png
wms-na.amazon-adsystem.com/panda/20070822/US/img/ 		4 KB
5 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://wms-na.amazon-adsystem.com/panda/20070822/US/img/amzn-nsa-sprite-2x.png
Requested by
Host:
URL: dynscript-1-1.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
143.204.102.74 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-143-204-102-74.fra50.r.cloudfront.net
Software
Server /
Resource Hash
3d363721e733cd455560f59c74cffdb28148623c7c716a23403bd6b85696b4fa

Request headers

Referer
https://www.andreafortuna.org/2018/03/28/what-is-the-china-chopper-webshell-and-how-to-find-it-on-a-compromized-system/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Sat, 16 Nov 2019 01:10:46 GMT
via
1.1 80c1ad5f9352d00b95a9da73eb6b6be5.cloudfront.net (CloudFront)
age
1695460
x-cache
Hit from cloudfront
status
200
content-length
4335
last-modified
Thu, 20 Jun 2019 05:40:26 GMT
server
Server
etag
"10ef-58bbac8710c8d"
content-type
image/png
charset
UTF-8
cache-control
max-age=2592000
x-amz-cf-pop
FRA50-C1
accept-ranges
bytes
x-amz-cf-id
XQwD9YuL-A1MDou6_xubiPbf270Ed0bXW7QvPcPHAW-h9or1bLS2FA==
expires
Sat, 23 Nov 2019 01:10:46 GMT
LateralMovement.jpg
i2.wp.com/www.andreafortuna.org/wp-content/uploads/2018/07/ 		10 KB
11 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://i2.wp.com/www.andreafortuna.org/wp-content/uploads/2018/07/LateralMovement.jpg?fit=975%2C482&ssl=1&resize=350%2C200
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
i1.wp.com
Software
nginx /
Resource Hash
17be1c56518772373bc64ea248e738aa78ba64b3148a8996f93a4bd58bc9289a
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.andreafortuna.org/2018/03/28/what-is-the-china-chopper-webshell-and-how-to-find-it-on-a-compromized-system/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-nc
HIT ams 1
date
Thu, 05 Dec 2019 16:08:28 GMT
x-content-type-options
nosniff
x-bytes-saved
3708
last-modified
Mon, 25 Nov 2019 18:04:43 GMT
server
nginx
etag
"121674d9a4d5a5a0"
vary
Accept
content-type
image/webp
status
200
cache-control
public, max-age=63115200
link
<https://www.andreafortuna.org/wp-content/uploads/2018/07/LateralMovement.jpg>; rel="canonical"
content-length
10658
expires
Thu, 25 Nov 2021 06:04:43 GMT
CloudFlare.jpg
i1.wp.com/www.andreafortuna.org/wp-content/uploads/2018/05/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://i1.wp.com/www.andreafortuna.org/wp-content/uploads/2018/05/CloudFlare.jpg?fit=1024%2C362&ssl=1&resize=350%2C200
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
i1.wp.com
Software
nginx /
Resource Hash
8be253965082a7c1635c1772597f2d603541ffba592b23e35e118223644a0db5
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.andreafortuna.org/2018/03/28/what-is-the-china-chopper-webshell-and-how-to-find-it-on-a-compromized-system/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-nc
HIT ams 5
date
Thu, 05 Dec 2019 16:08:28 GMT
x-content-type-options
nosniff
x-bytes-saved
4320
last-modified
Mon, 25 Nov 2019 18:04:43 GMT
server
nginx
etag
"cafc1c4c6128146b"
vary
Accept
content-type
image/webp
status
200
cache-control
public, max-age=63115200
link
<https://www.andreafortuna.org/wp-content/uploads/2018/05/CloudFlare.jpg>; rel="canonical"
content-length
2696
expires
Thu, 25 Nov 2021 06:04:43 GMT

Verdicts & Comments Add Verdict or Comment

99 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate function| amazon_assoc_ir_f_call_associates_ads function| amazon_assoc_ir_f_call function| amazon_assoc_ir_call function| amzn_assoc_ad_spec_type object| amzn_assoc_ad_spec object| amzn_assoc_ad_async_spec object| adUnitDeliveryNetwork object| slotCounter function| cmManager object| amzn_assoc_cm boolean| amzn_assoc_enable_abs object| amzn_assoc_internal_params function| assocUtilsMaker object| amzn_assoc_utils object| nativeAdLayoutComputer object| amzn_assoc_ad function| amzn_assoc_jsonp_callback_adunit0_0 function| amzn_assoc_client_cb_0 object| __cfQR object| amznAssocFallbackMode_0 object| amznAssocEstimatedPerformance_0 object| callbacks object| amznassoccsm function| asinHandler function| trackingUtils function| nativeAdLoader function| nativeAd undefined| $ function| jQuery object| related_posts_js_options string| chronus_menu_title function| gtag object| dataLayer object| adsbygoogle object| WPCOM_sharing_counts object| google_tag_manager object| google_js_reporting_queue number| google_srt object| google_ad_modifications object| google_logging_queue object| ggeac boolean| google_measure_js_timing object| googleToken object| googleIMState function| processGoogleToken object| google_reactive_ads_global_state boolean| _gfp_a_ object| google_sa_queue object| google_sl_win function| google_process_slots function| google_spfd object| google_sv_map object| google_t12n_vars function| amzn_assoc_jsonp_callback_adunit0_1 function| amzn_assoc_client_cb_1 object| wpcom_img_zoomer object| detectZoom object| sharing_js_options undefined| windowOpen boolean| __cfRLUnblockHandlers string| GoogleAnalyticsObject function| ga function| jetpackLazyImagesModule object| ak_js object| commentForm undefined| replyRowContainer undefined| children object| WPCOMSharing object| addComment object| wp function| Goog_AdSense_getAdAdapterInstance function| Goog_AdSense_OsdAdapter function| google_sa_impl object| google_jobrunner object| google_persistent_state_async object| __google_ad_urls number| google_global_correlator number| __google_ad_urls_id object| google_prev_clients object| gaGlobal object| ampInaboxIframes object| ampInaboxPendingMessages object| google_iframe_oncopy boolean| google_osd_loaded boolean| google_onload_fired object| google_tag_data object| gaplugins object| gaData function| Goog_Osd_UnloadAdBlock function| Goog_Osd_UpdateElementToMeasure function| google_osd_amcb boolean| _gfp_p_ number| google_lpabyc number| google_unique_id object| amznAssocFallbackMode_1 object| amznAssocEstimatedPerformance_1 function| nativeAdFeedback

0 Cookies

1 Console Messages

Source Level URL
Text
console-api log URL: https://www.andreafortuna.org/wp-content/cache/autoptimize/js/autoptimize_b1198eb09f3617a8760d9baf4100bf94.js(Line 1)
Message:
JQMIGRATE: Migrate is installed, version 1.4.1

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

aax-us-east.amazon-adsystem.com
adservice.google.com
adservice.google.de
ajax.cloudflare.com
googleads.g.doubleclick.net
graph.facebook.com
i1.wp.com
i2.wp.com
jetpack.wordpress.com
pagead2.googlesyndication.com
s0.wp.com
stats.g.doubleclick.net
wms-na.amazon-adsystem.com
www.andreafortuna.org
www.google-analytics.com
www.google.com
www.google.de
www.googletagmanager.com
www.googletagservices.com
z-na.amazon-adsystem.com
104.27.154.184
143.204.102.74
192.0.77.2
192.0.77.32
192.0.78.33
2606:4700::6811:4004
2a00:1450:4001:806::2008
2a00:1450:4001:808::2002
2a00:1450:4001:80b::2003
2a00:1450:4001:819::2002
2a00:1450:4001:81b::200e
2a00:1450:4001:825::2004
2a00:1450:400c:c0b::9d
2a03:2880:f01c:800e:face:b00c:0:2
52.222.170.133
52.46.141.211
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
08839c3f1d1ee00b43533391492dfeff7f3969a526ac2a8bd4f45c9b349d8dd2
1593483d88f332166a4f663bbb8a7ee690cbe3480abb65a9eb930a223d1e7669
17be1c56518772373bc64ea248e738aa78ba64b3148a8996f93a4bd58bc9289a
1ef564b89fc8b8baa6609f30535c85a5f7e793f16879169cbf7a8987fd85405d
3199a4d61799975495556a5411907a67f2e82ee0e598ed97e96ea6a4db889289
363aee73e3a1fea507ec69cf6a9b74ee2ca3a6c46f4839f6c2771a4631c2960d
3d363721e733cd455560f59c74cffdb28148623c7c716a23403bd6b85696b4fa
41d8cf7fb294fd883ec51e65efb3d63f153ef62fc9d3f29993822d92dc01d44f
46f1ffd1a4fdd526f53821fb907878b0245a5dff13e6338ddd3fb5d7f9e343d4
634b31cde658e26109972f378e0086a4aa49ac218f019302b6edf3caeda483c1
704d418b7b3efa6f1870d409134b9c6b80fc5f5f38b46a68aee496388a6bbd48
895964971ebdb56ee76d08850bcb4c5a88ec4c65e6a235882304e8ff6767cd7c
8a7324b76945d411582c2006f74e644ba0d0507320ba669ffadeb685a5e42fc6
8bac2f32e4d08efd7175b1b892ca189767507bfeef9372d6881e0419542e78d9
8be253965082a7c1635c1772597f2d603541ffba592b23e35e118223644a0db5
8c7ee0238fa5cd80a02ef9870a7fff498ef52097181cb73edb9219dc022fd919
99cdbced720885e7fb45eb13fc9fff73125468f7b89d60832443bbc97a6080b8
9cb13e171afddebbef4bb1ef84c79ec9937b45367ab971086856771ab0a7dd94
b08cdbc2d30e656a86b20f8342428d5863f70f4b30135b4f4061f754ce932f5e
b2b6ba4b6ceeeae0efb23f67b9ae53bdc72ffb7bd149e0f63104d855712a506c
cbdd5dec595ff9a47f0d3632c2fb563b0b504a9b6033192e2289a054e4ba1b9d
d6037e48944d3cda596cfc09c92c0a829dda34d3529d14b78f3d3b8af54f0ecf
dbb67c620eaabf6679a314db18d3ae43037aef71ab27422e6feec08ee987cc0a
ddeda14a0a3fa1b9696f3bbe5907edf2f254e0ca9e2987e835923464ea8f2627
ee3edad57a717a1b9ed1c3d5cb5d384145027c4e59f3af52322123bfc1fbca8b
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f32d41f2099a0be20e6b57c5e0d1b71c079d3e1345827b0f5c5b97c6e5e3f78d
f3cf89971def70af97ab61a3acceedcad79d31d6f462fccda577e55723d2b647