urlscan.io logo urlscan.io
SecurityTrails logo

rusvpn.com Open in urlscan Pro
2600:9000:2182:8c00:7:7266:1d00:93a1  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://t.co/slD9sGIKhp
Effective URL: https://rusvpn.com/en/blog/a-novel-malware-can-steal-passwords-from-vpn-software-and-web-browsers/?utm_source=twitt...
Submission: On November 25 via api from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 24 IPs in 7 countries across 20 domains to perform 61 HTTP transactions. The main IP is 2600:9000:2182:8c00:7:7266:1d00:93a1, located in United States and belongs to AMAZON-02, US. The main domain is rusvpn.com.
TLS certificate: Issued by Amazon on November 22nd 2020. Valid for: a year.
This is the only time rusvpn.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 104.244.42.5 13414 (TWITTER)
1 1 67.199.248.10 396982 (GOOGLE-PR...)
16 2600:9000:218... 16509 (AMAZON-02)
1 2a00:1450:400... 15169 (GOOGLE)
1 2a04:fa87:fff... 2635 (AUTOMATTIC)
2 2a00:1450:400... 15169 (GOOGLE)
1 2606:4700::68... 13335 (CLOUDFLAR...)
5 2a00:1450:400... 15169 (GOOGLE)
2 2606:4700::68... 13335 (CLOUDFLAR...)
1 45.157.141.55 52000 (MIRHOSTING)
1 2a00:1450:400... 15169 (GOOGLE)
1 216.58.207.66 15169 (GOOGLE)
3 12 2a02:6b8::1:119 13238 (YANDEX)
2 136.243.102.102 24940 (HETZNER-AS)
1 95.100.181.34 20940 (AKAMAI-ASN1)
2 2a03:2880:f01... 32934 (FACEBOOK)
1 2606:4700:303... 13335 (CLOUDFLAR...)
2 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
4 2.16.186.155 20940 (AKAMAI-ASN1)
2 2a03:2880:f12... 32934 (FACEBOOK)
61 24
1    104.244.42.5 (United States)

ASN13414 (TWITTER, US)
t.co
1    67.199.248.10 (United States)

ASN396982 (GOOGLE-PRIVATE-CLOUD, US)
PTR: bit.ly
bit.ly
16    2600:9000:2182:8c00:7:7266:1d00:93a1 (United States)

ASN16509 (AMAZON-02, US)
rusvpn.com
1    2a00:1450:4001:806::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.googletagmanager.com
1    2a04:fa87:fffe::c000:4902 (Ireland)

ASN2635 (AUTOMATTIC, US)
secure.gravatar.com
2    2a00:1450:4001:808::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.googleapis.com
1    2606:4700::6810:135e (United States)

ASN13335 (CLOUDFLARENET, US)
cdnjs.cloudflare.com
5    2a00:1450:4001:814::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.gstatic.com
2    2606:4700::6810:125e (United States)

ASN13335 (CLOUDFLARENET, US)
cdnjs.cloudflare.com
1    45.157.141.55 (None, )

ASN52000 (MIRHOSTING, RU)
PTR: sdc2-cloud.nl.hypermetrica.com
ip.rvpn.ws
1    2a00:1450:4001:80b::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google-analytics.com
1    216.58.207.66 (Mountain View, United States)

ASN15169 (GOOGLE, US)
PTR: fra16s25-in-f2.1e100.net
www.googleadservices.com
12    2a02:6b8::1:119 (Moscow, Russian Federation)

ASN13238 (YANDEX, RU)
mc.yandex.ru
mc.yandex.com
2    136.243.102.102 (Germany)

ASN24940 (HETZNER-AS, DE)
PTR: static.102.102.243.136.clients.your-server.de
track.rusvpn.com
1    95.100.181.34 (Ascension Island)

ASN20940 (AKAMAI-ASN1, EU)
PTR: a95-100-181-34.deploy.static.akamaitechnologies.com
cdn.livechatinc.com
2    2a03:2880:f01c:8012:face:b00c:0:3 (Ireland)

ASN32934 (FACEBOOK, US)
connect.facebook.net
1    2606:4700:3031::6812:3681 (United States)

ASN13335 (CLOUDFLARENET, US)
connected11.com
2    2a00:1450:4001:824::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google-analytics.com
1    2a00:1450:400c:c0c::9b (Brussels, Belgium)

ASN15169 (GOOGLE, US)
stats.g.doubleclick.net
1    2a00:1450:4001:81e::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
googleads.g.doubleclick.net
2    2a00:1450:4001:81a::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google.com
2    2a00:1450:4001:820::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google.de
4    2.16.186.155 (Ascension Island)

ASN20940 (AKAMAI-ASN1, EU)
PTR: a2-16-186-155.deploy.static.akamaitechnologies.com
secure.livechatinc.com
2    2a03:2880:f12d:83:face:b00c:0:25de (Ireland)

ASN32934 (FACEBOOK, US)
www.facebook.com
Domain Requested by
16 rusvpn.com t.co
rusvpn.com
10 mc.yandex.ru 2 redirects t.co
mc.yandex.ru
5 fonts.gstatic.com fonts.googleapis.com
4 secure.livechatinc.com cdn.livechatinc.com
3 www.google-analytics.com www.googletagmanager.com
www.google-analytics.com
3 cdnjs.cloudflare.com rusvpn.com
cdnjs.cloudflare.com
2 mc.yandex.com 1 redirects
2 www.facebook.com connect.facebook.net
2 www.google.de
2 www.google.com
2 connect.facebook.net t.co
connect.facebook.net
2 track.rusvpn.com t.co
2 fonts.googleapis.com rusvpn.com
1 googleads.g.doubleclick.net www.googleadservices.com
1 stats.g.doubleclick.net www.google-analytics.com
1 connected11.com www.googletagmanager.com
1 cdn.livechatinc.com t.co
1 www.googleadservices.com www.googletagmanager.com
1 ip.rvpn.ws
1 secure.gravatar.com rusvpn.com
1 www.googletagmanager.com rusvpn.com
1 bit.ly 1 redirects
1 t.co
61 23
Subject Issuer Validity Valid
t.co
DigiCert SHA2 High Assurance Server CA		 2020-03-05 -
2021-03-02		 a year crt.sh
rusvpn.com
Amazon		 2020-11-22 -
2021-12-21		 a year crt.sh
*.google-analytics.com
GTS CA 1O1		 2020-11-03 -
2021-01-26		 3 months crt.sh
*.gravatar.com
Sectigo RSA Domain Validation Secure Server CA		 2020-08-14 -
2022-11-16		 2 years crt.sh
upload.video.google.com
GTS CA 1O1		 2020-11-03 -
2021-01-26		 3 months crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2020-10-21 -
2021-10-20		 a year crt.sh
*.gstatic.com
GTS CA 1O1		 2020-11-03 -
2021-01-26		 3 months crt.sh
*.rvpn.ws
Let's Encrypt Authority X3		 2020-11-04 -
2021-02-02		 3 months crt.sh
www.googleadservices.com
GTS CA 1O1		 2020-11-03 -
2021-01-26		 3 months crt.sh
mc.yandex.ru
Yandex CA		 2020-09-29 -
2021-03-11		 5 months crt.sh
track.rusvpn.com
Let's Encrypt Authority X3		 2020-10-13 -
2021-01-11		 3 months crt.sh
livechat.com
DigiCert Secure Site ECC CA-1		 2020-07-16 -
2021-07-16		 a year crt.sh
*.facebook.com
DigiCert SHA2 High Assurance Server CA		 2020-11-02 -
2021-01-30		 3 months crt.sh
*.g.doubleclick.net
GTS CA 1O1		 2020-11-03 -
2021-01-26		 3 months crt.sh
www.google.com
GTS CA 1O1		 2020-11-03 -
2021-01-26		 3 months crt.sh
www.google.de
GTS CA 1O1		 2020-11-03 -
2021-01-26		 3 months crt.sh

This page contains 2 frames:

Primary Page: https://rusvpn.com/en/blog/a-novel-malware-can-steal-passwords-from-vpn-software-and-web-browsers/?utm_source=twitter&utm_medium=231120&utm_campaign=post
Frame ID: 849B1BC89ACEE61CAC1B2F38891E7D5F
Requests: 90 HTTP requests in this frame

Frame: https://secure.livechatinc.com/licence/10577487/v2/open_chat.cgi?license=10577487&group=0&embedded=1&widget_version=3&unique_groups=0&localization_improvement=1
Frame ID: 2F2F632DDBA50B46F6C57469B06DB0FA
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. https://t.co/slD9sGIKhp Page URL
  2. https://bit.ly/3fqLtcV HTTP 301
    https://rusvpn.com/en/blog/a-novel-malware-can-steal-passwords-from-vpn-software-and-web-browse... Page URL

Page Statistics

61
Requests

100 %
HTTPS

71 %
IPv6

20
Domains

23
Subdomains

24
IPs

7
Countries

1072 kB
Transfer

3404 kB
Size

3
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://t.co/slD9sGIKhp Page URL
  2. https://bit.ly/3fqLtcV HTTP 301
    https://rusvpn.com/en/blog/a-novel-malware-can-steal-passwords-from-vpn-software-and-web-browsers/?utm_source=twitter&utm_medium=231120&utm_campaign=post Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 78
  • https://mc.yandex.com/sync_cookie_image_check HTTP 302
  • https://mc.yandex.ru/sync_cookie_image_start?redirect_domain=mc.yandex.com&token=9103.1W5PZ3p58XsQLY1SOpelvZUMV6YsyuFcLHhW_eduOaC4D-yyJOea2p4O1aaTWmaC.BjcZi2LBBe31qv1pRhKgScwEcTM%2C HTTP 302
  • https://mc.yandex.com/sync_cookie_image_decide?token=9103.0tPTm6biws60yBIEee_hkUuXXK1KpbtnYVu1H5GApJ-oq4AOexlNQbLXNF_aXnJwdemjEfmP28ZLte7Mzme9qA%2C%2C.k74rQSmZT9OZ6sFr0R64-kaFQ2M%2C
Request Chain 83
  • https://mc.yandex.ru/watch/46628313?wmode=7&page-ref=https%3A%2F%2Ft.co%2FslD9sGIKhp&page-url=https%3A%2F%2Frusvpn.com%2Fen%2Fblog%2Fa-novel-malware-can-steal-passwords-from-vpn-software-and-web-browsers%2F%3Futm_source%3Dtwitter%26utm_medium%3D231120%26utm_campaign%3Dpost&charset=utf-8&browser-info=ti%3A10%3Ans%3A1606312117727%3As%3A1600x1200x24%3Ask%3A1%3Ahdl%3A1%3Aadb%3A2%3Afpr%3A216613626101%3Acn%3A1%3Aw%3A1600x1200%3Az%3A60%3Ai%3A20201125144838%3Aet%3A1606312119%3Aen%3Autf-8%3Ac%3A1%3Ala%3Aen-us%3Awh%3A1%3Apv%3A1%3Als%3A319971676982%3Arqn%3A1%3Arn%3A537526198%3Ahid%3A456258437%3Ads%3A20%2C19%2C11%2C8%2C237%2C0%2C0%2C364%2C5%2C726%2C726%2C3%2C657%3Afp%3A506%3Awn%3A41210%3Ahl%3A2%3Agdpr%3A14%3Av%3A1976%3Awv%3A2%3Arqnl%3A1%3Ast%3A1606312119%3Au%3A1606312119829003030%3App%3A3629563401%3At%3AA%20novel%20malware%20can%20steal%20passwords%20from%20VPN%20software%20and%20web%20browsers%20%E2%96%B6%EF%B8%8F%20RusVPN HTTP 302
  • https://mc.yandex.ru/watch/46628313/1?wmode=7&page-ref=https%3A%2F%2Ft.co%2FslD9sGIKhp&page-url=https%3A%2F%2Frusvpn.com%2Fen%2Fblog%2Fa-novel-malware-can-steal-passwords-from-vpn-software-and-web-browsers%2F%3Futm_source%3Dtwitter%26utm_medium%3D231120%26utm_campaign%3Dpost&charset=utf-8&browser-info=ti%3A10%3Ans%3A1606312117727%3As%3A1600x1200x24%3Ask%3A1%3Ahdl%3A1%3Aadb%3A2%3Afpr%3A216613626101%3Acn%3A1%3Aw%3A1600x1200%3Az%3A60%3Ai%3A20201125144838%3Aet%3A1606312119%3Aen%3Autf-8%3Ac%3A1%3Ala%3Aen-us%3Awh%3A1%3Apv%3A1%3Als%3A319971676982%3Arqn%3A1%3Arn%3A537526198%3Ahid%3A456258437%3Ads%3A20%2C19%2C11%2C8%2C237%2C0%2C0%2C364%2C5%2C726%2C726%2C3%2C657%3Afp%3A506%3Awn%3A41210%3Ahl%3A2%3Agdpr%3A14%3Av%3A1976%3Awv%3A2%3Arqnl%3A1%3Ast%3A1606312119%3Au%3A1606312119829003030%3App%3A3629563401%3At%3AA%20novel%20malware%20can%20steal%20passwords%20from%20VPN%20software%20and%20web%20browsers%20%E2%96%B6%EF%B8%8F%20RusVPN

61 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
slD9sGIKhp
t.co/ 		221 B
363 B 		Document
General
Check archive.org
Download Go to
Full URL
https://t.co/slD9sGIKhp
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.244.42.5 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
fd278fd514d10e8882809fc28ac73baf0d706f7f77aea18b7bf2cca438cfc4f6
Security Headers
Name Value
Strict-Transport-Security max-age=0
X-Xss-Protection 0

Request headers

:method
GET
:authority
t.co
:scheme
https
:path
/slD9sGIKhp
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

cache-control
private,max-age=300
content-encoding
gzip
content-length
173
content-type
text/html; charset=utf-8
date
Wed, 25 Nov 2020 13:48:37 GMT
expires
Wed, 25 Nov 2020 13:53:37 GMT
server
tsa_o
set-cookie
muc=6d571086-e044-46ca-ba8b-762e4517129a; Max-Age=63072000; Expires=Fri, 25 Nov 2022 13:48:37 GMT; Domain=t.co; Secure; SameSite=None
strict-transport-security
max-age=0
vary
Origin
x-connection-hash
1f403fb32f7af01e82e22847062ff787
x-response-time
128
x-xss-protection
0
Primary Request /
rusvpn.com/en/blog/a-novel-malware-can-steal-passwords-from-vpn-software-and-web-browsers/
Redirect Chain
  • https://bit.ly/3fqLtcV
  • https://rusvpn.com/en/blog/a-novel-malware-can-steal-passwords-from-vpn-software-and-web-browsers/?utm_source=twitter&utm_medium=231120&utm_campaign=post
306 KB
51 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://rusvpn.com/en/blog/a-novel-malware-can-steal-passwords-from-vpn-software-and-web-browsers/?utm_source=twitter&utm_medium=231120&utm_campaign=post
Requested by
Host: t.co
URL: https://t.co/slD9sGIKhp
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2182:8c00:7:7266:1d00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
ff66d026a9bfb3b3c64f51e60d84cc592c087091cd915c7e3c4d1099a8807f3a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Frame-Options SAMEORIGIN SAMEORIGIN

Request headers

:method
GET
:authority
rusvpn.com
:scheme
https
:path
/en/blog/a-novel-malware-can-steal-passwords-from-vpn-software-and-web-browsers/?utm_source=twitter&utm_medium=231120&utm_campaign=post
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
document
referer
https://t.co/slD9sGIKhp
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://t.co/slD9sGIKhp

Response headers

content-type
text/html; charset=UTF-8
server
nginx
date
Tue, 24 Nov 2020 14:30:58 GMT
x-pingback
https://rusvpn.com/xmlrpc.php
link
<https://rusvpn.com/wp-json/>; rel="https://api.w.org/" <https://rusvpn.com/en/?p=17973>; rel=shortlink
x-frame-options
SAMEORIGIN SAMEORIGIN
strict-transport-security
max-age=31536000
content-encoding
gzip
vary
Accept-Encoding
x-cache
Hit from cloudfront
via
1.1 91528fdf97ef415d04fa66a0fbb562d7.cloudfront.net (CloudFront)
x-amz-cf-pop
DUS51-C1
x-amz-cf-id
WTGbryzPdmX96lpHwSnyG1VElKsrGFIcjZjB_CZ3wZ17vO6xw-qZrQ==
age
83860

Redirect headers

server
nginx
date
Wed, 25 Nov 2020 13:48:37 GMT
content-type
text/html; charset=utf-8
content-length
248
cache-control
private, max-age=90
content-security-policy
referrer always;
location
https://rusvpn.com/en/blog/a-novel-malware-can-steal-passwords-from-vpn-software-and-web-browsers/?utm_source=twitter&utm_medium=231120&utm_campaign=post
referrer-policy
unsafe-url
set-cookie
_bit=kapdMB-b71f9089be5a7ac76f-00l; Domain=bit.ly; Expires=Mon, 24 May 2021 13:48:37 GMT
via
1.1 google
alt-svc
clear
style.min.css
rusvpn.com/wp-includes/css/dist/block-library/ 		52 KB
8 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://rusvpn.com/wp-includes/css/dist/block-library/style.min.css?ver=5.4.4
Requested by
Host: rusvpn.com
URL: https://rusvpn.com/en/blog/a-novel-malware-can-steal-passwords-from-vpn-software-and-web-browsers/?utm_source=twitter&utm_medium=231120&utm_campaign=post
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2182:8c00:7:7266:1d00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
bca7af0b45b6fc6a2064e8e7a34f2041f3e77261e63f0257209bcde6bc40545d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Frame-Options SAMEORIGIN, SAMEORIGIN

Request headers

Referer
https://rusvpn.com/en/blog/a-novel-malware-can-steal-passwords-from-vpn-software-and-web-browsers/?utm_source=twitter&utm_medium=231120&utm_campaign=post
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 24 Nov 2020 14:30:58 GMT
content-encoding
gzip
vary
Accept-Encoding
age
83860
x-cache
Hit from cloudfront
last-modified
Mon, 04 May 2020 23:33:51 GMT
server
nginx
x-frame-options
SAMEORIGIN, SAMEORIGIN
etag
W/"5eb0a65f-d159"
strict-transport-security
max-age=31536000
content-type
text/css
via
1.1 91528fdf97ef415d04fa66a0fbb562d7.cloudfront.net (CloudFront)
cache-control
max-age=315360000
x-amz-cf-pop
DUS51-C1
x-amz-cf-id
OUeFEW0podGPQ4Ll3xrtea51_zvui6m7xuBXEisKoVgGocSrUQcBBQ==
expires
Thu, 31 Dec 2037 23:55:55 GMT
maxicharts-tables.css
rusvpn.com/xx/blog/assets/plugins/maxicharts/css/ 		2 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://rusvpn.com/xx/blog/assets/plugins/maxicharts/css/maxicharts-tables.css?ver=5.4.4
Requested by
Host: rusvpn.com
URL: https://rusvpn.com/en/blog/a-novel-malware-can-steal-passwords-from-vpn-software-and-web-browsers/?utm_source=twitter&utm_medium=231120&utm_campaign=post
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2182:8c00:7:7266:1d00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
1f0828a0e20828f59fb4665bc749a907a2ae890862ecb870c07d69c38b35ab79
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Frame-Options SAMEORIGIN, SAMEORIGIN

Request headers

Referer
https://rusvpn.com/en/blog/a-novel-malware-can-steal-passwords-from-vpn-software-and-web-browsers/?utm_source=twitter&utm_medium=231120&utm_campaign=post
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 24 Nov 2020 14:30:58 GMT
content-encoding
gzip
vary
Accept-Encoding
age
83860
x-cache
Hit from cloudfront
last-modified
Mon, 04 May 2020 23:37:33 GMT
server
nginx
x-frame-options
SAMEORIGIN, SAMEORIGIN
etag
W/"5eb0a73d-62d"
strict-transport-security
max-age=31536000
content-type
text/css
via
1.1 91528fdf97ef415d04fa66a0fbb562d7.cloudfront.net (CloudFront)
cache-control
max-age=315360000
x-amz-cf-pop
DUS51-C1
x-amz-cf-id
0Mmj-XKg6GJ4YlG2LctQrqDYTmutZ4-6O5p87s2EdYLWDcL9qHi8ig==
expires
Thu, 31 Dec 2037 23:55:55 GMT
maxichartsreports.css
rusvpn.com/xx/blog/assets/plugins/maxicharts/css/ 		702 B
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://rusvpn.com/xx/blog/assets/plugins/maxicharts/css/maxichartsreports.css?ver=5.4.4
Requested by
Host: rusvpn.com
URL: https://rusvpn.com/en/blog/a-novel-malware-can-steal-passwords-from-vpn-software-and-web-browsers/?utm_source=twitter&utm_medium=231120&utm_campaign=post
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2182:8c00:7:7266:1d00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
0afd56f357ed0768a1382fd38f96d9b905b36e9376e7a44f67ed015d9c1af5c5
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Frame-Options SAMEORIGIN, SAMEORIGIN

Request headers

Referer
https://rusvpn.com/en/blog/a-novel-malware-can-steal-passwords-from-vpn-software-and-web-browsers/?utm_source=twitter&utm_medium=231120&utm_campaign=post
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 24 Nov 2020 14:30:58 GMT
via
1.1 91528fdf97ef415d04fa66a0fbb562d7.cloudfront.net (CloudFront)
age
83860
x-cache
Hit from cloudfront
content-length
702
last-modified
Mon, 04 May 2020 23:37:33 GMT
server
nginx
x-frame-options
SAMEORIGIN, SAMEORIGIN
etag
"5eb0a73d-2be"
strict-transport-security
max-age=31536000
content-type
text/css
cache-control
max-age=315360000
x-amz-cf-pop
DUS51-C1
accept-ranges
bytes
x-amz-cf-id
s6efwn5WYfFw-qaHGJTxRZXb7srudRJ1mLLUwkTC6ed7_LrPhY8aUQ==
expires
Thu, 31 Dec 2037 23:55:55 GMT
cms-navigation-base.css
rusvpn.com/xx/blog/assets/plugins/wpml-cms-nav/res/css/ 		3 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://rusvpn.com/xx/blog/assets/plugins/wpml-cms-nav/res/css/cms-navigation-base.css?ver=1.5.2
Requested by
Host: rusvpn.com
URL: https://rusvpn.com/en/blog/a-novel-malware-can-steal-passwords-from-vpn-software-and-web-browsers/?utm_source=twitter&utm_medium=231120&utm_campaign=post
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2182:8c00:7:7266:1d00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
8577df598f439b9602bfec90eb2c2a654dbb3bd1922ad1d768d6ca3aef58c825
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Frame-Options SAMEORIGIN, SAMEORIGIN

Request headers

Referer
https://rusvpn.com/en/blog/a-novel-malware-can-steal-passwords-from-vpn-software-and-web-browsers/?utm_source=twitter&utm_medium=231120&utm_campaign=post
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 24 Nov 2020 14:30:58 GMT
content-encoding
gzip
vary
Accept-Encoding
age
83860
x-cache
Hit from cloudfront
last-modified
Thu, 25 Jul 2019 13:06:07 GMT
server
nginx
x-frame-options
SAMEORIGIN, SAMEORIGIN
etag
W/"5d39a93f-bbc"
strict-transport-security
max-age=31536000
content-type
text/css
via
1.1 91528fdf97ef415d04fa66a0fbb562d7.cloudfront.net (CloudFront)
cache-control
max-age=315360000
x-amz-cf-pop
DUS51-C1
x-amz-cf-id
f4o7Yu2WqdrgHAgZVNVrpKWeLneFUROkFHUfC9jpwtE58-BeWnyygg==
expires
Thu, 31 Dec 2037 23:55:55 GMT
cms-navigation.css
rusvpn.com/xx/blog/assets/plugins/wpml-cms-nav/res/css/ 		2 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://rusvpn.com/xx/blog/assets/plugins/wpml-cms-nav/res/css/cms-navigation.css?ver=1.5.2
Requested by
Host: rusvpn.com
URL: https://rusvpn.com/en/blog/a-novel-malware-can-steal-passwords-from-vpn-software-and-web-browsers/?utm_source=twitter&utm_medium=231120&utm_campaign=post
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2182:8c00:7:7266:1d00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
cf7391b5c06a56e0f70f64b89ed9d42fd6ccc2efed6ea005237c39dc451ed681
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Frame-Options SAMEORIGIN, SAMEORIGIN

Request headers

Referer
https://rusvpn.com/en/blog/a-novel-malware-can-steal-passwords-from-vpn-software-and-web-browsers/?utm_source=twitter&utm_medium=231120&utm_campaign=post
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 25 Nov 2020 13:18:24 GMT
content-encoding
gzip
vary
Accept-Encoding
age
1814
x-cache
Hit from cloudfront
last-modified
Thu, 25 Jul 2019 13:06:07 GMT
server
nginx
x-frame-options
SAMEORIGIN, SAMEORIGIN
etag
W/"5d39a93f-946"
strict-transport-security
max-age=31536000
content-type
text/css
via
1.1 91528fdf97ef415d04fa66a0fbb562d7.cloudfront.net (CloudFront)
cache-control
max-age=315360000
x-amz-cf-pop
DUS51-C1
x-amz-cf-id
CPLAuMQ0Znbdp8DSospMvhA_9bQHftpg_aNy04MOOxZ8TG96gD5fow==
expires
Thu, 31 Dec 2037 23:55:55 GMT
app.css
rusvpn.com/xx/blog/assets/themes/rusvpn/assets/ 		218 KB
41 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://rusvpn.com/xx/blog/assets/themes/rusvpn/assets/app.css?ver=3.0.0
Requested by
Host: rusvpn.com
URL: https://rusvpn.com/en/blog/a-novel-malware-can-steal-passwords-from-vpn-software-and-web-browsers/?utm_source=twitter&utm_medium=231120&utm_campaign=post
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2182:8c00:7:7266:1d00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
c2f4274f9ff92bc96d63a4142dd50a342e49c74bcb5d62c3cebaca10f9741486
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Frame-Options SAMEORIGIN, SAMEORIGIN

Request headers

Referer
https://rusvpn.com/en/blog/a-novel-malware-can-steal-passwords-from-vpn-software-and-web-browsers/?utm_source=twitter&utm_medium=231120&utm_campaign=post
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 24 Nov 2020 14:30:58 GMT
content-encoding
gzip
vary
Accept-Encoding
age
83860
x-cache
Hit from cloudfront
last-modified
Mon, 23 Nov 2020 12:25:53 GMT
server
nginx
x-frame-options
SAMEORIGIN, SAMEORIGIN
etag
W/"5fbbaa51-3674f"
strict-transport-security
max-age=31536000
content-type
text/css
via
1.1 91528fdf97ef415d04fa66a0fbb562d7.cloudfront.net (CloudFront)
cache-control
max-age=315360000
x-amz-cf-pop
DUS51-C1
x-amz-cf-id
C3Y1aXnUpLeaI_VILyw3T10CJDhUzjqwEpAJMiH6OKLHYnx6kxS5bQ==
expires
Thu, 31 Dec 2037 23:55:55 GMT
Chart.min.js
rusvpn.com/xx/blog/assets/plugins/maxicharts/libs/node_modules/chart.js/dist/ 		169 KB
52 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://rusvpn.com/xx/blog/assets/plugins/maxicharts/libs/node_modules/chart.js/dist/Chart.min.js?ver=5.4.4
Requested by
Host: rusvpn.com
URL: https://rusvpn.com/en/blog/a-novel-malware-can-steal-passwords-from-vpn-software-and-web-browsers/?utm_source=twitter&utm_medium=231120&utm_campaign=post
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2182:8c00:7:7266:1d00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
478a6a70e615f25b7bb27c4c40efc749b5421513cc76b84014c1febebf608982
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Frame-Options SAMEORIGIN, SAMEORIGIN

Request headers

Referer
https://rusvpn.com/en/blog/a-novel-malware-can-steal-passwords-from-vpn-software-and-web-browsers/?utm_source=twitter&utm_medium=231120&utm_campaign=post
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 24 Nov 2020 14:30:58 GMT
content-encoding
gzip
vary
Accept-Encoding
age
83860
x-cache
Hit from cloudfront
last-modified
Mon, 04 May 2020 23:37:32 GMT
server
nginx
x-frame-options
SAMEORIGIN, SAMEORIGIN
etag
W/"5eb0a73c-2a30c"
strict-transport-security
max-age=31536000
content-type
application/javascript
via
1.1 91528fdf97ef415d04fa66a0fbb562d7.cloudfront.net (CloudFront)
cache-control
max-age=315360000
x-amz-cf-pop
DUS51-C1
x-amz-cf-id
8wpYlq2sV1t4FGS-DQHhM-iPtEpT5XLgm1vcYy1iej6RzHhgaIVJAQ==
expires
Thu, 31 Dec 2037 23:55:55 GMT
jquery.js
rusvpn.com/wp-includes/js/jquery/ 		95 KB
33 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://rusvpn.com/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp
Requested by
Host: rusvpn.com
URL: https://rusvpn.com/en/blog/a-novel-malware-can-steal-passwords-from-vpn-software-and-web-browsers/?utm_source=twitter&utm_medium=231120&utm_campaign=post
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2182:8c00:7:7266:1d00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
1db21d816296e6939ba1f42962496e4134ae2b0081e26970864c40c6d02bb1df
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Frame-Options SAMEORIGIN, SAMEORIGIN

Request headers

Referer
https://rusvpn.com/en/blog/a-novel-malware-can-steal-passwords-from-vpn-software-and-web-browsers/?utm_source=twitter&utm_medium=231120&utm_campaign=post
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 24 Nov 2020 14:30:58 GMT
content-encoding
gzip
vary
Accept-Encoding
age
83860
x-cache
Hit from cloudfront
last-modified
Wed, 22 May 2019 05:08:51 GMT
server
nginx
x-frame-options
SAMEORIGIN, SAMEORIGIN
etag
W/"5ce4d963-17a69"
strict-transport-security
max-age=31536000
content-type
application/javascript
via
1.1 91528fdf97ef415d04fa66a0fbb562d7.cloudfront.net (CloudFront)
cache-control
max-age=315360000
x-amz-cf-pop
DUS51-C1
x-amz-cf-id
FPIc7Lb6pmaLCXzhGk2aIyXGqXLL2LejP0L5Ji9Isz400t38jmTHIw==
expires
Thu, 31 Dec 2037 23:55:55 GMT
jquery-migrate.min.js
rusvpn.com/wp-includes/js/jquery/ 		10 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://rusvpn.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=1.4.1
Requested by
Host: rusvpn.com
URL: https://rusvpn.com/en/blog/a-novel-malware-can-steal-passwords-from-vpn-software-and-web-browsers/?utm_source=twitter&utm_medium=231120&utm_campaign=post
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2182:8c00:7:7266:1d00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
48eb8b500ae6a38617b5738d2b3faec481922a7782246e31d2755c034a45cd5d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Frame-Options SAMEORIGIN, SAMEORIGIN

Request headers

Referer
https://rusvpn.com/en/blog/a-novel-malware-can-steal-passwords-from-vpn-software-and-web-browsers/?utm_source=twitter&utm_medium=231120&utm_campaign=post
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 24 Nov 2020 14:30:58 GMT
content-encoding
gzip
vary
Accept-Encoding
age
83860
x-cache
Hit from cloudfront
last-modified
Fri, 20 May 2016 06:11:28 GMT
server
nginx
x-frame-options
SAMEORIGIN, SAMEORIGIN
etag
W/"573eaa90-2748"
strict-transport-security
max-age=31536000
content-type
application/javascript
via
1.1 91528fdf97ef415d04fa66a0fbb562d7.cloudfront.net (CloudFront)
cache-control
max-age=315360000
x-amz-cf-pop
DUS51-C1
x-amz-cf-id
9ywION3JrDg3juFPgaIjr7Pk6K06s9I_eIg2J0bh7rl5SiiLKFvk0A==
expires
Thu, 31 Dec 2037 23:55:55 GMT
functions.js
rusvpn.com/xx/blog/assets/plugins/maxicharts/js/ 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://rusvpn.com/xx/blog/assets/plugins/maxicharts/js/functions.js?ver=5.4.4
Requested by
Host: rusvpn.com
URL: https://rusvpn.com/en/blog/a-novel-malware-can-steal-passwords-from-vpn-software-and-web-browsers/?utm_source=twitter&utm_medium=231120&utm_campaign=post
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2182:8c00:7:7266:1d00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
e0f02b3c4b0c1b5f8ae68344278199dd71c2d9e94bad0f163b77dae8ad353c6e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Frame-Options SAMEORIGIN, SAMEORIGIN

Request headers

Referer
https://rusvpn.com/en/blog/a-novel-malware-can-steal-passwords-from-vpn-software-and-web-browsers/?utm_source=twitter&utm_medium=231120&utm_campaign=post
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 24 Nov 2020 14:30:58 GMT
content-encoding
gzip
vary
Accept-Encoding
age
83860
x-cache
Hit from cloudfront
last-modified
Mon, 04 May 2020 23:37:33 GMT
server
nginx
x-frame-options
SAMEORIGIN, SAMEORIGIN
etag
W/"5eb0a73d-a50"
strict-transport-security
max-age=31536000
content-type
application/javascript
via
1.1 91528fdf97ef415d04fa66a0fbb562d7.cloudfront.net (CloudFront)
cache-control
max-age=315360000
x-amz-cf-pop
DUS51-C1
x-amz-cf-id
MyLuDr3vC6kMQqSq61Dh1mFzz5PQ3F00cn12LzfsxyF8G-OtbVIqYg==
expires
Thu, 31 Dec 2037 23:55:55 GMT
gtm.js
www.googletagmanager.com/ 		97 KB
35 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-PZFRSTJ
Requested by
Host: rusvpn.com
URL: https://rusvpn.com/en/blog/a-novel-malware-can-steal-passwords-from-vpn-software-and-web-browsers/?utm_source=twitter&utm_medium=231120&utm_campaign=post
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
46d0d6cb4abb3baba2ae082ee2260e83cb38082d16e4b8a4c718e1ea2bc2e467
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Referer
https://rusvpn.com/en/blog/a-novel-malware-can-steal-passwords-from-vpn-software-and-web-browsers/?utm_source=twitter&utm_medium=231120&utm_campaign=post
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 25 Nov 2020 13:48:38 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
35975
x-xss-protection
0
last-modified
Wed, 25 Nov 2020 12:00:00 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Wed, 25 Nov 2020 13:48:38 GMT
wp-emoji-release.min.js
rusvpn.com/wp-includes/js/ 		14 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://rusvpn.com/wp-includes/js/wp-emoji-release.min.js?ver=5.4.4
Requested by
Host: rusvpn.com
URL: https://rusvpn.com/en/blog/a-novel-malware-can-steal-passwords-from-vpn-software-and-web-browsers/?utm_source=twitter&utm_medium=231120&utm_campaign=post
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2182:8c00:7:7266:1d00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
96d33f532112177ede6bf262dcf6d0140dbe29f05a4595d17b0be4743205b5ea
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Frame-Options SAMEORIGIN, SAMEORIGIN

Request headers

Referer
https://rusvpn.com/en/blog/a-novel-malware-can-steal-passwords-from-vpn-software-and-web-browsers/?utm_source=twitter&utm_medium=231120&utm_campaign=post
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 24 Nov 2020 14:30:58 GMT
content-encoding
gzip
vary
Accept-Encoding
age
83860
x-cache
Hit from cloudfront
last-modified
Mon, 04 May 2020 23:33:51 GMT
server
nginx
x-frame-options
SAMEORIGIN, SAMEORIGIN
etag
W/"5eb0a65f-364d"
strict-transport-security
max-age=31536000
content-type
application/javascript
via
1.1 91528fdf97ef415d04fa66a0fbb562d7.cloudfront.net (CloudFront)
cache-control
max-age=315360000
x-amz-cf-pop
DUS51-C1
x-amz-cf-id
swvI_WtR7hR09Q6gJvvQeLQwbNvvAuA8GZBHYOxIw0dg5IVTyoOgKw==
expires
Thu, 31 Dec 2037 23:55:55 GMT
rvpn-en-20200813_141741_078403.jpg
rusvpn.com/xx/blog/assets/uploads/2020/08/ 		84 KB
84 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rusvpn.com/xx/blog/assets/uploads/2020/08/rvpn-en-20200813_141741_078403.jpg
Requested by
Host: rusvpn.com
URL: https://rusvpn.com/en/blog/a-novel-malware-can-steal-passwords-from-vpn-software-and-web-browsers/?utm_source=twitter&utm_medium=231120&utm_campaign=post
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2182:8c00:7:7266:1d00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
6f4e9f09fd90ee642f7dfe08ce4567ba8dcb42956161bf5fb229c3fd44fba668
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Frame-Options SAMEORIGIN, SAMEORIGIN

Request headers

Referer
https://rusvpn.com/en/blog/a-novel-malware-can-steal-passwords-from-vpn-software-and-web-browsers/?utm_source=twitter&utm_medium=231120&utm_campaign=post
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 24 Nov 2020 14:30:58 GMT
via
1.1 91528fdf97ef415d04fa66a0fbb562d7.cloudfront.net (CloudFront)
age
83860
x-cache
Hit from cloudfront
content-length
85557
last-modified
Thu, 13 Aug 2020 14:17:40 GMT
server
nginx
x-frame-options
SAMEORIGIN, SAMEORIGIN
etag
"5f354b84-14e35"
strict-transport-security
max-age=31536000
content-type
image/jpeg
cache-control
max-age=315360000
x-amz-cf-pop
DUS51-C1
accept-ranges
bytes
x-amz-cf-id
31yHqaV70hxA5eBVQRzlR5AZ34dQdGBjlmPFo7EflSvMChyMsZ_BWg==
expires
Thu, 31 Dec 2037 23:55:55 GMT
dc05b686274207b4f654208c37369c68
secure.gravatar.com/avatar/ 		4 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://secure.gravatar.com/avatar/dc05b686274207b4f654208c37369c68?s=96&d=blank&r=g
Requested by
Host: rusvpn.com
URL: https://rusvpn.com/en/blog/a-novel-malware-can-steal-passwords-from-vpn-software-and-web-browsers/?utm_source=twitter&utm_medium=231120&utm_campaign=post
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
af669c76033604606fcf9ea111fc2cb62d0a89203628548759692b6c7c8b05ef

Request headers

Referer
https://rusvpn.com/en/blog/a-novel-malware-can-steal-passwords-from-vpn-software-and-web-browsers/?utm_source=twitter&utm_medium=231120&utm_campaign=post
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc
HIT ams 4
date
Wed, 25 Nov 2020 13:48:38 GMT
last-modified
Fri, 08 Mar 2019 12:01:00 GMT
server
nginx
content-type
image/jpeg
access-control-allow-origin
*
cache-control
max-age=300
content-disposition
inline; filename="dc05b686274207b4f654208c37369c68.jpeg"
accept-ranges
bytes
link
<https://www.gravatar.com/avatar/dc05b686274207b4f654208c37369c68?s=96&d=blank&r=g>; rel="canonical"
content-length
3680
expires
Wed, 25 Nov 2020 13:53:38 GMT
css2
fonts.googleapis.com/ 		9 KB
838 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css2?family=Montserrat:ital,wght@0,300;0,400;0,500;0,700;1,400&display=swap
Requested by
Host: rusvpn.com
URL: https://rusvpn.com/xx/blog/assets/themes/rusvpn/assets/app.css?ver=3.0.0
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
25da8e4c2b3ef63337daae0fa81f9be4cb52f0d198a92c0890aa8da5c7fadb62
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://rusvpn.com/xx/blog/assets/themes/rusvpn/assets/app.css?ver=3.0.0
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Wed, 25 Nov 2020 13:48:38 GMT
server
ESF
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
date
Wed, 25 Nov 2020 13:48:38 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
expires
Wed, 25 Nov 2020 13:48:38 GMT
css2
fonts.googleapis.com/ 		11 KB
878 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css2?family=Roboto:ital,wght@0,300;0,400;0,500;0,700;1,400&display=swap
Requested by
Host: rusvpn.com
URL: https://rusvpn.com/xx/blog/assets/themes/rusvpn/assets/app.css?ver=3.0.0
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
fbb79fa0a8727412c92c23985bca04897d934c0e4227c1c288006246e9542a52
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://rusvpn.com/xx/blog/assets/themes/rusvpn/assets/app.css?ver=3.0.0
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Wed, 25 Nov 2020 13:48:38 GMT
server
ESF
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
date
Wed, 25 Nov 2020 13:48:38 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
expires
Wed, 25 Nov 2020 13:48:38 GMT
all.min.css
cdnjs.cloudflare.com/ajax/libs/font-awesome/5.14.0/css/ 		58 KB
11 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.14.0/css/all.min.css
Requested by
Host: rusvpn.com
URL: https://rusvpn.com/xx/blog/assets/themes/rusvpn/assets/app.css?ver=3.0.0
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:135e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
14cbd9b866a9b092e3a2e03a93b128da5baca005fd8b44a1956146eaab7b48b7
Security Headers
Name Value
Strict-Transport-Security max-age=15780000

Request headers

Referer
https://rusvpn.com/xx/blog/assets/themes/rusvpn/assets/app.css?ver=3.0.0
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 25 Nov 2020 13:48:38 GMT
content-encoding
br
vary
Accept-Encoding
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
442229
x-via
cfworker/kv
cross-origin-resource-policy
cross-origin
content-length
10391
cf-request-id
06a142df3700002c1916b21000000001
timing-allow-origin
*
last-modified
Wed, 15 Jul 2020 18:15:47 GMT
server
cloudflare
etag
"5f0f47d3-e637"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15780000
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=r1l9qRSMOVeXUO5ejV%2BLiQrG4UELZ4G3cfH9GBG30QbWaFOETZXCpyFLZqgrcq1klUabNht6dG%2B%2FH%2FAj%2B8KmbyIGtzAKvZWTSuDF0J9QcIa%2FcazDM4qDuS48k2yVsF%2Fvpg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=30672000
accept-ranges
bytes
cf-ray
5f7bd411eccf2c19-FRA
expires
Mon, 15 Nov 2021 13:48:38 GMT
app.js
rusvpn.com/xx/blog/assets/themes/rusvpn/assets/ 		764 KB
177 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://rusvpn.com/xx/blog/assets/themes/rusvpn/assets/app.js?ver=3.0.0
Requested by
Host: rusvpn.com
URL: https://rusvpn.com/en/blog/a-novel-malware-can-steal-passwords-from-vpn-software-and-web-browsers/?utm_source=twitter&utm_medium=231120&utm_campaign=post
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2182:8c00:7:7266:1d00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
801d64f198efb6370535806ba5e5700f464801fadeda2f4a4f34d067a24e50fd
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Frame-Options SAMEORIGIN, SAMEORIGIN

Request headers

Referer
https://rusvpn.com/en/blog/a-novel-malware-can-steal-passwords-from-vpn-software-and-web-browsers/?utm_source=twitter&utm_medium=231120&utm_campaign=post
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 24 Nov 2020 14:30:58 GMT
content-encoding
gzip
vary
Accept-Encoding
age
83860
x-cache
Hit from cloudfront
last-modified
Mon, 23 Nov 2020 12:25:53 GMT
server
nginx
x-frame-options
SAMEORIGIN, SAMEORIGIN
etag
W/"5fbbaa51-bf0ba"
strict-transport-security
max-age=31536000
content-type
application/javascript
via
1.1 91528fdf97ef415d04fa66a0fbb562d7.cloudfront.net (CloudFront)
cache-control
max-age=315360000
x-amz-cf-pop
DUS51-C1
x-amz-cf-id
1l-yRpww3-a-ouPbOTjEg4oDkCp8BG1sezv6Y-IXrFlhc4LsVtretg==
expires
Thu, 31 Dec 2037 23:55:55 GMT
wp-embed.min.js
rusvpn.com/wp-includes/js/ 		1 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://rusvpn.com/wp-includes/js/wp-embed.min.js?ver=5.4.4
Requested by
Host: rusvpn.com
URL: https://rusvpn.com/en/blog/a-novel-malware-can-steal-passwords-from-vpn-software-and-web-browsers/?utm_source=twitter&utm_medium=231120&utm_campaign=post
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2182:8c00:7:7266:1d00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
6ebcda7a3a41ef97f0b4071160ceb1020e540fdc0f790079a5c2ef01ab654fe0
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Frame-Options SAMEORIGIN, SAMEORIGIN

Request headers

Referer
https://rusvpn.com/en/blog/a-novel-malware-can-steal-passwords-from-vpn-software-and-web-browsers/?utm_source=twitter&utm_medium=231120&utm_campaign=post
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 24 Nov 2020 14:30:58 GMT
content-encoding
gzip
vary
Accept-Encoding
age
83860
x-cache
Hit from cloudfront
last-modified
Mon, 04 May 2020 23:33:51 GMT
server
nginx
x-frame-options
SAMEORIGIN, SAMEORIGIN
etag
W/"5eb0a65f-59a"
strict-transport-security
max-age=31536000
content-type
application/javascript
via
1.1 91528fdf97ef415d04fa66a0fbb562d7.cloudfront.net (CloudFront)
cache-control
max-age=315360000
x-amz-cf-pop
DUS51-C1
x-amz-cf-id
C0v2Nx343zw_FcMs8KHn-scKD4kFUbqRNthb9uLVLz7L7o_PQmx-aw==
expires
Thu, 31 Dec 2037 23:55:55 GMT
forms.min.js
rusvpn.com/xx/blog/assets/plugins/mailchimp-for-wp/assets/js/ 		7 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://rusvpn.com/xx/blog/assets/plugins/mailchimp-for-wp/assets/js/forms.min.js?ver=4.7.7
Requested by
Host: rusvpn.com
URL: https://rusvpn.com/en/blog/a-novel-malware-can-steal-passwords-from-vpn-software-and-web-browsers/?utm_source=twitter&utm_medium=231120&utm_campaign=post
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2182:8c00:7:7266:1d00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
7e5c9c32f1019138c22b8dd1de14203e8f0f67d4ef8bf4fc5e501d65b98eaa0c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Frame-Options SAMEORIGIN, SAMEORIGIN

Request headers

Referer
https://rusvpn.com/en/blog/a-novel-malware-can-steal-passwords-from-vpn-software-and-web-browsers/?utm_source=twitter&utm_medium=231120&utm_campaign=post
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 24 Nov 2020 14:30:58 GMT
content-encoding
gzip
vary
Accept-Encoding
age
83860
x-cache
Hit from cloudfront
last-modified
Mon, 04 May 2020 23:37:37 GMT
server
nginx
x-frame-options
SAMEORIGIN, SAMEORIGIN
etag
W/"5eb0a741-1aa4"
strict-transport-security
max-age=31536000
content-type
application/javascript
via
1.1 91528fdf97ef415d04fa66a0fbb562d7.cloudfront.net (CloudFront)
cache-control
max-age=315360000
x-amz-cf-pop
DUS51-C1
x-amz-cf-id
4zhJtC-nR2EsRZ96tOEyV76Qk0ZNU3OqLAt0HQKoHnDl3OysYTzE4g==
expires
Thu, 31 Dec 2037 23:55:55 GMT
truncated
/ 		519 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
d5185440094ad1be3edf10ee211029028189b0416cead567858ed24743efe83e

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ 		16 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
ffe228371ddb91aba2db32a2b8f369449014598049624ec4d653886ff266b530

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		892 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
6f275a86581101d2104e7ab2a7e92414da2deb07853b681594426938fde01d8a

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		6 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
9a46272f6a64e6a1c6ff7dc7b98fd542c800b6db1c8c9cf10e72432dc8e0d94f

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		883 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
8be7306b94d95be91cf5089abe4e45b281e9b8495705dc3608ee6c1381125a98

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		892 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
415f8ef74d006599fb31809d584540238a1e76a49a866d38da1d47cb11a83215

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		991 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b0776f5f89402fcc2c1278a22d9a5d7d070b9b5f97196e09ef72a4d4cfab781d

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		2 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
fef1f411548ec8851bb9ab57d1ed97cf115ff2a27beee7996e3a7bdea3b05a1a

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		949 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
ecdda4f33d902731466f3ec355b3bd08d787cf1b7bb7b3e8f96e81bc7cc55481

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		883 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
46741f22cb1e25d0b01ef060cf35fc91ab4200840cf2b0b5fa36710121ffdb6c

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		892 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
ca5de7dc868cf71b7585be278d8525f023ca44591e59ffd312ff9fce9c5b3226

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		1 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
139c4145e653277c4e284aa252b115466f4fbb1ba6af2bbb5a69197f714cfdc7

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		782 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
073cf237fe86763936aafc59c56b031eb64b753ab59e7f2c2f4837bf97e41189

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		3 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
5d3065477603214e8534c57bb9b59536e55e561a619ec8518b31e7312b3c2439

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		949 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
76292cc4442fc4ce909c0fe6d41ee71c1eb81ce606e05419c681c86a8bb53d04

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		949 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
1c08ba136c6bb358c79b891042f41db03a10505770715301c7c6f6b35b45bb90

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		797 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
f7424eba59459f69b53c80ef1a46d3a7cc057f4ee55a91365ae43ff65c838d41

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		6 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
d28ac0a2cff115be2df6325bfaca1c71317be619e04150d6453d6de94f9de275

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		962 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
186443093dfe707143dc83f41782c1b9caabf33c05852d6992f4afeb15599112

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		14 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
4e890c2a8ae039e170979b656489fdc5b7a2c6b349263b6d6a174c16045380c6

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		873 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
e1412951ead689b4f051f8095a2a5b1c34df944e843048b781f8b2cb2ce85ca9

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
image/svg+xml
JTURjIg1_i6t8kCHKm45_ZpC3gnD_vx3rCs.woff2
fonts.gstatic.com/s/montserrat/v15/ 		13 KB
13 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/montserrat/v15/JTURjIg1_i6t8kCHKm45_ZpC3gnD_vx3rCs.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Montserrat:ital,wght@0,300;0,400;0,500;0,700;1,400&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:814::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
cedb226bd7759d04b58baa1a609e1aeecc1aa5c6c3280c4db153019f426f3de0
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://rusvpn.com
Referer
https://fonts.googleapis.com/css2?family=Montserrat:ital,wght@0,300;0,400;0,500;0,700;1,400&display=swap
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sun, 22 Nov 2020 08:33:44 GMT
x-content-type-options
nosniff
last-modified
Tue, 15 Sep 2020 18:11:07 GMT
server
sffe
age
278094
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
13640
x-xss-protection
0
expires
Mon, 22 Nov 2021 08:33:44 GMT
KFOlCnqEu92Fr1MmEU9fBBc4AMP6lQ.woff2
fonts.gstatic.com/s/roboto/v20/ 		11 KB
11 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmEU9fBBc4AMP6lQ.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Roboto:ital,wght@0,300;0,400;0,500;0,700;1,400&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:814::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
ce897833ac6e362df7c91ac8223fe511c6defcf33964928a81004600a2dd4c2e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://rusvpn.com
Referer
https://fonts.googleapis.com/css2?family=Roboto:ital,wght@0,300;0,400;0,500;0,700;1,400&display=swap
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 24 Nov 2020 11:20:36 GMT
x-content-type-options
nosniff
last-modified
Wed, 24 Jul 2019 01:18:48 GMT
server
sffe
age
95282
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
11056
x-xss-protection
0
expires
Wed, 24 Nov 2021 11:20:36 GMT
JTURjIg1_i6t8kCHKm45_dJE3gnD_vx3rCs.woff2
fonts.gstatic.com/s/montserrat/v15/ 		13 KB
13 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/montserrat/v15/JTURjIg1_i6t8kCHKm45_dJE3gnD_vx3rCs.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Montserrat:ital,wght@0,300;0,400;0,500;0,700;1,400&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:814::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
4c6cf0709b8e52572cae1fb57128acd0a5a453c9ce99dc3712a1860ff90c6bf8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://rusvpn.com
Referer
https://fonts.googleapis.com/css2?family=Montserrat:ital,wght@0,300;0,400;0,500;0,700;1,400&display=swap
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 24 Nov 2020 11:20:37 GMT
x-content-type-options
nosniff
last-modified
Tue, 15 Sep 2020 18:11:15 GMT
server
sffe
age
95281
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
13612
x-xss-protection
0
expires
Wed, 24 Nov 2021 11:20:37 GMT
JTUSjIg1_i6t8kCHKm459WlhyyTh89Y.woff2
fonts.gstatic.com/s/montserrat/v15/ 		13 KB
13 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/montserrat/v15/JTUSjIg1_i6t8kCHKm459WlhyyTh89Y.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Montserrat:ital,wght@0,300;0,400;0,500;0,700;1,400&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:814::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
0ce5a460ace775560c3344a43245687bdbec5cb8ee20d209ab9fa67f4e09a3e8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://rusvpn.com
Referer
https://fonts.googleapis.com/css2?family=Montserrat:ital,wght@0,300;0,400;0,500;0,700;1,400&display=swap
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 24 Nov 2020 11:20:46 GMT
x-content-type-options
nosniff
last-modified
Tue, 15 Sep 2020 18:12:14 GMT
server
sffe
age
95272
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
13708
x-xss-protection
0
expires
Wed, 24 Nov 2021 11:20:46 GMT
fa-solid-900.woff2
cdnjs.cloudflare.com/ajax/libs/font-awesome/5.14.0/webfonts/ 		78 KB
79 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.14.0/webfonts/fa-solid-900.woff2
Requested by
Host: cdnjs.cloudflare.com
URL: https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.14.0/css/all.min.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:125e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9c214017962f2b403ee2f8a0dd51333b467aa3f082c5fc93fdb86f0b3d90a19b
Security Headers
Name Value
Strict-Transport-Security max-age=15780000

Request headers

Origin
https://rusvpn.com
Referer
https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.14.0/css/all.min.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 25 Nov 2020 13:48:38 GMT
vary
Accept-Encoding
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
442228
x-via
cfworker/kv
cross-origin-resource-policy
cross-origin
content-length
80148
cf-request-id
06a142df97000005bb09b14000000001
timing-allow-origin
*
last-modified
Wed, 15 Jul 2020 18:15:47 GMT
server
cloudflare
etag
"5f0f47d3-13914"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15780000
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=5dOixRN1qSIMJPSkpYBuau5GTWBS5zCgUFcazdTM24bVxxu57SzxMeTi%2BoYjQuVIpskcqTh8lHdBVyGGexPSAXvx3rMAGFNCjOIHKVCffzsgdoqoAcOETNr4yZTR0IQNzw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/octet-stream; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=30672000
accept-ranges
bytes
cf-ray
5f7bd4128fba05bb-FRA
expires
Mon, 15 Nov 2021 13:48:38 GMT
JTURjIg1_i6t8kCHKm45_cJD3gnD_vx3rCs.woff2
fonts.gstatic.com/s/montserrat/v15/ 		13 KB
13 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/montserrat/v15/JTURjIg1_i6t8kCHKm45_cJD3gnD_vx3rCs.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Montserrat:ital,wght@0,300;0,400;0,500;0,700;1,400&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:814::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
03b52a1594b643f27fdfc0ad86291bf36368dde44df9f07e1206b6fd3563bcab
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://rusvpn.com
Referer
https://fonts.googleapis.com/css2?family=Montserrat:ital,wght@0,300;0,400;0,500;0,700;1,400&display=swap
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 24 Nov 2020 11:20:38 GMT
x-content-type-options
nosniff
last-modified
Tue, 15 Sep 2020 18:10:43 GMT
server
sffe
age
95280
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
13560
x-xss-protection
0
expires
Wed, 24 Nov 2021 11:20:38 GMT
fa-brands-400.woff2
cdnjs.cloudflare.com/ajax/libs/font-awesome/5.14.0/webfonts/ 		76 KB
76 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.14.0/webfonts/fa-brands-400.woff2
Requested by
Host: cdnjs.cloudflare.com
URL: https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.14.0/css/all.min.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:125e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
779249965fcc56df5ccc2c89293a582fbea63f785bc4041c878106b01b725dcb
Security Headers
Name Value
Strict-Transport-Security max-age=15780000

Request headers

Origin
https://rusvpn.com
Referer
https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.14.0/css/all.min.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 25 Nov 2020 13:48:38 GMT
vary
Accept-Encoding
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
442224
x-via
cfworker/kv
cross-origin-resource-policy
cross-origin
content-length
77400
cf-request-id
06a142df97000005bbf2999000000001
timing-allow-origin
*
last-modified
Wed, 15 Jul 2020 18:15:47 GMT
server
cloudflare
etag
"5f0f47d3-12e58"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15780000
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=J0Aw38vhI1EnH3usfYlBISrJuYSAbVchPbu%2BXJ%2FalomCe%2FWvyaW2y3scUezNAwkumDfLDj99OuBiXDacmfhBPIpcVDdIePGnp9E7CF7NgGTYULw87qAbg3YrX9oockz6IA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/octet-stream; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=30672000
accept-ranges
bytes
cf-ray
5f7bd4128fbc05bb-FRA
expires
Mon, 15 Nov 2021 13:48:38 GMT
truncated
/ 		223 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
09d31e6a86c9f2133ae80875edd8bf6ee4325d6ef2e224150ffb267774a34945

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ 		4 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
6b126f8367ccf28c409834b3a276a3dda26c42662a478386ff6ab756b7fa0d84

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ 		3 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
de2c35858d3e3660ebf288e81f2560fab68272980b25e6cb42c0a10bb0bdaa4f

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ 		2 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
1ad396270a5b70f825b54ee8035ce7e6c69ff09fdd919b4b6c18db608d6476d7

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ 		560 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
7a2690c6fceb310048d4c2097f7a19dcb5e3b014b2d0338ffcefce00bf4a7453

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ 		853 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
7720618af9a13eb14ad09da7d7e2060ad662204864485fecce5452046451cb1d

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ 		6 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
c2245d1e35cfb4dcf6e26b9afb4eef2b09cb27d368402a1d5eba5356bf3f4054

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		4 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
e7b44c86b050fca766a96ddac2d0932af0126da6f2305280342d909168dcce6b

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
image/gif
truncated
/ 		1 KB
1 KB 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
26726bac4060abb1226e6ceebc1336e84930fe7a7af1b3895a109d067f5b5dcc

Request headers

Origin
https://rusvpn.com
Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
font/woff
json
ip.rvpn.ws/ 		253 B
485 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://ip.rvpn.ws/json
Requested by
Host:
URL: webpack:///./node_modules/jquery/dist/jquery.js?
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
45.157.141.55 -, , ASN52000 (MIRHOSTING, RU),
Reverse DNS
sdc2-cloud.nl.hypermetrica.com
Software
nginx /
Resource Hash
17fa35b4d6345ce89ebed111ece9c2c995b47f59b177616baf338bb2260ae0c9

Request headers

Accept
*/*
Referer
https://rusvpn.com/en/blog/a-novel-malware-can-steal-passwords-from-vpn-software-and-web-browsers/?utm_source=twitter&utm_medium=231120&utm_campaign=post
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 25 Nov 2020 13:48:38 GMT
last-modified
Wednesday, 25-Nov-2020 13:48:38 GMT
server
nginx
access-control-allow-methods
GET, HEAD, POST, OPTIONS
content-type
application/json
access-control-allow-origin
*
cache-control
no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
content-length
253
analytics.js
www.google-analytics.com/ 		46 KB
18 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PZFRSTJ
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e441c3e2771625ba05630ab464275136a82c99650ee2145ca5aa9853bedeb01b
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://rusvpn.com/en/blog/a-novel-malware-can-steal-passwords-from-vpn-software-and-web-browsers/?utm_source=twitter&utm_medium=231120&utm_campaign=post
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Fri, 23 Oct 2020 03:00:57 GMT
server
Golfe2
age
7154
date
Wed, 25 Nov 2020 11:49:24 GMT
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
18817
expires
Wed, 25 Nov 2020 13:49:24 GMT
conversion_async.js
www.googleadservices.com/pagead/ 		30 KB
12 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googleadservices.com/pagead/conversion_async.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PZFRSTJ
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
216.58.207.66 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s25-in-f2.1e100.net
Software
cafe /
Resource Hash
30b509528a09195b7a7080345419048fd35269803cdfeab438a98c2176a1d9d0
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://rusvpn.com/en/blog/a-novel-malware-can-steal-passwords-from-vpn-software-and-web-browsers/?utm_source=twitter&utm_medium=231120&utm_campaign=post
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 25 Nov 2020 13:48:38 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
11761
x-xss-protection
0
server
cafe
etag
8854462785499610041
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600
timing-allow-origin
*
expires
Wed, 25 Nov 2020 13:48:38 GMT
tag.js
mc.yandex.ru/metrika/ 		368 KB
94 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://mc.yandex.ru/metrika/tag.js
Requested by
Host: t.co
URL: https://t.co/slD9sGIKhp
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6b8::1:119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
/
Resource Hash
97863c262254c3df6ff2e518ad72050dbf63ad92fb0e498914a8c5424aeef893
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Referer
https://rusvpn.com/en/blog/a-novel-malware-can-steal-passwords-from-vpn-software-and-web-browsers/?utm_source=twitter&utm_medium=231120&utm_campaign=post
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 25 Nov 2020 13:48:38 GMT
content-encoding
br
last-modified
Tue, 24 Nov 2020 15:14:36 GMT
etag
"5f993b61-17714"
strict-transport-security
max-age=31536000
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=3600
content-length
96020
expires
Wed, 25 Nov 2020 14:48:38 GMT
piwik.js
track.rusvpn.com/ 		65 KB
22 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://track.rusvpn.com/piwik.js
Requested by
Host: t.co
URL: https://t.co/slD9sGIKhp
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
136.243.102.102 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.102.102.243.136.clients.your-server.de
Software
nginx /
Resource Hash
40d0e772a84d0b4f851d4db2473e28cd4e8485722f85b56ee3415a5718a5985a

Request headers

Referer
https://rusvpn.com/en/blog/a-novel-malware-can-steal-passwords-from-vpn-software-and-web-browsers/?utm_source=twitter&utm_medium=231120&utm_campaign=post
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 25 Nov 2020 13:48:38 GMT
Content-Encoding
gzip
Last-Modified
Thu, 28 Feb 2019 12:08:31 GMT
Server
nginx
ETag
W/"5c77cf3f-1045d"
Vary
Accept-Encoding
Content-Type
application/javascript; charset=utf-8
Access-Control-Allow-Origin
*
Cache-Control
max-age=31536000
Transfer-Encoding
chunked
Connection
keep-alive
tracking.js
cdn.livechatinc.com/ 		75 KB
24 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.livechatinc.com/tracking.js
Requested by
Host: t.co
URL: https://t.co/slD9sGIKhp
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
95.100.181.34 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
a95-100-181-34.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
3bcbf0aa0146c1858ba5ef3b2813cc11abe2e9eb1848e6e5a919079e05dad8a0

Request headers

Referer
https://rusvpn.com/en/blog/a-novel-malware-can-steal-passwords-from-vpn-software-and-web-browsers/?utm_source=twitter&utm_medium=231120&utm_campaign=post
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id
z5wycykb_jPs1qKBbD67yN8pKhbYn1VX
content-encoding
gzip
last-modified
Mon, 23 Nov 2020 11:19:33 GMT
server
AmazonS3
x-amz-cf-pop
FRA50-C1
etag
"16473cff33a6dc92da1684ffee34442e"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=28800
date
Wed, 25 Nov 2020 13:48:38 GMT
content-length
23702
x-amz-cf-id
3AJn9tR-HnY03ybpV9rO9vJjD38sS1OJoEsXSYT2-JNeWxj4dwgzFg==
expires
Wed, 25 Nov 2020 21:48:38 GMT
fbevents.js
connect.facebook.net/en_US/ 		89 KB
23 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://connect.facebook.net/en_US/fbevents.js
Requested by
Host: t.co
URL: https://t.co/slD9sGIKhp
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
0e49c2b4e86d3fda1dda93eb1210a47712f7b091181b4e7c6da2b3e6f8e86396
Security Headers
Name Value
Content-Security-Policy default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

Referer
https://rusvpn.com/en/blog/a-novel-malware-can-steal-passwords-from-vpn-software-and-web-browsers/?utm_source=twitter&utm_medium=231120&utm_campaign=post
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy
default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
content-encoding
gzip
x-content-type-options
nosniff
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length
23320
x-xss-protection
0
pragma
public
x-fb-debug
zod4lZCDkFWuw7cdpNmDldYQF51V9X1A1vVggU17M+mdMiYNtGlGmOFRJn2R66cj4qiruX6vu3JDIc+JSPVrqQ==
x-fb-trip-id
664085054
x-frame-options
DENY
date
Wed, 25 Nov 2020 13:48:38 GMT
strict-transport-security
max-age=31536000; preload; includeSubDomains
content-type
application/x-javascript; charset=utf-8
vary
Accept-Encoding
cache-control
public, max-age=1200
expires
Sat, 01 Jan 2000 00:00:00 GMT
PushexSDK.js
connected11.com/ 		267 KB
59 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://connected11.com/PushexSDK.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PZFRSTJ
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3031::6812:3681 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
acfbc5c8acd6adfedf87fbc61b313dc38e60d0595ad8ffa9b2bd29fec9c78d1a

Request headers

Referer
https://rusvpn.com/en/blog/a-novel-malware-can-steal-passwords-from-vpn-software-and-web-browsers/?utm_source=twitter&utm_medium=231120&utm_campaign=post
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 25 Nov 2020 13:48:38 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
1406684
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=YcOia8P3gD6eFlFrZ5o5yd7YFHUsH57Rxkri5%2BtfNUmoOooZQjFllM%2FLPPugCI6hBGx7KBltRLgzUn6x00cejLDyk1CW2ZeRXDeebcekArMsthaArP6olsto4Yo%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
max-age=8640000
cf-ray
5f7bd4149ee12b1a-FRA
cf-request-id
06a142e0dc00002b1acd975000000001
collect
www.google-analytics.com/j/ 		2 B
62 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j87&a=1254418162&t=pageview&_s=1&dl=https%3A%2F%2Frusvpn.com%2Fen%2Fblog%2Fa-novel-malware-can-steal-passwords-from-vpn-software-and-web-browsers%2F%3Futm_source%3Dtwitter%26utm_medium%3D231120%26utm_campaign%3Dpost&dr=https%3A%2F%2Ft.co%2FslD9sGIKhp&ul=en-us&de=UTF-8&dt=A%20novel%20malware%20can%20steal%20passwords%20from%20VPN%20software%20and%20web%20browsers%20%E2%96%B6%EF%B8%8F%20RusVPN&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAEABAAAAAC~&jid=265647433&gjid=2144978037&cid=1544674518.1606312118&tid=UA-122885695-2&_gid=1873416859.1606312118&_r=1&gtm=2wgb41PZFRSTJ&z=969443072
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:824::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://rusvpn.com/en/blog/a-novel-malware-can-steal-passwords-from-vpn-software-and-web-browsers/?utm_source=twitter&utm_medium=231120&utm_campaign=post
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Wed, 25 Nov 2020 13:48:38 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://rusvpn.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
www.google-analytics.com/ 		35 B
63 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google-analytics.com/collect?v=1&_v=j87&a=1254418162&t=pageview&_s=1&dl=https%3A%2F%2Frusvpn.com%2Fen%2Fblog%2Fa-novel-malware-can-steal-passwords-from-vpn-software-and-web-browsers%2F%3Futm_source%3Dtwitter%26utm_medium%3D231120%26utm_campaign%3Dpost&dr=https%3A%2F%2Ft.co%2FslD9sGIKhp&ul=en-us&de=UTF-8&dt=A%20novel%20malware%20can%20steal%20passwords%20from%20VPN%20software%20and%20web%20browsers%20%E2%96%B6%EF%B8%8F%20RusVPN&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEDAAEABAAAAAC~&jid=&gjid=&cid=1544674518.1606312118&tid=UA-122885695-2&_gid=1873416859.1606312118&gtm=2wgb41PZFRSTJ&z=500984275
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:824::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://rusvpn.com/en/blog/a-novel-malware-can-steal-passwords-from-vpn-software-and-web-browsers/?utm_source=twitter&utm_medium=231120&utm_campaign=post
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 25 Nov 2020 09:04:38 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
17040
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
1183258908479974
connect.facebook.net/signals/config/ 		239 KB
69 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://connect.facebook.net/signals/config/1183258908479974?v=2.9.29&r=stable
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
4a5bb9d5b75ea6e42f05194235b32b5a2bb8a069359c5919feeef693be9110e9
Security Headers
Name Value
Content-Security-Policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

Referer
https://rusvpn.com/en/blog/a-novel-malware-can-steal-passwords-from-vpn-software-and-web-browsers/?utm_source=twitter&utm_medium=231120&utm_campaign=post
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy
default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
content-encoding
gzip
x-content-type-options
nosniff
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
x-xss-protection
0
pragma
public
x-fb-debug
8oL7wMbEMbtxjXZMPT7xdXebOCrrcpjQcl2+59uf5iMbsQOORJPk/HdqwmRB4VQZZ4nVQfk6j1otH/dGgxL8DQ==
x-fb-trip-id
664085054
x-frame-options
DENY
date
Wed, 25 Nov 2020 13:48:38 GMT
strict-transport-security
max-age=31536000; preload; includeSubDomains
content-type
application/x-javascript; charset=utf-8
vary
Accept-Encoding
cache-control
public, max-age=1200
x-content-id
1840787934
expires
Sat, 01 Jan 2000 00:00:00 GMT
collect
stats.g.doubleclick.net/j/ 		4 B
84 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j87&tid=UA-122885695-2&cid=1544674518.1606312118&jid=265647433&gjid=2144978037&_gid=1873416859.1606312118&_u=YEBAAEAAAAAAAC~&z=1903004418
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400c:c0c::9b Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://rusvpn.com/en/blog/a-novel-malware-can-steal-passwords-from-vpn-software-and-web-browsers/?utm_source=twitter&utm_medium=231120&utm_campaign=post
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
strict-transport-security
max-age=10886400; includeSubDomains; preload
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
date
Wed, 25 Nov 2020 13:48:38 GMT
content-type
text/plain
access-control-allow-origin
https://rusvpn.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
4
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/652000436/ 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/652000436/?random=1606312118506&cv=9&fst=1606312118506&num=1&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2wgb41&sendb=1&ig=1&frm=0&url=https%3A%2F%2Frusvpn.com%2Fen%2Fblog%2Fa-novel-malware-can-steal-passwords-from-vpn-software-and-web-browsers%2F%3Futm_source%3Dtwitter%26utm_medium%3D231120%26utm_campaign%3Dpost&ref=https%3A%2F%2Ft.co%2FslD9sGIKhp&tiba=A%20novel%20malware%20can%20steal%20passwords%20from%20VPN%20software%20and%20web%20browsers%20%E2%96%B6%EF%B8%8F%20RusVPN&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4
Requested by
Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
9a8f46f4d85750b25807af40bb95947ea030ed12223d099317bf6c4aac138e13
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://rusvpn.com/en/blog/a-novel-malware-can-steal-passwords-from-vpn-software-and-web-browsers/?utm_source=twitter&utm_medium=231120&utm_campaign=post
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 25 Nov 2020 13:48:38 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
alt-svc
h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
1160
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.com/ads/ 		42 B
107 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j87&tid=UA-122885695-2&cid=1544674518.1606312118&jid=265647433&_u=YEBAAEAAAAAAAC~&z=854426232
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81a::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://rusvpn.com/en/blog/a-novel-malware-can-steal-passwords-from-vpn-software-and-web-browsers/?utm_source=twitter&utm_medium=231120&utm_campaign=post
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 25 Nov 2020 13:48:38 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.de/ads/ 		42 B
107 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j87&tid=UA-122885695-2&cid=1544674518.1606312118&jid=265647433&_u=YEBAAEAAAAAAAC~&z=854426232
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:820::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://rusvpn.com/en/blog/a-novel-malware-can-steal-passwords-from-vpn-software-and-web-browsers/?utm_source=twitter&utm_medium=231120&utm_campaign=post
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 25 Nov 2020 13:48:38 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.com/pagead/1p-user-list/652000436/ 		42 B
108 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/pagead/1p-user-list/652000436/?random=1606312118506&cv=9&fst=1606309200000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2wgb41&sendb=1&frm=0&url=https%3A%2F%2Frusvpn.com%2Fen%2Fblog%2Fa-novel-malware-can-steal-passwords-from-vpn-software-and-web-browsers%2F%3Futm_source%3Dtwitter%26utm_medium%3D231120%26utm_campaign%3Dpost&ref=https%3A%2F%2Ft.co%2FslD9sGIKhp&tiba=A%20novel%20malware%20can%20steal%20passwords%20from%20VPN%20software%20and%20web%20browsers%20%E2%96%B6%EF%B8%8F%20RusVPN&async=1&fmt=3&is_vtc=1&random=2310544852&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81a::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://rusvpn.com/en/blog/a-novel-malware-can-steal-passwords-from-vpn-software-and-web-browsers/?utm_source=twitter&utm_medium=231120&utm_campaign=post
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 25 Nov 2020 13:48:38 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/652000436/ 		42 B
108 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.de/pagead/1p-user-list/652000436/?random=1606312118506&cv=9&fst=1606309200000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2wgb41&sendb=1&frm=0&url=https%3A%2F%2Frusvpn.com%2Fen%2Fblog%2Fa-novel-malware-can-steal-passwords-from-vpn-software-and-web-browsers%2F%3Futm_source%3Dtwitter%26utm_medium%3D231120%26utm_campaign%3Dpost&ref=https%3A%2F%2Ft.co%2FslD9sGIKhp&tiba=A%20novel%20malware%20can%20steal%20passwords%20from%20VPN%20software%20and%20web%20browsers%20%E2%96%B6%EF%B8%8F%20RusVPN&async=1&fmt=3&is_vtc=1&random=2310544852&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:820::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://rusvpn.com/en/blog/a-novel-malware-can-steal-passwords-from-vpn-software-and-web-browsers/?utm_source=twitter&utm_medium=231120&utm_campaign=post
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 25 Nov 2020 13:48:38 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
get_dynamic_config.js
secure.livechatinc.com/licence/10577487/v2/ 		1 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://secure.livechatinc.com/licence/10577487/v2/get_dynamic_config.js?t=1606312118555&url=https%3A%2F%2Frusvpn.com%2Fen%2Fblog%2Fa-novel-malware-can-steal-passwords-from-vpn-software-and-web-browsers%2F%3Futm_source%3Dtwitter%26utm_medium%3D231120%26utm_campaign%3Dpost&referrer=https%3A%2F%2Ft.co%2FslD9sGIKhp&channel_type=code&jsonp=__42z8nitg2vj
Requested by
Host: cdn.livechatinc.com
URL: https://cdn.livechatinc.com/tracking.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2.16.186.155 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
a2-16-186-155.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
6be19a787474cc4991103ffce570370bd81baf0faa86cd9d794f2c709aa6052d

Request headers

Referer
https://rusvpn.com/en/blog/a-novel-malware-can-steal-passwords-from-vpn-software-and-web-browsers/?utm_source=twitter&utm_medium=231120&utm_campaign=post
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 25 Nov 2020 13:48:38 GMT
Content-Encoding
gzip
Vary
Accept-Encoding
Content-Type
application/javascript; charset=UTF-8
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Length
537
Expires
Wed, 25 Nov 2020 13:48:38 GMT
piwik.php
track.rusvpn.com/ 		43 B
301 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://track.rusvpn.com/piwik.php?action_name=rusvpn.com%2FA%20novel%20malware%20can%20steal%20passwords%20from%20VPN%20software%20and%20web%20browsers%20%E2%96%B6%EF%B8%8F%20RusVPN&idsite=1&rec=1&r=782630&h=14&m=48&s=38&url=https%3A%2F%2Frusvpn.com%2Fen%2Fblog%2Fa-novel-malware-can-steal-passwords-from-vpn-software-and-web-browsers%2F%3Futm_source%3Dtwitter%26utm_medium%3D231120%26utm_campaign%3Dpost&urlref=https%3A%2F%2Ft.co%2FslD9sGIKhp&_id=9a199cb4fb2fe033&_idts=1606312119&_idvc=1&_idn=0&_rcn=post&_refts=1606312119&_viewts=1606312119&_ref=https%3A%2F%2Ft.co%2FslD9sGIKhp&send_image=1&cookie=1&res=1600x1200&gt_ms=19&pv_id=Fx2YMa
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
136.243.102.102 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.102.102.243.136.clients.your-server.de
Software
nginx /
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://rusvpn.com/en/blog/a-novel-malware-can-steal-passwords-from-vpn-software-and-web-browsers/?utm_source=twitter&utm_medium=231120&utm_campaign=post
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 25 Nov 2020 13:48:38 GMT
Server
nginx
X-Frame-Options
SAMEORIGIN
Strict-Transport-Security
max-age=31536000
Content-Type
image/gif
Cache-Control
no-store
Transfer-Encoding
chunked
Connection
keep-alive
/
www.facebook.com/tr/ 		44 B
258 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.facebook.com/tr/?id=1183258908479974&ev=PageView&dl=https%3A%2F%2Frusvpn.com%2Fen%2Fblog%2Fa-novel-malware-can-steal-passwords-from-vpn-software-and-web-browsers%2F%3Futm_source%3Dtwitter%26utm_medium%3D231120%26utm_campaign%3Dpost&rl=https%3A%2F%2Ft.co%2FslD9sGIKhp&if=false&ts=1606312118723&sw=1600&sh=1200&v=2.9.29&r=stable&ec=0&o=30&fbp=fb.1.1606312118721.1903149668&it=1606312118499&coo=false&rqm=GET
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f12d:83:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://rusvpn.com/en/blog/a-novel-malware-can-steal-passwords-from-vpn-software-and-web-browsers/?utm_source=twitter&utm_medium=231120&utm_campaign=post
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 25 Nov 2020 13:48:38 GMT
last-modified
Fri, 21 Dec 2012 00:00:01 GMT
server
proxygen-bolt
strict-transport-security
max-age=31536000; includeSubDomains
content-type
image/gif
cache-control
no-cache, must-revalidate, max-age=0
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length
44
expires
Wed, 25 Nov 2020 13:48:38 GMT
sync_cookie_image_decide
mc.yandex.com/
Redirect Chain
  • https://mc.yandex.com/sync_cookie_image_check
  • https://mc.yandex.ru/sync_cookie_image_start?redirect_domain=mc.yandex.com&token=9103.1W5PZ3p58XsQLY1SOpelvZUMV6YsyuFcLHhW_eduOaC4D-yyJOea2p4O1aaTWmaC.BjcZi2LBBe31qv1pRhKgScwEcTM%2C
  • https://mc.yandex.com/sync_cookie_image_decide?token=9103.0tPTm6biws60yBIEee_hkUuXXK1KpbtnYVu1H5GApJ-oq4AOexlNQbLXNF_aXnJwdemjEfmP28ZLte7Mzme9qA%2C%2C.k74rQSmZT9OZ6sFr0R64-kaFQ2M%2C
75 B
75 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://mc.yandex.com/sync_cookie_image_decide?token=9103.0tPTm6biws60yBIEee_hkUuXXK1KpbtnYVu1H5GApJ-oq4AOexlNQbLXNF_aXnJwdemjEfmP28ZLte7Mzme9qA%2C%2C.k74rQSmZT9OZ6sFr0R64-kaFQ2M%2C
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6b8::1:119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
/
Resource Hash
8398a026313c016324f186d1c9b24a46813109d4bc5477d910a683079cbf1434
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Xss-Protection 1; mode=block

Request headers

Referer
https://rusvpn.com/en/blog/a-novel-malware-can-steal-passwords-from-vpn-software-and-web-browsers/?utm_source=twitter&utm_medium=231120&utm_campaign=post
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 25 Nov 2020 13:48:38 GMT
strict-transport-security
max-age=31536000
content-length
75
x-xss-protection
1; mode=block
content-type
text/html; charset=utf-8

Redirect headers

location
https://mc.yandex.com/sync_cookie_image_decide?token=9103.0tPTm6biws60yBIEee_hkUuXXK1KpbtnYVu1H5GApJ-oq4AOexlNQbLXNF_aXnJwdemjEfmP28ZLte7Mzme9qA%2C%2C.k74rQSmZT9OZ6sFr0R64-kaFQ2M%2C
date
Wed, 25 Nov 2020 13:48:38 GMT
strict-transport-security
max-age=31536000
content-length
0
x-xss-protection
1; mode=block
advert.gif
mc.yandex.ru/metrika/ 		43 B
136 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://mc.yandex.ru/metrika/advert.gif
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6b8::1:119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
/
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Referer
https://rusvpn.com/en/blog/a-novel-malware-can-steal-passwords-from-vpn-software-and-web-browsers/?utm_source=twitter&utm_medium=231120&utm_campaign=post
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 25 Nov 2020 13:48:38 GMT
last-modified
Wed, 25 Nov 2020 10:41:32 GMT
etag
"5fbe2e7b-2b"
strict-transport-security
max-age=31536000
content-type
image/gif
access-control-allow-origin
*
cache-control
max-age=3600
accept-ranges
bytes
content-length
43
expires
Wed, 25 Nov 2020 14:48:38 GMT
get_static_config.0.766.1.1.1912.134.56.37.1.1.1.1.84.js
secure.livechatinc.com/licence/10577487/v2/ 		5 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://secure.livechatinc.com/licence/10577487/v2/get_static_config.0.766.1.1.1912.134.56.37.1.1.1.1.84.js?jsonp=__lc_static_config
Requested by
Host: cdn.livechatinc.com
URL: https://cdn.livechatinc.com/tracking.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2.16.186.155 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
a2-16-186-155.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
aaf7f7c12c852c276b37fbaaca918fac8f4b3a5d894e7e4b5dfbad28d9139590

Request headers

Referer
https://rusvpn.com/en/blog/a-novel-malware-can-steal-passwords-from-vpn-software-and-web-browsers/?utm_source=twitter&utm_medium=231120&utm_campaign=post
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 25 Nov 2020 13:48:38 GMT
Content-Encoding
gzip
Vary
Accept-Encoding
Access-Control-Allow-Methods
GET, HEAD, OPTIONS, POST
Content-Type
application/javascript; charset=UTF-8
Access-Control-Allow-Origin
https://api.chat.io
Access-Control-Expose-Headers
location
Cache-Control
public, max-age=540
Access-Control-Allow-Credentials
true
Access-Control-Max-Age
86400
Connection
keep-alive
Access-Control-Allow-Headers
origin, x-requested-with, content-type, accept
Content-Length
1822
Expires
Wed, 25 Nov 2020 13:57:38 GMT
open_chat.cgi
secure.livechatinc.com/licence/10577487/v2/ Frame 2F2F 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://secure.livechatinc.com/licence/10577487/v2/open_chat.cgi?license=10577487&group=0&embedded=1&widget_version=3&unique_groups=0&localization_improvement=1
Requested by
Host: cdn.livechatinc.com
URL: https://cdn.livechatinc.com/tracking.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2.16.186.155 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
a2-16-186-155.deploy.static.akamaitechnologies.com
Software
/
Resource Hash

Request headers

Host
secure.livechatinc.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
iframe
Referer
https://rusvpn.com/en/blog/a-novel-malware-can-steal-passwords-from-vpn-software-and-web-browsers/?utm_source=twitter&utm_medium=231120&utm_campaign=post
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Cookie
__livechat=lc_all_invitation%3D0%26lc_auto_invites_shown%3D%26lc_chat_number%3D0%26lc_client_version%3D%26lc_goals_achieved%3D%26lc_integration_params%3D%26lc_lang%3Den%26lc_last_chat_start_time%3D0%26lc_last_conference_id%3D%26lc_last_operator_id%3D%26lc_last_operator_key%3D%26lc_last_operator_key_per_skill%3D%26lc_last_operator_per_skill%3D%26lc_last_visit%3D1606312118%26lc_nick%3D%26lc_ok_invitation%3D0%26lc_page_view%3D0%26lc_session%3DS1606312118.d6515f426c%26lc_visit_number%3D0%26mcid%3D%26mcid_done%3D0
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://rusvpn.com/en/blog/a-novel-malware-can-steal-passwords-from-vpn-software-and-web-browsers/?utm_source=twitter&utm_medium=231120&utm_campaign=post

Response headers

Content-Type
text/html; charset=utf-8
Vary
Accept-Encoding
Content-Encoding
gzip
Expires
Wed, 25 Nov 2020 13:48:39 GMT
Cache-Control
max-age=0, no-cache, no-store
Pragma
no-cache
Date
Wed, 25 Nov 2020 13:48:39 GMT
Content-Length
1942
Connection
keep-alive
localization.en.0.ee121f4c7f8015887bb8d7dd406bd1cf_edd3ccabdf73c200cccd1baa63b1fba7.js
secure.livechatinc.com/licence/10577487/v2/ 		9 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://secure.livechatinc.com/licence/10577487/v2/localization.en.0.ee121f4c7f8015887bb8d7dd406bd1cf_edd3ccabdf73c200cccd1baa63b1fba7.js?jsonp=__lc_localization
Requested by
Host: cdn.livechatinc.com
URL: https://cdn.livechatinc.com/tracking.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2.16.186.155 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
a2-16-186-155.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
20a14f30588f6c32702b4ab93c7a71b98b339dba248e11ebf65f17896bdaf2fc

Request headers

Referer
https://rusvpn.com/en/blog/a-novel-malware-can-steal-passwords-from-vpn-software-and-web-browsers/?utm_source=twitter&utm_medium=231120&utm_campaign=post
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 25 Nov 2020 13:48:38 GMT
Content-Encoding
gzip
Vary
Accept-Encoding
Access-Control-Allow-Methods
GET, HEAD, OPTIONS, POST
Content-Type
application/javascript; charset=UTF-8
Access-Control-Allow-Origin
https://api.chat.io
Access-Control-Expose-Headers
location
Cache-Control
public, max-age=487
Access-Control-Allow-Credentials
true
Access-Control-Max-Age
86400
Connection
keep-alive
Access-Control-Allow-Headers
origin, x-requested-with, content-type, accept
Content-Length
3286
Expires
Wed, 25 Nov 2020 13:56:45 GMT
1
mc.yandex.ru/watch/46628313/
Redirect Chain
  • https://mc.yandex.ru/watch/46628313?wmode=7&page-ref=https%3A%2F%2Ft.co%2FslD9sGIKhp&page-url=https%3A%2F%2Frusvpn.com%2Fen%2Fblog%2Fa-novel-malware-can-steal-passwords-from-vpn-software-and-web-br...
  • https://mc.yandex.ru/watch/46628313/1?wmode=7&page-ref=https%3A%2F%2Ft.co%2FslD9sGIKhp&page-url=https%3A%2F%2Frusvpn.com%2Fen%2Fblog%2Fa-novel-malware-can-steal-passwords-from-vpn-software-and-web-...
186 B
343 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://mc.yandex.ru/watch/46628313/1?wmode=7&page-ref=https%3A%2F%2Ft.co%2FslD9sGIKhp&page-url=https%3A%2F%2Frusvpn.com%2Fen%2Fblog%2Fa-novel-malware-can-steal-passwords-from-vpn-software-and-web-browsers%2F%3Futm_source%3Dtwitter%26utm_medium%3D231120%26utm_campaign%3Dpost&charset=utf-8&browser-info=ti%3A10%3Ans%3A1606312117727%3As%3A1600x1200x24%3Ask%3A1%3Ahdl%3A1%3Aadb%3A2%3Afpr%3A216613626101%3Acn%3A1%3Aw%3A1600x1200%3Az%3A60%3Ai%3A20201125144838%3Aet%3A1606312119%3Aen%3Autf-8%3Ac%3A1%3Ala%3Aen-us%3Awh%3A1%3Apv%3A1%3Als%3A319971676982%3Arqn%3A1%3Arn%3A537526198%3Ahid%3A456258437%3Ads%3A20%2C19%2C11%2C8%2C237%2C0%2C0%2C364%2C5%2C726%2C726%2C3%2C657%3Afp%3A506%3Awn%3A41210%3Ahl%3A2%3Agdpr%3A14%3Av%3A1976%3Awv%3A2%3Arqnl%3A1%3Ast%3A1606312119%3Au%3A1606312119829003030%3App%3A3629563401%3At%3AA%20novel%20malware%20can%20steal%20passwords%20from%20VPN%20software%20and%20web%20browsers%20%E2%96%B6%EF%B8%8F%20RusVPN
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6b8::1:119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
/
Resource Hash
6f2a467a6d51fe01138d30a9be81f432b7c0d4d62a759b4b21835adc4285ccff
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://rusvpn.com/en/blog/a-novel-malware-can-steal-passwords-from-vpn-software-and-web-browsers/?utm_source=twitter&utm_medium=231120&utm_campaign=post
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 25 Nov 2020 13:48:39 GMT
x-content-type-options
nosniff
last-modified
Wed, 25-Nov-2020 13:48:39 GMT
strict-transport-security
max-age=31536000
content-type
application/json; charset=utf-8
access-control-allow-origin
https://rusvpn.com
cache-control
private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials
true
content-length
186
x-xss-protection
1; mode=block
expires
Wed, 25-Nov-2020 13:48:39 GMT

Redirect headers

pragma
no-cache
date
Wed, 25 Nov 2020 13:48:38 GMT
last-modified
Wed, 25-Nov-2020 13:48:38 GMT
location
/watch/46628313/1?wmode=7&page-ref=https%3A%2F%2Ft.co%2FslD9sGIKhp&page-url=https%3A%2F%2Frusvpn.com%2Fen%2Fblog%2Fa-novel-malware-can-steal-passwords-from-vpn-software-and-web-browsers%2F%3Futm_source%3Dtwitter%26utm_medium%3D231120%26utm_campaign%3Dpost&charset=utf-8&browser-info=ti%3A10%3Ans%3A1606312117727%3As%3A1600x1200x24%3Ask%3A1%3Ahdl%3A1%3Aadb%3A2%3Afpr%3A216613626101%3Acn%3A1%3Aw%3A1600x1200%3Az%3A60%3Ai%3A20201125144838%3Aet%3A1606312119%3Aen%3Autf-8%3Ac%3A1%3Ala%3Aen-us%3Awh%3A1%3Apv%3A1%3Als%3A319971676982%3Arqn%3A1%3Arn%3A537526198%3Ahid%3A456258437%3Ads%3A20%2C19%2C11%2C8%2C237%2C0%2C0%2C364%2C5%2C726%2C726%2C3%2C657%3Afp%3A506%3Awn%3A41210%3Ahl%3A2%3Agdpr%3A14%3Av%3A1976%3Awv%3A2%3Arqnl%3A1%3Ast%3A1606312119%3Au%3A1606312119829003030%3App%3A3629563401%3At%3AA%20novel%20malware%20can%20steal%20passwords%20from%20VPN%20software%20and%20web%20browsers%20%E2%96%B6%EF%B8%8F%20RusVPN
strict-transport-security
max-age=31536000
access-control-allow-origin
https://rusvpn.com
cache-control
private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials
true
content-length
0
x-xss-protection
1; mode=block
expires
Wed, 25-Nov-2020 13:48:38 GMT
/
www.facebook.com/tr/ 		0
67 B 		Other
General
Check archive.org
Download Go to
Full URL
https://www.facebook.com/tr/
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f12d:83:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://rusvpn.com/en/blog/a-novel-malware-can-steal-passwords-from-vpn-software-and-web-browsers/?utm_source=twitter&utm_medium=231120&utm_campaign=post
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
multipart/form-data; boundary=----WebKitFormBoundaryQ2FefZATuk0dygnA

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
server
proxygen-bolt
date
Wed, 25 Nov 2020 13:48:39 GMT
content-type
text/plain
access-control-allow-origin
https://rusvpn.com
access-control-allow-credentials
true
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length
0
46628313
mc.yandex.ru/webvisor/ 		43 B
145 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://mc.yandex.ru/webvisor/46628313?wmode=0&rn=626226054&page-url=https%3A%2F%2Frusvpn.com%2Fen%2Fblog%2Fa-novel-malware-can-steal-passwords-from-vpn-software-and-web-browsers%2F%3Futm_source%3Dtwitter%26utm_medium%3D231120%26utm_campaign%3Dpost&wv-type=3&wv-hit=456258437&wv-part=1&browser-info=ti%3A8%3Aet%3A1606312121%3Aw%3A1600x1200%3Av%3A1976%3Az%3A60%3Ai%3A20201125144838%3Abt%3A1%3Ast%3A1606312122%3Au%3A1606312119829003030
Requested by
Host: mc.yandex.ru
URL: https://mc.yandex.ru/metrika/tag.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6b8::1:119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
/
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Xss-Protection 1; mode=block

Request headers

Referer
https://rusvpn.com/en/blog/a-novel-malware-can-steal-passwords-from-vpn-software-and-web-browsers/?utm_source=twitter&utm_medium=231120&utm_campaign=post
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Wed, 25 Nov 2020 13:48:42 GMT
last-modified
Wed, 25-Nov-2020 13:48:42 GMT
strict-transport-security
max-age=31536000
content-type
image/gif
access-control-allow-origin
https://rusvpn.com
cache-control
private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials
true
content-length
43
x-xss-protection
1; mode=block
expires
Wed, 25-Nov-2020 13:48:42 GMT
46628313
mc.yandex.ru/webvisor/ 		43 B
176 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://mc.yandex.ru/webvisor/46628313?wmode=0&rn=918473765&page-url=https%3A%2F%2Frusvpn.com%2Fen%2Fblog%2Fa-novel-malware-can-steal-passwords-from-vpn-software-and-web-browsers%2F%3Futm_source%3Dtwitter%26utm_medium%3D231120%26utm_campaign%3Dpost&wv-type=3&wv-hit=456258437&wv-part=1&browser-info=ti%3A8%3Aet%3A1606312119%3Aw%3A1600x1200%3Av%3A1976%3Az%3A60%3Ai%3A20201125144838%3Ast%3A1606312122%3Au%3A1606312119829003030
Requested by
Host: mc.yandex.ru
URL: https://mc.yandex.ru/metrika/tag.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6b8::1:119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
/
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Xss-Protection 1; mode=block

Request headers

Referer
https://rusvpn.com/en/blog/a-novel-malware-can-steal-passwords-from-vpn-software-and-web-browsers/?utm_source=twitter&utm_medium=231120&utm_campaign=post
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Wed, 25 Nov 2020 13:48:41 GMT
last-modified
Wed, 25-Nov-2020 13:48:41 GMT
strict-transport-security
max-age=31536000
content-type
image/gif
access-control-allow-origin
https://rusvpn.com
cache-control
private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials
true
content-length
43
x-xss-protection
1; mode=block
expires
Wed, 25-Nov-2020 13:48:41 GMT
46628313
mc.yandex.ru/webvisor/ 		43 B
169 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://mc.yandex.ru/webvisor/46628313?wmode=0&rn=53453089&page-url=https%3A%2F%2Frusvpn.com%2Fen%2Fblog%2Fa-novel-malware-can-steal-passwords-from-vpn-software-and-web-browsers%2F%3Futm_source%3Dtwitter%26utm_medium%3D231120%26utm_campaign%3Dpost&wv-type=3&wv-hit=456258437&wv-part=2&browser-info=ti%3A8%3Aet%3A1606312121%3Aw%3A1600x1200%3Av%3A1976%3Az%3A60%3Ai%3A20201125144838%3Abt%3A1%3Ast%3A1606312124%3Au%3A1606312119829003030
Requested by
Host: mc.yandex.ru
URL: https://mc.yandex.ru/metrika/tag.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6b8::1:119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
/
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Xss-Protection 1; mode=block

Request headers

Referer
https://rusvpn.com/en/blog/a-novel-malware-can-steal-passwords-from-vpn-software-and-web-browsers/?utm_source=twitter&utm_medium=231120&utm_campaign=post
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Wed, 25 Nov 2020 13:48:43 GMT
last-modified
Wed, 25-Nov-2020 13:48:43 GMT
strict-transport-security
max-age=31536000
content-type
image/gif
access-control-allow-origin
https://rusvpn.com
cache-control
private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials
true
content-length
43
x-xss-protection
1; mode=block
expires
Wed, 25-Nov-2020 13:48:43 GMT
46628313
mc.yandex.ru/webvisor/ 		43 B
157 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://mc.yandex.ru/webvisor/46628313?wmode=0&rn=699798456&page-url=https%3A%2F%2Frusvpn.com%2Fen%2Fblog%2Fa-novel-malware-can-steal-passwords-from-vpn-software-and-web-browsers%2F%3Futm_source%3Dtwitter%26utm_medium%3D231120%26utm_campaign%3Dpost&wv-type=3&wv-hit=456258437&wv-part=3&browser-info=ti%3A8%3Aet%3A1606312126%3Aw%3A1600x1200%3Av%3A1976%3Az%3A60%3Ai%3A20201125144838%3Abt%3A1%3Ast%3A1606312126%3Au%3A1606312119829003030
Requested by
Host: mc.yandex.ru
URL: https://mc.yandex.ru/metrika/tag.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6b8::1:119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
/
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Xss-Protection 1; mode=block

Request headers

Referer
https://rusvpn.com/en/blog/a-novel-malware-can-steal-passwords-from-vpn-software-and-web-browsers/?utm_source=twitter&utm_medium=231120&utm_campaign=post
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Wed, 25 Nov 2020 13:48:46 GMT
last-modified
Wed, 25-Nov-2020 13:48:46 GMT
strict-transport-security
max-age=31536000
content-type
image/gif
access-control-allow-origin
https://rusvpn.com
cache-control
private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials
true
content-length
43
x-xss-protection
1; mode=block
expires
Wed, 25-Nov-2020 13:48:46 GMT
46628313
mc.yandex.ru/webvisor/ 		43 B
145 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://mc.yandex.ru/webvisor/46628313?wmode=0&rn=379257208&page-url=https%3A%2F%2Frusvpn.com%2Fen%2Fblog%2Fa-novel-malware-can-steal-passwords-from-vpn-software-and-web-browsers%2F%3Futm_source%3Dtwitter%26utm_medium%3D231120%26utm_campaign%3Dpost&wv-type=3&wv-hit=456258437&wv-part=4&browser-info=ti%3A8%3Aet%3A1606312126%3Aw%3A1600x1200%3Av%3A1976%3Az%3A60%3Ai%3A20201125144838%3Abt%3A1%3Ast%3A1606312129%3Au%3A1606312119829003030
Requested by
Host: mc.yandex.ru
URL: https://mc.yandex.ru/metrika/tag.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6b8::1:119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
/
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Xss-Protection 1; mode=block

Request headers

Referer
https://rusvpn.com/en/blog/a-novel-malware-can-steal-passwords-from-vpn-software-and-web-browsers/?utm_source=twitter&utm_medium=231120&utm_campaign=post
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Wed, 25 Nov 2020 13:48:48 GMT
last-modified
Wed, 25-Nov-2020 13:48:48 GMT
strict-transport-security
max-age=31536000
content-type
image/gif
access-control-allow-origin
https://rusvpn.com
cache-control
private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials
true
content-length
43
x-xss-protection
1; mode=block
expires
Wed, 25-Nov-2020 13:48:48 GMT

Verdicts & Comments Add Verdict or Comment

49 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated object| dataLayer object| _wpemojiSettings function| Color function| Chart function| $ function| jQuery object| mc4wp function| webpackHotUpdate object| wp object| maxicharts_reports object| maxicharts_reports_init object| twemoji object| google_tag_manager object| google_tag_data string| GoogleAnalyticsObject function| ga function| ym object| _paq object| __lc function| fbq function| _fbq object| PushexConfig object| gaplugins object| gaGlobal object| gaData function| GooglemKTybQhCsO function| google_trackConversion object| GooglebQhCsO boolean| __lc_inited object| LC_API object| JSON_PIWIK object| Piwik object| Matomo object| AnalyticsTracker function| piwik_log object| regeneratorRuntime object| Ya object| yaCounter46628313

3 Cookies

Domain/Path Name / Value
.rusvpn.com/ Name: _gid
Value: GA1.2.1873416859.1606312118
.rusvpn.com/ Name: _ga
Value: GA1.2.1544674518.1606312118
.rusvpn.com/ Name: _gcl_au
Value: 1.1.1790376209.1606312118

5 Console Messages

Source Level URL
Text
console-api log URL: https://rusvpn.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=1.4.1(Line 2)
Message:
JQMIGRATE: Migrate is installed, version 1.4.1
console-api log URL: webpack:///(webpack)/hot/log.js?(Line 24)
Message:
[HMR] Waiting for update signal from WDS...
console-api debug URL: webpack:///./app.js?(Line 26)
Message:
App started
console-api log URL: https://connected11.com/PushexSDK.js(Line 1)
Message:
@Pushex: SDK 0.2.7
console-api log URL: https://connected11.com/PushexSDK.js(Line 1)
Message:
@Pushex: SW 1.14.7

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=0
X-Xss-Protection 0

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

bit.ly
cdn.livechatinc.com
cdnjs.cloudflare.com
connect.facebook.net
connected11.com
fonts.googleapis.com
fonts.gstatic.com
googleads.g.doubleclick.net
ip.rvpn.ws
mc.yandex.com
mc.yandex.ru
rusvpn.com
secure.gravatar.com
secure.livechatinc.com
stats.g.doubleclick.net
t.co
track.rusvpn.com
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagmanager.com
104.244.42.5
136.243.102.102
2.16.186.155
216.58.207.66
2600:9000:2182:8c00:7:7266:1d00:93a1
2606:4700:3031::6812:3681
2606:4700::6810:125e
2606:4700::6810:135e
2a00:1450:4001:806::2008
2a00:1450:4001:808::200a
2a00:1450:4001:80b::200e
2a00:1450:4001:814::2003
2a00:1450:4001:81a::2004
2a00:1450:4001:81e::2002
2a00:1450:4001:820::2003
2a00:1450:4001:824::200e
2a00:1450:400c:c0c::9b
2a02:6b8::1:119
2a03:2880:f01c:8012:face:b00c:0:3
2a03:2880:f12d:83:face:b00c:0:25de
2a04:fa87:fffe::c000:4902
45.157.141.55
67.199.248.10
95.100.181.34
03b52a1594b643f27fdfc0ad86291bf36368dde44df9f07e1206b6fd3563bcab
073cf237fe86763936aafc59c56b031eb64b753ab59e7f2c2f4837bf97e41189
09d31e6a86c9f2133ae80875edd8bf6ee4325d6ef2e224150ffb267774a34945
0afd56f357ed0768a1382fd38f96d9b905b36e9376e7a44f67ed015d9c1af5c5
0ce5a460ace775560c3344a43245687bdbec5cb8ee20d209ab9fa67f4e09a3e8
0e49c2b4e86d3fda1dda93eb1210a47712f7b091181b4e7c6da2b3e6f8e86396
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
139c4145e653277c4e284aa252b115466f4fbb1ba6af2bbb5a69197f714cfdc7
14cbd9b866a9b092e3a2e03a93b128da5baca005fd8b44a1956146eaab7b48b7
17fa35b4d6345ce89ebed111ece9c2c995b47f59b177616baf338bb2260ae0c9
186443093dfe707143dc83f41782c1b9caabf33c05852d6992f4afeb15599112
1ad396270a5b70f825b54ee8035ce7e6c69ff09fdd919b4b6c18db608d6476d7
1c08ba136c6bb358c79b891042f41db03a10505770715301c7c6f6b35b45bb90
1db21d816296e6939ba1f42962496e4134ae2b0081e26970864c40c6d02bb1df
1f0828a0e20828f59fb4665bc749a907a2ae890862ecb870c07d69c38b35ab79
20a14f30588f6c32702b4ab93c7a71b98b339dba248e11ebf65f17896bdaf2fc
25da8e4c2b3ef63337daae0fa81f9be4cb52f0d198a92c0890aa8da5c7fadb62
26726bac4060abb1226e6ceebc1336e84930fe7a7af1b3895a109d067f5b5dcc
30b509528a09195b7a7080345419048fd35269803cdfeab438a98c2176a1d9d0
3bcbf0aa0146c1858ba5ef3b2813cc11abe2e9eb1848e6e5a919079e05dad8a0
40d0e772a84d0b4f851d4db2473e28cd4e8485722f85b56ee3415a5718a5985a
415f8ef74d006599fb31809d584540238a1e76a49a866d38da1d47cb11a83215
46741f22cb1e25d0b01ef060cf35fc91ab4200840cf2b0b5fa36710121ffdb6c
46d0d6cb4abb3baba2ae082ee2260e83cb38082d16e4b8a4c718e1ea2bc2e467
478a6a70e615f25b7bb27c4c40efc749b5421513cc76b84014c1febebf608982
48eb8b500ae6a38617b5738d2b3faec481922a7782246e31d2755c034a45cd5d
4a5bb9d5b75ea6e42f05194235b32b5a2bb8a069359c5919feeef693be9110e9
4c6cf0709b8e52572cae1fb57128acd0a5a453c9ce99dc3712a1860ff90c6bf8
4e890c2a8ae039e170979b656489fdc5b7a2c6b349263b6d6a174c16045380c6
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
5d3065477603214e8534c57bb9b59536e55e561a619ec8518b31e7312b3c2439
6b126f8367ccf28c409834b3a276a3dda26c42662a478386ff6ab756b7fa0d84
6be19a787474cc4991103ffce570370bd81baf0faa86cd9d794f2c709aa6052d
6ebcda7a3a41ef97f0b4071160ceb1020e540fdc0f790079a5c2ef01ab654fe0
6f275a86581101d2104e7ab2a7e92414da2deb07853b681594426938fde01d8a
6f2a467a6d51fe01138d30a9be81f432b7c0d4d62a759b4b21835adc4285ccff
6f4e9f09fd90ee642f7dfe08ce4567ba8dcb42956161bf5fb229c3fd44fba668
76292cc4442fc4ce909c0fe6d41ee71c1eb81ce606e05419c681c86a8bb53d04
7720618af9a13eb14ad09da7d7e2060ad662204864485fecce5452046451cb1d
779249965fcc56df5ccc2c89293a582fbea63f785bc4041c878106b01b725dcb
7a2690c6fceb310048d4c2097f7a19dcb5e3b014b2d0338ffcefce00bf4a7453
7e5c9c32f1019138c22b8dd1de14203e8f0f67d4ef8bf4fc5e501d65b98eaa0c
801d64f198efb6370535806ba5e5700f464801fadeda2f4a4f34d067a24e50fd
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
8398a026313c016324f186d1c9b24a46813109d4bc5477d910a683079cbf1434
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
8577df598f439b9602bfec90eb2c2a654dbb3bd1922ad1d768d6ca3aef58c825
8be7306b94d95be91cf5089abe4e45b281e9b8495705dc3608ee6c1381125a98
96d33f532112177ede6bf262dcf6d0140dbe29f05a4595d17b0be4743205b5ea
97863c262254c3df6ff2e518ad72050dbf63ad92fb0e498914a8c5424aeef893
9a46272f6a64e6a1c6ff7dc7b98fd542c800b6db1c8c9cf10e72432dc8e0d94f
9a8f46f4d85750b25807af40bb95947ea030ed12223d099317bf6c4aac138e13
9c214017962f2b403ee2f8a0dd51333b467aa3f082c5fc93fdb86f0b3d90a19b
aaf7f7c12c852c276b37fbaaca918fac8f4b3a5d894e7e4b5dfbad28d9139590
acfbc5c8acd6adfedf87fbc61b313dc38e60d0595ad8ffa9b2bd29fec9c78d1a
af669c76033604606fcf9ea111fc2cb62d0a89203628548759692b6c7c8b05ef
b0776f5f89402fcc2c1278a22d9a5d7d070b9b5f97196e09ef72a4d4cfab781d
bca7af0b45b6fc6a2064e8e7a34f2041f3e77261e63f0257209bcde6bc40545d
c2245d1e35cfb4dcf6e26b9afb4eef2b09cb27d368402a1d5eba5356bf3f4054
c2f4274f9ff92bc96d63a4142dd50a342e49c74bcb5d62c3cebaca10f9741486
ca5de7dc868cf71b7585be278d8525f023ca44591e59ffd312ff9fce9c5b3226
ce897833ac6e362df7c91ac8223fe511c6defcf33964928a81004600a2dd4c2e
cedb226bd7759d04b58baa1a609e1aeecc1aa5c6c3280c4db153019f426f3de0
cf7391b5c06a56e0f70f64b89ed9d42fd6ccc2efed6ea005237c39dc451ed681
d28ac0a2cff115be2df6325bfaca1c71317be619e04150d6453d6de94f9de275
d5185440094ad1be3edf10ee211029028189b0416cead567858ed24743efe83e
de2c35858d3e3660ebf288e81f2560fab68272980b25e6cb42c0a10bb0bdaa4f
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
e0f02b3c4b0c1b5f8ae68344278199dd71c2d9e94bad0f163b77dae8ad353c6e
e1412951ead689b4f051f8095a2a5b1c34df944e843048b781f8b2cb2ce85ca9
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e441c3e2771625ba05630ab464275136a82c99650ee2145ca5aa9853bedeb01b
e7b44c86b050fca766a96ddac2d0932af0126da6f2305280342d909168dcce6b
ecdda4f33d902731466f3ec355b3bd08d787cf1b7bb7b3e8f96e81bc7cc55481
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f7424eba59459f69b53c80ef1a46d3a7cc057f4ee55a91365ae43ff65c838d41
fbb79fa0a8727412c92c23985bca04897d934c0e4227c1c288006246e9542a52
fd278fd514d10e8882809fc28ac73baf0d706f7f77aea18b7bf2cca438cfc4f6
fef1f411548ec8851bb9ab57d1ed97cf115ff2a27beee7996e3a7bdea3b05a1a
ff66d026a9bfb3b3c64f51e60d84cc592c087091cd915c7e3c4d1099a8807f3a
ffe228371ddb91aba2db32a2b8f369449014598049624ec4d653886ff266b530