www.welivesecurity.com
Open in
urlscan Pro
2600:1408:5400:22::b819:7f98
Public Scan
URL:
https://www.welivesecurity.com/en/eset-research/cursed-tapes-exploiting-evilvideo-vulnerability-telegram-android/
Submission: On July 23 via api from TR — Scanned from US
Submission: On July 23 via api from TR — Scanned from US
Summary
This website contacted 12 IPs
in 1 countries
across 9 domains to perform 50 HTTP transactions.
The main IP is 2600:1408:5400:22::b819:7f98, located in
Ashburn, United States and
belongs to AKAMAI-ASN1, NL.
The main domain is www.welivesecurity.com.
The Cisco Umbrella rank of the primary domain is 380578.
TLS certificate: Issued by Thawte TLS RSA CA G1 on January 19th 2024. Valid for: a year.
This is the only time www.welivesecurity.com was scanned on urlscan.io!
TLS certificate: Issued by Thawte TLS RSA CA G1 on January 19th 2024. Valid for: a year.
This is the only time www.welivesecurity.com was scanned on urlscan.io!
urlscan.io Verdict: No classification
Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 18 | 2600:1408:540... 2600:1408:5400:22::b819:7f98 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
| 15 | 2606:2800:11f... 2606:2800:11f:1cb7:261b:1f9c:2074:3c | 15133 (EDGECAST) (EDGECAST) | |
| 1 | 2607:f8b0:400... 2607:f8b0:400d:c02::88 | 15169 (GOOGLE) (GOOGLE) | |
| 1 | 199.232.196.134 199.232.196.134 | 54113 (FASTLY) (FASTLY) | |
| 2 | 2607:f8b0:400... 2607:f8b0:400d:c04::61 | 15169 (GOOGLE) (GOOGLE) | |
| 1 | 151.101.192.134 151.101.192.134 | 54113 (FASTLY) (FASTLY) | |
| 2 | 199.232.192.134 199.232.192.134 | 54113 (FASTLY) (FASTLY) | |
| 2 | 2620:1ec:29:1... 2620:1ec:29:1::40 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
| 2 | 2607:f8b0:400... 2607:f8b0:400d:c02::5d | 15169 (GOOGLE) (GOOGLE) | |
| 1 | 2607:f8b0:400... 2607:f8b0:400d:c07::8b | 15169 (GOOGLE) (GOOGLE) | |
| 2 | 2600:9000:250... 2600:9000:2509:ca00:6:8656:f5c0:93a1 | 16509 (AMAZON-02) (AMAZON-02) | |
| 50 | 12 |
18
2600:1408:5400:22::b819:7f98
(Ashburn, United States)
ASN20940 (AKAMAI-ASN1, NL)
ASN20940 (AKAMAI-ASN1, NL)
| www.welivesecurity.com |
15
2606:2800:11f:1cb7:261b:1f9c:2074:3c
(United States)
ASN15133 (EDGECAST, US)
ASN15133 (EDGECAST, US)
| web-assets.esetstatic.com |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 18 |
welivesecurity.com
www.welivesecurity.com — Cisco Umbrella Rank: 380578 |
1 MB |
| 17 |
esetstatic.com
web-assets.esetstatic.com cdn.esetstatic.com |
2 MB |
| 4 |
disqus.com
welivesecurity.disqus.com disqus.com — Cisco Umbrella Rank: 1722 referrer.disqus.com — Cisco Umbrella Rank: 7356 |
27 KB |
| 2 |
disquscdn.com
c.disquscdn.com — Cisco Umbrella Rank: 5377 |
839 B |
| 2 |
youtube.com
www.youtube.com — Cisco Umbrella Rank: 84 |
13 KB |
| 2 |
googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 112 |
205 KB |
| 1 |
google-analytics.com
www.google-analytics.com — Cisco Umbrella Rank: 104 |
|
| 1 |
youtube-nocookie.com
www.youtube-nocookie.com — Cisco Umbrella Rank: 4316 |
|
| 0 |
go-mpulse.net
Failed
s.go-mpulse.net Failed |
|
| 50 | 9 |
| Domain | Requested by | |
|---|---|---|
| 18 | www.welivesecurity.com |
www.welivesecurity.com
|
| 15 | web-assets.esetstatic.com |
www.welivesecurity.com
|
| 2 | c.disquscdn.com |
welivesecurity.disqus.com
|
| 2 | www.youtube.com |
www.googletagmanager.com
www.youtube.com |
| 2 | cdn.esetstatic.com |
www.googletagmanager.com
|
| 2 | referrer.disqus.com |
www.welivesecurity.com
|
| 2 | www.googletagmanager.com |
www.welivesecurity.com
www.googletagmanager.com |
| 1 | www.google-analytics.com |
www.googletagmanager.com
|
| 1 | disqus.com |
welivesecurity.disqus.com
|
| 1 | welivesecurity.disqus.com |
www.welivesecurity.com
|
| 1 | www.youtube-nocookie.com |
www.welivesecurity.com
|
| 0 | s.go-mpulse.net Failed |
www.welivesecurity.com
|
| 50 | 12 |
This site contains links to these domains. Also see Links.
| Domain |
|---|
| www.eset.com |
| github.com |
| attack.mitre.org |
| www.facebook.com |
| www.linkedin.com |
| twitter.com |
| youtube.com |
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| www.welivesecurity.com Thawte TLS RSA CA G1 |
2024-01-19 - 2025-01-18 |
a year | crt.sh |
| web-assets.esetstatic.com Thawte TLS RSA CA G1 |
2024-05-22 - 2025-05-21 |
a year | crt.sh |
| *.google.com WR2 |
2024-06-24 - 2024-09-16 |
3 months | crt.sh |
| *.disqus.com Sectigo RSA Domain Validation Secure Server CA |
2024-04-16 - 2025-04-16 |
a year | crt.sh |
| *.google-analytics.com WR2 |
2024-06-24 - 2024-09-16 |
3 months | crt.sh |
| cdn.esetstatic.com Thawte TLS RSA CA G1 |
2023-11-06 - 2024-11-05 |
a year | crt.sh |
| a.disquscdn.com Amazon RSA 2048 M01 |
2023-08-31 - 2024-09-27 |
a year | crt.sh |
This page contains 8 frames:
Primary Page:
https://www.welivesecurity.com/en/eset-research/cursed-tapes-exploiting-evilvideo-vulnerability-telegram-android/
Frame ID: F2652B535F7B2B965186781884D709E3
Requests: 46 HTTP requests in this frame
Frame:
https://www.youtube-nocookie.com/embed/8mdW3MWoeFI
Frame ID: EDBECE5B858B64C5433CB53AF704A5F2
Requests: 1 HTTP requests in this frame
Frame:
https://s.go-mpulse.net/boomerang/7R9SM-QGSYF-QDLJK-UETXR-SPM6B
Frame ID: 05247FEFD387F1DC746DD40C28FE7B90
Requests: 1 HTTP requests in this frame
Frame:
https://disqus.com/embed/comments/?base=default&f=welivesecurity&t_i=Cursed%20tapes%3A%20Exploiting%20the%20EvilVideo%20vulnerability%20on%20Telegram%20for%20Android&t_u=https%3A%2F%2Fwww.welivesecurity.com%2Fen%2Feset-research%2Fcursed-tapes-exploiting-evilvideo-vulnerability-telegram-android%2F&t_e=30615&t_d=Cursed%20tapes%3A%20Exploiting%20the%20EvilVideo%20vulnerability%20on%20Telegram%20for%20Android&t_t=30615&s_o=default&l=en
Frame ID: 38C8935F1C68C947E18AF1939044CB01
Requests: 1 HTTP requests in this frame
Frame:
data://truncated
Frame ID: 1D83C55BCB8F606A444D5D3B30ABD687
Requests: 3 HTTP requests in this frame
Frame:
data://truncated
Frame ID: 635CC00DC3B15C804ED1C35DB45A157C
Requests: 3 HTTP requests in this frame
Frame:
https://c.disquscdn.com/next/embed/styles/realtime.b23ff3c36dd0169627f8e54ca1621eca.css
Frame ID: 784272F7888681442558F19AB7D5CA61
Requests: 1 HTTP requests in this frame
Frame:
https://c.disquscdn.com/next/embed/styles/realtime.b23ff3c36dd0169627f8e54ca1621eca.css
Frame ID: 5DFB1586468D07EAD11F268B08645D59
Requests: 1 HTTP requests in this frame
Screenshot
Page Title
Cursed tapes: Exploiting the EvilVideo vulnerability on Telegram for AndroidDetected technologies
Vue.js
(JavaScript Frameworks)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- <[^>]+\sdata-v(?:ue)?-
Google Analytics
(Analytics)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
Google Tag Manager
(Tag Managers)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- googletagmanager\.com/ns\.html[^>]+></iframe>
- <!-- (?:End )?Google Tag Manager -->
- googletagmanager\.com/gtm\.js
- googletagmanager\.com/gtag/js
Page Statistics
14 Outgoing links
These are links going to different origins than the main page.
URL: https://www.eset.com/int/research/vulnerability-disclosure-policy/?utm_source=welivesecurity.com&utm_medium=referral&utm_campaign=autotagging&utm_content=eset-research&utm_term=en
Title: coordinated disclosure policy
Title: coordinated disclosure policy
Search URL Search Domain Scan URL
URL: https://www.eset.com/int/business/services/threat-intelligence/?utm_source=welivesecurity.com&utm_medium=referral&utm_campaign=wls-research&utm_content=cursed-tapes-exploiting-evilvideo-vulnerability-telegram-android&sfdccampaignid=7011n0000017htTAAQ
Title: ESET Threat Intelligence
Title: ESET Threat Intelligence
Search URL Search Domain Scan URL
URL: https://github.com/eset/malware-ioc/tree/master/evilvideo
Title: our GitHub repository
Title: our GitHub repository
Search URL Search Domain Scan URL
URL: https://attack.mitre.org/resources/versions/
Title: version 15
Title: version 15
Search URL Search Domain Scan URL
URL: https://attack.mitre.org/techniques/T1664/
Title: T1664
Title: T1664
Search URL Search Domain Scan URL
URL: https://attack.mitre.org/techniques/T1658/
Title: T1658
Title: T1658
Search URL Search Domain Scan URL
URL: https://www.facebook.com/sharer/sharer.php?u=https://www.welivesecurity.com/en/eset-research/cursed-tapes-exploiting-evilvideo-vulnerability-telegram-android/
Search URL Search Domain Scan URL
URL: https://www.linkedin.com/shareArticle?mini=true&url=https://www.welivesecurity.com/en/eset-research/cursed-tapes-exploiting-evilvideo-vulnerability-telegram-android/
Search URL Search Domain Scan URL
URL: https://twitter.com/intent/tweet?url=https://www.welivesecurity.com/en/eset-research/cursed-tapes-exploiting-evilvideo-vulnerability-telegram-android/
Search URL Search Domain Scan URL
URL: https://www.eset.com/?utm_source=welivesecurity.com&utm_medium=referral&utm_campaign=autotagging&utm_content=eset-research&utm_term=en
Title: ESET
Title: ESET
Search URL Search Domain Scan URL
URL: https://www.facebook.com/eset/
Search URL Search Domain Scan URL
URL: https://youtube.com/esetglobal
Search URL Search Domain Scan URL
URL: https://twitter.com/ESET
Search URL Search Domain Scan URL
URL: https://www.linkedin.com/company/eset
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
50 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H2 |
Primary Request
/
www.welivesecurity.com/en/eset-research/cursed-tapes-exploiting-evilvideo-vulnerability-telegram-android/ |
81 KB 27 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
FedraSansAltPro-BookLF-405f3258.woff
www.welivesecurity.com/build/assets/ |
163 KB 167 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
FedraSansAltPro-BoldLF-31f4bc72.woff
www.welivesecurity.com/build/assets/ |
162 KB 166 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
FedraSansAltPro-DemiLF-8885b886.woff
www.welivesecurity.com/build/assets/ |
164 KB 168 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
telegram-exploit-zero-day-cursed-tapes.jpeg
web-assets.esetstatic.com/tn/-x425/wls/2024/7-2024/cursed-tapes/ |
81 KB 81 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
article-header-995fa639.js
www.welivesecurity.com/build/assets/ |
442 B 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
app-6317871c.css
www.welivesecurity.com/build/assets/ |
298 KB 36 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
lukas-stefanko.jpeg
web-assets.esetstatic.com/tn/-x45/wls/2023/07/ |
1 KB 1 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
telegram-exploit-zero-day-cursed-tapes.jpeg
web-assets.esetstatic.com/tn/-x700/wls/2024/7-2024/cursed-tapes/ |
221 KB 221 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
figure-2-post-on-an-underground-forum.png
web-assets.esetstatic.com/wls/2024/7-2024/cursed-tapes/ |
21 KB 21 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
figure-3-example-of-exploit.jpeg
web-assets.esetstatic.com/wls/2024/7-2024/cursed-tapes/ |
141 KB 141 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
figure-4-telegram-warning-that-it-can-t-play-the-video.png
web-assets.esetstatic.com/wls/2024/7-2024/cursed-tapes/ |
155 KB 155 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
figure-5-telegram-requests-the-user-to-allow-it-to-install-unknown-apps.png
web-assets.esetstatic.com/wls/2024/7-2024/cursed-tapes/ |
259 KB 259 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
figure-6-request-to-install-malicious-payload-detected-as-androidspy-spymax-t-after-exploitation.png
web-assets.esetstatic.com/wls/2024/7-2024/cursed-tapes/ |
252 KB 252 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
figure-7-error-message-from-telegram-web-when-triggering-the-exploit.png
web-assets.esetstatic.com/wls/2024/7-2024/cursed-tapes/ |
65 KB 65 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
figure-8-underground-forum-post-advertising-an-android-cryptor-as-a-service.png
web-assets.esetstatic.com/wls/2024/7-2024/cursed-tapes/ |
199 KB 199 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
figure-9-telegram-version-10-14-5-chat-correctly-displaying-the-nature-of-shared-binary-file.jpeg
web-assets.esetstatic.com/wls/2024/7-2024/cursed-tapes/ |
125 KB 125 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
welivesecurity-eset-threat-intelligence.jpeg
web-assets.esetstatic.com/wls/2023/2023-12/ |
72 KB 72 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
0days-pdf.jpeg
web-assets.esetstatic.com/tn/-x82/wls/2018/05/ |
6 KB 6 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
shutterstock_1104531338.jpg
web-assets.esetstatic.com/tn/-x82/wls/2018/06/ |
5 KB 6 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
whatsapp-telegram-crypto-wallet-clippers.jpg
web-assets.esetstatic.com/tn/-x82/wls/2023/03/ |
4 KB 4 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
apt-activity-report-4523d00f.webp
www.welivesecurity.com/build/assets/ |
42 KB 46 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
app-7a4ecde0.js
www.welivesecurity.com/build/assets/ |
80 KB 25 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
search-7d9f58b7.js
www.welivesecurity.com/build/assets/ |
276 KB 88 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
_commonjsHelpers-042e6b4d.js
www.welivesecurity.com/build/assets/ |
725 B 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
prism-40494b65.css
www.welivesecurity.com/build/assets/ |
2 KB 4 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
prism-40d1b0a4.js
www.welivesecurity.com/build/assets/ |
66 KB 24 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
article-e3625c4c.css
www.welivesecurity.com/build/assets/ |
23 KB 8 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
article-fd027339.js
www.welivesecurity.com/build/assets/ |
140 KB 39 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
7R9SM-QGSYF-QDLJK-UETXR-SPM6B
s.go-mpulse.net/boomerang/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
8mdW3MWoeFI
www.youtube-nocookie.com/embed/ Frame EDBE |
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
embed.js
welivesecurity.disqus.com/ |
80 KB 26 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
7R9SM-QGSYF-QDLJK-UETXR-SPM6B
s.go-mpulse.net/boomerang/ Frame 0524 |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
671 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
FedraSansAltPro-MediumLF-261e3ac5.woff
www.welivesecurity.com/build/assets/ |
166 KB 170 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
FedraSansAltPro-BookItalicLF-4cad214a.woff
www.welivesecurity.com/build/assets/ |
162 KB 166 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
FedraSansAltPro-LightLF-ec800a5b.woff
www.welivesecurity.com/build/assets/ |
159 KB 163 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
gtm.js
www.googletagmanager.com/ |
361 KB 114 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
/
disqus.com/embed/comments/ Frame 38C8 |
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
event.gif
referrer.disqus.com/juggler/ |
43 B 339 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
event.gif
referrer.disqus.com/juggler/ |
43 B 339 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ Frame 1D83 |
3 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ Frame 1D83 |
5 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ Frame 1D83 |
155 B 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ Frame 635C |
3 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ Frame 635C |
5 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ Frame 635C |
155 B 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
js
www.googletagmanager.com/gtag/ |
258 KB 91 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
app.min.css
cdn.esetstatic.com/cookie-consent/v3/ |
21 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
app.min.js
cdn.esetstatic.com/cookie-consent/v3/ |
381 KB 140 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
iframe_api
www.youtube.com/ |
993 B 2 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
POST H2 |
collect
www.google-analytics.com/g/ |
0 0 |
Fetch
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
www-widgetapi.js
www.youtube.com/s/player/38c5c1c9/www-widgetapi.vflset/ |
31 KB 11 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
favicon.ico
www.welivesecurity.com/ |
1 KB 5 KB |
Other
image/x-icon |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
realtime.b23ff3c36dd0169627f8e54ca1621eca.css
c.disquscdn.com/next/embed/styles/ Frame 7842 |
337 B 839 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
realtime.b23ff3c36dd0169627f8e54ca1621eca.css
c.disquscdn.com/next/embed/styles/ Frame 5DFB |
337 B 0 |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
POST |
collect
www.google-analytics.com/g/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- s.go-mpulse.net
- URL
- https://s.go-mpulse.net/boomerang/7R9SM-QGSYF-QDLJK-UETXR-SPM6B
- Domain
- s.go-mpulse.net
- URL
- https://s.go-mpulse.net/boomerang/7R9SM-QGSYF-QDLJK-UETXR-SPM6B
- Domain
- www.google-analytics.com
- URL
- https://www.google-analytics.com/g/collect?v=2&tid=G-FBY6B30C4M>m=45je47h0v889440112z86269785za200zb6269785&_p=1721700471260&gcs=G101&gcd=13q3v3q3q5&npa=1&dma_cps=-&dma=0&tag_exp=0&cid=1692999151.1721700472&ul=en-us&sr=1600x1200&ir=1&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=denied&_eu=EA&ngs=1&_s=2&sid=1721700472&sct=1&seg=0&dl=https%3A%2F%2Fwww.welivesecurity.com%2Fen%2Feset-research%2Fcursed-tapes-exploiting-evilvideo-vulnerability-telegram-android%2F&dt=Cursed%20tapes%3A%20Exploiting%20the%20EvilVideo%20vulnerability%20on%20Telegram%20for%20Android&en=cookie_consent_visible&ep.branch=en&ep.page_location_noquery=https%3A%2F%2Fwww.welivesecurity.com%2Fen%2Feset-research%2Fcursed-tapes-exploiting-evilvideo-vulnerability-telegram-android%2F&ep.hostname=www.welivesecurity.com&ep.useragent=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F126.0.0.0%20Safari%2F537.36&ep.article_category=ESET%20Research&ep.article_date=2024%2F07%2F22&ep.article_section=(not%20set)&ep.author=Lukas%20Stefanko&ep.blog_length=1.5k-2k&epn.publication_id=30615&ep.cookie_consent=b%3A1%7Ca%3A0%7Cm%3A0&_et=704&tfd=7539&_z=fetch
Verdicts & Comments Add Verdict or Comment
36 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| 1 object| 2 object| 3 object| 4 object| 5 object| 6 object| 7 object| $current_language object| BOOMR_mq string| BOOMR_API_key object| BOOMR number| BOOMR_lstart function| disqus_config object| dataLayer number| uidEvent object| __VUE_INSTANCE_SETTERS__ boolean| __VUE_I18N_FULL_INSTALL__ boolean| __VUE_I18N_LEGACY_API__ boolean| __VUE__ object| Prism object| DISQUS object| google_tag_manager object| google_tag_data function| onYouTubeIframeAPIReady string| myDomain object| links object| gaGlobal object| scriptUrl object| ttPolicy object| YT object| YTConfig function| onYTReady object| regeneratorRuntime object| $cookiebar number| BOOMR_onload15 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
| Domain/Path | Expires | Name / Value |
|---|---|---|
| .welivesecurity.com/ | Name: AKA_A2 Value: A |
|
| .welivesecurity.com/ | Name: _ga Value: GA1.1.1692999151.1721700472 |
|
| .youtube.com/ | Name: YSC Value: hndTM-f3BLE |
|
| .youtube.com/ | Name: VISITOR_INFO1_LIVE Value: aQaGKJ3h99w |
|
| .youtube.com/ | Name: VISITOR_PRIVACY_METADATA Value: CgJVUxIEGgAgDg%3D%3D |
|
| .welivesecurity.com/ | Name: _ga_FBY6B30C4M Value: GS1.1.1721700472.1.0.1721700472.0.0.0 |
|
| .disqus.com/ | Name: disqus_unique Value: 1h7tfv019qj3d2 |
|
| disqus.com/ | Name: __jid Value: 1h9o2pfd6u8v3 |
|
| .pippio.com/ | Name: did Value: c8rVA_fZiXKyCDiH |
|
| .pippio.com/ | Name: didts Value: 1721700475 |
|
| .pippio.com/ | Name: nnls Value: |
|
| io.narrative.io/ | Name: io.narrative.guid.v2 Value: 604fdc10-4898-11ef-82f8-00000a0ffa4e |
|
| .rlcdn.com/ | Name: rlas3 Value: gF8t2R4a6pzC/+qAoh+3HqU/o1ckIMaAqLhMTmHHpPI= |
|
| .rlcdn.com/ | Name: pxrc Value: CPyg/LQGEgUI6AcQABIFCOhHEAA= |
|
| .pippio.com/ | Name: pxrc Value: CPug/LQGEgUIlCkQABIFCOUrEAASBQjmKxAAEgUI5ysQABIFCOgrEAASBQjpKxAAEgUI6isQABIFCOsrEAASBQjsKxAAEgUI7SsQABIFCO4rEAASBQjVQxAAEgYI36wrEAESBgjjrysQABIGCO2vKxAAEgYI7q8rEAASBgjvrysQABIGCPCvKxAAEgYI8a8rEAASBgjyrysQABIGCPOvKxAA |
17 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
| Source | Level | URL Text |
|---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
| Header | Value |
|---|---|
| Content-Security-Policy | default-src 'none'; child-src https://disqus.com https://vars.hotjar.com; connect-src 'self' http://ad.doubleclick.net https://*.akamaihd.net https://*.akstat.io https://*.eset.com https://*.hotjar.com https://*.hotjar.io https://adservice.google.com https://captcha.eset.com https://captcha.welivesecurity.com https://cc.welivesecurity.com https://cdn.esetstatic.com https://cdn.linkedin.oribi.io https://in.hotjar.com https://px.ads.linkedin.com https://region1.google-analytics.com https://stats.g.doubleclick.net https://trial-eum-clientnsv4-s.akamaihd.net https://trial-eum-clienttons-s.akamaihd.net https://vc.hotjar.io https://ws22.hotjar.com https://ws32.hotjar.com https://www.facebook.com https://www.google-analytics.com https://www.google.com https://www.googletagmanager.com https://www.opinionstage.com wss://*.hotjar.com wss://ws1.hotjar.com; font-src 'self' data: https://script.hotjar.com; form-action 'self'; frame-ancestors 'self'; frame-src 'self' https://*.slideshare.net https://bid.g.doubleclick.net https://c.disquscdn.com https://disqus.com https://m.facebook.com https://open.spotify.com/ https://platform.twitter.com https://player.vimeo.com https://share.transistor.fm https://tpc.googlesyndication.com https://vars.hotjar.com https://www.facebook.com https://www.googletagmanager.com https://www.instagram.com https://www.opinionstage.com https://www.podbean.com https://www.screencast.com https://www.slideshare.net https://www.youtube-nocookie.com https://www.youtube.com; img-src 'self' data: https://*.ads.linkedin.com https://*.esetstatic.com https://adservice.google.com https://analytics.twitter.com https://c.disquscdn.com https://captcha.welivesecurity.com https://connect.facebook.net https://googleads.g.doubleclick.net https://px.ads.linkedin.com https://referrer.disqus.com https://region1.google-analytics.com https://script.hotjar.com https://secure.eset.com https://syndication.twitter.com https://t.co https://twitter.com https://www.facebook.com https://www.google-analytics.com https://www.google.al https://www.google.ba https://www.google.bf https://www.google.bg https://www.google.by https://www.google.ca https://www.google.cd https://www.google.ch https://www.google.co.ao https://www.google.co.il https://www.google.co.in https://www.google.co.jp https://www.google.co.ke https://www.google.co.ls https://www.google.co.ma https://www.google.co.tz https://www.google.co.za https://www.google.com.af https://www.google.com.au https://www.google.com.bd https://www.google.com.bh https://www.google.com.br https://www.google.com.co https://www.google.com.do https://www.google.com.eg https://www.google.com.gi https://www.google.com.gt https://www.google.com.hk https://www.google.com.kw https://www.google.com.ly https://www.google.com.mx https://www.google.com.ni https://www.google.com.pe https://www.google.com.ph https://www.google.com.pk https://www.google.com.sa https://www.google.com.sl https://www.google.com.tr https://www.google.com.tw https://www.google.com.vn https://www.google.cv https://www.google.cz https://www.google.es https://www.google.fi https://www.google.ge https://www.google.gm https://www.google.gy https://www.google.hn https://www.google.hr https://www.google.ie https://www.google.it https://www.google.je https://www.google.jo https://www.google.kg https://www.google.lt https://www.google.lu https://www.google.lv https://www.google.md https://www.google.mw https://www.google.no https://www.google.ps https://www.google.rs https://www.google.sk https://www.google.tg https://www.google.tn https://www.googletagmanager.com https://www.hotjar.com https://www.linkedin.com https://www.youtube.com; manifest-src 'self'; media-src 'self' https://web-assets.esetstatic.com; object-src 'self' https://content.screencast.com; prefetch-src https://c.disquscdn.com https://disqus.com; script-src 'self' 'unsafe-eval' 'unsafe-inline' https://a.disquscdn.com https://assets.esetstatic.com https://cdn.esetstatic.com https://connect.facebook.net https://googleads.g.doubleclick.net https://platform.twitter.com https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tpc.googlesyndication.com https://welivesecurity.disqus.com https://www.google-analytics.com https://www.google.ie https://www.google.nl https://www.googleadservices.com https://www.googletagmanager.com https://www.instagram.com https://www.opinionstage.com https://www.youtube.com; style-src 'self' 'unsafe-inline' https://assets.esetstatic.com https://c.disquscdn.com https://cdn.esetstatic.com; worker-src 'self'; report-uri https://www-welivesecurity-com.api.cspconsole.com/v1/csp/report; report-to default; |
| Strict-Transport-Security | max-age=15724800 |
| X-Content-Type-Options | nosniff |
| X-Xss-Protection | 1; mode=block |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
c.disquscdn.com
cdn.esetstatic.com
disqus.com
referrer.disqus.com
s.go-mpulse.net
web-assets.esetstatic.com
welivesecurity.disqus.com
www.google-analytics.com
www.googletagmanager.com
www.welivesecurity.com
www.youtube-nocookie.com
www.youtube.com
s.go-mpulse.net
www.google-analytics.com
151.101.192.134
199.232.192.134
199.232.196.134
2600:1408:5400:22::b819:7f98
2600:9000:2509:ca00:6:8656:f5c0:93a1
2606:2800:11f:1cb7:261b:1f9c:2074:3c
2607:f8b0:400d:c02::5d
2607:f8b0:400d:c02::88
2607:f8b0:400d:c04::61
2607:f8b0:400d:c07::8b
2620:1ec:29:1::40
04d05978fdb111358073ab0524e5c1fafc0826615c206987618416b8bd8a4747
06d4793872942785be4a2c1f4f3336f89e092d61a5380dfc991b115545e2a881
09b97c5d8ceb96aa30b194d9ff8e9fe0bf930db76158bbe45b348736841697ae
13d1a190e6a23400b5547645f6f047e82b37c0edbadc1bc65616e3bbe245c4e8
261e3ac5dbb4ba8069ecba539a13b971d2e147981f4573e993410d8bd6de0037
31f4bc726f2849a3c8f77f8432b635d2d4529a3ff80b669fc9e21b0ed1c81ea7
35b7ed1e4bfbc258ad836ca11403bb9bec55112beeae5aee8397d4391a210ee1
3fc101b4369828ec89090f73f9f0517ae2090a3549b02f55adc30cb89e65f7ae
40494b653a0f9485c88432191eaace18e7dff8646f45114d6007fe19da129e34
405f32580b4440f0ddf2af9fcfd37fc9a863fde26b57b5623a9b188d61d47166
4523d00f830e0b1ed61aae703522b8ec315f4e5b00357656875c9148c20d988c
45308492c0fe1b391debaddeceddda36e8fec746dbfb86a743b750162aad4d4e
4cad214a2eeb48599ea314d32d2685f6554fe548be21add2f606db059530506e
522d3d35d57f506ba00e835c8d44dcd118f3ad54fe1d7ac1dd78bba95e33eda7
5339bc3238b5c32f7e74226c6845bbd2ba69722c7b6b0f7d7ddf39557235507e
5ae93490b1ec417983664c1a8944b5a04d410972491b56af740a5199f633332b
606ea62b1a8a1e2b24b9e0eafef0757cea22f73f3956d6548611f7c26c4551b5
6317871c5ca7b272b4fd676ec207449ca4e75847b4af2c95f4682e15fde4af95
644fbb688b94c602990a4988d379d439a5151ea782e06496cb6347cbbb64e49d
6572478fbf8e29ee8109a22286fd9f82330fae739c518b58d5f37df25e17ea37
6bf080531d0dffc4888f4a81b3d39485944e9b5509ce920e20c869937e924270
6fb2f34ecc07db02bbd7bdbd0cf773500ec41c2a20d00cea2c84d5fea2f52e97
715c0c7673fd9b045b513c8d460c9acde7031b61d338f6a8a646a6ac891d5af2
7808605ddd1f0eaa454aa444293d2f0260943e51e53838fca46506e6a69fe521
81b0b9aa30ff74d6e8eb03dc1ac3399d5374e3bf6d0cea7dae97de1d607d5bf3
8885b88667beb8538140ecc550853e59d12e85fbd73dd70d4487b6cc757d8a2b
8b67a0820b92ad626dd7204b203736274c68fa2cb1a107077d571e60f6dedf96
956f61e41e263b6074a58cbcb2eb181014e8c8e277388ebd98cc0d59921577f4
9f09923ecce0c7875b290814f42ae9dc07745f8e00f9ce7370f493e6b806ca7c
a34d02723e6139fb4e1f71b124e4b1216ec27b9d856255d1e45f785e0ecf8697
a7def1fa0223f6d52a8d16be0dfde290883e9e2aa7911d0bfd46141eae8beabe
c284dcb06ef882b1b45e11e0a16baa223b4117eca94e243c8e725c4ce3f909b3
c288129b76beda63b0d94f744cda300380f41f04842ddcbd507dc933fb079435
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
d4e6682435f51b57256b4fc15f3508e427051f98b8e8d9be1d543c74c7f1f681
d64c9a6c254bf65e906504f335197f521e11d4918b587545b3235a827543d360
e2a59215eee21f7bed6351d85f164c6bb74978a49f585474fe1586c81ee41118
e349768e694c7f9868300e3354d2530c21f857c267a8b497fa0007408a7355ef
e3625c4c1b10a8e8b5fb271f45549d6d68e0a9c462062fc927709ea7ab285ca5
e4222715b556e7d99622c83e620d2f8e090047e56adb07923047f95828d561f2
e9d5fa7dbd42331253c178a9fb1ce2aaac7543c8667326489b58d4ab3a51abfd
ec800a5bcb2d4e57adcc0c7ec3d69427ac3e392d4a0302891dd76fb80ffd0bfd
ed915d2176566b841f0e01e7632ce7a20b023cbcb4f5976a6015284fccd8a865
f42a1dfbcfaf42f04c1a32b2f6383182a9edbbb34f5567b846e168ebecd7faec
f46ef13eb88f1d90f737c136e9a04240c6744e5c51daccce968e54576533912e
ff8aa28fd474f1a70f496d00ac52027a1f089c82941cc4f63e43c80a0e2822d0