urlscan.io logo urlscan.io
SecurityTrails logo

yoroi.company Open in urlscan Pro
2a06:98c1:3120::3  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb...
Effective URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb...
Submission: On December 13 via api from DE — Scanned from NL
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 14 IPs in 2 countries across 8 domains to perform 80 HTTP transactions. The main IP is 2a06:98c1:3120::3, located in United States and belongs to CLOUDFLARENET, US. The main domain is yoroi.company.
TLS certificate: Issued by E1 on November 8th 2023. Valid for: 3 months.
This is the only time yoroi.company was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 1 2a06:98c1:312... 13335 (CLOUDFLAR...)
47 2a06:98c1:312... 13335 (CLOUDFLAR...)
8 192.0.77.37 2635 (AUTOMATTIC)
1 2a00:1450:400... 15169 (GOOGLE)
1 192.0.77.32 2635 (AUTOMATTIC)
2 2606:4700::68... 13335 (CLOUDFLAR...)
5 2a00:1450:400... 15169 (GOOGLE)
4 192.0.76.3 2635 (AUTOMATTIC)
3 2a00:1450:400... 15169 (GOOGLE)
1 192.0.77.2 2635 (AUTOMATTIC)
1 2a02:26f0:310... 20940 (AKAMAI-ASN1)
4 2a00:1450:400... 15169 (GOOGLE)
4 5 2620:1ec:21::14 8068 (MICROSOFT...)
1 13.107.42.14 8068 (MICROSOFT...)
80 14
1    2a06:98c1:3121::3 (United States)

ASN13335 (CLOUDFLARENET, US)
yoroi.company
47    2a06:98c1:3120::3 (United States)

ASN13335 (CLOUDFLARENET, US)
yoroi.company
8    192.0.77.37 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)
PTR: wordpress.com
c0.wp.com
1    2a00:1450:4001:831::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.googleapis.com
1    192.0.77.32 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)
PTR: wordpress.com
s0.wp.com
2    2606:4700::6810:5614 (United States)

ASN13335 (CLOUDFLARENET, US)
cdn.jsdelivr.net
5    2a00:1450:4001:828::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google.com
4    192.0.76.3 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)
stats.wp.com
pixel.wp.com
3    2a00:1450:4001:80f::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.gstatic.com
1    192.0.77.2 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)
PTR: i1.wp.com
i0.wp.com
1    2a02:26f0:3100::1735:2a40 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)
snap.licdn.com
4    2a00:1450:4001:81c::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.gstatic.com
5    2620:1ec:21::14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
px.ads.linkedin.com
www.linkedin.com
1    13.107.42.14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
px4.ads.linkedin.com
Apex Domain
Subdomains		 Transfer
48 yoroi.company
yoroi.company
301 KB
14 wp.com
c0.wp.com — Cisco Umbrella Rank: 8588
s0.wp.com — Cisco Umbrella Rank: 7928
stats.wp.com — Cisco Umbrella Rank: 2814
i0.wp.com — Cisco Umbrella Rank: 3858
pixel.wp.com — Cisco Umbrella Rank: 2796
185 KB
7 gstatic.com
fonts.gstatic.com
www.gstatic.com
510 KB
6 linkedin.com
px.ads.linkedin.com — Cisco Umbrella Rank: 327
www.linkedin.com — Cisco Umbrella Rank: 629
px4.ads.linkedin.com — Cisco Umbrella Rank: 6419
5 KB
5 google.com
www.google.com — Cisco Umbrella Rank: 2
43 KB
2 jsdelivr.net
cdn.jsdelivr.net — Cisco Umbrella Rank: 313
10 KB
1 licdn.com
snap.licdn.com — Cisco Umbrella Rank: 763
15 KB
1 googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 29
1015 B
80 8
Domain Requested by
48 yoroi.company 1 redirects yoroi.company
c0.wp.com
8 c0.wp.com yoroi.company
5 www.google.com yoroi.company
www.gstatic.com
www.google.com
4 px.ads.linkedin.com 3 redirects snap.licdn.com
4 www.gstatic.com www.google.com
www.gstatic.com
3 pixel.wp.com yoroi.company
3 fonts.gstatic.com fonts.googleapis.com
www.google.com
2 cdn.jsdelivr.net yoroi.company
1 px4.ads.linkedin.com yoroi.company
1 www.linkedin.com 1 redirects
1 snap.licdn.com yoroi.company
1 i0.wp.com yoroi.company
1 stats.wp.com yoroi.company
1 s0.wp.com yoroi.company
1 fonts.googleapis.com yoroi.company
80 15
Subject Issuer Validity Valid
yoroi.company
E1		 2023-11-08 -
2024-02-06		 3 months crt.sh
*.wp.com
Sectigo ECC Domain Validation Secure Server CA		 2023-11-28 -
2024-12-28		 a year crt.sh
upload.video.google.com
GTS CA 1C3		 2023-11-20 -
2024-02-12		 3 months crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2023-05-02 -
2024-05-01		 a year crt.sh
www.google.com
GTS CA 1C3		 2023-11-20 -
2024-02-12		 3 months crt.sh
*.gstatic.com
GTS CA 1C3		 2023-11-20 -
2024-02-12		 3 months crt.sh
snap.licdn.com
DigiCert SHA2 Secure Server CA		 2023-02-01 -
2024-01-31		 a year crt.sh
*.google.com
GTS CA 1C3		 2023-11-20 -
2024-02-12		 3 months crt.sh
www.linkedin.com
DigiCert SHA2 Secure Server CA		 2023-11-03 -
2024-05-03		 6 months crt.sh

This page contains 3 frames:

Primary Page: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
Frame ID: 8D44694D0EBD4D840CCDC1084979EEF6
Requests: 72 HTTP requests in this frame

Frame: https://yoroi.company/cdn-cgi/challenge-platform/scripts/jsd/main.js
Frame ID: A2C6A59FDE9343C21C29D73092928492
Requests: 1 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfTr-AUAAAAANb_RvhTeWu00N_K6josD9XFY1OD&co=aHR0cHM6Ly95b3JvaS5jb21wYW55OjQ0Mw..&hl=nl&v=cwQvQhsy4_nYdnSDY4u7O5_B&size=invisible&cb=4lur5zucfw95
Frame ID: 982B46E0DAAE193F21B1056F06EA634B
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Unveiling “Vetta Loader”: A custom loader hitting Italy and spread through infected USB Drives - Yoroilinkedinfacebookpinterestyoutubersstwitterinstagramfacebook-blankrss-blanklinkedin-blankpinterestyoutubetwitterinstagram

Page URL History Show full URLs

  1. http://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-... HTTP 301
    https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link rel=["']stylesheet["'] [^>]+/wp-(?:content|includes)/
  • /wp-(?:content|includes)/
Overall confidence: 100%
Detected patterns
  • wp-content/plugins/oxygen
Overall confidence: 100%
Detected patterns
  • <link[^>]+foundation[^>"]+css
Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
  • <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
  • (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
Overall confidence: 100%
Detected patterns
  • snap\.licdn\.com/li\.lms-analytics/insight\.min\.js
Overall confidence: 100%
Detected patterns
  • ([\d.]+)?/modernizr(?:\.([\d.]+))?.*\.js
Overall confidence: 100%
Detected patterns
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Overall confidence: 100%
Detected patterns
  • //cdn\.jsdelivr\.net/
Overall confidence: 100%
Detected patterns
  • /recaptcha/api\.js

Page Statistics

80
Requests

98 %
HTTPS

64 %
IPv6

8
Domains

15
Subdomains

14
IPs

2
Countries

1065 kB
Transfer

3191 kB
Size

14
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/ HTTP 301
    https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 63
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=3795428&time=1702479968151&url=https%3A%2F%2Fyoroi.company%2Fen%2Fresearch%2Funveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives%2F HTTP 302
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=3795428&time=1702479968151&url=https%3A%2F%2Fyoroi.company%2Fen%2Fresearch%2Funveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives%2F&cookiesTest=true HTTP 302
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D3795428%26time%3D1702479968151%26url%3Dhttps%253A%252F%252Fyoroi.company%252Fen%252Fresearch%252Funveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives%252F%26cookiesTest%3Dtrue%26liSync%3Dtrue HTTP 302
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=3795428&time=1702479968151&url=https%3A%2F%2Fyoroi.company%2Fen%2Fresearch%2Funveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives%2F&cookiesTest=true&liSync=true HTTP 302
  • https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=3795428&time=1702479968151&url=https%3A%2F%2Fyoroi.company%2Fen%2Fresearch%2Funveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives%2F&cookiesTest=true&liSync=true&e_ipv6=AQLZcUqLZAXY7QAAAYxjtrpZtfSAaDTkx2T7bo11eW260kmT_MaW4jaj3HhyFDbEdY3abA

80 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
Redirect Chain
  • http://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
  • https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
219 KB
32 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
37ff54f3c8b10b14bf9c8a54adb7cbd4551b5e94a0110174507599a405fe4320
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language
nl-NL,nl;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400
cache-control
max-age=51, must-revalidate
cf-cache-status
DYNAMIC
cf-ray
834f1bf36aa06568-AMS
content-encoding
br
content-type
text/html; charset=UTF-8
date
Wed, 13 Dec 2023 15:06:07 GMT
host-header
WordPress.com
last-modified
Wed, 13 Dec 2023 15:01:58 GMT
link
<https://yoroi.company/wp-json/>; rel="https://api.w.org/" <https://yoroi.company/wp-json/wp/v2/posts/7796>; rel="alternate"; type="application/json" <https://yoroi.company/?p=7796>; rel=shortlink
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hQuXddfelHXGE%2BjJ8nLozgs6zJkQiGWJKctn1eD36FZR9DKQq20K2u7nKvMut%2B0nlirfzS5pNSh56mCHvw03abFBOkwZoggWEXy5YPf%2Fxjxy8dm67gm5nsNrnpI4dH%2FE09DOlNVd9TVLillO"}],"group":"cf-nel","max_age":604800}
server
cloudflare
strict-transport-security
max-age=31536000
vary
Accept-Encoding Cookie
x-ac
2.ams _atomic_ams BYPASS
x-hacker
Want root? Visit join.a8c.com and mention this header.
x-nananana
Batcache-Hit
x-pingback
https://yoroi.company/xmlrpc.php

Redirect headers

CF-Cache-Status
DYNAMIC
CF-RAY
834f1bf1ec860b42-AMS
Connection
keep-alive
Content-Type
text/html
Date
Wed, 13 Dec 2023 15:06:07 GMT
Location
https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
NEL
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Report-To
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gvtdN52L8qLFdLgoYczpvGod%2FhotwjYy%2B7veD5HulQXBiluHiSkMyHB%2FNmfN3zbEE5H3qNPS1EvhWOgHrWMb8Yq7ssS%2BHy35jWBI2MAG%2BdIZ0vT6MpPFgNIF%2FVF1yA3IuUmbaK8u8BkeNzM2"}],"group":"cf-nel","max_age":604800}
Server
cloudflare
Transfer-Encoding
chunked
X-ac
2.ams _atomic_ams BYPASS
alt-svc
h3=":443"; ma=86400
dashicons.min.css
c0.wp.com/c/6.4.2/wp-includes/css/ 		58 KB
35 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://c0.wp.com/c/6.4.2/wp-includes/css/dashicons.min.css
Requested by
Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.37 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
c21e5a2b32c47bc5f9d9efc97bc0e29fd081946d1d3ebffc5621cfafb1d3960e
Security Headers
Name Value
Strict-Transport-Security max-age=15552000

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://yoroi.company/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

x-nc
HIT ams 1
date
Wed, 13 Dec 2023 15:06:07 GMT
content-encoding
br
strict-transport-security
max-age=15552000
last-modified
Wed, 03 Mar 2021 21:16:22 GMT
server
nginx
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
text/css
access-control-allow-origin
*
cache-control
max-age=31536000
timing-allow-origin
*
alt-svc
h3=":443"; ma=86400, h3=":443"; ma=86400
expires
Thu, 12 Dec 2024 15:06:07 GMT
elusive.min.css
yoroi.company/wp-content/plugins/slick-menu/includes/modules/slick-menu-icons/includes/library/slick-menu-icon-picker/css/types/ 		12 KB
3 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://yoroi.company/wp-content/plugins/slick-menu/includes/modules/slick-menu-icons/includes/library/slick-menu-icon-picker/css/types/elusive.min.css?ver=2.0
Requested by
Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6cf390024b9fb02ae1756d257499f568393acc60c76ae6b13ce986a46f396e34
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Wed, 13 Dec 2023 15:06:07 GMT
strict-transport-security
max-age=31536000
x-ac
2.ams _atomic_ams BYPASS
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
169920
content-encoding
br
alt-svc
h3=":443"; ma=86400
last-modified
Tue, 25 Jul 2023 02:32:20 GMT
server
cloudflare
etag
W/"64bf3434-31f0"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
text/css
access-control-allow-origin
*
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qFwLbrv22qQN0ic%2BFeBIxY%2FRYg8m%2F%2BrkiWBHdgTu5XH%2Bz0l1bFwNZgOnqCz581sUD4SJWz7rTb1mJzN2DVzlnVSEiu8BisomGx9OTyVoVj%2BshFVyKwTyiPVhjXEUbsSx0lltq7xri5HL572R"}],"group":"cf-nel","max_age":604800}
cache-control
max-age=315360000
cf-ray
834f1bf52d086568-AMS
expires
Thu, 31 Dec 2037 23:55:55 GMT
font-awesome.min.css
yoroi.company/wp-content/plugins/slick-menu/includes/modules/slick-menu-icons/includes/library/slick-menu-icon-picker/css/types/ 		28 KB
7 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://yoroi.company/wp-content/plugins/slick-menu/includes/modules/slick-menu-icons/includes/library/slick-menu-icon-picker/css/types/font-awesome.min.css?ver=4.6.3
Requested by
Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5fd50e41f2ce65b53589fb6ca59a03d2fc269d65db66f8c0b29fc5bc8ba84d08
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Wed, 13 Dec 2023 15:06:07 GMT
strict-transport-security
max-age=31536000
x-ac
2.ams _atomic_ams BYPASS
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
169920
content-encoding
br
alt-svc
h3=":443"; ma=86400
last-modified
Tue, 25 Jul 2023 02:32:20 GMT
server
cloudflare
etag
W/"64bf3434-7160"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
text/css
access-control-allow-origin
*
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2D3MphrRz9vCv%2FWw0uP1ACMQ9EYrdBY9UEiZ8FFKhldCI16q7MFU3Lke5Ux53onE9e1DTK5toNwVvY8M8Ny%2FNiR5XZ%2FnVoT%2BA47TscN8sexicYd02zV3q9TLEVFLBbEcbfmeBTgHG7h1NpwC"}],"group":"cf-nel","max_age":604800}
cache-control
max-age=315360000
cf-ray
834f1bf52d0b6568-AMS
expires
Thu, 31 Dec 2037 23:55:55 GMT
foundation-icons.min.css
yoroi.company/wp-content/plugins/slick-menu/includes/modules/slick-menu-icons/includes/library/slick-menu-icon-picker/css/types/ 		17 KB
4 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://yoroi.company/wp-content/plugins/slick-menu/includes/modules/slick-menu-icons/includes/library/slick-menu-icon-picker/css/types/foundation-icons.min.css?ver=3.0
Requested by
Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d51089ba164e46643145dc475cce83e53896a1e6541c68b20d841c1ab24e65b9
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Wed, 13 Dec 2023 15:06:07 GMT
strict-transport-security
max-age=31536000
x-ac
2.ams _atomic_ams BYPASS
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
169920
content-encoding
br
alt-svc
h3=":443"; ma=86400
last-modified
Tue, 25 Jul 2023 02:32:20 GMT
server
cloudflare
etag
W/"64bf3434-439a"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
text/css
access-control-allow-origin
*
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6oXxgH2qe1%2FHEIOOQw7hcRQ3hF024ZgfD3kOlx80ExvaZ1%2B8ZeUyTxaVww%2BTHQ5EVzNn1o%2FNNeiybJqd4oMJZy12CAVoqaDe2DzeihdoH8g%2BitAK1yD5nsJpqUFXJ%2B0Wnr0F%2FcHiChsNlE%2Fz"}],"group":"cf-nel","max_age":604800}
cache-control
max-age=315360000
cf-ray
834f1bf52d116568-AMS
expires
Thu, 31 Dec 2037 23:55:55 GMT
genericons.min.css
yoroi.company/wp-content/plugins/slick-menu/includes/modules/slick-menu-icons/includes/library/slick-menu-icon-picker/css/types/ 		26 KB
16 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://yoroi.company/wp-content/plugins/slick-menu/includes/modules/slick-menu-icons/includes/library/slick-menu-icon-picker/css/types/genericons.min.css?ver=3.4
Requested by
Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2deb67a6ea5e9e0e254330515f7aa291a07618b72715a63971274378cd4d06c4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Wed, 13 Dec 2023 15:06:07 GMT
strict-transport-security
max-age=31536000
x-ac
2.ams _atomic_ams BYPASS
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
169920
content-encoding
br
alt-svc
h3=":443"; ma=86400
last-modified
Tue, 25 Jul 2023 02:32:20 GMT
server
cloudflare
etag
W/"64bf3434-683c"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
text/css
access-control-allow-origin
*
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ax0v66MjWQEQDIoQU9EyNIrG2U6Is5TJzWEFlCNN9yrRT%2BQGnOAwirsvqb6h1ykrarHHLnVvborEeThs1bf4DRZn9lFowJjHH83L3kRc1Vcaxd6uc%2BXHrinRWf7uommAAzoFW0%2BUFn5lx3ZY"}],"group":"cf-nel","max_age":604800}
cache-control
max-age=315360000
cf-ray
834f1bf52d136568-AMS
expires
Thu, 31 Dec 2037 23:55:55 GMT
extra.min.css
yoroi.company/wp-content/plugins/slick-menu/includes/modules/slick-menu-icons/css/ 		1 KB
670 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://yoroi.company/wp-content/plugins/slick-menu/includes/modules/slick-menu-icons/css/extra.min.css?ver=0.10.1
Requested by
Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
cb45a5a7cef4f74f99afa05c6d5c244ed8f36799f372504b042a3e7e6c3d54b7
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Wed, 13 Dec 2023 15:06:07 GMT
strict-transport-security
max-age=31536000
x-ac
2.ams _atomic_ams BYPASS
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
169920
content-encoding
br
alt-svc
h3=":443"; ma=86400
last-modified
Tue, 25 Jul 2023 02:32:20 GMT
server
cloudflare
etag
W/"64bf3434-4cc"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
text/css
access-control-allow-origin
*
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8m2gHGPu0Dfqoyd1Il1usZR%2B8sz8QuaB8sG2NqbveNETg7ZEwzFfaxTfrzeO02%2F0wfCm%2Bfba3Rz4CXP0s4QQfkcn4buJX5AZzbl7B%2BB2zWFDlPLdsxbkrnMpKbX4CbGEcXDdjt2ka%2FBK%2FmN1"}],"group":"cf-nel","max_age":604800}
cache-control
max-age=315360000
cf-ray
834f1bf52d146568-AMS
expires
Thu, 31 Dec 2037 23:55:55 GMT
style.min.css
c0.wp.com/c/6.4.2/wp-includes/css/dist/block-library/ 		107 KB
13 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://c0.wp.com/c/6.4.2/wp-includes/css/dist/block-library/style.min.css
Requested by
Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.37 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
698b89c0da3d319754d6a837b5e6d4e6a42dc402d9ffd7559b8c4cb29c644340
Security Headers
Name Value
Strict-Transport-Security max-age=15552000

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://yoroi.company/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

x-nc
HIT ams 1
date
Wed, 13 Dec 2023 15:06:07 GMT
content-encoding
br
strict-transport-security
max-age=15552000
last-modified
Sun, 05 Nov 2023 19:40:32 GMT
server
nginx
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
text/css
access-control-allow-origin
*
cache-control
max-age=31536000
timing-allow-origin
*
alt-svc
h3=":443"; ma=86400, h3=":443"; ma=86400
expires
Thu, 12 Dec 2024 15:06:07 GMT
mediaelementplayer-legacy.min.css
c0.wp.com/c/6.4.2/wp-includes/js/mediaelement/ 		11 KB
3 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://c0.wp.com/c/6.4.2/wp-includes/js/mediaelement/mediaelementplayer-legacy.min.css
Requested by
Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.37 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
b7908a015a567ec2363011df2475368dbff34360e9da3fdff50604d6395fb646
Security Headers
Name Value
Strict-Transport-Security max-age=15552000

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://yoroi.company/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

x-nc
HIT ams 1
date
Wed, 13 Dec 2023 15:06:07 GMT
content-encoding
br
strict-transport-security
max-age=15552000
last-modified
Tue, 29 Sep 2020 15:53:06 GMT
server
nginx
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
text/css
access-control-allow-origin
*
cache-control
max-age=31536000
timing-allow-origin
*
alt-svc
h3=":443"; ma=86400, h3=":443"; ma=86400
expires
Thu, 12 Dec 2024 15:06:07 GMT
wp-mediaelement.min.css
c0.wp.com/c/6.4.2/wp-includes/js/mediaelement/ 		4 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://c0.wp.com/c/6.4.2/wp-includes/js/mediaelement/wp-mediaelement.min.css
Requested by
Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.37 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
2e10d353ff038c2cad3492fc17801af3e6ef2669c9e9713bdb78b1dcb104c4fe
Security Headers
Name Value
Strict-Transport-Security max-age=15552000

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://yoroi.company/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

x-nc
HIT ams 1
date
Wed, 13 Dec 2023 15:06:07 GMT
content-encoding
br
strict-transport-security
max-age=15552000
last-modified
Fri, 07 Jun 2019 20:45:02 GMT
server
nginx
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
text/css
access-control-allow-origin
*
cache-control
max-age=31536000
timing-allow-origin
*
alt-svc
h3=":443"; ma=86400, h3=":443"; ma=86400
expires
Thu, 12 Dec 2024 15:06:07 GMT
styles.css
yoroi.company/wp-content/plugins/contact-form-7/includes/css/ 		3 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://yoroi.company/wp-content/plugins/contact-form-7/includes/css/styles.css?ver=5.8.4
Requested by
Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ccd31ffa708d025833f954b3e0560cedd58df9a0d2706b2ccee5f501c5b2467b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Wed, 13 Dec 2023 15:06:07 GMT
strict-transport-security
max-age=31536000
x-ac
2.ams _atomic_ams BYPASS
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
900277
content-encoding
br
alt-svc
h3=":443"; ma=86400
last-modified
Sat, 02 Dec 2023 18:04:43 GMT
server
cloudflare
etag
W/"656b71bb-b4e"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
text/css
access-control-allow-origin
*
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=v%2Bz3W3%2FXE1M2VdZyC2qKaKC6HUuCUkp2EfXn0sOWor%2BLXNRmWvG%2Bm%2FQHeGhM9KbSwI0JJw33oM%2FpIsFsqLrNTaNvFOa2O9yNB6TqCv%2FDWv%2Ftv0H%2FE%2BwVUHLEmas467TdRnCZXfSK4%2FHquSFE"}],"group":"cf-nel","max_age":604800}
cache-control
max-age=315360000
cf-ray
834f1bf53d296568-AMS
expires
Thu, 31 Dec 2037 23:55:55 GMT
cookie-law-info-public.css
yoroi.company/wp-content/plugins/cookie-law-info/public/css/ 		3 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://yoroi.company/wp-content/plugins/cookie-law-info/public/css/cookie-law-info-public.css?ver=2.1.3
Requested by
Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
fbe820b6140ad28e86f34ffae507d807cf591a22697a05b71958f2014e96a9e4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Wed, 13 Dec 2023 15:06:07 GMT
strict-transport-security
max-age=31536000
x-ac
2.ams _atomic_ams BYPASS
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
811
content-encoding
br
alt-svc
h3=":443"; ma=86400
last-modified
Thu, 22 Sep 2022 14:31:50 GMT
server
cloudflare
etag
W/"632c71d6-c22"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
text/css
access-control-allow-origin
*
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dRDALWHUyuRoTbOLdfjCf%2BmaynCbvx9eneF0ygaNyQau6bkluYad%2FpeKWPQIwATHFD19hSnurpPPYYLoNbp5RjWzwqTFLUIj%2BEXhhTUH9fbePjt87H9G72VaRLUcSYChr%2BPiwd5BsLATrX2S"}],"group":"cf-nel","max_age":604800}
cache-control
max-age=315360000
cf-ray
834f1bf53d2a6568-AMS
expires
Thu, 31 Dec 2037 23:55:55 GMT
cookie-law-info-gdpr.css
yoroi.company/wp-content/plugins/cookie-law-info/public/css/ 		27 KB
5 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://yoroi.company/wp-content/plugins/cookie-law-info/public/css/cookie-law-info-gdpr.css?ver=2.1.3
Requested by
Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
655ae452d922f501b62c7028fc35e238138de989387381cc1ed9cea9085864db
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Wed, 13 Dec 2023 15:06:07 GMT
strict-transport-security
max-age=31536000
x-ac
2.ams _atomic_ams BYPASS
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
3035725
content-encoding
br
alt-svc
h3=":443"; ma=86400
last-modified
Thu, 22 Sep 2022 14:31:50 GMT
server
cloudflare
etag
W/"632c71d6-6a71"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
text/css
access-control-allow-origin
*
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fum22f2xz4nofKcLIlh0MukACiT5r4h8heYdZ42keh2naME0tQkQp%2Fi0IuMv7IQ40%2FJM8g2jiSAE5wro9rMYR4%2BfGd3bc4V7EqzO0PJb32h07YMlKm%2BhZVa0OcKsgrPFEa5qVagkIpEP4Zbt"}],"group":"cf-nel","max_age":604800}
cache-control
max-age=315360000
cf-ray
834f1bf53d2b6568-AMS
expires
Thu, 31 Dec 2037 23:55:55 GMT
mailup-public.css
yoroi.company/wp-content/plugins/mailup-email-and-newsletter-subscription-form/public/css/ 		3 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://yoroi.company/wp-content/plugins/mailup-email-and-newsletter-subscription-form/public/css/mailup-public.css?ver=1.2.5
Requested by
Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0d349f88844345061cef86a46e23bf67ae8ef16f7ec2453f20abe90add14655b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Wed, 13 Dec 2023 15:06:07 GMT
strict-transport-security
max-age=31536000
x-ac
2.ams _atomic_ams BYPASS
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
169920
content-encoding
br
alt-svc
h3=":443"; ma=86400
last-modified
Thu, 30 Nov 2023 17:00:58 GMT
server
cloudflare
etag
W/"6568bfca-b1d"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
text/css
access-control-allow-origin
*
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=J%2BtIo3bzCHiGPD6gb1H77cgZRLFrKSB0zCaEkFp%2FIgOiXWS%2B0RXSDW8Zm7KA9YsQeLo9KtuP0RfcKV0z4K6sL2squvcsbKIWc0xdMMMVXUsxyUiS27YVld4wHyVlpTpP0CAiWzw%2FjjNXHZuO"}],"group":"cf-nel","max_age":604800}
cache-control
max-age=315360000
cf-ray
834f1bf53d2e6568-AMS
expires
Thu, 31 Dec 2037 23:55:55 GMT
aos.css
yoroi.company/wp-content/plugins/oxygen/component-framework/vendor/aos/ 		25 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://yoroi.company/wp-content/plugins/oxygen/component-framework/vendor/aos/aos.css?ver=6.4.2
Requested by
Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
1aa8845fd06e475aefe733d4e55b36a92fcd487975049c8172341827ac9cc03e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Wed, 13 Dec 2023 15:06:07 GMT
strict-transport-security
max-age=31536000
x-ac
2.ams _atomic_ams BYPASS
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
169920
content-encoding
br
alt-svc
h3=":443"; ma=86400
last-modified
Sun, 18 Apr 2021 08:04:29 GMT
server
cloudflare
etag
W/"607be80d-65c5"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
text/css
access-control-allow-origin
*
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0DMqYpwHuC6GOI7FxREZOIlf4AcsUepP%2BqE1ewRk6dO%2FrHb0yQM%2FGVYMBZfVIFZZjSTVllPPx6uqttXN8byJ3AWaLlHMaBHejLFvCr%2BXpcnt2kJh7fz2g1ZaiuUQjw8HUnx5XqC5U1JynJB3"}],"group":"cf-nel","max_age":604800}
cache-control
max-age=315360000
cf-ray
834f1bf53d2f6568-AMS
expires
Thu, 31 Dec 2037 23:55:55 GMT
oxygen.css
yoroi.company/wp-content/plugins/oxygen/component-framework/ 		18 KB
4 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://yoroi.company/wp-content/plugins/oxygen/component-framework/oxygen.css?ver=3.7.1
Requested by
Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3457140e78788c55cd49cc718bd4e91975bc7b3de7d2754dc3607563e510dced
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Wed, 13 Dec 2023 15:06:07 GMT
strict-transport-security
max-age=31536000
x-ac
2.ams _atomic_ams BYPASS
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
169920
content-encoding
br
alt-svc
h3=":443"; ma=86400
last-modified
Sun, 18 Apr 2021 08:04:29 GMT
server
cloudflare
etag
W/"607be80d-49c8"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
text/css
access-control-allow-origin
*
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=uZrST8o%2BSJeq%2BVzlQlUkgmsWNoSJLVx6wW7sJGOmId7OaluUPDqzsH857OSZ9tcVlB9iMUGYX8rTGbtUefKeT%2B4%2FBNTJxmG5K9fpL2pN0J%2Fn%2FdkKa2av2XB59nLiCd0RR2JBWrQoy%2FkZCTyP"}],"group":"cf-nel","max_age":604800}
cache-control
max-age=315360000
cf-ray
834f1bf54d636568-AMS
expires
Thu, 31 Dec 2037 23:55:55 GMT
contact-form-7-email-spam-blocker-public.css
yoroi.company/wp-content/plugins/wp-contact-form7-email-spam-blocker/public/css/ 		98 B
452 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://yoroi.company/wp-content/plugins/wp-contact-form7-email-spam-blocker/public/css/contact-form-7-email-spam-blocker-public.css?ver=1.0.0
Requested by
Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
547dda3c14b284819be511be1e410da94a5efc6ccc4a9afe1c75394f9333191a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Wed, 13 Dec 2023 15:06:07 GMT
strict-transport-security
max-age=31536000
x-ac
2.ams _atomic_ams BYPASS
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
169920
content-encoding
br
alt-svc
h3=":443"; ma=86400
last-modified
Tue, 04 Feb 2020 11:21:55 GMT
server
cloudflare
etag
W/"5e3953d3-62"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
text/css
access-control-allow-origin
*
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=t284eZCZszPRYwSJ7PdeFB4kmnfT2YYUQLEjLyGQurWZLTptXxN0s8WOGDIYv5%2B2cPOJu2GQ0BpRf2MpsxC0TCG6a1LHqYdGn%2Fqvo5LQL4ri7KiRAQRN5yXXVKKAeWEMcojHn0wWITH7zXOC"}],"group":"cf-nel","max_age":604800}
cache-control
max-age=315360000
cf-ray
834f1bf54d666568-AMS
expires
Thu, 31 Dec 2037 23:55:55 GMT
animate.css
yoroi.company/wp-content/plugins/slick-menu/assets/vendors/animate/ 		77 KB
5 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://yoroi.company/wp-content/plugins/slick-menu/assets/vendors/animate/animate.css?ver=1.5.2
Requested by
Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
97470c6fac60d3431c7309907a10d67d0356b563c7bab67f7a44301d4164ac38
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Wed, 13 Dec 2023 15:06:07 GMT
strict-transport-security
max-age=31536000
x-ac
2.ams _atomic_ams BYPASS
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
169920
content-encoding
br
alt-svc
h3=":443"; ma=86400
last-modified
Tue, 25 Jul 2023 02:32:20 GMT
server
cloudflare
etag
W/"64bf3434-135d3"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
text/css
access-control-allow-origin
*
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=XOLni0KdPjSXPuD31a1ATl0AjICRBIiXTkQnvAKnXFUofx4ohMwzWL4%2BU2yj%2FrNL5kSXg0TLbRkZfiPp3dPmcqFdU3zM8npIXTBOFbaZecvgkUWWnlWTB1ZIsxzr%2FZJRSYZAZ0%2ByKnmcw5Lt"}],"group":"cf-nel","max_age":604800}
cache-control
max-age=315360000
cf-ray
834f1bf54d696568-AMS
expires
Thu, 31 Dec 2037 23:55:55 GMT
slickmenu.min.css
yoroi.company/wp-content/plugins/slick-menu/assets/css/ 		48 KB
8 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://yoroi.company/wp-content/plugins/slick-menu/assets/css/slickmenu.min.css?ver=1.5.2
Requested by
Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
02e2dd08ed3c4680e621ea71891aa5675ed8afe3ea8e99dc5d4b0caa4e2ef799
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Wed, 13 Dec 2023 15:06:07 GMT
strict-transport-security
max-age=31536000
x-ac
2.ams _atomic_ams BYPASS
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
1233235
content-encoding
br
alt-svc
h3=":443"; ma=86400
last-modified
Tue, 25 Jul 2023 02:32:19 GMT
server
cloudflare
etag
W/"64bf3433-be85"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
text/css
access-control-allow-origin
*
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ea0cy6uD3dttLC4vz2R1deW4fuNw4%2FZwWhKSW0vyQZaYwJ%2FB1lRA8wcyrKGkEVjZsJXkAnrXt8YanhNxOzQpyU64TumCIARLlbrJuNAEwo5OIGeJLS9Ij5RInHzY97XNnrQNAAttSV6tvDYv"}],"group":"cf-nel","max_age":604800}
cache-control
max-age=315360000
cf-ray
834f1bf54d6b6568-AMS
expires
Thu, 31 Dec 2037 23:55:55 GMT
twentytwenty.css
yoroi.company/wp-content/plugins/jetpack/modules/theme-tools/compat/ 		6 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://yoroi.company/wp-content/plugins/jetpack/modules/theme-tools/compat/twentytwenty.css?ver=13.0-a.1
Requested by
Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f99ea61de5d3dbaf01e20bf1efd0b8b834bc2ca576c6e4f7b68ab25b62e73a6f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Wed, 13 Dec 2023 15:06:07 GMT
strict-transport-security
max-age=31536000
x-ac
2.ams _atomic_ams BYPASS
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
69444
content-encoding
br
alt-svc
h3=":443"; ma=86400
last-modified
Tue, 09 Aug 2022 13:37:56 GMT
server
cloudflare
etag
W/"62f26334-16ea"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
text/css
access-control-allow-origin
*
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zHruTHjrk2EqGCGeeohsGewGdOY%2FCyK4OeHih59cTzPO1BYleL5UhCXgkJxcUop8H9z0402TLffa%2BwohQgbAmzqAFfq%2FK5Wx4YoVz2w5p9vhKTQZ40FH9ngKkCodiNdBuXCE%2FbzzrQbgpeKC"}],"group":"cf-nel","max_age":604800}
cache-control
max-age=315360000
cf-ray
834f1bf54d6c6568-AMS
expires
Thu, 31 Dec 2037 23:55:55 GMT
/
yoroi.company/ 		547 KB
18 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://yoroi.company/?sm_ajax=dynamic_styles&t=1702454609&ver=1.5.2
Requested by
Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
03776ba2741b34dfc2f6a356327e2dc25cbb07f9138b5a779c6b187a58be39e0
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

x-nananana
Batcache-Hit
date
Wed, 13 Dec 2023 15:06:07 GMT
strict-transport-security
max-age=31536000
x-hacker
Want root? Visit join.a8c.com and mention this header.
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-ac
2.ams _atomic_ams BYPASS
content-encoding
br
host-header
WordPress.com
alt-svc
h3=":443"; ma=86400
last-modified
Wed, 13 Dec 2023 15:05:30 GMT
server
cloudflare
vary
Cookie
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0qJ%2FAWdvFyzqe21oreLt7KtlYkWbjkw%2B1jVeGjN9Locet7Yo%2FOZxAF6mkDdq4RPWcOT62zdLPEBE%2BKzvpUktqFtadda0TRBSbtJ6TeaPCpTR5yFCxnWIhmaoTHcrQKqDGwf52yiaqc030dYL"}],"group":"cf-nel","max_age":604800}
content-type
text/css; charset: UTF-8;charset=utf-8
cache-control
max-age=263, must-revalidate
cf-ray
834f1bf54d6e6568-AMS
jquery.min.js
c0.wp.com/c/6.4.2/wp-includes/js/jquery/ 		86 KB
29 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://c0.wp.com/c/6.4.2/wp-includes/js/jquery/jquery.min.js
Requested by
Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.37 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
cb6f2d32c49d1c2b25e9ffc9aaafa3f83075346c01bcd4ae6eb187392a4292cf
Security Headers
Name Value
Strict-Transport-Security max-age=15552000

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://yoroi.company/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

x-nc
HIT ams 1
date
Wed, 13 Dec 2023 15:06:07 GMT
content-encoding
br
strict-transport-security
max-age=15552000
last-modified
Mon, 28 Aug 2023 17:14:23 GMT
server
nginx
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=31536000
timing-allow-origin
*
alt-svc
h3=":443"; ma=86400, h3=":443"; ma=86400
expires
Thu, 12 Dec 2024 15:06:07 GMT
cookie-law-info-public.js
yoroi.company/wp-content/plugins/cookie-law-info/public/js/ 		33 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://yoroi.company/wp-content/plugins/cookie-law-info/public/js/cookie-law-info-public.js?ver=2.1.3
Requested by
Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6c52384c7b0641dd1ead85d079c22d39bcc6dc5f2537afb1e6396bb619771a3f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Wed, 13 Dec 2023 15:06:07 GMT
strict-transport-security
max-age=31536000
x-ac
2.ams _atomic_ams BYPASS
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
169920
content-encoding
br
alt-svc
h3=":443"; ma=86400
last-modified
Thu, 22 Sep 2022 14:31:50 GMT
server
cloudflare
etag
W/"632c71d6-8583"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=F2rhenUVyyIU4gVP9wXXth2oiXUTyqNCXsh8yCHJzI6262ON8PxBPI2g5n3GZ0BIVlmP3%2B857OGk3eYSPS%2B3Uua6JUOCHrtteJS0bMvTnFXYIdyLotaGRQRdKSp%2F7AcZvKE%2BJmi2e%2B1EL3wQ"}],"group":"cf-nel","max_age":604800}
cache-control
max-age=315360000
cf-ray
834f1bf5be316568-AMS
expires
Thu, 31 Dec 2037 23:55:55 GMT
jquery.validate.min.js
yoroi.company/wp-content/plugins/mailup-email-and-newsletter-subscription-form/admin/js/ 		24 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://yoroi.company/wp-content/plugins/mailup-email-and-newsletter-subscription-form/admin/js/jquery.validate.min.js?ver=1.19.5
Requested by
Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
270524b0d27afd1d3b6622d1a176c678daed94564c143297e217a63e21ce9820
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Wed, 13 Dec 2023 15:06:07 GMT
strict-transport-security
max-age=31536000
x-ac
2.ams _atomic_ams BYPASS
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
1107250
content-encoding
br
alt-svc
h3=":443"; ma=86400
last-modified
Thu, 30 Nov 2023 17:00:58 GMT
server
cloudflare
etag
W/"6568bfca-6019"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mvvOAXvcmhC%2BSoiKNYyps56VTDgrgQybhOJU0oFXuQrVsHf4YYuSbDr8%2B8JrmbS%2BdZzSbPHyec69EpUwpyXPAqbJPk1rPVv7jECUCxq3WDAHVzrnEpPgigkB48f3BA5jl7ATQL5TbM7GJO%2BW"}],"group":"cf-nel","max_age":604800}
cache-control
max-age=315360000
cf-ray
834f1bf5be326568-AMS
expires
Thu, 31 Dec 2037 23:55:55 GMT
mailup-public.js
yoroi.company/wp-content/plugins/mailup-email-and-newsletter-subscription-form/public/js/ 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://yoroi.company/wp-content/plugins/mailup-email-and-newsletter-subscription-form/public/js/mailup-public.js?ver=1.2.5
Requested by
Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
83d04fa061be70b12909406d9cdb1d5ba40596f512fc3c716ae04b645527648c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Wed, 13 Dec 2023 15:06:07 GMT
strict-transport-security
max-age=31536000
x-ac
2.ams _atomic_ams BYPASS
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
169919
content-encoding
br
alt-svc
h3=":443"; ma=86400
last-modified
Thu, 30 Nov 2023 17:00:58 GMT
server
cloudflare
etag
W/"6568bfca-c98"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=D%2BB%2FlCdO5tejqbiPXO1p%2FC3zyloVAMDNYA2U%2F7cjeB3TmIKoMOQWRzI54u4XytuVJG8x%2Bo3tQc6lpyFeIs%2BZZJXVm1taFuD1QRNugCVVT2RAfV17YLUx6QgYrXOjMV0pi9CDDhzq6ye01sh1"}],"group":"cf-nel","max_age":604800}
cache-control
max-age=315360000
cf-ray
834f1bf5be336568-AMS
expires
Thu, 31 Dec 2037 23:55:55 GMT
aos.js
yoroi.company/wp-content/plugins/oxygen/component-framework/vendor/aos/ 		14 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://yoroi.company/wp-content/plugins/oxygen/component-framework/vendor/aos/aos.js?ver=1
Requested by
Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4460f1596174d06cca957fdaca2c71e1a377cf1d6f07ee4c75ffb3bf3fc97a03
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Wed, 13 Dec 2023 15:06:07 GMT
strict-transport-security
max-age=31536000
x-ac
2.ams _atomic_ams BYPASS
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
684943
content-encoding
br
alt-svc
h3=":443"; ma=86400
last-modified
Sun, 18 Apr 2021 08:04:29 GMT
server
cloudflare
etag
W/"607be80d-37a3"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=tw%2BMTF79vCHDOZYepCtA6r99JSUTk0oe7l9QMRpvpBc3g8c6wWWh0B%2BEi3zsaWQPo1XTNpqHlnJwQnnCeLOnE%2FZ8gkhS64%2Bf7w2eiK3DpKpeNcYIKsERLKLgnQi6ULopF51aGJj5C53%2BOVur"}],"group":"cf-nel","max_age":604800}
cache-control
max-age=315360000
cf-ray
834f1bf5be346568-AMS
expires
Thu, 31 Dec 2037 23:55:55 GMT
contact-form-7-email-spam-blocker-public.js
yoroi.company/wp-content/plugins/wp-contact-form7-email-spam-blocker/public/js/ 		838 B
772 B 		Script
General
Check archive.org
Download Go to
Full URL
https://yoroi.company/wp-content/plugins/wp-contact-form7-email-spam-blocker/public/js/contact-form-7-email-spam-blocker-public.js?ver=1.0.0
Requested by
Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
57a50c99a31ef4e89e86664e96f6dfbdde163a2eb96e88b3b492c49aa4be2f37
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Wed, 13 Dec 2023 15:06:07 GMT
strict-transport-security
max-age=31536000
x-ac
2.ams _atomic_ams BYPASS
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
744314
content-encoding
br
alt-svc
h3=":443"; ma=86400
last-modified
Tue, 04 Feb 2020 11:21:55 GMT
server
cloudflare
etag
W/"5e3953d3-346"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=yVkubAdvfwhjd4Rp%2FtFQ39OrU3iT4DVWbZTGkE0%2BM8WIRRDph%2Fjiyj0EWa3034t7zrcrR8ukyFxOwXIFen2W6VMkUiZHtY%2Fj6izNq5Jgj45O9igO%2B5BFMh7dOQxM7b59D16QL8quI0NsL4v%2F"}],"group":"cf-nel","max_age":604800}
cache-control
max-age=315360000
cf-ray
834f1bf5be356568-AMS
expires
Thu, 31 Dec 2037 23:55:55 GMT
css
fonts.googleapis.com/ 		10 KB
1015 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Work+Sans:100,200,300,400,500,600,700,800,900|Work+Sans:100,200,300,400,500,600,700,800,900
Requested by
Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:831::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
6f3b3eda120231c8b7775699ee027905ac6a8f998e7dddefe9bdab0a0b32219f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://yoroi.company/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Wed, 13 Dec 2023 15:06:07 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Wed, 13 Dec 2023 14:53:20 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Wed, 13 Dec 2023 15:06:07 GMT
/
yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/ 		46 KB
9 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/?xlink=css&ver=6.4.2
Requested by
Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
058518d45e49147be19e3e9847a1bb86c2fca0e546ecf62504aea2faaee0a72e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

x-nananana
Batcache-Hit
date
Wed, 13 Dec 2023 15:06:07 GMT
strict-transport-security
max-age=31536000
x-hacker
Want root? Visit join.a8c.com and mention this header.
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-ac
2.ams _atomic_ams BYPASS
x-pingback
https://yoroi.company/xmlrpc.php
content-encoding
br
host-header
WordPress.com
alt-svc
h3=":443"; ma=86400
last-modified
Wed, 13 Dec 2023 15:01:59 GMT
server
cloudflare
vary
Accept-Encoding, Cookie
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5PC%2Bcr%2BSjO9WD2uq7ecc%2BC%2FTkwxji378sJBcDs7oKiNeWQxV45rnLeyk60KrQdXmf7qJFXk4GD9JrcaRCtb%2BMujHMhkeCA93zh%2FoDwSMRrji08w1KVW67FIb%2FtGpkZz%2FaOxo9rY5fyBmngUG"}],"group":"cf-nel","max_age":604800}
content-type
text/css;charset=utf-8
cache-control
max-age=52, must-revalidate
cf-ray
834f1bf5be2d6568-AMS
link
<https://yoroi.company/wp-json/>; rel="https://api.w.org/", <https://yoroi.company/wp-json/wp/v2/posts/7796>; rel="alternate"; type="application/json", <https://yoroi.company/?p=7796>; rel=shortlink
logo-head.svg
yoroi.company/wp-content/uploads/2020/01/ 		3 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://yoroi.company/wp-content/uploads/2020/01/logo-head.svg
Requested by
Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
65158a29c17b7bd93fcb3409b97eda74a7c090d932a9ce494adb9f82d737894d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Wed, 13 Dec 2023 15:06:07 GMT
strict-transport-security
max-age=31536000
x-ac
2.ams _atomic_ams BYPASS
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
4017
content-encoding
br
alt-svc
h3=":443"; ma=86400
last-modified
Mon, 03 Feb 2020 11:41:20 GMT
server
cloudflare
etag
W/"5e3806e0-a21"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
image/svg+xml
access-control-allow-origin
*
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Urz9Qi2JGLgwkkPAMLaeClcZrJetvUlMJb49DcY9Mj0SEWCVn9qvgDWxK8OM491ErNWHPgcLv79QFTCCoWUlxLkDEsbHkFsRMo5dBDXfEgQJ6Ylz2yptkmm3uXx10nlMs5pr9bYpGCKIy%2B9u"}],"group":"cf-nel","max_age":604800}
cache-control
max-age=604800
cf-ray
834f1bf5be3b6568-AMS
expires
Wed, 20 Dec 2023 13:59:10 GMT
hamburger.svg
yoroi.company/wp-content/uploads/2020/01/ 		488 B
610 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://yoroi.company/wp-content/uploads/2020/01/hamburger.svg
Requested by
Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f349f68dd834591897a2b648193d96446427a388772b17163e166c17bf4bb5f4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Wed, 13 Dec 2023 15:06:07 GMT
strict-transport-security
max-age=31536000
x-ac
2.ams _atomic_ams BYPASS
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
811
content-encoding
br
alt-svc
h3=":443"; ma=86400
last-modified
Mon, 03 Feb 2020 11:41:17 GMT
server
cloudflare
etag
W/"5e3806dd-1e8"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
image/svg+xml
access-control-allow-origin
*
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HjZQbgjCCpYLebuvV2NtE7oW4KB92GS04CrRLIhc7fzeGOedhKu0dX5fuaOJfLr808hdCy0Uh4IesNXF5%2FvKSKKVe8A8%2FmBvKYfBW5UvR8P6xzR%2BBNKkPS9nQEOvMwVawyJAY0EbjUinqFMN"}],"group":"cf-nel","max_age":604800}
cache-control
max-age=604800
cf-ray
834f1bf5be3c6568-AMS
expires
Wed, 20 Dec 2023 14:52:36 GMT
Risorsa-36-8.png
yoroi.company/wp-content/uploads/2020/01/ 		30 KB
30 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://yoroi.company/wp-content/uploads/2020/01/Risorsa-36-8.png
Requested by
Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
048e7b54fbc9022c80b0bf1144f55baaf814f91fe575515dbd4263634317013f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Wed, 13 Dec 2023 15:06:07 GMT
strict-transport-security
max-age=31536000
x-ac
2.ams _atomic_ams BYPASS
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
604310
alt-svc
h3=":443"; ma=86400
content-length
30485
last-modified
Mon, 03 Feb 2020 11:41:18 GMT
server
cloudflare
etag
"5e3806de-7715"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
image/png
access-control-allow-origin
*
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dTiQm0pvBPgRKnpczB8QIx3p0TRlQQhmtlbwmynikiAE9hiocu97LGSXgODzz2jIuzT86TiQGcYnvJ4poFb6bEwQk%2B%2BdLzEFSfdadEevjIFAR2gjC6nHDH16HlhHNzzvClTWwfRcKGDA3Mrz"}],"group":"cf-nel","max_age":604800}
cache-control
max-age=604800
accept-ranges
bytes
cf-ray
834f1bf608fe6638-AMS
expires
Wed, 13 Dec 2023 15:14:17 GMT
logo_tinexta-ai_3.png
yoroi.company/wp-content/uploads/2021/09/ 		40 KB
41 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://yoroi.company/wp-content/uploads/2021/09/logo_tinexta-ai_3.png
Requested by
Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
814005c14007af177ca97da8fdc108fa76b6765c1e2ed546280c7645a0a63ccd
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Wed, 13 Dec 2023 15:06:07 GMT
strict-transport-security
max-age=31536000
x-ac
2.ams _atomic_ams BYPASS
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
96110
alt-svc
h3=":443"; ma=86400
content-length
41285
last-modified
Thu, 02 Sep 2021 10:17:29 GMT
server
cloudflare
etag
"6130a4b9-a145"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
image/png
access-control-allow-origin
*
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=10rQ9bWTtKevfiu0iyP0ivV62OvdUr9arGuhqCKQKeSg528JqdErkAGfXPSIaarzrOWWmu74I3QGB49pebwoI5HwDV%2BtAsmwMzqs2IV2ADGAk0xQicpwqtv8z4aFwFVhSsf%2BoQrDWO3VV6uh"}],"group":"cf-nel","max_age":604800}
cache-control
max-age=604800
accept-ranges
bytes
cf-ray
834f1bf608ff6638-AMS
expires
Tue, 19 Dec 2023 12:24:17 GMT
image-16.png
yoroi.company/wp-content/uploads/2021/03/ 		11 KB
11 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://yoroi.company/wp-content/uploads/2021/03/image-16.png
Requested by
Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
52a86f59fd1312a60def6374184c8055b7fa03858e8494a7c35d25f619156b0f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Wed, 13 Dec 2023 15:06:07 GMT
strict-transport-security
max-age=31536000
x-ac
2.ams _atomic_ams BYPASS
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
177324
alt-svc
h3=":443"; ma=86400
content-length
10893
last-modified
Thu, 18 Mar 2021 10:17:13 GMT
server
cloudflare
etag
"605328a9-2a8d"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
image/png
access-control-allow-origin
*
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DP9eNVvTr%2Fa3Mwm7aN0xX3RR1QwLbrFhNx7xl9GDfExzK7XevjRDE8x0dj8yUWnbvBaQTQZ0sFt7cP2SqcNAnxZ3rz%2BlmQPeEjqjcBu4%2BLBLcOWdpP5GlQyLCfa7n0b3i%2FC%2BN%2FG2ogZIzqzM"}],"group":"cf-nel","max_age":604800}
cache-control
max-age=604800
accept-ranges
bytes
cf-ray
834f1bf669ae6638-AMS
expires
Mon, 18 Dec 2023 13:50:43 GMT
LOGO_YOROI_TC_WHITE-1.png
yoroi.company/wp-content/uploads/2021/10/ 		14 KB
14 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://yoroi.company/wp-content/uploads/2021/10/LOGO_YOROI_TC_WHITE-1.png
Requested by
Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
204a3227a3631e685f978c6567314a00f03a3bedbbbc947122c97bcc4ac62d9d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Wed, 13 Dec 2023 15:06:07 GMT
strict-transport-security
max-age=31536000
x-ac
2.ams _atomic_ams BYPASS
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
521952
alt-svc
h3=":443"; ma=86400
content-length
14192
last-modified
Fri, 08 Oct 2021 10:47:32 GMT
server
cloudflare
etag
"616021c4-3770"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
image/png
access-control-allow-origin
*
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=WK9bftPV0OyHySzJMX72PkBz%2FQhdcy8FhQI6rglgNIqnJDFSZ3E8%2FeyefVDw6Wdn80AWBTU13vEtoSRsYyX%2FLw8n5qPNfd7jiqihSWE7PbKGx6w3wW%2BEgqsBmv9hyP8Jnl6fvGGIph3vlOxr"}],"group":"cf-nel","max_age":604800}
cache-control
max-age=604800
accept-ranges
bytes
cf-ray
834f1bf77b3b6638-AMS
expires
Thu, 14 Dec 2023 14:06:55 GMT
email-decode.min.js
yoroi.company/cdn-cgi/scripts/5c5dd728/cloudflare-static/ 		1 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://yoroi.company/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js
Requested by
Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Wed, 13 Dec 2023 15:06:07 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Fri, 01 Dec 2023 15:04:24 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"6569f5f8-4d7"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HL112TuFfS08RI6boz%2BPKQFlZu7FtNpe0CnTbIjE%2FmkU13Lzxv9gz01V1iBWijuBMKNifCgH%2FAXJS%2FaKWI9rb%2BZNfPm14fIyQFouDAK%2ButoJyIkm5iRBXwx9uf3Llbj7rLJSWu5%2B2ZdBm8I%2B"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
x-frame-options
DENY
cache-control
max-age=172800, public
cf-ray
834f1bf6da4c6638-AMS
expires
Fri, 15 Dec 2023 15:06:07 GMT
bilmur.min.js
s0.wp.com/wp-content/js/ 		6 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s0.wp.com/wp-content/js/bilmur.min.js?m=202350
Requested by
Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
216728e33a7de4be9b784eff527c6ccf1658319ea78fe66a7864c0b923200252

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://yoroi.company/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

x-nc
HIT ams 2
date
Wed, 13 Dec 2023 15:06:07 GMT
content-encoding
br
x-ac
4.ams _dfw MISS
last-modified
Wed, 15 Nov 2023 17:05:24 GMT
server
nginx
etag
W/"6554fa54-161b"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=31536000
timing-allow-origin
*
alt-svc
h3=":443"; ma=86400
expires
Tue, 10 Dec 2024 00:00:00 GMT
logo-cookieyes.svg
yoroi.company/wp-content/plugins/cookie-law-info/public/images/ 		3 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://yoroi.company/wp-content/plugins/cookie-law-info/public/images/logo-cookieyes.svg
Requested by
Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
fab005de52ce54d75f373c5a020e7ddd194caea5b4bf6e87886196e5d4451adc
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Wed, 13 Dec 2023 15:06:07 GMT
strict-transport-security
max-age=31536000
x-ac
2.ams _atomic_ams BYPASS
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
277265
content-encoding
br
alt-svc
h3=":443"; ma=86400
last-modified
Thu, 22 Sep 2022 14:31:50 GMT
server
cloudflare
etag
W/"632c71d6-a15"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
image/svg+xml
access-control-allow-origin
*
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=QCVmrdruFTFFGt3hU5O2sR2moKU%2FS4V8MgsR1OfClElCcxptSqdq98FNf3yKTJ24yftm9KyDYJy3vvDVMCIDrqRUU8hgVcOMEphtVVb%2BVpoWCs7vrGYPWJHLhyRoiNqa2%2FVT0E84hAo9jRp6"}],"group":"cf-nel","max_age":604800}
cache-control
max-age=604800
cf-ray
834f1bf77b3d6638-AMS
expires
Sun, 17 Dec 2023 10:05:02 GMT
countUp.min.js
yoroi.company/wp-content/assets/js/ 		5 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://yoroi.company/wp-content/assets/js/countUp.min.js
Requested by
Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c63a636fec47c33c1f90b009d2f95830d3492083c04e429cda86914834714967
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Referer
https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
Origin
https://yoroi.company
accept-language
nl-NL,nl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Wed, 13 Dec 2023 15:06:07 GMT
strict-transport-security
max-age=31536000
x-ac
2.ams _atomic_ams BYPASS
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
69444
content-encoding
br
alt-svc
h3=":443"; ma=86400
last-modified
Mon, 03 Feb 2020 11:40:49 GMT
server
cloudflare
etag
W/"5e3806c1-126e"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ZI18SfyNAMQ93dg%2BwWw6h15SlXHje3r7mKz%2F89dg9H6g0e3cRHEbkk4KtiC4Yric%2BT64SVGR81Gghp3hZbUy85Gr4MVMQ2vxEsqRCNyBhzNHLTrGXNTXDVkIIKGCA6QqNhjvI6wr2zYvfi8Y"}],"group":"cf-nel","max_age":604800}
cache-control
max-age=604800
cf-ray
834f1bf5be366568-AMS
expires
Tue, 19 Dec 2023 19:48:43 GMT
counters.js
yoroi.company/wp-content/assets/js/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://yoroi.company/wp-content/assets/js/counters.js
Requested by
Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
1c594062728319da3ecaa98c4c0b930b07d5e64207eb6e4987d4fcbff9134768
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Referer
https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
Origin
https://yoroi.company
accept-language
nl-NL,nl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Wed, 13 Dec 2023 15:06:07 GMT
strict-transport-security
max-age=31536000
x-ac
2.ams _atomic_ams BYPASS
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
510992
content-encoding
br
alt-svc
h3=":443"; ma=86400
last-modified
Mon, 03 Feb 2020 11:40:49 GMT
server
cloudflare
etag
W/"5e3806c1-78d"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ceJkWI1aZlyQsyufrFetOroOoRZ2B9Z3pXTZpZupDwHbxn19BBi%2Bg%2BYxTpz%2FT71ZN%2B5lAN6hDcBtamzAmT%2FT9sPWkSSHNokt91yLb5CazQTf3A%2FWJDU0KZd6e9QEAORbBrxnVSltVwJjC7uj"}],"group":"cf-nel","max_age":604800}
cache-control
max-age=604800
cf-ray
834f1bf5be376568-AMS
expires
Thu, 14 Dec 2023 17:09:35 GMT
parallax.min.js
yoroi.company/wp-content/assets/js/ 		17 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://yoroi.company/wp-content/assets/js/parallax.min.js
Requested by
Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
bf4d20b28de8c7f77428b24325ec3afb39b6f7e277f6b61666f3a0a17cc3b42b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Wed, 13 Dec 2023 15:06:07 GMT
strict-transport-security
max-age=31536000
x-ac
2.ams _atomic_ams BYPASS
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
803
content-encoding
br
alt-svc
h3=":443"; ma=86400
last-modified
Mon, 03 Feb 2020 11:40:49 GMT
server
cloudflare
etag
W/"5e3806c1-43a2"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DPTY6Le9sEVhJHiwasyaeyNQiCrUk2GbYpae5qW3D4RpVikdQppRI804ZgkPF7Xs8XrUHWSbkUI62lcLpIB3CCSRYPbeFpdClUtsYky2X34vInaP0nTAoQaZZ0aFdwW1SVtYpJTb7kocUAbQ"}],"group":"cf-nel","max_age":604800}
cache-control
max-age=604800
cf-ray
834f1bf6da4d6638-AMS
expires
Wed, 20 Dec 2023 14:52:44 GMT
intersection-observer.js
cdn.jsdelivr.net/npm/intersection-observer@0.7.0/ 		22 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.jsdelivr.net/npm/intersection-observer@0.7.0/intersection-observer.js
Requested by
Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:5614 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
1dc6d2d43514d1d8956877d1f2ef347cd5abdb8ecf8e47aba59d87b8a6da49bb
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://yoroi.company/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Wed, 13 Dec 2023 15:06:07 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age
1156043
x-jsd-version
0.7.0
content-encoding
br
x-cache
HIT, HIT
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
x-served-by
cache-fra-eddf8230054-FRA, cache-ams21081-AMS
x-jsd-version-type
version
server
cloudflare
etag
W/"57ad-m3EaUx6495LHE8zS0+QpFP8kqM0"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HnoS1rvQSCloO3ur6O%2FTshdd9pE3S2oW9Bky4pmMJ8APMFech3WhSqoGlKAhjUXG5vuGFlvCkj4NnqGZ%2BkNFaFHwwH8Ogmxt4GUCE0dW9f3PKr1hLsiQWH%2FdSRHJ0pOzQETck%2BBb9z1oO5vka8I%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=31536000, s-maxage=31536000, immutable
timing-allow-origin
*
cf-ray
834f1bf7ece10bd0-AMS
lazyload.min.js
cdn.jsdelivr.net/npm/vanilla-lazyload@12.4.0/dist/ 		6 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.jsdelivr.net/npm/vanilla-lazyload@12.4.0/dist/lazyload.min.js
Requested by
Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:5614 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0be502b9446e16b338d36ccadac232f4a68ab74655f98fec415ccdbbccbf5729
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://yoroi.company/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Wed, 13 Dec 2023 15:06:07 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age
1236833
x-jsd-version
12.4.0
content-encoding
br
x-cache
HIT, HIT
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
x-served-by
cache-fra-eddf8230062-FRA, cache-ams21036-AMS
x-jsd-version-type
version
server
cloudflare
etag
W/"1926-ftj+zhhSvu4E/RMH3S02cxSkfWc"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=PDII%2B3POwCEwVNyuP3LPdbrys7n26WRK6uUmWQCl33lY1saPmHS9vITKDfz7BrLMTtk1fKvmsSvcw%2B6J1MXxdWIyLYXb69pio0KOdrNdKRuRZtRw1eT4QeW9SndQXKy41mIt%2FnlKSYOy4OH9GR4%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=31536000, s-maxage=31536000, immutable
timing-allow-origin
*
cf-ray
834f1bf7ece00bd0-AMS
cookie-law-info-table.css
yoroi.company/wp-content/plugins/cookie-law-info/public/css/ 		6 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://yoroi.company/wp-content/plugins/cookie-law-info/public/css/cookie-law-info-table.css?ver=2.1.3
Requested by
Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2e2f2336b5e6698b628afc75fa9a24c67b73d5872c1d4af99ca436064f636ee0
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Wed, 13 Dec 2023 15:06:07 GMT
strict-transport-security
max-age=31536000
x-ac
2.ams _atomic_ams BYPASS
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
1141806
content-encoding
br
alt-svc
h3=":443"; ma=86400
last-modified
Thu, 22 Sep 2022 14:31:50 GMT
server
cloudflare
etag
W/"632c71d6-17e1"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
text/css
access-control-allow-origin
*
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=z7Iefh%2F02hKhpC32oZcVwbjm8FoE%2FWV8wjcQh69g4wfkobm2%2FmagVmV1UHvDg4H%2FkMnbmLIn2uug4Ks4gAWbw5rrHJZkXt03dAOCbWjFtG3ILlqG9JcbBd1bxCcJqkykNLT5CBgBQSrF2vPT"}],"group":"cf-nel","max_age":604800}
cache-control
max-age=315360000
cf-ray
834f1bf72abc6638-AMS
expires
Thu, 31 Dec 2037 23:55:55 GMT
image-cdn.js
yoroi.company/wp-content/plugins/jetpack/jetpack_vendor/automattic/jetpack-image-cdn/dist/ 		701 B
875 B 		Script
General
Check archive.org
Download Go to
Full URL
https://yoroi.company/wp-content/plugins/jetpack/jetpack_vendor/automattic/jetpack-image-cdn/dist/image-cdn.js?minify=false&ver=132249e245926ae3e188
Requested by
Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
27dd9b075cc59cf5f3c0f6ee075f4bd113782d81ce30a4f16aac669ecfdc4fa2
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Wed, 13 Dec 2023 15:06:07 GMT
strict-transport-security
max-age=31536000
x-ac
2.ams _atomic_ams BYPASS
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
277265
content-encoding
br
alt-svc
h3=":443"; ma=86400
last-modified
Mon, 08 May 2023 16:57:46 GMT
server
cloudflare
etag
W/"64592a0a-2bd"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ZnAcacfVJvpg868w6fUXKAVjoxQuU022OrA6TqHTjqW486v6jkEX%2Ftmk8WZ7OUgUqlgcVN2JHM%2BqhUoDKVqTKCKZdmBFkZ0eH0tXxuRH5mLmtfPDuv7xGZxjcv5MawItukND7knWzxjGd6XS"}],"group":"cf-nel","max_age":604800}
cache-control
max-age=315360000
cf-ray
834f1bf72ac26638-AMS
expires
Thu, 31 Dec 2037 23:55:55 GMT
index.js
yoroi.company/wp-content/plugins/contact-form-7/includes/swv/js/ 		11 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://yoroi.company/wp-content/plugins/contact-form-7/includes/swv/js/index.js?ver=5.8.4
Requested by
Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9c1989ecd392a0c54fb799409154242706940a8e6d800542ba579dfda576bb9d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Wed, 13 Dec 2023 15:06:07 GMT
strict-transport-security
max-age=31536000
x-ac
2.ams _atomic_ams BYPASS
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
931605
content-encoding
br
alt-svc
h3=":443"; ma=86400
last-modified
Sat, 02 Dec 2023 18:04:44 GMT
server
cloudflare
etag
W/"656b71bc-2b6d"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DctLqbSUbZlVf%2Br%2F7FLeUf0OnP69iwWHfNnJNJHtQMmsYhTGQBOKApBzPCoJKmKNtqXJBXvz7nBcqXtdmXbyRDjBy4RhFE5Z6otjfxlTyDzgcnHj9C1D7RJfHXDInt7hUktWLbNNqMDyeEcV"}],"group":"cf-nel","max_age":604800}
cache-control
max-age=315360000
cf-ray
834f1bf76b246638-AMS
expires
Thu, 31 Dec 2037 23:55:55 GMT
index.js
yoroi.company/wp-content/plugins/contact-form-7/includes/js/ 		13 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://yoroi.company/wp-content/plugins/contact-form-7/includes/js/index.js?ver=5.8.4
Requested by
Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
7ee08c60d39f5712a56938fda3e2ab10fe3ef23ec98aeb3c9a29e54f6f31ffe1
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Wed, 13 Dec 2023 15:06:07 GMT
strict-transport-security
max-age=31536000
x-ac
2.ams _atomic_ams BYPASS
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
931605
content-encoding
br
alt-svc
h3=":443"; ma=86400
last-modified
Sat, 02 Dec 2023 18:04:44 GMT
server
cloudflare
etag
W/"656b71bc-337e"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=cOhUgz7aOYm1%2BKZ%2FIozB3BVnDEXjPqUbioPTKFN3%2FBsw6bcinYEztxOMLeUbuPafWAA3WHjtMaw3bNKMMvINpxgplquw7L0tGpp0u9JiVdTxqo3O54Sr0FXuD5PDUBAOTf0K34A%2F3FvLJOqr"}],"group":"cf-nel","max_age":604800}
cache-control
max-age=315360000
cf-ray
834f1bf77b316638-AMS
expires
Thu, 31 Dec 2037 23:55:55 GMT
api.js
www.google.com/recaptcha/ 		1 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google.com/recaptcha/api.js?render=6LfTr-AUAAAAANb_RvhTeWu00N_K6josD9XFY1OD&ver=3.0
Requested by
Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:828::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
73a1f126cf805ced3f24d65132d3163821ed2bb33a62e83e4a305687045dcce5
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://yoroi.company/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Wed, 13 Dec 2023 15:06:08 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy
frame-ancestors 'self'
server
GSE
x-frame-options
SAMEORIGIN
content-type
text/javascript; charset=utf-8
cache-control
private, max-age=300
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
1; mode=block
expires
Wed, 13 Dec 2023 15:06:08 GMT
wp-polyfill-inert.min.js
c0.wp.com/c/6.4.2/wp-includes/js/dist/vendor/ 		8 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://c0.wp.com/c/6.4.2/wp-includes/js/dist/vendor/wp-polyfill-inert.min.js
Requested by
Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.37 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
c1a9a3e223bad631dff12d33b5499eb145cb08d8621c20d9d73870e78d97afe4
Security Headers
Name Value
Strict-Transport-Security max-age=15552000

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://yoroi.company/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

x-nc
HIT ams 1
date
Wed, 13 Dec 2023 15:06:07 GMT
content-encoding
br
strict-transport-security
max-age=15552000
last-modified
Wed, 18 Jan 2023 11:16:33 GMT
server
nginx
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=31536000
timing-allow-origin
*
alt-svc
h3=":443"; ma=86400, h3=":443"; ma=86400
expires
Thu, 12 Dec 2024 15:06:07 GMT
regenerator-runtime.min.js
c0.wp.com/c/6.4.2/wp-includes/js/dist/vendor/ 		6 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://c0.wp.com/c/6.4.2/wp-includes/js/dist/vendor/regenerator-runtime.min.js
Requested by
Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.37 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
1d52e1ac7d3bc25a8b0ffc257153f9dd50249f96fe9a4df5e0d771241a69062c
Security Headers
Name Value
Strict-Transport-Security max-age=15552000

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://yoroi.company/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

x-nc
HIT ams 1
date
Wed, 13 Dec 2023 15:06:07 GMT
content-encoding
br
strict-transport-security
max-age=15552000
last-modified
Tue, 19 Sep 2023 19:30:24 GMT
server
nginx
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=31536000
timing-allow-origin
*
alt-svc
h3=":443"; ma=86400, h3=":443"; ma=86400
expires
Thu, 12 Dec 2024 15:06:07 GMT
wp-polyfill.min.js
c0.wp.com/c/6.4.2/wp-includes/js/dist/vendor/ 		112 KB
34 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://c0.wp.com/c/6.4.2/wp-includes/js/dist/vendor/wp-polyfill.min.js
Requested by
Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.37 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
da9ed5720b674f0d297fe621ac2d8d518c4e622bef1e9b0d4ae489dee9aa43f8
Security Headers
Name Value
Strict-Transport-Security max-age=15552000

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://yoroi.company/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

x-nc
HIT ams 1
date
Wed, 13 Dec 2023 15:06:07 GMT
content-encoding
br
strict-transport-security
max-age=15552000
last-modified
Tue, 26 Sep 2023 14:23:26 GMT
server
nginx
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=31536000
timing-allow-origin
*
alt-svc
h3=":443"; ma=86400, h3=":443"; ma=86400
expires
Thu, 12 Dec 2024 15:06:07 GMT
index.js
yoroi.company/wp-content/plugins/contact-form-7/modules/recaptcha/ 		934 B
986 B 		Script
General
Check archive.org
Download Go to
Full URL
https://yoroi.company/wp-content/plugins/contact-form-7/modules/recaptcha/index.js?ver=5.8.4
Requested by
Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
df0ec8330290d184b1084527076cb87d41b33ba706ff5ab579d761f0cb6a744b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Wed, 13 Dec 2023 15:06:07 GMT
strict-transport-security
max-age=31536000
x-ac
2.ams _atomic_ams BYPASS
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
277265
content-encoding
br
alt-svc
h3=":443"; ma=86400
last-modified
Sat, 02 Dec 2023 18:04:45 GMT
server
cloudflare
etag
W/"656b71bd-3a6"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dMKL7td5g0zzGsZEVJ8xeUQMRJxhzEmM4k0V9wC1VCdXdatwP1Yjrnkf9K4aNm5XVWQ%2FWey9j%2Bv29aIQB9hgJBRTiPzr9UIt3mxL5XT3QyEilKdJODrN0KtWI6ezJSPuU49tuYtOqTLm%2FI0F"}],"group":"cf-nel","max_age":604800}
cache-control
max-age=315360000
cf-ray
834f1bf77b326638-AMS
expires
Thu, 31 Dec 2037 23:55:55 GMT
modernizr.js
yoroi.company/wp-content/plugins/slick-menu/assets/vendors/modernizr/ 		12 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://yoroi.company/wp-content/plugins/slick-menu/assets/vendors/modernizr/modernizr.js?ver=1.5.2
Requested by
Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
49cf0f2de45929d5674df4377cfc2363324674ca4dfdef454bc1dfeebcec9ca5
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Wed, 13 Dec 2023 15:06:07 GMT
strict-transport-security
max-age=31536000
x-ac
2.ams _atomic_ams BYPASS
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
338781
content-encoding
br
alt-svc
h3=":443"; ma=86400
last-modified
Tue, 25 Jul 2023 02:32:20 GMT
server
cloudflare
etag
W/"64bf3434-317b"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LwyLa%2Fgrzbd6vFrL8GoQ45wDQZWcWKzdX3UFGHkgDNX3%2F5xoxjCYU2MTfnZB1TdYRzKZWTyqSxLHPY2WGua0DOlnvzFoknHESILo9h1y8b6uVK3xa%2FVpQkuIpKTR8sgRExx%2FqaPPfsBVHxJf"}],"group":"cf-nel","max_age":604800}
cache-control
max-age=315360000
cf-ray
834f1bf77b336638-AMS
expires
Thu, 31 Dec 2037 23:55:55 GMT
body-scroll-lock.min.js
yoroi.company/wp-content/plugins/slick-menu/assets/vendors/body-scroll-lock/ 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://yoroi.company/wp-content/plugins/slick-menu/assets/vendors/body-scroll-lock/body-scroll-lock.min.js?ver=1.5.2
Requested by
Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d947b55573f76b9876038798590599aef4ec471cd0b44a41438b02ae00fcee5b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Wed, 13 Dec 2023 15:06:07 GMT
strict-transport-security
max-age=31536000
x-ac
2.ams _atomic_ams BYPASS
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
277265
content-encoding
br
alt-svc
h3=":443"; ma=86400
last-modified
Tue, 25 Jul 2023 02:32:20 GMT
server
cloudflare
etag
W/"64bf3434-b15"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=w7pt6qKexwEY9VJWybW2%2F5w9B%2BtYxY3XzpBIMdIdEpurbW17J2t1TisNZEFCOtdRyF5%2BYryHZ4ChX1%2BfnjUqwFyHYhDEB8c6mOkc2tkKooqx5%2FFqDJmxVmNBimciHqOCnYyHpp1N%2B5nl0fxz"}],"group":"cf-nel","max_age":604800}
cache-control
max-age=315360000
cf-ray
834f1bf77b346638-AMS
expires
Thu, 31 Dec 2037 23:55:55 GMT
utils.min.js
yoroi.company/wp-content/plugins/slick-menu/assets/js/ 		19 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://yoroi.company/wp-content/plugins/slick-menu/assets/js/utils.min.js?ver=1.5.2
Requested by
Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0f4a3ba36482c233c6d7970cd42fb5b76ea054044dbebe424176db9f176616cb
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Wed, 13 Dec 2023 15:06:07 GMT
strict-transport-security
max-age=31536000
x-ac
2.ams _atomic_ams BYPASS
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
1270610
content-encoding
br
alt-svc
h3=":443"; ma=86400
last-modified
Tue, 25 Jul 2023 02:32:19 GMT
server
cloudflare
etag
W/"64bf3433-4bab"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=peHfN3LnC1sSaVRHTgN6ody76F8oU8Mi92t6FT381sKaEh7fzYQ18s4uRbMgU8LEFsw55aieJ0VKnOAppdKYbWmRn8ijmdhtjReVRZcu%2BX6G%2F3%2BTCg66s3Ie0MSwjwOeV3SCMRfQcFGFemU0"}],"group":"cf-nel","max_age":604800}
cache-control
max-age=315360000
cf-ray
834f1bf77b356638-AMS
expires
Thu, 31 Dec 2037 23:55:55 GMT
slickmenu.min.js
yoroi.company/wp-content/plugins/slick-menu/assets/js/ 		34 KB
9 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://yoroi.company/wp-content/plugins/slick-menu/assets/js/slickmenu.min.js?ver=1.5.2
Requested by
Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
1e41b9ba20319d67b5b640af59346a76cec477cee421bfc5e05b1238eb292246
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Wed, 13 Dec 2023 15:06:07 GMT
strict-transport-security
max-age=31536000
x-ac
2.ams _atomic_ams BYPASS
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
2551138
content-encoding
br
alt-svc
h3=":443"; ma=86400
last-modified
Tue, 25 Jul 2023 02:32:19 GMT
server
cloudflare
etag
W/"64bf3433-8631"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3oXDheiHzGINQTy7MOaL5TTGB2g7P1mYwRZWx0cvSXA8ALMK4c6fWGx5Wbon2UyZBCkmV%2BR9qrPnDNmydr1rMSmMFDBfJRFsMS2uCH0oeTG8iAUgC831s1s7PFCDUIA6WkbymnCrFtYtGFlh"}],"group":"cf-nel","max_age":604800}
cache-control
max-age=315360000
cf-ray
834f1bf77b366638-AMS
expires
Thu, 31 Dec 2037 23:55:55 GMT
e-202350.js
stats.wp.com/ 		7 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://stats.wp.com/e-202350.js
Requested by
Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
ca7752fb33cf3a98c0f29bc4eec563112025da4109a0dcc69dabf5f861751258

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://yoroi.company/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

x-minify-cache
hit
x-nc
HIT ams
date
Wed, 13 Dec 2023 15:06:07 GMT
content-encoding
br
server
nginx
x-minify
t
etag
W/13576-1684461103136.7104
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=31536000
expires
Mon, 09 Dec 2024 06:23:59 GMT
frontend.min.js
yoroi.company/wp-content/plugins/slick-menu/assets/js/ 		22 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://yoroi.company/wp-content/plugins/slick-menu/assets/js/frontend.min.js?ver=1.5.2
Requested by
Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d3ad83af3a48c24913133f351cc69b135c950df64ec6f0fefd414bc79249c6ba
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Wed, 13 Dec 2023 15:06:07 GMT
strict-transport-security
max-age=31536000
x-ac
2.ams _atomic_ams BYPASS
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
282370
content-encoding
br
alt-svc
h3=":443"; ma=86400
last-modified
Tue, 25 Jul 2023 02:32:19 GMT
server
cloudflare
etag
W/"64bf3433-581d"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=F78HaHlDolb%2FPDPQ5JBIwiaSeIl9vdFxvbWWA2FlkFKUeShNwW0jC37pqTS3N1M1trq2A3eaEDxSB9XmwvdQlgtACweAjm3XLTiosknec9EMYTQdQslShKL15NwvPP7FnEDw01l2YnN23wj%2F"}],"group":"cf-nel","max_age":604800}
cache-control
max-age=315360000
cf-ray
834f1bf77b386638-AMS
expires
Thu, 31 Dec 2037 23:55:55 GMT
truncated
/ 		350 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
7bdc4fd1b52f88617553782da88299fc8551f6921d5a30c5a29b96cb8b4c3eae

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ 		234 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
5486d67c53956813c2ab1fdef773516ee85aff7adae4ae0186cf09e398c1e28f

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Content-Type
image/png
QGYsz_wNahGAdqQ43Rh_fKDp.woff2
fonts.gstatic.com/s/worksans/v19/ 		49 KB
50 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/worksans/v19/QGYsz_wNahGAdqQ43Rh_fKDp.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Work+Sans:100,200,300,400,500,600,700,800,900|Work+Sans:100,200,300,400,500,600,700,800,900
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
6912f7388531e949bd5406b5668cd6b55fea4cc7e2d123dbaed489054dd98438
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://yoroi.company
accept-language
nl-NL,nl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Sat, 09 Dec 2023 06:00:54 GMT
x-content-type-options
nosniff
age
378314
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
50668
x-xss-protection
0
last-modified
Thu, 14 Sep 2023 01:13:52 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 08 Dec 2024 06:00:54 GMT
vettaIMG.png
i0.wp.com/yoroi.company/wp-content/uploads/2023/12/ 		58 KB
59 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://i0.wp.com/yoroi.company/wp-content/uploads/2023/12/vettaIMG.png?w=480&ssl=1
Requested by
Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
i1.wp.com
Software
nginx /
Resource Hash
c59f8ce89d8016bba0fd065c18aa463688563cf18eb79226df9cb62e8e096533
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://yoroi.company/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Wed, 13 Dec 2023 15:06:08 GMT
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=86400
content-length
59670
x-nc
HIT ams 8
last-modified
Mon, 11 Dec 2023 15:54:17 GMT
server
nginx
etag
"6e795eaf230cfa34"
vary
Accept
access-control-allow-methods
GET, HEAD
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=63115200
timing-allow-origin
*
link
<https://yoroi.company/wp-content/uploads/2023/12/vettaIMG.png>; rel="canonical"
expires
Thu, 11 Dec 2025 03:54:17 GMT
insight.min.js
snap.licdn.com/li.lms-analytics/ 		42 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by
Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:3100::1735:2a40 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
f3b0e2a3800f73c56a4dc78562fc32130a8eec6887982d10e6a5dcf6497969c6
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://yoroi.company/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Wed, 13 Dec 2023 15:06:08 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Wed, 13 Dec 2023 13:09:33 GMT
x-cdn
AKAM
x-amz-server-side-encryption
AES256
vary
Accept-Encoding
content-type
application/javascript;charset=utf-8
cache-control
max-age=79407
accept-ranges
bytes
content-length
15541
recaptcha__nl.js
www.gstatic.com/recaptcha/releases/cwQvQhsy4_nYdnSDY4u7O5_B/ 		502 KB
202 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.gstatic.com/recaptcha/releases/cwQvQhsy4_nYdnSDY4u7O5_B/recaptcha__nl.js
Requested by
Host: www.google.com
URL: https://www.google.com/recaptcha/api.js?render=6LfTr-AUAAAAANb_RvhTeWu00N_K6josD9XFY1OD&ver=3.0
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81c::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e3f281a93c5293be122ec933426887f46ae314ffada3e3da98ac76f5ee5992cd
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://yoroi.company/
Origin
https://yoroi.company
accept-language
nl-NL,nl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Tue, 12 Dec 2023 08:54:17 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
108711
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
206030
x-xss-protection
0
last-modified
Mon, 04 Dec 2023 17:08:31 GMT
server
sffe
cross-origin-opener-policy
same-origin-allow-popups; report-to="recaptcha"
vary
Accept-Encoding
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Wed, 11 Dec 2024 08:54:17 GMT
collect
px4.ads.linkedin.com/
Redirect Chain
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=3795428&time=1702479968151&url=https%3A%2F%2Fyoroi.company%2Fen%2Fresearch%2Funveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-throu...
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=3795428&time=1702479968151&url=https%3A%2F%2Fyoroi.company%2Fen%2Fresearch%2Funveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-throu...
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D3795428%26time%3D1702479968151%26url%3Dhttps%253A%252F%252Fyoroi.company%252Fen%2...
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=3795428&time=1702479968151&url=https%3A%2F%2Fyoroi.company%2Fen%2Fresearch%2Funveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-throu...
  • https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=3795428&time=1702479968151&url=https%3A%2F%2Fyoroi.company%2Fen%2Fresearch%2Funveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-thro...
0
267 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=3795428&time=1702479968151&url=https%3A%2F%2Fyoroi.company%2Fen%2Fresearch%2Funveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives%2F&cookiesTest=true&liSync=true&e_ipv6=AQLZcUqLZAXY7QAAAYxjtrpZtfSAaDTkx2T7bo11eW260kmT_MaW4jaj3HhyFDbEdY3abA
Requested by
Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
Protocol
H2
Server
13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://yoroi.company/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Wed, 13 Dec 2023 15:06:08 GMT
x-li-pop
afd-prod-lva1-x
x-msedge-ref
Ref A: B052A25CED8C4AC0B88D38684DBC66BF Ref B: AMS04EDGE1210 Ref C: 2023-12-13T15:06:09Z
linkedin-action
1
x-cache
CONFIG_NOCACHE
content-type
application/javascript
x-li-fabric
prod-lva1
x-li-proto
http/2
content-length
0
x-li-uuid
AAYMZYHK2meBV4jJv7GvHA==

Redirect headers

date
Wed, 13 Dec 2023 15:06:07 GMT
x-li-pop
afd-prod-lva1-x
x-msedge-ref
Ref A: 8B463818B27B4A1BA7B53EE639AFBE6C Ref B: AMS04EDGE2609 Ref C: 2023-12-13T15:06:08Z
linkedin-action
1
x-cache
CONFIG_NOCACHE
x-li-fabric
prod-lva1
location
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=3795428&time=1702479968151&url=https%3A%2F%2Fyoroi.company%2Fen%2Fresearch%2Funveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives%2F&cookiesTest=true&liSync=true&e_ipv6=AQLZcUqLZAXY7QAAAYxjtrpZtfSAaDTkx2T7bo11eW260kmT_MaW4jaj3HhyFDbEdY3abA
x-li-proto
http/2
content-length
0
x-li-uuid
AAYMZYHHAEGDEZctgPRpDg==
g.gif
pixel.wp.com/ 		50 B
153 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.wp.com/g.gif?v=ext&blog=151656741&post=7796&tz=2&srv=yoroi.company&hp=atomic&ac=2&amp=0&j=1%3A13.0-a.1&host=yoroi.company&ref=&fcp=0&rand=0.8168455656301814
Requested by
Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://yoroi.company/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

access-control-allow-origin
*
date
Wed, 13 Dec 2023 15:06:08 GMT
cache-control
no-cache
server
nginx
content-length
50
content-type
image/gif
schema
yoroi.company/wp-json/contact-form-7/v1/contact-forms/223/feedback/ 		476 B
944 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://yoroi.company/wp-json/contact-form-7/v1/contact-forms/223/feedback/schema
Requested by
Host: yoroi.company
URL: https://yoroi.company/wp-content/plugins/contact-form-7/includes/js/index.js?ver=5.8.4
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9b53ba79fa63e6281e11715289c6da0ab79aeb98f98b3901685efbd32e708791
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff

Request headers

Accept
application/json, */*;q=0.1
Referer
https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
accept-language
nl-NL,nl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

x-nananana
Batcache-Hit
date
Wed, 13 Dec 2023 15:06:08 GMT
strict-transport-security
max-age=31536000
x-hacker
Want root? Visit join.a8c.com and mention this header.
x-content-type-options
nosniff
x-ac
2.ams _atomic_ams BYPASS
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-cache-status
DYNAMIC
content-encoding
br
host-header
WordPress.com
alt-svc
h3=":443"; ma=86400
last-modified
Wed, 13 Dec 2023 15:01:44 GMT
server
cloudflare
vary
Accept-Encoding, Cookie, Origin
allow
GET
content-type
application/json; charset=UTF-8
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mTJBofozQ0gME%2FGZo19El7F9WWQPyNPVdbubgMxbaM6Uc59kAsZbsaojbOZ%2FcelA8rXp4JNv8sigK%2BRfWPLKIzU7%2FQCRoe9wjXMbeTjeQZBKBmQsImVRO0FlCGVYlRnUTldde9Z6iMxBya51"}],"group":"cf-nel","max_age":604800}
access-control-expose-headers
X-WP-Total, X-WP-TotalPages, Link
cache-control
max-age=36, must-revalidate
x-robots-tag
noindex
link
<https://yoroi.company/wp-json/>; rel="https://api.w.org/"
access-control-allow-headers
Authorization, X-WP-Nonce, Content-Disposition, Content-MD5, Content-Type
cf-ray
834f1bf91d586638-AMS
main.js
yoroi.company/cdn-cgi/challenge-platform/scripts/jsd/ Frame A2C6 		0
0
cookie-law-info-table.css
yoroi.company/wp-content/plugins/cookie-law-info/public/css/ 		6 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://yoroi.company/wp-content/plugins/cookie-law-info/public/css/cookie-law-info-table.css?ver=2.1.3
Requested by
Host: c0.wp.com
URL: https://c0.wp.com/c/6.4.2/wp-includes/js/jquery/jquery.min.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2e2f2336b5e6698b628afc75fa9a24c67b73d5872c1d4af99ca436064f636ee0
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Wed, 13 Dec 2023 15:06:08 GMT
strict-transport-security
max-age=31536000
x-ac
2.ams _atomic_ams BYPASS
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
1141807
content-encoding
br
alt-svc
h3=":443"; ma=86400
last-modified
Thu, 22 Sep 2022 14:31:50 GMT
server
cloudflare
etag
W/"632c71d6-17e1"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
text/css
access-control-allow-origin
*
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=A12BNQQgia1ZtrPv79T32WcL2m3%2FhQ0kZoOJaPKpAKjGxUysDORoyM%2BGtA2mt2tg%2BwPPxavipqo1MGp%2Bw90V5AM01tzr%2FfCVm%2FG7Oq76M%2F7%2FyAP5txxZ99mzewiiwBZJ2XnYkrVsNTx4ZalG"}],"group":"cf-nel","max_age":604800}
cache-control
max-age=315360000
cf-ray
834f1bf95da46638-AMS
expires
Thu, 31 Dec 2037 23:55:55 GMT
anchor
www.google.com/recaptcha/api2/ Frame 982B 		41 KB
26 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfTr-AUAAAAANb_RvhTeWu00N_K6josD9XFY1OD&co=aHR0cHM6Ly95b3JvaS5jb21wYW55OjQ0Mw..&hl=nl&v=cwQvQhsy4_nYdnSDY4u7O5_B&size=invisible&cb=4lur5zucfw95
Requested by
Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/cwQvQhsy4_nYdnSDY4u7O5_B/recaptcha__nl.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:828::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
8af8adad18e5e3104c9864f0274518d67db4c4fe3c6602d372e5334ec4752e8d
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-ayl_9zBLLbAfFoUi9M4Tgw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://yoroi.company/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language
nl-NL,nl;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
no-cache, no-store, max-age=0, must-revalidate
content-encoding
gzip
content-security-policy
script-src 'report-sample' 'nonce-ayl_9zBLLbAfFoUi9M4Tgw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type
text/html; charset=utf-8
cross-origin-embedder-policy
require-corp
cross-origin-resource-policy
cross-origin
date
Wed, 13 Dec 2023 15:06:08 GMT
expires
Mon, 01 Jan 1990 00:00:00 GMT
pragma
no-cache
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server
GSE
x-content-type-options
nosniff
x-xss-protection
1; mode=block
styles__ltr.css
www.gstatic.com/recaptcha/releases/cwQvQhsy4_nYdnSDY4u7O5_B/ Frame 982B 		55 KB
24 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.gstatic.com/recaptcha/releases/cwQvQhsy4_nYdnSDY4u7O5_B/styles__ltr.css
Requested by
Host: www.google.com
URL: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfTr-AUAAAAANb_RvhTeWu00N_K6josD9XFY1OD&co=aHR0cHM6Ly95b3JvaS5jb21wYW55OjQ0Mw..&hl=nl&v=cwQvQhsy4_nYdnSDY4u7O5_B&size=invisible&cb=4lur5zucfw95
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:81c::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
7859a62e04b0acb06516eb12454de6673883ecfaeaed6c254659bca7cd59c050
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.google.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Wed, 13 Dec 2023 14:03:23 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
3765
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
24606
x-xss-protection
0
last-modified
Mon, 04 Dec 2023 17:08:31 GMT
server
sffe
cross-origin-opener-policy
same-origin-allow-popups; report-to="recaptcha"
vary
Accept-Encoding
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type
text/css
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Thu, 12 Dec 2024 14:03:23 GMT
recaptcha__nl.js
www.gstatic.com/recaptcha/releases/cwQvQhsy4_nYdnSDY4u7O5_B/ Frame 982B 		502 KB
201 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.gstatic.com/recaptcha/releases/cwQvQhsy4_nYdnSDY4u7O5_B/recaptcha__nl.js
Requested by
Host: www.google.com
URL: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfTr-AUAAAAANb_RvhTeWu00N_K6josD9XFY1OD&co=aHR0cHM6Ly95b3JvaS5jb21wYW55OjQ0Mw..&hl=nl&v=cwQvQhsy4_nYdnSDY4u7O5_B&size=invisible&cb=4lur5zucfw95
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:81c::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e3f281a93c5293be122ec933426887f46ae314ffada3e3da98ac76f5ee5992cd
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.google.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Tue, 12 Dec 2023 08:54:17 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
108711
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
206030
x-xss-protection
0
last-modified
Mon, 04 Dec 2023 17:08:31 GMT
server
sffe
cross-origin-opener-policy
same-origin-allow-popups; report-to="recaptcha"
vary
Accept-Encoding
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Wed, 11 Dec 2024 08:54:17 GMT
kn2owPU74JTsOwTGty0aoUlXRSKSJihCWxBMzE3aLQs.js
www.google.com/js/bg/ Frame 982B 		17 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google.com/js/bg/kn2owPU74JTsOwTGty0aoUlXRSKSJihCWxBMzE3aLQs.js
Requested by
Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/cwQvQhsy4_nYdnSDY4u7O5_B/recaptcha__nl.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:828::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
927da8c0f53be094ec3b04c6b72d1aa149574522922628425b104ccc4dda2d0b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfTr-AUAAAAANb_RvhTeWu00N_K6josD9XFY1OD&co=aHR0cHM6Ly95b3JvaS5jb21wYW55OjQ0Mw..&hl=nl&v=cwQvQhsy4_nYdnSDY4u7O5_B&size=invisible&cb=4lur5zucfw95
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Mon, 11 Dec 2023 15:24:10 GMT
content-encoding
br
x-content-type-options
nosniff
age
171718
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
6851
x-xss-protection
0
last-modified
Tue, 28 Nov 2023 18:30:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="botguard-scs"
vary
Accept-Encoding
report-to
{"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Tue, 10 Dec 2024 15:24:10 GMT
logo_48.png
www.gstatic.com/recaptcha/api2/ Frame 982B 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.gstatic.com/recaptcha/api2/logo_48.png
Requested by
Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/cwQvQhsy4_nYdnSDY4u7O5_B/styles__ltr.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:81c::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
1b9efb22c938500971aac2b2130a475fa23684dd69e43103894968df83145b8a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.gstatic.com/recaptcha/releases/cwQvQhsy4_nYdnSDY4u7O5_B/styles__ltr.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Mon, 11 Dec 2023 21:09:58 GMT
x-content-type-options
nosniff
age
150970
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
2228
x-xss-protection
0
last-modified
Tue, 03 Mar 2020 20:15:00 GMT
server
sffe
cross-origin-opener-policy
same-origin-allow-popups; report-to="recaptcha"
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type
image/png
cache-control
public, max-age=604800
accept-ranges
bytes
expires
Mon, 18 Dec 2023 21:09:58 GMT
KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v18/ Frame 982B 		15 KB
15 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2
Requested by
Host: www.google.com
URL: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfTr-AUAAAAANb_RvhTeWu00N_K6josD9XFY1OD&co=aHR0cHM6Ly95b3JvaS5jb21wYW55OjQ0Mw..&hl=nl&v=cwQvQhsy4_nYdnSDY4u7O5_B&size=invisible&cb=4lur5zucfw95
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.google.com/
Origin
https://www.google.com
accept-language
nl-NL,nl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Thu, 07 Dec 2023 23:26:56 GMT
x-content-type-options
nosniff
age
488352
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
15344
x-xss-protection
0
last-modified
Mon, 16 Oct 2017 17:32:55 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 06 Dec 2024 23:26:56 GMT
KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v18/ Frame 982B 		15 KB
15 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2
Requested by
Host: www.google.com
URL: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfTr-AUAAAAANb_RvhTeWu00N_K6josD9XFY1OD&co=aHR0cHM6Ly95b3JvaS5jb21wYW55OjQ0Mw..&hl=nl&v=cwQvQhsy4_nYdnSDY4u7O5_B&size=invisible&cb=4lur5zucfw95
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
5a8c1e7681318caa29e9f44e8a6e271f6a4067a2703e9916dfd4fe9099241db7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.google.com/
Origin
https://www.google.com
accept-language
nl-NL,nl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Wed, 06 Dec 2023 21:01:27 GMT
x-content-type-options
nosniff
age
583481
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
15552
x-xss-protection
0
last-modified
Mon, 16 Oct 2017 17:33:02 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Thu, 05 Dec 2024 21:01:27 GMT
webworker.js
www.google.com/recaptcha/api2/ Frame 982B 		102 B
134 B 		Other
General
Check archive.org
Download Go to
Full URL
https://www.google.com/recaptcha/api2/webworker.js?hl=nl&v=cwQvQhsy4_nYdnSDY4u7O5_B
Requested by
Host: www.google.com
URL: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfTr-AUAAAAANb_RvhTeWu00N_K6josD9XFY1OD&co=aHR0cHM6Ly95b3JvaS5jb21wYW55OjQ0Mw..&hl=nl&v=cwQvQhsy4_nYdnSDY4u7O5_B&size=invisible&cb=4lur5zucfw95
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:828::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
5ae64d93a741f65b963259f6f6985cf60f834b4966e67c65dc68a3de17674baf
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfTr-AUAAAAANb_RvhTeWu00N_K6josD9XFY1OD&co=aHR0cHM6Ly95b3JvaS5jb21wYW55OjQ0Mw..&hl=nl&v=cwQvQhsy4_nYdnSDY4u7O5_B&size=invisible&cb=4lur5zucfw95
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Wed, 13 Dec 2023 15:06:08 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy
frame-ancestors 'self'
server
GSE
cross-origin-embedder-policy
require-corp
x-frame-options
SAMEORIGIN
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type
text/javascript; charset=utf-8
cache-control
private, max-age=300
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
1; mode=block
expires
Wed, 13 Dec 2023 15:06:08 GMT
/
px.ads.linkedin.com/wa/ 		0
195 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://px.ads.linkedin.com/wa/
Requested by
Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept
*
Referer
https://yoroi.company/
accept-language
nl-NL,nl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

date
Wed, 13 Dec 2023 15:06:08 GMT
x-li-pop
afd-prod-lva1-x
x-msedge-ref
Ref A: 700D91CE3D6742DAAD91D6554605F3C3 Ref B: AMS04EDGE2609 Ref C: 2023-12-13T15:06:09Z
linkedin-action
1
vary
Origin
x-cache
CONFIG_NOCACHE
x-li-fabric
prod-lva1
access-control-allow-origin
https://yoroi.company
x-li-proto
http/2
access-control-allow-credentials
true
x-li-uuid
AAYMZYHNZTDkLtsGYGoKXQ==
refill
yoroi.company/wp-json/contact-form-7/v1/contact-forms/223/ 		2 B
776 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://yoroi.company/wp-json/contact-form-7/v1/contact-forms/223/refill
Requested by
Host: yoroi.company
URL: https://yoroi.company/wp-content/plugins/contact-form-7/includes/js/index.js?ver=5.8.4
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff

Request headers

Accept
application/json, */*;q=0.1
Referer
https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
accept-language
nl-NL,nl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

x-nananana
Batcache-Hit
date
Wed, 13 Dec 2023 15:06:09 GMT
strict-transport-security
max-age=31536000
x-hacker
Want root? Visit join.a8c.com and mention this header.
x-content-type-options
nosniff
x-ac
2.ams _atomic_ams BYPASS
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-cache-status
DYNAMIC
content-encoding
br
host-header
WordPress.com
alt-svc
h3=":443"; ma=86400
last-modified
Wed, 13 Dec 2023 15:05:58 GMT
server
cloudflare
vary
Accept-Encoding, Cookie, Origin
allow
GET
content-type
application/json; charset=UTF-8
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=T4WtHh9B4d%2BAwjwGLMCTfbiw%2Br5dSchOrrRRqE3SadxYxbf721uNuSX%2FM7VLq1qbeOESSnO8AbBeceFPuAmJQQKB44tRm2CnrdWg5F6QKHJM1y6vTxPki%2FCfHVR%2Fjqe%2Fgf%2F6sV3l2Esf%2BmYE"}],"group":"cf-nel","max_age":604800}
access-control-expose-headers
X-WP-Total, X-WP-TotalPages, Link
cache-control
max-age=289, must-revalidate
x-robots-tag
noindex
link
<https://yoroi.company/wp-json/>; rel="https://api.w.org/"
access-control-allow-headers
Authorization, X-WP-Nonce, Content-Disposition, Content-MD5, Content-Type
cf-ray
834f1bff5cef6638-AMS
t.gif
pixel.wp.com/ 		43 B
146 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.wp.com/t.gif?blog=151656741&post=7796&blog_id=151656741&jetpack_version=13.0-a.1&_ui=lBkqHpm9UizZhNX%2B7zEpUDMI&_ut=anon&_en=jetpack_pageview_timing&_ts=1702479969276&_tz=-1&_lg=en-US&_pf=Win32&_ht=1200&_wd=1600&_sx=0&_sy=0&_dl=https%3A%2F%2Fyoroi.company%2Fen%2Fresearch%2Funveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives%2F&_dr=&conn_type=4g&conn_downlink=10&protocol=h2&dns_latency=0&conn_latency=79&resp_latency=175&resp_duration=107&dom_interact=1176&dom_load=1179&page_load=2180&files_origin=48&files_ext=17&files_ssl=65&files_http1=7&files_http2=39&files_js=29&files_css=22&files_img=6&files_font=0&files_other=8&duration_js=8341&duration_css=2780&duration_img=1102&duration_font=0&duration_other=2492&first_paint=995&first_cf_paint=1295&rand=0.8291117364283278
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://yoroi.company/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

access-control-allow-origin
*
date
Wed, 13 Dec 2023 15:06:09 GMT
cache-control
no-cache
server
nginx
content-length
43
content-type
image/gif
reload
www.google.com/recaptcha/api2/ Frame 982B 		13 KB
9 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.google.com/recaptcha/api2/reload?k=6LfTr-AUAAAAANb_RvhTeWu00N_K6josD9XFY1OD
Requested by
Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/cwQvQhsy4_nYdnSDY4u7O5_B/recaptcha__nl.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:828::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
b321c3fddb695f19760c4c2e43d3bb498140ca06a5bd2425f3c98ba31d43db69
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfTr-AUAAAAANb_RvhTeWu00N_K6josD9XFY1OD&co=aHR0cHM6Ly95b3JvaS5jb21wYW55OjQ0Mw..&hl=nl&v=cwQvQhsy4_nYdnSDY4u7O5_B&size=invisible&cb=4lur5zucfw95
accept-language
nl-NL,nl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type
application/x-protobuffer

Response headers

date
Wed, 13 Dec 2023 15:06:09 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy
frame-ancestors 'self'
server
GSE
x-frame-options
SAMEORIGIN
content-type
application/json; charset=utf-8
cache-control
private, max-age=0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
1; mode=block
expires
Wed, 13 Dec 2023 15:06:09 GMT
boom.gif
pixel.wp.com/ 		0
81 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.wp.com/boom.gif?bilmur=1&cumulative_layout_shift=0&largest_contentful_paint=1295&batcache_hit=1&provider=wordpress.com&service=atomic&effective_connection_type=4g&rtt=0&downlink=10000&host_name=yoroi.company&url_path=%2Fen%2Fresearch%2Funveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives%2F&nt_fetchStart=186&nt_domainLookupStart=189&nt_domainLookupEnd=189&nt_connectStart=189&nt_connectEnd=268&nt_secureConnectionStart=216&nt_requestStart=275&nt_responseStart=450&nt_responseEnd=557&nt_domLoading=454&nt_domInteractive=1176&nt_domContentLoadedEventStart=1179&nt_domContentLoadedEventEnd=1197&nt_domComplete=2180&nt_loadEventStart=2180&nt_loadEventEnd=2183&nt_redirectCount=0&nt_nextHopProtocol=h2&nt_api_level=2&start_render=995&first_contentful_paint=1295&resource_size=1743936&resource_transferred=460107&resource_cache_percent=0&js_size=472026&js_transferred=156324&js_cache_percent=0&blocking_size=1268248&blocking_transferred=194203&blocking_cache_percent=0&last_resource_end=2329
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://yoroi.company/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

access-control-allow-origin
*
date
Wed, 13 Dec 2023 15:06:11 GMT
cache-control
no-cache
server
nginx

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
yoroi.company
URL
https://yoroi.company/cdn-cgi/challenge-platform/scripts/jsd/main.js

Verdicts & Comments Add Verdict or Comment

70 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 object| documentPictureInPicture undefined| $ function| jQuery object| Cli_Data object| cli_cookiebar_settings object| log_object object| CLI_Cookie object| CLI object| cliBlocker string| CLI_ACCEPT_COOKIE_NAME string| CLI_PREFERNCE_COOKIE number| CLI_ACCEPT_COOKIE_EXPIRE boolean| CLI_COOKIEBAR_AS_POPUP object| mailup_params object| AOS function| Parallax object| lazyLoadOptions string| _linkedin_partner_id object| _linkedin_data_partner_ids function| lintrk object| swv object| wpcf7 function| _toConsumableArray function| _nonIterableSpread function| _iterableToArray function| _arrayWithoutHoles function| _extends function| _typeof function| LazyLoad object| ___grecaptcha_cfg object| grecaptcha string| __recaptcha_api boolean| __google_recaptcha_client object| runtime object| regeneratorRuntime object| wpcf7_recaptcha object| html5 object| Modernizr object| bodyScrollLock object| classie object| iNoBounce object| YTPlayer object| SM_Timer function| getWindowScrollTop function| setWindowScrollTop function| getScrollTop function| setScrollTop object| SlickMenu object| _stq object| SM_VARS object| SM object| cursor boolean| _already_called_lintrk function| st_go function| linktracker_init object| wpcom string| currentText string| categoryCookie object| categoryCookieValue object| cli_chkbox_elm string| cli_chkbox_data_id string| cli_chkbox_data_id_trimmed object| srcReplaceableElms function| oxyCloseModal object| recaptcha object| closure_lm_602062 object| ORIBILI

14 Cookies

Domain/Path Name / Value
www.google.com/recaptcha Name: _GRECAPTCHA
Value: 09APfP6pVknCzH0T1mttvi1tVVM39m4nRbiEjKYQ5aa5y6VPMUVqbx-fLZpTUsh6kJ6QWfZgBWEgBgZHt274VZBCU
yoroi.company/ Name: pll_language
Value: en
yoroi.company/ Name: cookielawinfo-checkbox-necessary
Value: yes
yoroi.company/ Name: cookielawinfo-checkbox-performance
Value: no
yoroi.company/ Name: cookielawinfo-checkbox-advertisement
Value: no
yoroi.company/ Name: cookielawinfo-checkbox-others
Value: no
yoroi.company/ Name: cookielawinfo-checkbox-analytics-it
Value: no
.linkedin.com/ Name: li_sugr
Value: 54601808-6d1a-4cbb-ad59-79c3013ab230
.linkedin.com/ Name: bcookie
Value: "v=2&82587356-b29e-40d1-88ea-5613a3b9e280"
.linkedin.com/ Name: lidc
Value: "b=VGST09:s=V:r=V:a=V:p=V:g=2741:u=1:x=1:i=1702479968:t=1702566368:v=2:sig=AQHLT7cbktsbieohywxpqPl8pkPxpDll"
.linkedin.com/ Name: UserMatchHistory
Value: AQK_cpAS6vMKlQAAAYxjtrkqyrcXQ2aCZQlGExPdjeZk_mdUS3erlfgiw5McS8qF1dJqcZAfYw0sNw
.linkedin.com/ Name: AnalyticsSyncHistory
Value: AQIG_3ep5SY7PwAAAYxjtrkqzyBF7-SaOhaxdD-tRvAeio_YYlAuLIFg5S3UXAnjdwHq3VXwWGRNTFePFzT6Xw
.www.linkedin.com/ Name: bscookie
Value: "v=1&202312131506087b95db3f-4b70-437b-8608-7aef794434beAQGt8WeVSm7-LY2koGa75G1c3wn4t9R8"
.linkedin.com/ Name: li_gc
Value: MTswOzE3MDI0Nzk5Njg7MjswMjH7m2oJn47jB6xTg79GLKI8yoOG8rcmzKxOcvdeKoP2rg==

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=31536000

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

c0.wp.com
cdn.jsdelivr.net
fonts.googleapis.com
fonts.gstatic.com
i0.wp.com
pixel.wp.com
px.ads.linkedin.com
px4.ads.linkedin.com
s0.wp.com
snap.licdn.com
stats.wp.com
www.google.com
www.gstatic.com
www.linkedin.com
yoroi.company
yoroi.company
13.107.42.14
192.0.76.3
192.0.77.2
192.0.77.32
192.0.77.37
2606:4700::6810:5614
2620:1ec:21::14
2a00:1450:4001:80f::2003
2a00:1450:4001:81c::2003
2a00:1450:4001:828::2004
2a00:1450:4001:831::200a
2a02:26f0:3100::1735:2a40
2a06:98c1:3120::3
2a06:98c1:3121::3
02e2dd08ed3c4680e621ea71891aa5675ed8afe3ea8e99dc5d4b0caa4e2ef799
03776ba2741b34dfc2f6a356327e2dc25cbb07f9138b5a779c6b187a58be39e0
048e7b54fbc9022c80b0bf1144f55baaf814f91fe575515dbd4263634317013f
058518d45e49147be19e3e9847a1bb86c2fca0e546ecf62504aea2faaee0a72e
0be502b9446e16b338d36ccadac232f4a68ab74655f98fec415ccdbbccbf5729
0d349f88844345061cef86a46e23bf67ae8ef16f7ec2453f20abe90add14655b
0f4a3ba36482c233c6d7970cd42fb5b76ea054044dbebe424176db9f176616cb
1aa8845fd06e475aefe733d4e55b36a92fcd487975049c8172341827ac9cc03e
1b9efb22c938500971aac2b2130a475fa23684dd69e43103894968df83145b8a
1c594062728319da3ecaa98c4c0b930b07d5e64207eb6e4987d4fcbff9134768
1d52e1ac7d3bc25a8b0ffc257153f9dd50249f96fe9a4df5e0d771241a69062c
1dc6d2d43514d1d8956877d1f2ef347cd5abdb8ecf8e47aba59d87b8a6da49bb
1e41b9ba20319d67b5b640af59346a76cec477cee421bfc5e05b1238eb292246
204a3227a3631e685f978c6567314a00f03a3bedbbbc947122c97bcc4ac62d9d
216728e33a7de4be9b784eff527c6ccf1658319ea78fe66a7864c0b923200252
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
270524b0d27afd1d3b6622d1a176c678daed94564c143297e217a63e21ce9820
27dd9b075cc59cf5f3c0f6ee075f4bd113782d81ce30a4f16aac669ecfdc4fa2
2deb67a6ea5e9e0e254330515f7aa291a07618b72715a63971274378cd4d06c4
2e10d353ff038c2cad3492fc17801af3e6ef2669c9e9713bdb78b1dcb104c4fe
2e2f2336b5e6698b628afc75fa9a24c67b73d5872c1d4af99ca436064f636ee0
3457140e78788c55cd49cc718bd4e91975bc7b3de7d2754dc3607563e510dced
37ff54f3c8b10b14bf9c8a54adb7cbd4551b5e94a0110174507599a405fe4320
3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc
4460f1596174d06cca957fdaca2c71e1a377cf1d6f07ee4c75ffb3bf3fc97a03
49cf0f2de45929d5674df4377cfc2363324674ca4dfdef454bc1dfeebcec9ca5
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
52a86f59fd1312a60def6374184c8055b7fa03858e8494a7c35d25f619156b0f
547dda3c14b284819be511be1e410da94a5efc6ccc4a9afe1c75394f9333191a
5486d67c53956813c2ab1fdef773516ee85aff7adae4ae0186cf09e398c1e28f
57a50c99a31ef4e89e86664e96f6dfbdde163a2eb96e88b3b492c49aa4be2f37
5a8c1e7681318caa29e9f44e8a6e271f6a4067a2703e9916dfd4fe9099241db7
5ae64d93a741f65b963259f6f6985cf60f834b4966e67c65dc68a3de17674baf
5fd50e41f2ce65b53589fb6ca59a03d2fc269d65db66f8c0b29fc5bc8ba84d08
65158a29c17b7bd93fcb3409b97eda74a7c090d932a9ce494adb9f82d737894d
655ae452d922f501b62c7028fc35e238138de989387381cc1ed9cea9085864db
6912f7388531e949bd5406b5668cd6b55fea4cc7e2d123dbaed489054dd98438
698b89c0da3d319754d6a837b5e6d4e6a42dc402d9ffd7559b8c4cb29c644340
6c52384c7b0641dd1ead85d079c22d39bcc6dc5f2537afb1e6396bb619771a3f
6cf390024b9fb02ae1756d257499f568393acc60c76ae6b13ce986a46f396e34
6f3b3eda120231c8b7775699ee027905ac6a8f998e7dddefe9bdab0a0b32219f
73a1f126cf805ced3f24d65132d3163821ed2bb33a62e83e4a305687045dcce5
7859a62e04b0acb06516eb12454de6673883ecfaeaed6c254659bca7cd59c050
7bdc4fd1b52f88617553782da88299fc8551f6921d5a30c5a29b96cb8b4c3eae
7ee08c60d39f5712a56938fda3e2ab10fe3ef23ec98aeb3c9a29e54f6f31ffe1
814005c14007af177ca97da8fdc108fa76b6765c1e2ed546280c7645a0a63ccd
83d04fa061be70b12909406d9cdb1d5ba40596f512fc3c716ae04b645527648c
8af8adad18e5e3104c9864f0274518d67db4c4fe3c6602d372e5334ec4752e8d
927da8c0f53be094ec3b04c6b72d1aa149574522922628425b104ccc4dda2d0b
97470c6fac60d3431c7309907a10d67d0356b563c7bab67f7a44301d4164ac38
9b53ba79fa63e6281e11715289c6da0ab79aeb98f98b3901685efbd32e708791
9c1989ecd392a0c54fb799409154242706940a8e6d800542ba579dfda576bb9d
b321c3fddb695f19760c4c2e43d3bb498140ca06a5bd2425f3c98ba31d43db69
b7908a015a567ec2363011df2475368dbff34360e9da3fdff50604d6395fb646
bf4d20b28de8c7f77428b24325ec3afb39b6f7e277f6b61666f3a0a17cc3b42b
c1a9a3e223bad631dff12d33b5499eb145cb08d8621c20d9d73870e78d97afe4
c21e5a2b32c47bc5f9d9efc97bc0e29fd081946d1d3ebffc5621cfafb1d3960e
c59f8ce89d8016bba0fd065c18aa463688563cf18eb79226df9cb62e8e096533
c63a636fec47c33c1f90b009d2f95830d3492083c04e429cda86914834714967
ca7752fb33cf3a98c0f29bc4eec563112025da4109a0dcc69dabf5f861751258
cb45a5a7cef4f74f99afa05c6d5c244ed8f36799f372504b042a3e7e6c3d54b7
cb6f2d32c49d1c2b25e9ffc9aaafa3f83075346c01bcd4ae6eb187392a4292cf
ccd31ffa708d025833f954b3e0560cedd58df9a0d2706b2ccee5f501c5b2467b
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
d3ad83af3a48c24913133f351cc69b135c950df64ec6f0fefd414bc79249c6ba
d51089ba164e46643145dc475cce83e53896a1e6541c68b20d841c1ab24e65b9
d947b55573f76b9876038798590599aef4ec471cd0b44a41438b02ae00fcee5b
da9ed5720b674f0d297fe621ac2d8d518c4e622bef1e9b0d4ae489dee9aa43f8
df0ec8330290d184b1084527076cb87d41b33ba706ff5ab579d761f0cb6a744b
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e3f281a93c5293be122ec933426887f46ae314ffada3e3da98ac76f5ee5992cd
f349f68dd834591897a2b648193d96446427a388772b17163e166c17bf4bb5f4
f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1
f3b0e2a3800f73c56a4dc78562fc32130a8eec6887982d10e6a5dcf6497969c6
f99ea61de5d3dbaf01e20bf1efd0b8b834bc2ca576c6e4f7b68ab25b62e73a6f
fab005de52ce54d75f373c5a020e7ddd194caea5b4bf6e87886196e5d4451adc
fbe820b6140ad28e86f34ffae507d807cf591a22697a05b71958f2014e96a9e4