urlscan.io logo urlscan.io
SecurityTrails logo

yoroi.company Open in urlscan Pro
2a06:98c1:3120::3  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb...
Effective URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb...
Submission: On December 15 via api from US — Scanned from NL
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 14 IPs in 2 countries across 8 domains to perform 78 HTTP transactions. The main IP is 2a06:98c1:3120::3, located in United States and belongs to CLOUDFLARENET, US. The main domain is yoroi.company.
TLS certificate: Issued by E1 on November 8th 2023. Valid for: 3 months.
This is the only time yoroi.company was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 1 2a06:98c1:312... 13335 (CLOUDFLAR...)
46 2a06:98c1:312... 13335 (CLOUDFLAR...)
8 192.0.77.37 2635 (AUTOMATTIC)
1 2a00:1450:400... 15169 (GOOGLE)
1 192.0.77.32 2635 (AUTOMATTIC)
2 2606:4700::68... 13335 (CLOUDFLAR...)
5 2a00:1450:400... 15169 (GOOGLE)
3 192.0.76.3 2635 (AUTOMATTIC)
1 2a02:26f0:350... 20940 (AKAMAI-ASN1)
3 2a00:1450:400... 15169 (GOOGLE)
1 192.0.77.2 2635 (AUTOMATTIC)
4 2a00:1450:400... 15169 (GOOGLE)
4 5 2620:1ec:21::14 8068 (MICROSOFT...)
1 13.107.42.14 8068 (MICROSOFT...)
78 14
1    2a06:98c1:3121::3 (United States)

ASN13335 (CLOUDFLARENET, US)
yoroi.company
46    2a06:98c1:3120::3 (United States)

ASN13335 (CLOUDFLARENET, US)
yoroi.company
8    192.0.77.37 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)
PTR: wordpress.com
c0.wp.com
1    2a00:1450:4001:829::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.googleapis.com
1    192.0.77.32 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)
PTR: wordpress.com
s0.wp.com
2    2606:4700::6810:5614 (United States)

ASN13335 (CLOUDFLARENET, US)
cdn.jsdelivr.net
5    2a00:1450:4001:82f::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google.com
3    192.0.76.3 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)
stats.wp.com
pixel.wp.com
1    2a02:26f0:3500:16::215:149b (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)
snap.licdn.com
3    2a00:1450:4001:80f::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.gstatic.com
1    192.0.77.2 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)
PTR: i0.wp.com
i0.wp.com
4    2a00:1450:4001:831::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.gstatic.com
5    2620:1ec:21::14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
px.ads.linkedin.com
www.linkedin.com
1    13.107.42.14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
px4.ads.linkedin.com
Apex Domain
Subdomains		 Transfer
47 yoroi.company
yoroi.company
299 KB
13 wp.com
c0.wp.com — Cisco Umbrella Rank: 8588
s0.wp.com — Cisco Umbrella Rank: 7928
stats.wp.com — Cisco Umbrella Rank: 2814
i0.wp.com — Cisco Umbrella Rank: 3858
pixel.wp.com — Cisco Umbrella Rank: 2796
190 KB
7 gstatic.com
fonts.gstatic.com
www.gstatic.com
1 MB
6 linkedin.com
px.ads.linkedin.com — Cisco Umbrella Rank: 327
www.linkedin.com — Cisco Umbrella Rank: 629
px4.ads.linkedin.com — Cisco Umbrella Rank: 6419
5 KB
5 google.com
www.google.com — Cisco Umbrella Rank: 2
43 KB
2 jsdelivr.net
cdn.jsdelivr.net — Cisco Umbrella Rank: 313
10 KB
1 licdn.com
snap.licdn.com — Cisco Umbrella Rank: 763
15 KB
1 googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 29
1015 B
78 8
Domain Requested by
47 yoroi.company 1 redirects yoroi.company
8 c0.wp.com yoroi.company
5 www.google.com yoroi.company
www.gstatic.com
www.google.com
4 px.ads.linkedin.com 3 redirects snap.licdn.com
4 www.gstatic.com www.google.com
www.gstatic.com
3 fonts.gstatic.com fonts.googleapis.com
www.google.com
2 pixel.wp.com yoroi.company
2 cdn.jsdelivr.net yoroi.company
1 px4.ads.linkedin.com yoroi.company
1 www.linkedin.com 1 redirects
1 i0.wp.com yoroi.company
1 snap.licdn.com yoroi.company
1 stats.wp.com yoroi.company
1 s0.wp.com yoroi.company
1 fonts.googleapis.com yoroi.company
78 15
Subject Issuer Validity Valid
yoroi.company
E1		 2023-11-08 -
2024-02-06		 3 months crt.sh
*.wp.com
Sectigo ECC Domain Validation Secure Server CA		 2023-11-28 -
2024-12-28		 a year crt.sh
upload.video.google.com
GTS CA 1C3		 2023-11-20 -
2024-02-12		 3 months crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2023-05-02 -
2024-05-01		 a year crt.sh
www.google.com
GTS CA 1C3		 2023-11-20 -
2024-02-12		 3 months crt.sh
snap.licdn.com
DigiCert SHA2 Secure Server CA		 2023-12-13 -
2024-12-12		 a year crt.sh
*.gstatic.com
GTS CA 1C3		 2023-11-20 -
2024-02-12		 3 months crt.sh
www.linkedin.com
DigiCert SHA2 Secure Server CA		 2023-11-03 -
2024-05-03		 6 months crt.sh
*.google.com
GTS CA 1C3		 2023-11-20 -
2024-02-12		 3 months crt.sh

This page contains 3 frames:

Primary Page: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
Frame ID: C356E60A41B8A8B768D915D4CA15C4E0
Requests: 70 HTTP requests in this frame

Frame: https://yoroi.company/cdn-cgi/challenge-platform/scripts/jsd/main.js
Frame ID: 9E78947215FA153A4C5024704276CCF9
Requests: 1 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfTr-AUAAAAANb_RvhTeWu00N_K6josD9XFY1OD&co=aHR0cHM6Ly95b3JvaS5jb21wYW55OjQ0Mw..&hl=nl&v=cwQvQhsy4_nYdnSDY4u7O5_B&size=invisible&cb=2h4ssctf2yqs
Frame ID: 2C7318E3E677F133473F352823EF4A02
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Unveiling “Vetta Loader”: A custom loader hitting Italy and spread through infected USB Drives - Yoroilinkedinfacebookpinterestyoutubersstwitterinstagramfacebook-blankrss-blanklinkedin-blankpinterestyoutubetwitterinstagram

Page URL History Show full URLs

  1. http://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-... HTTP 301
    https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link rel=["']stylesheet["'] [^>]+/wp-(?:content|includes)/
  • /wp-(?:content|includes)/
Overall confidence: 100%
Detected patterns
  • wp-content/plugins/oxygen
Overall confidence: 100%
Detected patterns
  • <link[^>]+foundation[^>"]+css
Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
  • <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
  • (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
Overall confidence: 100%
Detected patterns
  • snap\.licdn\.com/li\.lms-analytics/insight\.min\.js
Overall confidence: 100%
Detected patterns
  • ([\d.]+)?/modernizr(?:\.([\d.]+))?.*\.js
Overall confidence: 100%
Detected patterns
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Overall confidence: 100%
Detected patterns
  • //cdn\.jsdelivr\.net/
Overall confidence: 100%
Detected patterns
  • /recaptcha/api\.js

Page Statistics

78
Requests

97 %
HTTPS

64 %
IPv6

8
Domains

15
Subdomains

14
IPs

2
Countries

1670 kB
Transfer

3178 kB
Size

14
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/ HTTP 301
    https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 66
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=3795428&time=1702614319825&url=https%3A%2F%2Fyoroi.company%2Fen%2Fresearch%2Funveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives%2F HTTP 302
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=3795428&time=1702614319825&url=https%3A%2F%2Fyoroi.company%2Fen%2Fresearch%2Funveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives%2F&cookiesTest=true HTTP 302
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D3795428%26time%3D1702614319825%26url%3Dhttps%253A%252F%252Fyoroi.company%252Fen%252Fresearch%252Funveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives%252F%26cookiesTest%3Dtrue%26liSync%3Dtrue HTTP 302
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=3795428&time=1702614319825&url=https%3A%2F%2Fyoroi.company%2Fen%2Fresearch%2Funveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives%2F&cookiesTest=true&liSync=true HTTP 302
  • https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=3795428&time=1702614319825&url=https%3A%2F%2Fyoroi.company%2Fen%2Fresearch%2Funveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives%2F&cookiesTest=true&liSync=true&e_ipv6=AQK5vrRlms6YbgAAAYxruMV3v_yABsVLh4Dnu5kJvUqiDa0XJXtSrVXoYRh3bw5SXzIW5a4

78 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
Redirect Chain
  • http://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
  • https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
212 KB
32 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
7d5b7824ea3c7db497bfc2acc4777d3e0839bdf626cd1bab42431e4321b63f91
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language
nl-NL,nl;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400
cache-control
max-age=289, must-revalidate
cf-cache-status
DYNAMIC
cf-ray
835bec035acc6570-AMS
content-encoding
br
content-type
text/html; charset=UTF-8
date
Fri, 15 Dec 2023 04:25:18 GMT
host-header
WordPress.com
last-modified
Fri, 15 Dec 2023 04:25:07 GMT
link
<https://yoroi.company/wp-json/>; rel="https://api.w.org/" <https://yoroi.company/wp-json/wp/v2/posts/7796>; rel="alternate"; type="application/json" <https://yoroi.company/?p=7796>; rel=shortlink
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9s7itBOtBfJOo5kV8vIdWSbQXEx79JjLLLLF%2B7daLUQaZL96SrlN24nvfMhXhQyrKSubO6R61zchkh%2BZbQ56yYr5472kAuN3AD%2Bx%2BBpmUgrPc6Ia1BMTLb5%2BaU1FXKKtzlVQ%2FBk73cIx5YNe"}],"group":"cf-nel","max_age":604800}
server
cloudflare
strict-transport-security
max-age=31536000
vary
Accept-Encoding Cookie
x-ac
2.ams _atomic_ams BYPASS
x-hacker
Want root? Visit join.a8c.com and mention this header.
x-nananana
Batcache-Hit
x-pingback
https://yoroi.company/xmlrpc.php

Redirect headers

CF-Cache-Status
DYNAMIC
CF-RAY
835bec02bdf46697-AMS
Connection
keep-alive
Content-Type
text/html
Date
Fri, 15 Dec 2023 04:25:18 GMT
Location
https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
NEL
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Report-To
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ODBfmNVpIiFw20h9EUaMYoP7Bwr9UmLjhf2NUPPt%2BZfBUoZxyPMQTJo0mJu9n4%2FUiX59vvo3O1mRHmRqM1B2HnerpQOgjVMTNNVmwOwAwkv68U8PbtgafQSOeeUon94qn7fKXbuZZnnVAYML"}],"group":"cf-nel","max_age":604800}
Server
cloudflare
Transfer-Encoding
chunked
X-ac
2.ams _atomic_ams BYPASS
alt-svc
h3=":443"; ma=86400
dashicons.min.css
c0.wp.com/c/6.4.2/wp-includes/css/ 		58 KB
35 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://c0.wp.com/c/6.4.2/wp-includes/css/dashicons.min.css
Requested by
Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.37 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
c21e5a2b32c47bc5f9d9efc97bc0e29fd081946d1d3ebffc5621cfafb1d3960e
Security Headers
Name Value
Strict-Transport-Security max-age=15552000

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://yoroi.company/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

x-nc
HIT ams 1
date
Fri, 15 Dec 2023 04:25:18 GMT
content-encoding
gzip
strict-transport-security
max-age=15552000
last-modified
Wed, 03 Mar 2021 21:16:22 GMT
server
nginx
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
text/css
access-control-allow-origin
*
cache-control
max-age=31536000
timing-allow-origin
*
alt-svc
h3=":443"; ma=86400, h3=":443"; ma=86400
expires
Sat, 14 Dec 2024 04:25:18 GMT
elusive.min.css
yoroi.company/wp-content/plugins/slick-menu/includes/modules/slick-menu-icons/includes/library/slick-menu-icon-picker/css/types/ 		12 KB
3 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://yoroi.company/wp-content/plugins/slick-menu/includes/modules/slick-menu-icons/includes/library/slick-menu-icon-picker/css/types/elusive.min.css?ver=2.0
Requested by
Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6cf390024b9fb02ae1756d257499f568393acc60c76ae6b13ce986a46f396e34
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Fri, 15 Dec 2023 04:25:18 GMT
strict-transport-security
max-age=31536000
x-ac
2.ams _atomic_ams BYPASS
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
23
content-encoding
br
alt-svc
h3=":443"; ma=86400
last-modified
Tue, 25 Jul 2023 02:32:20 GMT
server
cloudflare
etag
W/"64bf3434-31f0"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
text/css
access-control-allow-origin
*
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xsBMJrsVEBWF7lkkBluOnrv2krLponbppARPx973tI3Coco1aLJlZsNu7SirM%2BrxjlJs%2FiZgHonGr99rt1%2BYbNfNh8HCwnr3vDiQN7sLtAYawPEY0qakZsOjhsJQe0S%2F8YWFOKbzdeK8gy4J"}],"group":"cf-nel","max_age":604800}
cache-control
max-age=315360000
cf-ray
835bec044bc76570-AMS
expires
Thu, 31 Dec 2037 23:55:55 GMT
font-awesome.min.css
yoroi.company/wp-content/plugins/slick-menu/includes/modules/slick-menu-icons/includes/library/slick-menu-icon-picker/css/types/ 		28 KB
7 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://yoroi.company/wp-content/plugins/slick-menu/includes/modules/slick-menu-icons/includes/library/slick-menu-icon-picker/css/types/font-awesome.min.css?ver=4.6.3
Requested by
Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5fd50e41f2ce65b53589fb6ca59a03d2fc269d65db66f8c0b29fc5bc8ba84d08
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Fri, 15 Dec 2023 04:25:18 GMT
strict-transport-security
max-age=31536000
x-ac
2.ams _atomic_ams BYPASS
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
23
content-encoding
br
alt-svc
h3=":443"; ma=86400
last-modified
Tue, 25 Jul 2023 02:32:20 GMT
server
cloudflare
etag
W/"64bf3434-7160"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
text/css
access-control-allow-origin
*
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=SoZvGZWvx5CIlzSIohiPjf5mVH9OvUdyCboH6xuJ077kBs85wvx%2FFlRuAHXCfp0YkJ0QLkgqjqkFh3tqRYv49eRpYFKf6Cm5Mjh193S2TF4vX7Cy%2Bq%2BEnMRHkwVDn0HJPJ%2BHNWHIETeVMeek"}],"group":"cf-nel","max_age":604800}
cache-control
max-age=315360000
cf-ray
835bec044bc86570-AMS
expires
Thu, 31 Dec 2037 23:55:55 GMT
foundation-icons.min.css
yoroi.company/wp-content/plugins/slick-menu/includes/modules/slick-menu-icons/includes/library/slick-menu-icon-picker/css/types/ 		17 KB
4 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://yoroi.company/wp-content/plugins/slick-menu/includes/modules/slick-menu-icons/includes/library/slick-menu-icon-picker/css/types/foundation-icons.min.css?ver=3.0
Requested by
Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d51089ba164e46643145dc475cce83e53896a1e6541c68b20d841c1ab24e65b9
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Fri, 15 Dec 2023 04:25:18 GMT
strict-transport-security
max-age=31536000
x-ac
2.ams _atomic_ams BYPASS
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
304271
content-encoding
br
alt-svc
h3=":443"; ma=86400
last-modified
Tue, 25 Jul 2023 02:32:20 GMT
server
cloudflare
etag
W/"64bf3434-439a"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
text/css
access-control-allow-origin
*
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=WmHHq2ylN41otS6d5hMVveCTBTtVk7SUP%2BkGFrJxHg5WGp5%2B5ZjXL6rf7sMOdGBtOG1mvl20UXkONXM4xNCS1MsXcWJhKt7bo4RUCG5Qvy2GRjEsUVEiF2U1s9ZQ%2Fivr8rQ4DO74xR%2Fmwav9"}],"group":"cf-nel","max_age":604800}
cache-control
max-age=315360000
cf-ray
835bec044bc96570-AMS
expires
Thu, 31 Dec 2037 23:55:55 GMT
genericons.min.css
yoroi.company/wp-content/plugins/slick-menu/includes/modules/slick-menu-icons/includes/library/slick-menu-icon-picker/css/types/ 		26 KB
16 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://yoroi.company/wp-content/plugins/slick-menu/includes/modules/slick-menu-icons/includes/library/slick-menu-icon-picker/css/types/genericons.min.css?ver=3.4
Requested by
Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2deb67a6ea5e9e0e254330515f7aa291a07618b72715a63971274378cd4d06c4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Fri, 15 Dec 2023 04:25:18 GMT
strict-transport-security
max-age=31536000
x-ac
2.ams _atomic_ams BYPASS
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
23
content-encoding
br
alt-svc
h3=":443"; ma=86400
last-modified
Tue, 25 Jul 2023 02:32:20 GMT
server
cloudflare
etag
W/"64bf3434-683c"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
text/css
access-control-allow-origin
*
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KMoHAJJLnTAq78ReTKWsHMtxx7im%2B0Z3JmQKW%2Fhry5vw9SJy%2FpkfxXVXyOJdLg8h7x%2FQlvObP%2BrFCw1VUD1OXVt1ItXIhHDo7xBlziOT%2B1XxIG8RclkIIBnRkfEwMyFKNmlynNYRC3ESgg50"}],"group":"cf-nel","max_age":604800}
cache-control
max-age=315360000
cf-ray
835bec044bca6570-AMS
expires
Thu, 31 Dec 2037 23:55:55 GMT
extra.min.css
yoroi.company/wp-content/plugins/slick-menu/includes/modules/slick-menu-icons/css/ 		1 KB
671 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://yoroi.company/wp-content/plugins/slick-menu/includes/modules/slick-menu-icons/css/extra.min.css?ver=0.10.1
Requested by
Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
cb45a5a7cef4f74f99afa05c6d5c244ed8f36799f372504b042a3e7e6c3d54b7
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Fri, 15 Dec 2023 04:25:18 GMT
strict-transport-security
max-age=31536000
x-ac
2.ams _atomic_ams BYPASS
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
23
content-encoding
br
alt-svc
h3=":443"; ma=86400
last-modified
Tue, 25 Jul 2023 02:32:20 GMT
server
cloudflare
etag
W/"64bf3434-4cc"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
text/css
access-control-allow-origin
*
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=bGA%2B0ByYNhf0JgVK5wH%2FFrJXj8WbyuKHRBoKXz8juR8Ul3kT2uXk1Stlh2%2FlXhZeUiNceGGWr7hf%2BJdn6WzdF2I1Ybvss%2BZ%2FTCh%2Fg1Ojd4aMnt0bJoguvxWaNB6ea8HFF87ootXy65Vyqpf2"}],"group":"cf-nel","max_age":604800}
cache-control
max-age=315360000
cf-ray
835bec044bcb6570-AMS
expires
Thu, 31 Dec 2037 23:55:55 GMT
style.min.css
c0.wp.com/c/6.4.2/wp-includes/css/dist/block-library/ 		107 KB
15 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://c0.wp.com/c/6.4.2/wp-includes/css/dist/block-library/style.min.css
Requested by
Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.37 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
698b89c0da3d319754d6a837b5e6d4e6a42dc402d9ffd7559b8c4cb29c644340
Security Headers
Name Value
Strict-Transport-Security max-age=15552000

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://yoroi.company/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

x-nc
HIT ams 1
date
Fri, 15 Dec 2023 04:25:18 GMT
content-encoding
gzip
strict-transport-security
max-age=15552000
last-modified
Sun, 05 Nov 2023 19:40:32 GMT
server
nginx
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
text/css
access-control-allow-origin
*
cache-control
max-age=31536000
timing-allow-origin
*
alt-svc
h3=":443"; ma=86400, h3=":443"; ma=86400
expires
Sat, 14 Dec 2024 04:25:18 GMT
mediaelementplayer-legacy.min.css
c0.wp.com/c/6.4.2/wp-includes/js/mediaelement/ 		11 KB
3 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://c0.wp.com/c/6.4.2/wp-includes/js/mediaelement/mediaelementplayer-legacy.min.css
Requested by
Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.37 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
b7908a015a567ec2363011df2475368dbff34360e9da3fdff50604d6395fb646
Security Headers
Name Value
Strict-Transport-Security max-age=15552000

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://yoroi.company/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

x-nc
HIT ams 1
date
Fri, 15 Dec 2023 04:25:18 GMT
content-encoding
gzip
strict-transport-security
max-age=15552000
last-modified
Tue, 29 Sep 2020 15:53:06 GMT
server
nginx
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
text/css
access-control-allow-origin
*
cache-control
max-age=31536000
timing-allow-origin
*
alt-svc
h3=":443"; ma=86400, h3=":443"; ma=86400
expires
Sat, 14 Dec 2024 04:25:18 GMT
wp-mediaelement.min.css
c0.wp.com/c/6.4.2/wp-includes/js/mediaelement/ 		4 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://c0.wp.com/c/6.4.2/wp-includes/js/mediaelement/wp-mediaelement.min.css
Requested by
Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.37 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
2e10d353ff038c2cad3492fc17801af3e6ef2669c9e9713bdb78b1dcb104c4fe
Security Headers
Name Value
Strict-Transport-Security max-age=15552000

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://yoroi.company/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

x-nc
HIT ams 1
date
Fri, 15 Dec 2023 04:25:18 GMT
content-encoding
gzip
strict-transport-security
max-age=15552000
last-modified
Fri, 07 Jun 2019 20:45:02 GMT
server
nginx
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
text/css
access-control-allow-origin
*
cache-control
max-age=31536000
timing-allow-origin
*
alt-svc
h3=":443"; ma=86400, h3=":443"; ma=86400
expires
Sat, 14 Dec 2024 04:25:18 GMT
styles.css
yoroi.company/wp-content/plugins/contact-form-7/includes/css/ 		3 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://yoroi.company/wp-content/plugins/contact-form-7/includes/css/styles.css?ver=5.8.4
Requested by
Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ccd31ffa708d025833f954b3e0560cedd58df9a0d2706b2ccee5f501c5b2467b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Fri, 15 Dec 2023 04:25:18 GMT
strict-transport-security
max-age=31536000
x-ac
2.ams _atomic_ams BYPASS
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
1034628
content-encoding
br
alt-svc
h3=":443"; ma=86400
last-modified
Sat, 02 Dec 2023 18:04:43 GMT
server
cloudflare
etag
W/"656b71bb-b4e"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
text/css
access-control-allow-origin
*
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=TVGUYhvhx02ct8rCMwOoVyB3C%2B74ItS43k1yQFLZeYl08gs01rnwtGyVPQp4MT%2BvkX4CQ1ADHZYWg5cmIks0Ww1fA9LQpiVaq1BL2htoNoTU%2FE9ki5Epz%2FhQssb3zTd1niVIiHQdvrNE7GkA"}],"group":"cf-nel","max_age":604800}
cache-control
max-age=315360000
cf-ray
835bec048c106570-AMS
expires
Thu, 31 Dec 2037 23:55:55 GMT
cookie-law-info-public.css
yoroi.company/wp-content/plugins/cookie-law-info/public/css/ 		3 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://yoroi.company/wp-content/plugins/cookie-law-info/public/css/cookie-law-info-public.css?ver=2.1.3
Requested by
Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
fbe820b6140ad28e86f34ffae507d807cf591a22697a05b71958f2014e96a9e4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Fri, 15 Dec 2023 04:25:18 GMT
strict-transport-security
max-age=31536000
x-ac
2.ams _atomic_ams BYPASS
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
23
content-encoding
br
alt-svc
h3=":443"; ma=86400
last-modified
Thu, 22 Sep 2022 14:31:50 GMT
server
cloudflare
etag
W/"632c71d6-c22"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
text/css
access-control-allow-origin
*
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KltRGypYMxvK6%2BkKUKq2P4pE2BFa6s%2BvCsCiNJkfWgVqKcUETmjh9%2FiFyzq7zcfY3TFAuxe38AqzPWAVu%2BIGv3tZZJseuTulesf%2B5WExcNO0nKyrP%2BMYnGX5lhgm8bsjejGR086rNPLBI5wY"}],"group":"cf-nel","max_age":604800}
cache-control
max-age=315360000
cf-ray
835bec048c126570-AMS
expires
Thu, 31 Dec 2037 23:55:55 GMT
cookie-law-info-gdpr.css
yoroi.company/wp-content/plugins/cookie-law-info/public/css/ 		27 KB
5 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://yoroi.company/wp-content/plugins/cookie-law-info/public/css/cookie-law-info-gdpr.css?ver=2.1.3
Requested by
Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
655ae452d922f501b62c7028fc35e238138de989387381cc1ed9cea9085864db
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Fri, 15 Dec 2023 04:25:18 GMT
strict-transport-security
max-age=31536000
x-ac
2.ams _atomic_ams BYPASS
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
3170076
content-encoding
br
alt-svc
h3=":443"; ma=86400
last-modified
Thu, 22 Sep 2022 14:31:50 GMT
server
cloudflare
etag
W/"632c71d6-6a71"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
text/css
access-control-allow-origin
*
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2HI9f%2Fw%2FXteTPAWrXnNwRodMqhnsna6cdYJ6uGhBu00Z83HHPss8TUBNHSV2LRjtd0m5jgRGR5hNPiBRb0Bq8HgaIZEFavxYhCGV4MCUlCNL5ClS93kx9pINN547z5eNSyrh2rSOiMi85N%2Fd"}],"group":"cf-nel","max_age":604800}
cache-control
max-age=315360000
cf-ray
835bec048c136570-AMS
expires
Thu, 31 Dec 2037 23:55:55 GMT
mailup-public.css
yoroi.company/wp-content/plugins/mailup-email-and-newsletter-subscription-form/public/css/ 		3 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://yoroi.company/wp-content/plugins/mailup-email-and-newsletter-subscription-form/public/css/mailup-public.css?ver=1.2.5
Requested by
Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0d349f88844345061cef86a46e23bf67ae8ef16f7ec2453f20abe90add14655b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Fri, 15 Dec 2023 04:25:18 GMT
strict-transport-security
max-age=31536000
x-ac
2.ams _atomic_ams BYPASS
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
23
content-encoding
br
alt-svc
h3=":443"; ma=86400
last-modified
Thu, 30 Nov 2023 17:00:58 GMT
server
cloudflare
etag
W/"6568bfca-b1d"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
text/css
access-control-allow-origin
*
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RU%2Bz5K%2Bj%2BfdwnDfcKaYNqi7tc7jwIhH4Cdww4pUWVFBmu9elms1HLwDLW4JM2ZzqIUyDwoVhY945%2BwT1%2BYP57kCnA%2B2XfQrZViXGjtU%2F0dAFp8cX0Inu0zsabkgDhltQ11q7J7wXxiNL5kEZ"}],"group":"cf-nel","max_age":604800}
cache-control
max-age=315360000
cf-ray
835bec048c146570-AMS
expires
Thu, 31 Dec 2037 23:55:55 GMT
aos.css
yoroi.company/wp-content/plugins/oxygen/component-framework/vendor/aos/ 		25 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://yoroi.company/wp-content/plugins/oxygen/component-framework/vendor/aos/aos.css?ver=6.4.2
Requested by
Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
1aa8845fd06e475aefe733d4e55b36a92fcd487975049c8172341827ac9cc03e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Fri, 15 Dec 2023 04:25:18 GMT
strict-transport-security
max-age=31536000
x-ac
2.ams _atomic_ams BYPASS
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
23
content-encoding
br
alt-svc
h3=":443"; ma=86400
last-modified
Sun, 18 Apr 2021 08:04:29 GMT
server
cloudflare
etag
W/"607be80d-65c5"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
text/css
access-control-allow-origin
*
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qsur0typ2wgUwoXu2yEzHAEGkMBtLIUrCy2ycUGUx8eWKMw1mUZSbJf5niQ2%2FjokV%2BB29uLd7D0c7xEgjRc0N8h19edpT3Log4xI5TZmYSxzBCtA%2FluDeYwV4LziInyyEGs8%2BfKJeuD0CEpJ"}],"group":"cf-nel","max_age":604800}
cache-control
max-age=315360000
cf-ray
835bec048c156570-AMS
expires
Thu, 31 Dec 2037 23:55:55 GMT
oxygen.css
yoroi.company/wp-content/plugins/oxygen/component-framework/ 		18 KB
4 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://yoroi.company/wp-content/plugins/oxygen/component-framework/oxygen.css?ver=3.7.1
Requested by
Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3457140e78788c55cd49cc718bd4e91975bc7b3de7d2754dc3607563e510dced
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Fri, 15 Dec 2023 04:25:18 GMT
strict-transport-security
max-age=31536000
x-ac
2.ams _atomic_ams BYPASS
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
23
content-encoding
br
alt-svc
h3=":443"; ma=86400
last-modified
Sun, 18 Apr 2021 08:04:29 GMT
server
cloudflare
etag
W/"607be80d-49c8"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
text/css
access-control-allow-origin
*
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=upB0jYs4Ex0wek6RUi8dvtFZRl97BROy6ipOGo%2BdADyBhXf3%2FlDiusxhz719huQQGa4GlBJRvJONOEyObc7o8LOaFbOOAP%2BVnzjgZKVVU9KOadWIq5YCgVVWomFEr%2Bwg0MHG5s2Ec1cXrBsN"}],"group":"cf-nel","max_age":604800}
cache-control
max-age=315360000
cf-ray
835bec048c166570-AMS
expires
Thu, 31 Dec 2037 23:55:55 GMT
contact-form-7-email-spam-blocker-public.css
yoroi.company/wp-content/plugins/wp-contact-form7-email-spam-blocker/public/css/ 		98 B
403 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://yoroi.company/wp-content/plugins/wp-contact-form7-email-spam-blocker/public/css/contact-form-7-email-spam-blocker-public.css?ver=1.0.0
Requested by
Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
547dda3c14b284819be511be1e410da94a5efc6ccc4a9afe1c75394f9333191a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Fri, 15 Dec 2023 04:25:18 GMT
strict-transport-security
max-age=31536000
x-ac
2.ams _atomic_ams BYPASS
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
23
content-encoding
br
alt-svc
h3=":443"; ma=86400
last-modified
Tue, 04 Feb 2020 11:21:55 GMT
server
cloudflare
etag
W/"5e3953d3-62"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
text/css
access-control-allow-origin
*
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ENilagbdGFmLhR3TSKn8zljukU4fzbACZtWEu3rwDgGvAh30Ef4ADxwoGBupp%2B62Xu3KHVaRou%2B0rbOJo9p%2BX7UYRRIh6UND7PR6lp8laohkjMnVfWBftT0js0zRFooM7%2F6gGWfXeK2LxJ0Q"}],"group":"cf-nel","max_age":604800}
cache-control
max-age=315360000
cf-ray
835bec048c176570-AMS
expires
Thu, 31 Dec 2037 23:55:55 GMT
animate.css
yoroi.company/wp-content/plugins/slick-menu/assets/vendors/animate/ 		77 KB
5 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://yoroi.company/wp-content/plugins/slick-menu/assets/vendors/animate/animate.css?ver=1.5.2
Requested by
Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
97470c6fac60d3431c7309907a10d67d0356b563c7bab67f7a44301d4164ac38
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Fri, 15 Dec 2023 04:25:18 GMT
strict-transport-security
max-age=31536000
x-ac
2.ams _atomic_ams BYPASS
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
23
content-encoding
br
alt-svc
h3=":443"; ma=86400
last-modified
Tue, 25 Jul 2023 02:32:20 GMT
server
cloudflare
etag
W/"64bf3434-135d3"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
text/css
access-control-allow-origin
*
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=sew%2FVubvp7%2BYKQKaJMIR35KJEzoMm1kuKTq7peBf2N5pCuIUygOeE3SZN5yPFW%2FhCBrQ%2BAExgBiwnOe5n5eTA%2BePv36jd2FMpufyl8jr1fgxMI67vTb10VLl1CmLLx%2BSDAhruYK5DD6f2BUT"}],"group":"cf-nel","max_age":604800}
cache-control
max-age=315360000
cf-ray
835bec048c186570-AMS
expires
Thu, 31 Dec 2037 23:55:55 GMT
slickmenu.min.css
yoroi.company/wp-content/plugins/slick-menu/assets/css/ 		48 KB
8 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://yoroi.company/wp-content/plugins/slick-menu/assets/css/slickmenu.min.css?ver=1.5.2
Requested by
Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
02e2dd08ed3c4680e621ea71891aa5675ed8afe3ea8e99dc5d4b0caa4e2ef799
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Fri, 15 Dec 2023 04:25:18 GMT
strict-transport-security
max-age=31536000
x-ac
2.ams _atomic_ams BYPASS
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
23
content-encoding
br
alt-svc
h3=":443"; ma=86400
last-modified
Tue, 25 Jul 2023 02:32:19 GMT
server
cloudflare
etag
W/"64bf3433-be85"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
text/css
access-control-allow-origin
*
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=tHqEN3vgrM98UaxCtkhnfuR1cfY9MKh8Xi8ax7KURh8LKz7OinULUKgj%2BVWyyCWVpdAhW3LgFMmOQrcq1eu0E2bI7TStL1nWfYIt21L36jMJv0HDvIELMcx%2FS%2BiqA8%2F2RxWW1OtuRhe0Lbpw"}],"group":"cf-nel","max_age":604800}
cache-control
max-age=315360000
cf-ray
835bec048c196570-AMS
expires
Thu, 31 Dec 2037 23:55:55 GMT
twentytwenty.css
yoroi.company/wp-content/plugins/jetpack/modules/theme-tools/compat/ 		6 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://yoroi.company/wp-content/plugins/jetpack/modules/theme-tools/compat/twentytwenty.css?ver=13.0-a.1
Requested by
Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f99ea61de5d3dbaf01e20bf1efd0b8b834bc2ca576c6e4f7b68ab25b62e73a6f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Fri, 15 Dec 2023 04:25:18 GMT
strict-transport-security
max-age=31536000
x-ac
2.ams _atomic_ams BYPASS
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
203795
content-encoding
br
alt-svc
h3=":443"; ma=86400
last-modified
Tue, 09 Aug 2022 13:37:56 GMT
server
cloudflare
etag
W/"62f26334-16ea"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
text/css
access-control-allow-origin
*
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=NjzvXy7BjxH70FTqBZGPpY24eGPeGcLcWyqMKYBujdRG54XBS4wiohpkYomXcMYeSlTOJiQ5RqRC35UHFeQdFALEL%2FDmVJyw1FyehuCLxUHidpYZrzzgYs%2BHA6h1BnbsUfVBGm7mVxabCrdk"}],"group":"cf-nel","max_age":604800}
cache-control
max-age=315360000
cf-ray
835bec048c1a6570-AMS
expires
Thu, 31 Dec 2037 23:55:55 GMT
/
yoroi.company/ 		547 KB
18 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://yoroi.company/?sm_ajax=dynamic_styles&t=1702593821&ver=1.5.2
Requested by
Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
03776ba2741b34dfc2f6a356327e2dc25cbb07f9138b5a779c6b187a58be39e0
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

x-nananana
Batcache-Hit
date
Fri, 15 Dec 2023 04:25:19 GMT
strict-transport-security
max-age=31536000
x-hacker
Want root? Visit join.a8c.com and mention this header.
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-ac
2.ams _atomic_ams BYPASS
content-encoding
br
host-header
WordPress.com
alt-svc
h3=":443"; ma=86400
last-modified
Fri, 15 Dec 2023 04:24:56 GMT
server
cloudflare
vary
Cookie
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=MY5kNN%2FYrtPOPE0z2MNEc%2F4JvYqJSznlrYtEehvV4J4LqdRSvtPcXiDkKbQKnpklZ3gi055uAwBA5QjRmFUG9IUXUeHRv%2Bv%2FdUbqNXVnSrysDu1CDVL3vkIoNJ7CDxgN0J5NN%2FDy%2FmV0EZS9"}],"group":"cf-nel","max_age":604800}
content-type
text/css; charset: UTF-8;charset=utf-8
cache-control
max-age=278, must-revalidate
cf-ray
835bec04bc576570-AMS
jquery.min.js
c0.wp.com/c/6.4.2/wp-includes/js/jquery/ 		86 KB
30 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://c0.wp.com/c/6.4.2/wp-includes/js/jquery/jquery.min.js
Requested by
Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.37 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
cb6f2d32c49d1c2b25e9ffc9aaafa3f83075346c01bcd4ae6eb187392a4292cf
Security Headers
Name Value
Strict-Transport-Security max-age=15552000

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://yoroi.company/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

x-nc
HIT ams 1
date
Fri, 15 Dec 2023 04:25:18 GMT
content-encoding
gzip
strict-transport-security
max-age=15552000
last-modified
Mon, 28 Aug 2023 17:14:23 GMT
server
nginx
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=31536000
timing-allow-origin
*
alt-svc
h3=":443"; ma=86400, h3=":443"; ma=86400
expires
Sat, 14 Dec 2024 04:25:18 GMT
cookie-law-info-public.js
yoroi.company/wp-content/plugins/cookie-law-info/public/js/ 		33 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://yoroi.company/wp-content/plugins/cookie-law-info/public/js/cookie-law-info-public.js?ver=2.1.3
Requested by
Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6c52384c7b0641dd1ead85d079c22d39bcc6dc5f2537afb1e6396bb619771a3f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Fri, 15 Dec 2023 04:25:18 GMT
strict-transport-security
max-age=31536000
x-ac
2.ams _atomic_ams BYPASS
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
1451225
content-encoding
br
alt-svc
h3=":443"; ma=86400
last-modified
Thu, 22 Sep 2022 14:31:50 GMT
server
cloudflare
etag
W/"632c71d6-8583"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=uVLAWk%2FPCqloS7m0fYo2KyridHFS3tzaP5QFhrKa1PXA8gcuOm5OQZKpS2jRioxI4F0QQm%2FQFEMMQGf18rnPNUIII5r1DIESgQaNbhY62PxlV84U3BL1smHp7wueLF8sgmXbyJ7iFMwwDCPC"}],"group":"cf-nel","max_age":604800}
cache-control
max-age=315360000
cf-ray
835bec049ca766cd-AMS
expires
Thu, 31 Dec 2037 23:55:55 GMT
jquery.validate.min.js
yoroi.company/wp-content/plugins/mailup-email-and-newsletter-subscription-form/admin/js/ 		24 KB
9 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://yoroi.company/wp-content/plugins/mailup-email-and-newsletter-subscription-form/admin/js/jquery.validate.min.js?ver=1.19.5
Requested by
Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
270524b0d27afd1d3b6622d1a176c678daed94564c143297e217a63e21ce9820
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Fri, 15 Dec 2023 04:25:18 GMT
strict-transport-security
max-age=31536000
x-ac
2.ams _atomic_ams BYPASS
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
606123
content-encoding
br
alt-svc
h3=":443"; ma=86400
last-modified
Thu, 30 Nov 2023 17:00:58 GMT
server
cloudflare
etag
W/"6568bfca-6019"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=wP9ZSrH1XrMCO1cqIN2OZXXlxEmh9AAHyx9Tq6TEMHM6fh0kKRBAnoidDap0hRbJPNvbfa7FhQmnY6aTy89piwJ%2BDDiqB6lo%2B7r%2F71iH2kP%2FthB%2Fja4aeW%2Bqz83vkHUNnYl1JL3l13X7I2d%2F"}],"group":"cf-nel","max_age":604800}
cache-control
max-age=315360000
cf-ray
835bec049ca966cd-AMS
expires
Thu, 31 Dec 2037 23:55:55 GMT
mailup-public.js
yoroi.company/wp-content/plugins/mailup-email-and-newsletter-subscription-form/public/js/ 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://yoroi.company/wp-content/plugins/mailup-email-and-newsletter-subscription-form/public/js/mailup-public.js?ver=1.2.5
Requested by
Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
83d04fa061be70b12909406d9cdb1d5ba40596f512fc3c716ae04b645527648c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Fri, 15 Dec 2023 04:25:18 GMT
strict-transport-security
max-age=31536000
x-ac
2.ams _atomic_ams BYPASS
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
606123
content-encoding
br
alt-svc
h3=":443"; ma=86400
last-modified
Thu, 30 Nov 2023 17:00:58 GMT
server
cloudflare
etag
W/"6568bfca-c98"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KqaDc0BWGDbtzij7U6av6mwYx3jnPW%2BSsz%2FnhRygliOexSTBMclaEIWFqp6f%2F01uIsBXeOp9lgh%2FdowbDYWxaVsHqzSrLF79TFeN02Y5kqbiDT10ckuTQU26xV2rNGc52Q8zHVjnIJu2JsZz"}],"group":"cf-nel","max_age":604800}
cache-control
max-age=315360000
cf-ray
835bec049caa66cd-AMS
expires
Thu, 31 Dec 2037 23:55:55 GMT
aos.js
yoroi.company/wp-content/plugins/oxygen/component-framework/vendor/aos/ 		14 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://yoroi.company/wp-content/plugins/oxygen/component-framework/vendor/aos/aos.js?ver=1
Requested by
Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4460f1596174d06cca957fdaca2c71e1a377cf1d6f07ee4c75ffb3bf3fc97a03
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Fri, 15 Dec 2023 04:25:18 GMT
strict-transport-security
max-age=31536000
x-ac
2.ams _atomic_ams BYPASS
cf-cache-status
MISS
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding
br
alt-svc
h3=":443"; ma=86400
last-modified
Sun, 18 Apr 2021 08:04:29 GMT
server
cloudflare
etag
W/"607be80d-37a3"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=iINO5xoZEvpTIhdu69G1PLaRLL6u6snihGiQIq9qMIcx5M%2FY%2BuaZrjOD5oiaZceIlq4AZt7aX%2BZ8C2smBCSrLyT1FgzSyRQPqN1XEfvgcKrrlTY%2Fu85g%2B1rkAJdhJ8tYTjN%2FLwDTO26Gp4mT"}],"group":"cf-nel","max_age":604800}
cache-control
max-age=315360000
cf-ray
835bec049cab66cd-AMS
expires
Thu, 31 Dec 2037 23:55:55 GMT
contact-form-7-email-spam-blocker-public.js
yoroi.company/wp-content/plugins/wp-contact-form7-email-spam-blocker/public/js/ 		838 B
981 B 		Script
General
Check archive.org
Download Go to
Full URL
https://yoroi.company/wp-content/plugins/wp-contact-form7-email-spam-blocker/public/js/contact-form-7-email-spam-blocker-public.js?ver=1.0.0
Requested by
Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
57a50c99a31ef4e89e86664e96f6dfbdde163a2eb96e88b3b492c49aa4be2f37
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Fri, 15 Dec 2023 04:25:18 GMT
strict-transport-security
max-age=31536000
x-ac
2.ams _atomic_ams BYPASS
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
2762794
content-encoding
br
alt-svc
h3=":443"; ma=86400
last-modified
Tue, 04 Feb 2020 11:21:55 GMT
server
cloudflare
etag
W/"5e3953d3-346"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xS%2FgzYOkFL5btniK3YeRHmcMepx%2FziJJkB3Vq4qKYM%2BQzRP6KXEbHl%2Fzs2KR4FZ3g6zks97ksmu3RuQVICFz%2B%2F%2Bcjhds%2BnUCILUcmHmtXK4xMIDYyTBXUG70K3%2FCsgFOyPVrvdHK%2FrHGr%2Fox"}],"group":"cf-nel","max_age":604800}
cache-control
max-age=315360000
cf-ray
835bec049cac66cd-AMS
expires
Thu, 31 Dec 2037 23:55:55 GMT
css
fonts.googleapis.com/ 		10 KB
1015 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Work+Sans:100,200,300,400,500,600,700,800,900|Work+Sans:100,200,300,400,500,600,700,800,900
Requested by
Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:829::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
6f3b3eda120231c8b7775699ee027905ac6a8f998e7dddefe9bdab0a0b32219f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://yoroi.company/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Fri, 15 Dec 2023 04:25:18 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Fri, 15 Dec 2023 04:25:18 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Fri, 15 Dec 2023 04:25:18 GMT
/
yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/ 		46 KB
9 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/?xlink=css&ver=6.4.2
Requested by
Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
058518d45e49147be19e3e9847a1bb86c2fca0e546ecf62504aea2faaee0a72e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

x-nananana
Batcache-Hit
date
Fri, 15 Dec 2023 04:25:18 GMT
strict-transport-security
max-age=31536000
x-hacker
Want root? Visit join.a8c.com and mention this header.
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-ac
2.ams _atomic_ams BYPASS
x-pingback
https://yoroi.company/xmlrpc.php
content-encoding
br
host-header
WordPress.com
alt-svc
h3=":443"; ma=86400
last-modified
Fri, 15 Dec 2023 04:24:56 GMT
server
cloudflare
vary
Accept-Encoding, Cookie
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3zPhW9bWxi3u79Fgeq0fZtczNBPHZR4Cxn2r8CGwvKL1PxTJ%2FtLQlKT1Du%2FL7WyZIk9FwMLvGWr%2FTlfAlYuEeI%2FbWNjwknRpAkMh%2FKn8n96H%2FlWdYX29u9%2FIdXceWUYnfbYr2UcGzSqzBP6Y"}],"group":"cf-nel","max_age":604800}
content-type
text/css;charset=utf-8
cache-control
max-age=278, must-revalidate
cf-ray
835bec049cad66cd-AMS
link
<https://yoroi.company/wp-json/>; rel="https://api.w.org/", <https://yoroi.company/wp-json/wp/v2/posts/7796>; rel="alternate"; type="application/json", <https://yoroi.company/?p=7796>; rel=shortlink
logo-head.svg
yoroi.company/wp-content/uploads/2020/01/ 		3 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://yoroi.company/wp-content/uploads/2020/01/logo-head.svg
Requested by
Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
65158a29c17b7bd93fcb3409b97eda74a7c090d932a9ce494adb9f82d737894d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Fri, 15 Dec 2023 04:25:18 GMT
strict-transport-security
max-age=31536000
x-ac
2.ams _atomic_ams BYPASS
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
224813
content-encoding
br
alt-svc
h3=":443"; ma=86400
last-modified
Mon, 03 Feb 2020 11:41:20 GMT
server
cloudflare
etag
W/"5e3806e0-a21"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
image/svg+xml
access-control-allow-origin
*
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=omWNBNtRJK4%2BVACXAGdN3K%2BYMnSsIQnIdMZtZ1h5sXHmmmvIcSrY10K4qzDVpSRCGLecaOGGRU8zztAvwDnrbbbS07U8bW0cjb2ln6Q%2F%2B7ZY5%2FWJev3upX%2FFOLFr%2B094zCfNuH6obb1idtRn"}],"group":"cf-nel","max_age":604800}
cache-control
max-age=604800
cf-ray
835bec049cae66cd-AMS
expires
Tue, 19 Dec 2023 13:58:25 GMT
hamburger.svg
yoroi.company/wp-content/uploads/2020/01/ 		488 B
778 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://yoroi.company/wp-content/uploads/2020/01/hamburger.svg
Requested by
Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f349f68dd834591897a2b648193d96446427a388772b17163e166c17bf4bb5f4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Fri, 15 Dec 2023 04:25:18 GMT
strict-transport-security
max-age=31536000
x-ac
2.ams _atomic_ams BYPASS
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
477115
content-encoding
br
alt-svc
h3=":443"; ma=86400
last-modified
Mon, 03 Feb 2020 11:41:17 GMT
server
cloudflare
etag
W/"5e3806dd-1e8"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
image/svg+xml
access-control-allow-origin
*
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qodVkdojA85Ox4fZ0JSgXKaIeKEclgss2wu4eRR2fAqJTpG5yS1AXLYEVykWn1Y4EHn4ACs%2FZOsvDXJjQoLJYaK4r1rTVXqwW65M3ZUNNgXCDz%2FS1AOQg7efXVaOwbTVlPA%2B5H4xH9yZura%2F"}],"group":"cf-nel","max_age":604800}
cache-control
max-age=604800
cf-ray
835bec049cb066cd-AMS
expires
Sat, 16 Dec 2023 15:53:22 GMT
Risorsa-36-8.png
yoroi.company/wp-content/uploads/2020/01/ 		30 KB
30 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://yoroi.company/wp-content/uploads/2020/01/Risorsa-36-8.png
Requested by
Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
048e7b54fbc9022c80b0bf1144f55baaf814f91fe575515dbd4263634317013f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Fri, 15 Dec 2023 04:25:18 GMT
strict-transport-security
max-age=31536000
x-ac
2.ams _atomic_ams BYPASS
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
36746
alt-svc
h3=":443"; ma=86400
content-length
30485
last-modified
Mon, 03 Feb 2020 11:41:18 GMT
server
cloudflare
etag
"5e3806de-7715"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
image/png
access-control-allow-origin
*
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=tcSuPVA9maXkRhgAE7BQ8Y0iP%2Fs7MxQ%2BmT0yQ7qMbOkr0sxKvYPSKD0eeM7Ts5CD2yl2HfY37kjlQGECNxtZ4T6IGYyrT2Y0Wj1wFcH%2FAQKOLat9xezm4M2L4mTTgyeGSOb5kb9PrxFojlIT"}],"group":"cf-nel","max_age":604800}
cache-control
max-age=604800
accept-ranges
bytes
cf-ray
835bec04fcde66cd-AMS
expires
Thu, 21 Dec 2023 18:12:52 GMT
logo_tinexta-ai_3.png
yoroi.company/wp-content/uploads/2021/09/ 		40 KB
41 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://yoroi.company/wp-content/uploads/2021/09/logo_tinexta-ai_3.png
Requested by
Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
814005c14007af177ca97da8fdc108fa76b6765c1e2ed546280c7645a0a63ccd
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Fri, 15 Dec 2023 04:25:18 GMT
strict-transport-security
max-age=31536000
x-ac
2.ams _atomic_ams BYPASS
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
228004
alt-svc
h3=":443"; ma=86400
content-length
41285
last-modified
Thu, 02 Sep 2021 10:17:29 GMT
server
cloudflare
etag
"6130a4b9-a145"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
image/png
access-control-allow-origin
*
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=47pMTy3uYEtx4dBcqXjIBWz90r%2BJOBLjPb%2FlyHPt%2BKFdAoo%2B1EMdf5v6Ydk6%2BYRIT06LeExVSI78iWYhlep8GHDplJadWRmYFtCVan7vSsFOV5c2mYPblMdgYCmGtAbTU5BzStBXTOJSaV1w"}],"group":"cf-nel","max_age":604800}
cache-control
max-age=604800
accept-ranges
bytes
cf-ray
835bec050cdf66cd-AMS
expires
Tue, 19 Dec 2023 13:05:14 GMT
image-16.png
yoroi.company/wp-content/uploads/2021/03/ 		11 KB
11 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://yoroi.company/wp-content/uploads/2021/03/image-16.png
Requested by
Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
52a86f59fd1312a60def6374184c8055b7fa03858e8494a7c35d25f619156b0f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Fri, 15 Dec 2023 04:25:18 GMT
strict-transport-security
max-age=31536000
x-ac
2.ams _atomic_ams BYPASS
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
477112
alt-svc
h3=":443"; ma=86400
content-length
10893
last-modified
Thu, 18 Mar 2021 10:17:13 GMT
server
cloudflare
etag
"605328a9-2a8d"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
image/png
access-control-allow-origin
*
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RqMLUeE4eGwomXUGD38vZdej5ATBmXVxoRBaiiD0OBIGWw01XTqNDtW4Un22oe8N6dN0%2FnOy2vGsYfHfxvTw6R3Sp8Ugt2uWkNEuwPdGozvPLOrY395o0qXuAc%2BHH5uDEdt8cWEYC9FXZX4q"}],"group":"cf-nel","max_age":604800}
cache-control
max-age=604800
accept-ranges
bytes
cf-ray
835bec055d2166cd-AMS
expires
Sat, 16 Dec 2023 15:53:26 GMT
LOGO_YOROI_TC_WHITE-1.png
yoroi.company/wp-content/uploads/2021/10/ 		14 KB
14 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://yoroi.company/wp-content/uploads/2021/10/LOGO_YOROI_TC_WHITE-1.png
Requested by
Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
204a3227a3631e685f978c6567314a00f03a3bedbbbc947122c97bcc4ac62d9d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Fri, 15 Dec 2023 04:25:19 GMT
strict-transport-security
max-age=31536000
x-ac
2.ams _atomic_ams BYPASS
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
394803
alt-svc
h3=":443"; ma=86400
content-length
14192
last-modified
Fri, 08 Oct 2021 10:47:32 GMT
server
cloudflare
etag
"616021c4-3770"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
image/png
access-control-allow-origin
*
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=lNCCV4uvkDgLQFt8Q3uSSpkjYdfvyTPO2Hg3F2GekVAFgbF%2Fqu9B8FMjbLc9pqu8pXfv2NNlRUAvbW5pQFCLUHJvbSl0zERtq8k%2Fprm4GQr41%2FNGGYE2ZAysSxu74Y9bpgN%2FkoBHN1sRL%2BSq"}],"group":"cf-nel","max_age":604800}
cache-control
max-age=604800
accept-ranges
bytes
cf-ray
835bec084f4766cd-AMS
expires
Sun, 17 Dec 2023 14:45:16 GMT
email-decode.min.js
yoroi.company/cdn-cgi/scripts/5c5dd728/cloudflare-static/ 		1 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://yoroi.company/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js
Requested by
Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Fri, 15 Dec 2023 04:25:18 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Fri, 01 Dec 2023 15:04:24 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"6569f5f8-4d7"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Opt6eiD%2B7d6h%2F9IyojT348IZiaX2Ab7K1CXaRuXqwQE2HdINRk2L9zL2od71BnOZaVMMj6KRf0LCT7bSWbBjpnc5oiQ9iCgF%2B5%2F%2FtBwIm2mEIjiakPft3NfMyh5FNyXIX%2FgIEAYVuqtqlz2e"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
x-frame-options
DENY
cache-control
max-age=172800, public
cf-ray
835bec058d3466cd-AMS
expires
Sun, 17 Dec 2023 04:25:18 GMT
bilmur.min.js
s0.wp.com/wp-content/js/ 		6 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s0.wp.com/wp-content/js/bilmur.min.js?m=202350
Requested by
Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
216728e33a7de4be9b784eff527c6ccf1658319ea78fe66a7864c0b923200252

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://yoroi.company/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

x-nc
HIT ams 1
date
Fri, 15 Dec 2023 04:25:19 GMT
content-encoding
gzip
x-ac
4.ams _dfw MISS
last-modified
Wed, 15 Nov 2023 17:05:23 GMT
server
nginx
etag
W/"6554fa53-161b"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=31536000
timing-allow-origin
*
alt-svc
h3=":443"; ma=86400
expires
Tue, 10 Dec 2024 00:00:04 GMT
logo-cookieyes.svg
yoroi.company/wp-content/plugins/cookie-law-info/public/images/ 		3 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://yoroi.company/wp-content/plugins/cookie-law-info/public/images/logo-cookieyes.svg
Requested by
Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
fab005de52ce54d75f373c5a020e7ddd194caea5b4bf6e87886196e5d4451adc
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Fri, 15 Dec 2023 04:25:19 GMT
strict-transport-security
max-age=31536000
x-ac
2.ams _atomic_ams BYPASS
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
477113
content-encoding
br
alt-svc
h3=":443"; ma=86400
last-modified
Thu, 22 Sep 2022 14:31:50 GMT
server
cloudflare
etag
W/"632c71d6-a15"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
image/svg+xml
access-control-allow-origin
*
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=yyB4UqlbxeElVrZN3YsmD85JFIOVoKSsih82Vr92DGqIhZtLAlYzf0mie2kT%2BWwAqZAMOtc1wiBL1MmNCzzbbEHd5oE98t3cxlv%2Fsv8b0esDJ4sd9nnDJyW6R5GBDvGAy7XpCZpGRjDn6FPh"}],"group":"cf-nel","max_age":604800}
cache-control
max-age=604800
cf-ray
835bec08ffc866cd-AMS
expires
Sat, 16 Dec 2023 15:53:26 GMT
countUp.min.js
yoroi.company/wp-content/assets/js/ 		5 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://yoroi.company/wp-content/assets/js/countUp.min.js
Requested by
Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c63a636fec47c33c1f90b009d2f95830d3492083c04e429cda86914834714967
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Referer
https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
Origin
https://yoroi.company
accept-language
nl-NL,nl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Fri, 15 Dec 2023 04:25:18 GMT
strict-transport-security
max-age=31536000
x-ac
2.ams _atomic_ams BYPASS
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
477115
content-encoding
br
alt-svc
h3=":443"; ma=86400
last-modified
Mon, 03 Feb 2020 11:40:49 GMT
server
cloudflare
etag
W/"5e3806c1-126e"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=nrMMarb58srRhqe%2FNvG%2FAdGFaFcqrYmBOaX1wj%2Bx1C%2FRpMnJSkvcC%2FGesP8P9mBvMpBt5bjeoLoDUmhLX%2BLaos4WH%2FivGuEenaRYGOSItEUWuMy8h%2FfgrpEf8C0TKqN7yvw1KSeQeDOlSOZ%2B"}],"group":"cf-nel","max_age":604800}
cache-control
max-age=604800
cf-ray
835bec049cb166cd-AMS
expires
Sat, 16 Dec 2023 15:53:22 GMT
counters.js
yoroi.company/wp-content/assets/js/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://yoroi.company/wp-content/assets/js/counters.js
Requested by
Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
1c594062728319da3ecaa98c4c0b930b07d5e64207eb6e4987d4fcbff9134768
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Referer
https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
Origin
https://yoroi.company
accept-language
nl-NL,nl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Fri, 15 Dec 2023 04:25:18 GMT
strict-transport-security
max-age=31536000
x-ac
2.ams _atomic_ams BYPASS
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
477115
content-encoding
br
alt-svc
h3=":443"; ma=86400
last-modified
Mon, 03 Feb 2020 11:40:49 GMT
server
cloudflare
etag
W/"5e3806c1-78d"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RAy4feN7vLYyz4XytVU3aqGqvTG45CU6ao10TNvYAVxy2BKX3pttMDxJHJPHbqukJmExS5cCLFNy3syOe23CNoy6fht3gvxzqedjctT2Z1XWyYPzsYPwKvfsJDATh0PCKnDc7WnFnXuC%2FPke"}],"group":"cf-nel","max_age":604800}
cache-control
max-age=604800
cf-ray
835bec049cb366cd-AMS
expires
Sat, 16 Dec 2023 15:53:23 GMT
parallax.min.js
yoroi.company/wp-content/assets/js/ 		17 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://yoroi.company/wp-content/assets/js/parallax.min.js
Requested by
Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
bf4d20b28de8c7f77428b24325ec3afb39b6f7e277f6b61666f3a0a17cc3b42b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Fri, 15 Dec 2023 04:25:18 GMT
strict-transport-security
max-age=31536000
x-ac
2.ams _atomic_ams BYPASS
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
199570
content-encoding
br
alt-svc
h3=":443"; ma=86400
last-modified
Mon, 03 Feb 2020 11:40:49 GMT
server
cloudflare
etag
W/"5e3806c1-43a2"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=oH%2BxgxVinBLUJqubXcAHNFX4ODch4kkIfF2dQzgLpl%2FfWC7cQmSvGo2cBOqDa2qQ2SXp1oK9v%2BPw0hxefaRm2yAexeeaSK7PcJuKsr1XvOkbZpiERoUIUgAuuLj0dQE7Kf5vxlffXT%2BOI8G9"}],"group":"cf-nel","max_age":604800}
cache-control
max-age=604800
cf-ray
835bec05ad4d66cd-AMS
expires
Tue, 19 Dec 2023 20:59:08 GMT
intersection-observer.js
cdn.jsdelivr.net/npm/intersection-observer@0.7.0/ 		22 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.jsdelivr.net/npm/intersection-observer@0.7.0/intersection-observer.js
Requested by
Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:5614 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
1dc6d2d43514d1d8956877d1f2ef347cd5abdb8ecf8e47aba59d87b8a6da49bb
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://yoroi.company/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Fri, 15 Dec 2023 04:25:19 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age
1466096
x-jsd-version
0.7.0
content-encoding
br
x-cache
HIT, HIT
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
x-served-by
cache-fra-eddf8230054-FRA, cache-ams21031-AMS
x-jsd-version-type
version
server
cloudflare
etag
W/"57ad-m3EaUx6495LHE8zS0+QpFP8kqM0"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=uvJhLs83ueExzAk%2FZz5ELxNAREPNq4ll8t5BvAqaxM8y4HAZfoni4oAYnP9jApOgAvIacDEmWhURDeJLxgHX9UmdeVrGjZzHj%2BnsvfK6bu6y7%2B9haH4Vh0dZ9PwKKeFtgeBqvnjMeSY6CgydhFw%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=31536000, s-maxage=31536000, immutable
timing-allow-origin
*
cf-ray
835bec098c3a0e48-AMS
lazyload.min.js
cdn.jsdelivr.net/npm/vanilla-lazyload@12.4.0/dist/ 		6 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.jsdelivr.net/npm/vanilla-lazyload@12.4.0/dist/lazyload.min.js
Requested by
Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:5614 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0be502b9446e16b338d36ccadac232f4a68ab74655f98fec415ccdbbccbf5729
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://yoroi.company/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Fri, 15 Dec 2023 04:25:19 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age
3116806
x-jsd-version
12.4.0
content-encoding
br
x-cache
HIT, HIT
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
x-served-by
cache-fra-eddf8230062-FRA, cache-ams21052-AMS
x-jsd-version-type
version
server
cloudflare
etag
W/"1926-ftj+zhhSvu4E/RMH3S02cxSkfWc"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=WfgGHVAomZJ%2BrZCUQNBJ%2FhJToCKChURBL5zY9w4slJGU2RH%2FNGVzGLvIAwN7XyYZRk1SwLMvfKa7Mz94f3ujKnhIZquB8ENf%2BjeoIY34udva8A0EmdBWHfCjdJpxA1H2iWj5Xl2AHFvcBu%2B0Oo4%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=31536000, s-maxage=31536000, immutable
timing-allow-origin
*
cf-ray
835bec09ac470e48-AMS
cookie-law-info-table.css
yoroi.company/wp-content/plugins/cookie-law-info/public/css/ 		6 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://yoroi.company/wp-content/plugins/cookie-law-info/public/css/cookie-law-info-table.css?ver=2.1.3
Requested by
Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2e2f2336b5e6698b628afc75fa9a24c67b73d5872c1d4af99ca436064f636ee0
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Fri, 15 Dec 2023 04:25:19 GMT
strict-transport-security
max-age=31536000
x-ac
2.ams _atomic_ams BYPASS
cf-cache-status
MISS
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding
br
alt-svc
h3=":443"; ma=86400
last-modified
Thu, 22 Sep 2022 14:31:50 GMT
server
cloudflare
etag
W/"632c71d6-17e1"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
text/css
access-control-allow-origin
*
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gmhI9bgnibX6%2B1au1odxGx3e30wsrt2XTHu8NQYuOuOlM461CtWRi0bbKB33f3ZADxpBwYSflc0qzn30%2Bppcaxx43cuyJFj3DKycTzB41KSYt7qpQZJ9lDXjFGZfN7t7rLXWO1c7dqYda7xa"}],"group":"cf-nel","max_age":604800}
cache-control
max-age=315360000
cf-ray
835bec05bd5566cd-AMS
expires
Thu, 31 Dec 2037 23:55:55 GMT
image-cdn.js
yoroi.company/wp-content/plugins/jetpack/jetpack_vendor/automattic/jetpack-image-cdn/dist/ 		701 B
874 B 		Script
General
Check archive.org
Download Go to
Full URL
https://yoroi.company/wp-content/plugins/jetpack/jetpack_vendor/automattic/jetpack-image-cdn/dist/image-cdn.js?minify=false&ver=132249e245926ae3e188
Requested by
Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
27dd9b075cc59cf5f3c0f6ee075f4bd113782d81ce30a4f16aac669ecfdc4fa2
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Fri, 15 Dec 2023 04:25:19 GMT
strict-transport-security
max-age=31536000
x-ac
2.ams _atomic_ams BYPASS
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
2912994
content-encoding
br
alt-svc
h3=":443"; ma=86400
last-modified
Mon, 08 May 2023 16:57:46 GMT
server
cloudflare
etag
W/"64592a0a-2bd"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=uzEhH8%2FrWDcYlgFkL1IfNyIfMW5kAlNxMfBaDQ2mIIIkkBLK7UdMtuTvCs%2FuQQ1EEwv7HhaWzpE2BaZx0o5gQ8F9oesWeOztX5k%2Fp6RQGFm6Tk8mxdVP8a2aiJ0435ttEVQlmT6blTmpvD4R"}],"group":"cf-nel","max_age":604800}
cache-control
max-age=315360000
cf-ray
835bec05ed7f66cd-AMS
expires
Thu, 31 Dec 2037 23:55:55 GMT
index.js
yoroi.company/wp-content/plugins/contact-form-7/includes/swv/js/ 		11 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://yoroi.company/wp-content/plugins/contact-form-7/includes/swv/js/index.js?ver=5.8.4
Requested by
Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9c1989ecd392a0c54fb799409154242706940a8e6d800542ba579dfda576bb9d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Fri, 15 Dec 2023 04:25:19 GMT
strict-transport-security
max-age=31536000
x-ac
2.ams _atomic_ams BYPASS
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
1052009
content-encoding
br
alt-svc
h3=":443"; ma=86400
last-modified
Sat, 02 Dec 2023 18:04:44 GMT
server
cloudflare
etag
W/"656b71bc-2b6d"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=QGh63GZ5iOsQKEsPtkEp3ErGaNpPnw8UWfO7a%2FA85%2FT%2Bp1PWz6VNei1Q6JTS%2BstSenYC4UbxQOqZUyY6JYrqj2puqMme9hFhwg2owg8j8XICq3K63jP1dv4pE%2B6wEqm7tlytEOd0CLPkKbXH"}],"group":"cf-nel","max_age":604800}
cache-control
max-age=315360000
cf-ray
835bec061da666cd-AMS
expires
Thu, 31 Dec 2037 23:55:55 GMT
index.js
yoroi.company/wp-content/plugins/contact-form-7/includes/js/ 		13 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://yoroi.company/wp-content/plugins/contact-form-7/includes/js/index.js?ver=5.8.4
Requested by
Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
7ee08c60d39f5712a56938fda3e2ab10fe3ef23ec98aeb3c9a29e54f6f31ffe1
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Fri, 15 Dec 2023 04:25:19 GMT
strict-transport-security
max-age=31536000
x-ac
2.ams _atomic_ams BYPASS
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
978382
content-encoding
br
alt-svc
h3=":443"; ma=86400
last-modified
Sat, 02 Dec 2023 18:04:44 GMT
server
cloudflare
etag
W/"656b71bc-337e"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=q7d0yFH97GewTkOMkgJlPbzHnJneSWAxLonfwngxbvLXVdZYTlEsgoAodaX%2Bipm6E9z%2BRzrb3DO4F6hS%2FGWcoed20Vi5cP9x3nVRwnFGpiFumSxI1HP6c4VMI5Tqx%2FACBvCQ1Qrl%2FU8gNh6J"}],"group":"cf-nel","max_age":604800}
cache-control
max-age=315360000
cf-ray
835bec064dd166cd-AMS
expires
Thu, 31 Dec 2037 23:55:55 GMT
api.js
www.google.com/recaptcha/ 		1 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google.com/recaptcha/api.js?render=6LfTr-AUAAAAANb_RvhTeWu00N_K6josD9XFY1OD&ver=3.0
Requested by
Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
73a1f126cf805ced3f24d65132d3163821ed2bb33a62e83e4a305687045dcce5
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://yoroi.company/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Fri, 15 Dec 2023 04:25:19 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy
frame-ancestors 'self'
server
GSE
x-frame-options
SAMEORIGIN
content-type
text/javascript; charset=utf-8
cache-control
private, max-age=300
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
1; mode=block
expires
Fri, 15 Dec 2023 04:25:19 GMT
wp-polyfill-inert.min.js
c0.wp.com/c/6.4.2/wp-includes/js/dist/vendor/ 		8 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://c0.wp.com/c/6.4.2/wp-includes/js/dist/vendor/wp-polyfill-inert.min.js
Requested by
Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.37 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
c1a9a3e223bad631dff12d33b5499eb145cb08d8621c20d9d73870e78d97afe4
Security Headers
Name Value
Strict-Transport-Security max-age=15552000

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://yoroi.company/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

x-nc
HIT ams 1
date
Fri, 15 Dec 2023 04:25:19 GMT
content-encoding
gzip
strict-transport-security
max-age=15552000
last-modified
Wed, 18 Jan 2023 11:16:33 GMT
server
nginx
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=31536000
timing-allow-origin
*
alt-svc
h3=":443"; ma=86400, h3=":443"; ma=86400
expires
Sat, 14 Dec 2024 04:25:19 GMT
regenerator-runtime.min.js
c0.wp.com/c/6.4.2/wp-includes/js/dist/vendor/ 		6 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://c0.wp.com/c/6.4.2/wp-includes/js/dist/vendor/regenerator-runtime.min.js
Requested by
Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.37 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
1d52e1ac7d3bc25a8b0ffc257153f9dd50249f96fe9a4df5e0d771241a69062c
Security Headers
Name Value
Strict-Transport-Security max-age=15552000

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://yoroi.company/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

x-nc
HIT ams 1
date
Fri, 15 Dec 2023 04:25:19 GMT
content-encoding
gzip
strict-transport-security
max-age=15552000
last-modified
Tue, 19 Sep 2023 19:30:24 GMT
server
nginx
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=31536000
timing-allow-origin
*
alt-svc
h3=":443"; ma=86400, h3=":443"; ma=86400
expires
Sat, 14 Dec 2024 04:25:19 GMT
wp-polyfill.min.js
c0.wp.com/c/6.4.2/wp-includes/js/dist/vendor/ 		112 KB
36 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://c0.wp.com/c/6.4.2/wp-includes/js/dist/vendor/wp-polyfill.min.js
Requested by
Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.37 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
da9ed5720b674f0d297fe621ac2d8d518c4e622bef1e9b0d4ae489dee9aa43f8
Security Headers
Name Value
Strict-Transport-Security max-age=15552000

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://yoroi.company/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

x-nc
HIT ams 1
date
Fri, 15 Dec 2023 04:25:19 GMT
content-encoding
gzip
strict-transport-security
max-age=15552000
last-modified
Tue, 26 Sep 2023 14:23:26 GMT
server
nginx
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=31536000
timing-allow-origin
*
alt-svc
h3=":443"; ma=86400, h3=":443"; ma=86400
expires
Sat, 14 Dec 2024 04:25:19 GMT
index.js
yoroi.company/wp-content/plugins/contact-form-7/modules/recaptcha/ 		934 B
989 B 		Script
General
Check archive.org
Download Go to
Full URL
https://yoroi.company/wp-content/plugins/contact-form-7/modules/recaptcha/index.js?ver=5.8.4
Requested by
Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
df0ec8330290d184b1084527076cb87d41b33ba706ff5ab579d761f0cb6a744b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Fri, 15 Dec 2023 04:25:19 GMT
strict-transport-security
max-age=31536000
x-ac
2.ams _atomic_ams BYPASS
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
978382
content-encoding
br
alt-svc
h3=":443"; ma=86400
last-modified
Sat, 02 Dec 2023 18:04:45 GMT
server
cloudflare
etag
W/"656b71bd-3a6"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=UXajrt4iH8MqseXWejkNrYsFinkSGH%2F%2FHR50eb%2Fu%2FngnKtoF7kmymYl5NZeizTV9E%2Bo4oGLaJG0uDa0CLNuwcYAtrdmxOzGia30VIEUdWxpK7z9vPKa5RYvM0BhFC6ZSQSLfKLzX5TP%2Fh97c"}],"group":"cf-nel","max_age":604800}
cache-control
max-age=315360000
cf-ray
835bec072e7b66cd-AMS
expires
Thu, 31 Dec 2037 23:55:55 GMT
modernizr.js
yoroi.company/wp-content/plugins/slick-menu/assets/vendors/modernizr/ 		12 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://yoroi.company/wp-content/plugins/slick-menu/assets/vendors/modernizr/modernizr.js?ver=1.5.2
Requested by
Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
49cf0f2de45929d5674df4377cfc2363324674ca4dfdef454bc1dfeebcec9ca5
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Fri, 15 Dec 2023 04:25:19 GMT
strict-transport-security
max-age=31536000
x-ac
2.ams _atomic_ams BYPASS
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
1188493
content-encoding
br
alt-svc
h3=":443"; ma=86400
last-modified
Tue, 25 Jul 2023 02:32:20 GMT
server
cloudflare
etag
W/"64bf3434-317b"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=r2Af7MoWeGZ9vwYHI2eUg7xzKo6%2B4XbLgKSX5J3gElMmWwLnm5bb2%2FIlk%2FZt8vB%2BY6%2Bv2cjZiYk%2B9xRErCZS%2FMZjmcsK8bzdEiiXxWnh8Hhxr97lntufd8d9KkklquIoyRDGN8jfwITIoS7M"}],"group":"cf-nel","max_age":604800}
cache-control
max-age=315360000
cf-ray
835bec075ea766cd-AMS
expires
Thu, 31 Dec 2037 23:55:55 GMT
body-scroll-lock.min.js
yoroi.company/wp-content/plugins/slick-menu/assets/vendors/body-scroll-lock/ 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://yoroi.company/wp-content/plugins/slick-menu/assets/vendors/body-scroll-lock/body-scroll-lock.min.js?ver=1.5.2
Requested by
Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d947b55573f76b9876038798590599aef4ec471cd0b44a41438b02ae00fcee5b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Fri, 15 Dec 2023 04:25:19 GMT
strict-transport-security
max-age=31536000
x-ac
2.ams _atomic_ams BYPASS
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
1431534
content-encoding
br
alt-svc
h3=":443"; ma=86400
last-modified
Tue, 25 Jul 2023 02:32:20 GMT
server
cloudflare
etag
W/"64bf3434-b15"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=oLRt1Von0OkPP3IqY0c7Laao%2FaAvoDjGSgD8OFcc583kto4P2TXe5un1TaxcoCbxnyzgw0KeiAfdDSXPODkVolm8JgUCH5ws02xdYk1bbtG3lOfeh6ltmJOYcPCiiWNpBX4J9G6n5OaCrUXj"}],"group":"cf-nel","max_age":604800}
cache-control
max-age=315360000
cf-ray
835bec078ed066cd-AMS
expires
Thu, 31 Dec 2037 23:55:55 GMT
utils.min.js
yoroi.company/wp-content/plugins/slick-menu/assets/js/ 		19 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://yoroi.company/wp-content/plugins/slick-menu/assets/js/utils.min.js?ver=1.5.2
Requested by
Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0f4a3ba36482c233c6d7970cd42fb5b76ea054044dbebe424176db9f176616cb
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Fri, 15 Dec 2023 04:25:19 GMT
strict-transport-security
max-age=31536000
x-ac
2.ams _atomic_ams BYPASS
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
6133
content-encoding
br
alt-svc
h3=":443"; ma=86400
last-modified
Tue, 25 Jul 2023 02:32:19 GMT
server
cloudflare
etag
W/"64bf3433-4bab"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7mIl3keuynq2Cuuq6Y0G1h03MbqNxUjX%2FlEcRA4ZgcVo3mAhs7FuowF66zV10%2FjdmnWR6AdBAeck3xhr5JN5870rJohTfuMh1Oi8dZ27qpMbNRDIxj8mNCtpVLaL9JGvS9Ie4wjKhkYG7WtL"}],"group":"cf-nel","max_age":604800}
cache-control
max-age=315360000
cf-ray
835bec07ceed66cd-AMS
expires
Thu, 31 Dec 2037 23:55:55 GMT
slickmenu.min.js
yoroi.company/wp-content/plugins/slick-menu/assets/js/ 		34 KB
9 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://yoroi.company/wp-content/plugins/slick-menu/assets/js/slickmenu.min.js?ver=1.5.2
Requested by
Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
1e41b9ba20319d67b5b640af59346a76cec477cee421bfc5e05b1238eb292246
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Fri, 15 Dec 2023 04:25:19 GMT
strict-transport-security
max-age=31536000
x-ac
2.ams _atomic_ams BYPASS
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
6133
content-encoding
br
alt-svc
h3=":443"; ma=86400
last-modified
Tue, 25 Jul 2023 02:32:19 GMT
server
cloudflare
etag
W/"64bf3433-8631"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kzjgoD7DfMaeDZ2xge%2F6FmNUN2xSJRuiTauwcCn8E8092oobVMxYFCM%2BCQg2w1HkxI0HnFT7LYNwgfdhajR0gPLnv4fjeNXafMJWV3fibsPPLnKWpDPZUiTqb4IMl5EL83mFoiWdBAGFkfBd"}],"group":"cf-nel","max_age":604800}
cache-control
max-age=315360000
cf-ray
835bec07ff1366cd-AMS
expires
Thu, 31 Dec 2037 23:55:55 GMT
e-202350.js
stats.wp.com/ 		7 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://stats.wp.com/e-202350.js
Requested by
Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
ca7752fb33cf3a98c0f29bc4eec563112025da4109a0dcc69dabf5f861751258

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://yoroi.company/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

x-minify-cache
hit
x-nc
HIT ams
date
Fri, 15 Dec 2023 04:25:19 GMT
content-encoding
gzip
server
nginx
x-minify
t
etag
W/13576-1684464982353.1523
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=31536000
expires
Mon, 09 Dec 2024 17:11:28 GMT
frontend.min.js
yoroi.company/wp-content/plugins/slick-menu/assets/js/ 		22 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://yoroi.company/wp-content/plugins/slick-menu/assets/js/frontend.min.js?ver=1.5.2
Requested by
Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d3ad83af3a48c24913133f351cc69b135c950df64ec6f0fefd414bc79249c6ba
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Fri, 15 Dec 2023 04:25:19 GMT
strict-transport-security
max-age=31536000
x-ac
2.ams _atomic_ams BYPASS
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
502620
content-encoding
br
alt-svc
h3=":443"; ma=86400
last-modified
Tue, 25 Jul 2023 02:32:19 GMT
server
cloudflare
etag
W/"64bf3433-581d"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=aH7zmg1%2Fwki37i0sILfWa8a%2Bc0Xp14XkNpmV7Rrf0hJVCRa8TPAt50W0HRoqgmAde50NFiHJlkRdWdGBAEptSZ1H0MLyNH%2BfBnTF9O81qbXqBzpsBFjbYYpVLOuVbIDYM5ryFUdwLHdl1SbN"}],"group":"cf-nel","max_age":604800}
cache-control
max-age=315360000
cf-ray
835bec080f2166cd-AMS
expires
Thu, 31 Dec 2037 23:55:55 GMT
truncated
/ 		350 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
7bdc4fd1b52f88617553782da88299fc8551f6921d5a30c5a29b96cb8b4c3eae

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ 		234 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
5486d67c53956813c2ab1fdef773516ee85aff7adae4ae0186cf09e398c1e28f

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Content-Type
image/png
insight.min.js
snap.licdn.com/li.lms-analytics/ 		42 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by
Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:3500:16::215:149b Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
f3b0e2a3800f73c56a4dc78562fc32130a8eec6887982d10e6a5dcf6497969c6
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://yoroi.company/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Fri, 15 Dec 2023 04:25:19 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Wed, 13 Dec 2023 13:09:33 GMT
x-cdn
AKAM
x-amz-server-side-encryption
AES256
vary
Accept-Encoding
content-type
application/javascript;charset=utf-8
cache-control
max-age=22897
accept-ranges
bytes
content-length
15541
QGYsz_wNahGAdqQ43Rh_fKDp.woff2
fonts.gstatic.com/s/worksans/v19/ 		49 KB
50 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/worksans/v19/QGYsz_wNahGAdqQ43Rh_fKDp.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Work+Sans:100,200,300,400,500,600,700,800,900|Work+Sans:100,200,300,400,500,600,700,800,900
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
6912f7388531e949bd5406b5668cd6b55fea4cc7e2d123dbaed489054dd98438
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://yoroi.company
accept-language
nl-NL,nl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Sat, 09 Dec 2023 06:00:54 GMT
x-content-type-options
nosniff
age
512665
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
50668
x-xss-protection
0
last-modified
Thu, 14 Sep 2023 01:13:52 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 08 Dec 2024 06:00:54 GMT
vettaIMG.png
i0.wp.com/yoroi.company/wp-content/uploads/2023/12/ 		58 KB
59 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://i0.wp.com/yoroi.company/wp-content/uploads/2023/12/vettaIMG.png?w=480&ssl=1
Requested by
Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
i0.wp.com
Software
nginx /
Resource Hash
c59f8ce89d8016bba0fd065c18aa463688563cf18eb79226df9cb62e8e096533
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://yoroi.company/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Fri, 15 Dec 2023 04:25:19 GMT
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=86400
content-length
59670
x-nc
HIT ams 8
last-modified
Mon, 11 Dec 2023 15:54:17 GMT
server
nginx
etag
"6e795eaf230cfa34"
vary
Accept
access-control-allow-methods
GET, HEAD
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=63115200
timing-allow-origin
*
link
<https://yoroi.company/wp-content/uploads/2023/12/vettaIMG.png>; rel="canonical"
expires
Thu, 11 Dec 2025 03:54:17 GMT
recaptcha__nl.js
www.gstatic.com/recaptcha/releases/cwQvQhsy4_nYdnSDY4u7O5_B/ 		502 KB
503 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.gstatic.com/recaptcha/releases/cwQvQhsy4_nYdnSDY4u7O5_B/recaptcha__nl.js
Requested by
Host: www.google.com
URL: https://www.google.com/recaptcha/api.js?render=6LfTr-AUAAAAANb_RvhTeWu00N_K6josD9XFY1OD&ver=3.0
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e3f281a93c5293be122ec933426887f46ae314ffada3e3da98ac76f5ee5992cd
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://yoroi.company/
Origin
https://yoroi.company
accept-language
nl-NL,nl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Mon, 11 Dec 2023 22:10:18 GMT
x-content-type-options
nosniff
age
281701
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
514144
x-xss-protection
0
last-modified
Mon, 04 Dec 2023 17:08:31 GMT
server
sffe
cross-origin-opener-policy
same-origin-allow-popups; report-to="recaptcha"
vary
Accept-Encoding
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Tue, 10 Dec 2024 22:10:18 GMT
g.gif
pixel.wp.com/ 		50 B
153 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.wp.com/g.gif?v=ext&blog=151656741&post=7796&tz=2&srv=yoroi.company&hp=atomic&ac=2&amp=0&j=1%3A13.0-a.1&host=yoroi.company&ref=&fcp=0&rand=0.5089122041800298
Requested by
Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://yoroi.company/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

access-control-allow-origin
*
date
Fri, 15 Dec 2023 04:25:19 GMT
cache-control
no-cache
server
nginx
content-length
50
content-type
image/gif
schema
yoroi.company/wp-json/contact-form-7/v1/contact-forms/223/feedback/ 		476 B
946 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://yoroi.company/wp-json/contact-form-7/v1/contact-forms/223/feedback/schema
Requested by
Host: yoroi.company
URL: https://yoroi.company/wp-content/plugins/contact-form-7/includes/js/index.js?ver=5.8.4
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9b53ba79fa63e6281e11715289c6da0ab79aeb98f98b3901685efbd32e708791
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff

Request headers

Accept
application/json, */*;q=0.1
Referer
https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
accept-language
nl-NL,nl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

x-nananana
Batcache-Hit
date
Fri, 15 Dec 2023 04:25:19 GMT
strict-transport-security
max-age=31536000
x-hacker
Want root? Visit join.a8c.com and mention this header.
x-content-type-options
nosniff
x-ac
2.ams _atomic_ams BYPASS
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-cache-status
DYNAMIC
content-encoding
br
host-header
WordPress.com
alt-svc
h3=":443"; ma=86400
last-modified
Fri, 15 Dec 2023 04:25:09 GMT
server
cloudflare
vary
Accept-Encoding, Cookie, Origin
allow
GET
content-type
application/json; charset=UTF-8
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0Dh%2FnoheN%2Fkx6coeHeLWES1XUOO%2FCoIwsnnkvtX7XAbSz2lGEIoNbb%2Bv3WMuFTnt5GLmjuF7%2BzIiKHrDbAuta8Xp3oieHxXHBUQLre9JKljyLiJ3SuE%2BwVnGGcAxgcnUljrighawrwaddpxD"}],"group":"cf-nel","max_age":604800}
access-control-expose-headers
X-WP-Total, X-WP-TotalPages, Link
cache-control
max-age=290, must-revalidate
x-robots-tag
noindex
link
<https://yoroi.company/wp-json/>; rel="https://api.w.org/"
access-control-allow-headers
Authorization, X-WP-Nonce, Content-Disposition, Content-MD5, Content-Type
cf-ray
835bec0a587f66cd-AMS
main.js
yoroi.company/cdn-cgi/challenge-platform/scripts/jsd/ Frame 9E78 		0
0
collect
px4.ads.linkedin.com/
Redirect Chain
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=3795428&time=1702614319825&url=https%3A%2F%2Fyoroi.company%2Fen%2Fresearch%2Funveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-throu...
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=3795428&time=1702614319825&url=https%3A%2F%2Fyoroi.company%2Fen%2Fresearch%2Funveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-throu...
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D3795428%26time%3D1702614319825%26url%3Dhttps%253A%252F%252Fyoroi.company%252Fen%2...
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=3795428&time=1702614319825&url=https%3A%2F%2Fyoroi.company%2Fen%2Fresearch%2Funveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-throu...
  • https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=3795428&time=1702614319825&url=https%3A%2F%2Fyoroi.company%2Fen%2Fresearch%2Funveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-thro...
0
266 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=3795428&time=1702614319825&url=https%3A%2F%2Fyoroi.company%2Fen%2Fresearch%2Funveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives%2F&cookiesTest=true&liSync=true&e_ipv6=AQK5vrRlms6YbgAAAYxruMV3v_yABsVLh4Dnu5kJvUqiDa0XJXtSrVXoYRh3bw5SXzIW5a4
Requested by
Host: yoroi.company
URL: https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
Protocol
H2
Server
13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://yoroi.company/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Fri, 15 Dec 2023 04:25:19 GMT
x-li-pop
afd-prod-ltx1-x
x-msedge-ref
Ref A: F8B718C04AD64498B639BABE452715B5 Ref B: DUS30EDGE0912 Ref C: 2023-12-15T04:25:20Z
linkedin-action
1
x-cache
CONFIG_NOCACHE
content-type
application/javascript
x-li-fabric
prod-ltx1
x-li-proto
http/2
content-length
0
x-li-uuid
AAYMhMnG5QRQwyoJRujE8A==

Redirect headers

date
Fri, 15 Dec 2023 04:25:20 GMT
x-li-pop
afd-prod-ltx1-x
x-msedge-ref
Ref A: BE4CC3744AD64CB4BB41D117B0480602 Ref B: DUS30EDGE0409 Ref C: 2023-12-15T04:25:20Z
linkedin-action
1
x-cache
CONFIG_NOCACHE
x-li-fabric
prod-ltx1
location
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=3795428&time=1702614319825&url=https%3A%2F%2Fyoroi.company%2Fen%2Fresearch%2Funveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives%2F&cookiesTest=true&liSync=true&e_ipv6=AQK5vrRlms6YbgAAAYxruMV3v_yABsVLh4Dnu5kJvUqiDa0XJXtSrVXoYRh3bw5SXzIW5a4
x-li-proto
http/2
content-length
0
x-li-uuid
AAYMhMnDOuMYe4MyZZGDoA==
anchor
www.google.com/recaptcha/api2/ Frame 2C73 		41 KB
26 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfTr-AUAAAAANb_RvhTeWu00N_K6josD9XFY1OD&co=aHR0cHM6Ly95b3JvaS5jb21wYW55OjQ0Mw..&hl=nl&v=cwQvQhsy4_nYdnSDY4u7O5_B&size=invisible&cb=2h4ssctf2yqs
Requested by
Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/cwQvQhsy4_nYdnSDY4u7O5_B/recaptcha__nl.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
3cc2099313e7a6fd7e0dc7864f93944546c6a7c0de353e903d1b06ceb9c544ba
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-4CHK9XX_d8s1wa40SMTIIw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://yoroi.company/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language
nl-NL,nl;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
no-cache, no-store, max-age=0, must-revalidate
content-encoding
gzip
content-security-policy
script-src 'report-sample' 'nonce-4CHK9XX_d8s1wa40SMTIIw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type
text/html; charset=utf-8
cross-origin-embedder-policy
require-corp
cross-origin-resource-policy
cross-origin
date
Fri, 15 Dec 2023 04:25:20 GMT
expires
Mon, 01 Jan 1990 00:00:00 GMT
pragma
no-cache
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server
GSE
x-content-type-options
nosniff
x-xss-protection
1; mode=block
styles__ltr.css
www.gstatic.com/recaptcha/releases/cwQvQhsy4_nYdnSDY4u7O5_B/ Frame 2C73 		55 KB
24 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.gstatic.com/recaptcha/releases/cwQvQhsy4_nYdnSDY4u7O5_B/styles__ltr.css
Requested by
Host: www.google.com
URL: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfTr-AUAAAAANb_RvhTeWu00N_K6josD9XFY1OD&co=aHR0cHM6Ly95b3JvaS5jb21wYW55OjQ0Mw..&hl=nl&v=cwQvQhsy4_nYdnSDY4u7O5_B&size=invisible&cb=2h4ssctf2yqs
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
7859a62e04b0acb06516eb12454de6673883ecfaeaed6c254659bca7cd59c050
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.google.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Thu, 14 Dec 2023 22:45:27 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
20393
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
24606
x-xss-protection
0
last-modified
Mon, 04 Dec 2023 17:08:31 GMT
server
sffe
cross-origin-opener-policy
same-origin-allow-popups; report-to="recaptcha"
vary
Accept-Encoding
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type
text/css
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Fri, 13 Dec 2024 22:45:27 GMT
recaptcha__nl.js
www.gstatic.com/recaptcha/releases/cwQvQhsy4_nYdnSDY4u7O5_B/ Frame 2C73 		502 KB
502 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.gstatic.com/recaptcha/releases/cwQvQhsy4_nYdnSDY4u7O5_B/recaptcha__nl.js
Requested by
Host: www.google.com
URL: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfTr-AUAAAAANb_RvhTeWu00N_K6josD9XFY1OD&co=aHR0cHM6Ly95b3JvaS5jb21wYW55OjQ0Mw..&hl=nl&v=cwQvQhsy4_nYdnSDY4u7O5_B&size=invisible&cb=2h4ssctf2yqs
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e3f281a93c5293be122ec933426887f46ae314ffada3e3da98ac76f5ee5992cd
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.google.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Mon, 11 Dec 2023 22:10:18 GMT
x-content-type-options
nosniff
age
281702
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
514144
x-xss-protection
0
last-modified
Mon, 04 Dec 2023 17:08:31 GMT
server
sffe
cross-origin-opener-policy
same-origin-allow-popups; report-to="recaptcha"
vary
Accept-Encoding
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Tue, 10 Dec 2024 22:10:18 GMT
/
px.ads.linkedin.com/wa/ 		0
193 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://px.ads.linkedin.com/wa/
Requested by
Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept
*
Referer
https://yoroi.company/
accept-language
nl-NL,nl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

date
Fri, 15 Dec 2023 04:25:20 GMT
x-li-pop
afd-prod-ltx1-x
x-msedge-ref
Ref A: CBFF078B52A9485F99A0948902E4F0DC Ref B: DUS30EDGE0409 Ref C: 2023-12-15T04:25:20Z
linkedin-action
1
vary
Origin
x-cache
CONFIG_NOCACHE
x-li-fabric
prod-ltx1
access-control-allow-origin
https://yoroi.company
x-li-proto
http/2
access-control-allow-credentials
true
x-li-uuid
AAYMhMnJmLjRbahDUl52iQ==
SHUkEiphQuZqXyLzDNA1LcOjIY5P93oSbI0OKMKltYY.js
www.google.com/js/bg/ Frame 2C73 		17 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google.com/js/bg/SHUkEiphQuZqXyLzDNA1LcOjIY5P93oSbI0OKMKltYY.js
Requested by
Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/cwQvQhsy4_nYdnSDY4u7O5_B/recaptcha__nl.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
487524122a6142e66a5f22f30cd0352dc3a3218e4ff77a126c8d0e28c2a5b586
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfTr-AUAAAAANb_RvhTeWu00N_K6josD9XFY1OD&co=aHR0cHM6Ly95b3JvaS5jb21wYW55OjQ0Mw..&hl=nl&v=cwQvQhsy4_nYdnSDY4u7O5_B&size=invisible&cb=2h4ssctf2yqs
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Wed, 13 Dec 2023 05:38:46 GMT
content-encoding
br
x-content-type-options
nosniff
age
168394
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
6849
x-xss-protection
0
last-modified
Tue, 28 Nov 2023 18:30:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="botguard-scs"
vary
Accept-Encoding
report-to
{"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Thu, 12 Dec 2024 05:38:46 GMT
logo_48.png
www.gstatic.com/recaptcha/api2/ Frame 2C73 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.gstatic.com/recaptcha/api2/logo_48.png
Requested by
Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/cwQvQhsy4_nYdnSDY4u7O5_B/styles__ltr.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
1b9efb22c938500971aac2b2130a475fa23684dd69e43103894968df83145b8a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.gstatic.com/recaptcha/releases/cwQvQhsy4_nYdnSDY4u7O5_B/styles__ltr.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Mon, 11 Dec 2023 19:56:54 GMT
x-content-type-options
nosniff
age
289706
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
2228
x-xss-protection
0
last-modified
Tue, 03 Mar 2020 20:15:00 GMT
server
sffe
cross-origin-opener-policy
same-origin-allow-popups; report-to="recaptcha"
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type
image/png
cache-control
public, max-age=604800
accept-ranges
bytes
expires
Mon, 18 Dec 2023 19:56:54 GMT
KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v18/ Frame 2C73 		15 KB
15 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2
Requested by
Host: www.google.com
URL: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfTr-AUAAAAANb_RvhTeWu00N_K6josD9XFY1OD&co=aHR0cHM6Ly95b3JvaS5jb21wYW55OjQ0Mw..&hl=nl&v=cwQvQhsy4_nYdnSDY4u7O5_B&size=invisible&cb=2h4ssctf2yqs
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.google.com/
Origin
https://www.google.com
accept-language
nl-NL,nl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Thu, 14 Dec 2023 23:26:56 GMT
x-content-type-options
nosniff
age
17904
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
15344
x-xss-protection
0
last-modified
Mon, 16 Oct 2017 17:32:55 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 13 Dec 2024 23:26:56 GMT
KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v18/ Frame 2C73 		15 KB
15 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2
Requested by
Host: www.google.com
URL: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfTr-AUAAAAANb_RvhTeWu00N_K6josD9XFY1OD&co=aHR0cHM6Ly95b3JvaS5jb21wYW55OjQ0Mw..&hl=nl&v=cwQvQhsy4_nYdnSDY4u7O5_B&size=invisible&cb=2h4ssctf2yqs
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
5a8c1e7681318caa29e9f44e8a6e271f6a4067a2703e9916dfd4fe9099241db7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.google.com/
Origin
https://www.google.com
accept-language
nl-NL,nl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Wed, 13 Dec 2023 21:01:27 GMT
x-content-type-options
nosniff
age
113033
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
15552
x-xss-protection
0
last-modified
Mon, 16 Oct 2017 17:33:02 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Thu, 12 Dec 2024 21:01:27 GMT
webworker.js
www.google.com/recaptcha/api2/ Frame 2C73 		102 B
134 B 		Other
General
Check archive.org
Download Go to
Full URL
https://www.google.com/recaptcha/api2/webworker.js?hl=nl&v=cwQvQhsy4_nYdnSDY4u7O5_B
Requested by
Host: www.google.com
URL: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfTr-AUAAAAANb_RvhTeWu00N_K6josD9XFY1OD&co=aHR0cHM6Ly95b3JvaS5jb21wYW55OjQ0Mw..&hl=nl&v=cwQvQhsy4_nYdnSDY4u7O5_B&size=invisible&cb=2h4ssctf2yqs
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
5ae64d93a741f65b963259f6f6985cf60f834b4966e67c65dc68a3de17674baf
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfTr-AUAAAAANb_RvhTeWu00N_K6josD9XFY1OD&co=aHR0cHM6Ly95b3JvaS5jb21wYW55OjQ0Mw..&hl=nl&v=cwQvQhsy4_nYdnSDY4u7O5_B&size=invisible&cb=2h4ssctf2yqs
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Fri, 15 Dec 2023 04:25:21 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy
frame-ancestors 'self'
server
GSE
cross-origin-embedder-policy
require-corp
x-frame-options
SAMEORIGIN
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type
text/javascript; charset=utf-8
cache-control
private, max-age=300
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
1; mode=block
expires
Fri, 15 Dec 2023 04:25:21 GMT
refill
yoroi.company/wp-json/contact-form-7/v1/contact-forms/223/ 		2 B
773 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://yoroi.company/wp-json/contact-form-7/v1/contact-forms/223/refill
Requested by
Host: yoroi.company
URL: https://yoroi.company/wp-content/plugins/contact-form-7/includes/js/index.js?ver=5.8.4
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff

Request headers

Accept
application/json, */*;q=0.1
Referer
https://yoroi.company/en/research/unveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives/
accept-language
nl-NL,nl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

x-nananana
Batcache-Hit
date
Fri, 15 Dec 2023 04:25:21 GMT
strict-transport-security
max-age=31536000
x-hacker
Want root? Visit join.a8c.com and mention this header.
x-content-type-options
nosniff
x-ac
2.ams _atomic_ams BYPASS
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-cache-status
DYNAMIC
content-encoding
br
host-header
WordPress.com
alt-svc
h3=":443"; ma=86400
last-modified
Fri, 15 Dec 2023 04:25:09 GMT
server
cloudflare
vary
Accept-Encoding, Cookie, Origin
allow
GET
content-type
application/json; charset=UTF-8
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5VjlbZznO%2BOxWditHCp2ET4NRYx4rPWjzJzfsyYP3Ufx4YdZERGiywop456qTpst%2F1TEOK1KAkMebIONpc8FcjN2YCJ0spGukhVpuxEUIRWj%2BzwI8ZGcTt1MaSGWkesO%2Bgam%2BdSQNOgOc5qo"}],"group":"cf-nel","max_age":604800}
access-control-expose-headers
X-WP-Total, X-WP-TotalPages, Link
cache-control
max-age=288, must-revalidate
x-robots-tag
noindex
link
<https://yoroi.company/wp-json/>; rel="https://api.w.org/"
access-control-allow-headers
Authorization, X-WP-Nonce, Content-Disposition, Content-MD5, Content-Type
cf-ray
835bec130df066cd-AMS
reload
www.google.com/recaptcha/api2/ Frame 2C73 		13 KB
9 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.google.com/recaptcha/api2/reload?k=6LfTr-AUAAAAANb_RvhTeWu00N_K6josD9XFY1OD
Requested by
Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/cwQvQhsy4_nYdnSDY4u7O5_B/recaptcha__nl.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
979ecfccf369304d36462e46ba32946508ac53031b4f936ccf3513e6f5d7b8bd
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfTr-AUAAAAANb_RvhTeWu00N_K6josD9XFY1OD&co=aHR0cHM6Ly95b3JvaS5jb21wYW55OjQ0Mw..&hl=nl&v=cwQvQhsy4_nYdnSDY4u7O5_B&size=invisible&cb=2h4ssctf2yqs
accept-language
nl-NL,nl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type
application/x-protobuffer

Response headers

date
Fri, 15 Dec 2023 04:25:21 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy
frame-ancestors 'self'
server
GSE
x-frame-options
SAMEORIGIN
content-type
application/json; charset=utf-8
cache-control
private, max-age=0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
1; mode=block
expires
Fri, 15 Dec 2023 04:25:21 GMT
boom.gif
pixel.wp.com/ 		0
81 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.wp.com/boom.gif?bilmur=1&cumulative_layout_shift=0.007&largest_contentful_paint=1347&batcache_hit=1&provider=wordpress.com&service=atomic&effective_connection_type=4g&rtt=0&downlink=10000&host_name=yoroi.company&url_path=%2Fen%2Fresearch%2Funveiling-vetta-loader-a-custom-loader-hitting-italy-and-spread-through-infected-usb-drives%2F&nt_fetchStart=68&nt_domainLookupStart=69&nt_domainLookupEnd=69&nt_connectStart=69&nt_connectEnd=124&nt_secureConnectionStart=93&nt_requestStart=124&nt_responseStart=267&nt_responseEnd=323&nt_domLoading=269&nt_domInteractive=1215&nt_domContentLoadedEventStart=1240&nt_domContentLoadedEventEnd=1248&nt_domComplete=2629&nt_loadEventStart=2629&nt_loadEventEnd=2631&nt_redirectCount=0&nt_nextHopProtocol=h2&nt_api_level=2&start_render=1192&first_contentful_paint=1347&resource_size=1684266&resource_transferred=405005&resource_cache_percent=0&js_size=472026&js_transferred=159076&js_cache_percent=0&blocking_size=1268248&blocking_transferred=197082&blocking_cache_percent=0&last_resource_end=2772
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://yoroi.company/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

access-control-allow-origin
*
date
Fri, 15 Dec 2023 04:25:23 GMT
cache-control
no-cache
server
nginx

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
yoroi.company
URL
https://yoroi.company/cdn-cgi/challenge-platform/scripts/jsd/main.js

Verdicts & Comments Add Verdict or Comment

70 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 object| documentPictureInPicture undefined| $ function| jQuery object| Cli_Data object| cli_cookiebar_settings object| log_object object| CLI_Cookie object| CLI object| cliBlocker string| CLI_ACCEPT_COOKIE_NAME string| CLI_PREFERNCE_COOKIE number| CLI_ACCEPT_COOKIE_EXPIRE boolean| CLI_COOKIEBAR_AS_POPUP object| mailup_params object| AOS function| Parallax object| lazyLoadOptions string| _linkedin_partner_id object| _linkedin_data_partner_ids function| lintrk object| swv object| wpcf7 object| ___grecaptcha_cfg object| grecaptcha string| __recaptcha_api boolean| __google_recaptcha_client object| runtime object| regeneratorRuntime object| wpcf7_recaptcha object| html5 object| Modernizr object| bodyScrollLock object| classie object| iNoBounce object| YTPlayer object| SM_Timer function| getWindowScrollTop function| setWindowScrollTop function| getScrollTop function| setScrollTop object| SlickMenu object| _stq object| SM_VARS object| SM object| cursor function| _toConsumableArray function| _nonIterableSpread function| _iterableToArray function| _arrayWithoutHoles function| _extends function| _typeof function| LazyLoad function| st_go function| linktracker_init object| wpcom string| currentText string| categoryCookie object| categoryCookieValue object| cli_chkbox_elm string| cli_chkbox_data_id string| cli_chkbox_data_id_trimmed object| srcReplaceableElms function| oxyCloseModal boolean| _already_called_lintrk object| recaptcha object| closure_lm_151508 object| ORIBILI

14 Cookies

Domain/Path Name / Value
www.google.com/recaptcha Name: _GRECAPTCHA
Value: 09AC_RnBKp-k4dxNC_G_ECjkEkw2Y5hTLSP7oAzdCcb6-A27RjiBwEqRBfNI-xaN2xG6_GaKwGHGHjm9LBr2GQg3U
yoroi.company/ Name: pll_language
Value: en
yoroi.company/ Name: cookielawinfo-checkbox-necessary
Value: yes
yoroi.company/ Name: cookielawinfo-checkbox-performance
Value: no
yoroi.company/ Name: cookielawinfo-checkbox-advertisement
Value: no
yoroi.company/ Name: cookielawinfo-checkbox-others
Value: no
yoroi.company/ Name: cookielawinfo-checkbox-analytics-it
Value: no
.linkedin.com/ Name: li_sugr
Value: 951a5f40-16ee-4a36-bcc7-92e5095fc6e9
.linkedin.com/ Name: bcookie
Value: "v=2&2eb47680-74ac-4421-80ee-e17d55f404f2"
.linkedin.com/ Name: lidc
Value: "b=TGST00:s=T:r=T:a=T:p=T:g=3275:u=1:x=1:i=1702614319:t=1702700719:v=2:sig=AQHzgaj9E9pzgd7XnNFLQHtsEFrgWwGG"
.linkedin.com/ Name: UserMatchHistory
Value: AQINWWxH2v5s2QAAAYxruMQNeWs9oh4KB_SM8DnuzIszl59FmBAZJpMREVt8XPM3_Pmrhk4bHNF8Zw
.linkedin.com/ Name: AnalyticsSyncHistory
Value: AQJwd0Vp3CK2kgAAAYxruMQNwwb6wpNEyj3JbBAaNsAbriN_FLsKYv7_FtQSPBtCnqDs0ku7QzEdMmRFym4j_Q
.www.linkedin.com/ Name: bscookie
Value: "v=1&202312150425205ad87d1a-a2b1-4808-8f85-6d998456441fAQF68ZEtbDO_61mdbrYH3EAfl_k-GjvQ"
.linkedin.com/ Name: li_gc
Value: MTswOzE3MDI2MTQzMjA7MjswMjHoovYnA7+3uQQO4hQ0QUTe/pFbifSreD1AnHGI+nK9TA==

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=31536000

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

c0.wp.com
cdn.jsdelivr.net
fonts.googleapis.com
fonts.gstatic.com
i0.wp.com
pixel.wp.com
px.ads.linkedin.com
px4.ads.linkedin.com
s0.wp.com
snap.licdn.com
stats.wp.com
www.google.com
www.gstatic.com
www.linkedin.com
yoroi.company
yoroi.company
13.107.42.14
192.0.76.3
192.0.77.2
192.0.77.32
192.0.77.37
2606:4700::6810:5614
2620:1ec:21::14
2a00:1450:4001:80f::2003
2a00:1450:4001:829::200a
2a00:1450:4001:82f::2004
2a00:1450:4001:831::2003
2a02:26f0:3500:16::215:149b
2a06:98c1:3120::3
2a06:98c1:3121::3
02e2dd08ed3c4680e621ea71891aa5675ed8afe3ea8e99dc5d4b0caa4e2ef799
03776ba2741b34dfc2f6a356327e2dc25cbb07f9138b5a779c6b187a58be39e0
048e7b54fbc9022c80b0bf1144f55baaf814f91fe575515dbd4263634317013f
058518d45e49147be19e3e9847a1bb86c2fca0e546ecf62504aea2faaee0a72e
0be502b9446e16b338d36ccadac232f4a68ab74655f98fec415ccdbbccbf5729
0d349f88844345061cef86a46e23bf67ae8ef16f7ec2453f20abe90add14655b
0f4a3ba36482c233c6d7970cd42fb5b76ea054044dbebe424176db9f176616cb
1aa8845fd06e475aefe733d4e55b36a92fcd487975049c8172341827ac9cc03e
1b9efb22c938500971aac2b2130a475fa23684dd69e43103894968df83145b8a
1c594062728319da3ecaa98c4c0b930b07d5e64207eb6e4987d4fcbff9134768
1d52e1ac7d3bc25a8b0ffc257153f9dd50249f96fe9a4df5e0d771241a69062c
1dc6d2d43514d1d8956877d1f2ef347cd5abdb8ecf8e47aba59d87b8a6da49bb
1e41b9ba20319d67b5b640af59346a76cec477cee421bfc5e05b1238eb292246
204a3227a3631e685f978c6567314a00f03a3bedbbbc947122c97bcc4ac62d9d
216728e33a7de4be9b784eff527c6ccf1658319ea78fe66a7864c0b923200252
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
270524b0d27afd1d3b6622d1a176c678daed94564c143297e217a63e21ce9820
27dd9b075cc59cf5f3c0f6ee075f4bd113782d81ce30a4f16aac669ecfdc4fa2
2deb67a6ea5e9e0e254330515f7aa291a07618b72715a63971274378cd4d06c4
2e10d353ff038c2cad3492fc17801af3e6ef2669c9e9713bdb78b1dcb104c4fe
2e2f2336b5e6698b628afc75fa9a24c67b73d5872c1d4af99ca436064f636ee0
3457140e78788c55cd49cc718bd4e91975bc7b3de7d2754dc3607563e510dced
3cc2099313e7a6fd7e0dc7864f93944546c6a7c0de353e903d1b06ceb9c544ba
3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc
4460f1596174d06cca957fdaca2c71e1a377cf1d6f07ee4c75ffb3bf3fc97a03
487524122a6142e66a5f22f30cd0352dc3a3218e4ff77a126c8d0e28c2a5b586
49cf0f2de45929d5674df4377cfc2363324674ca4dfdef454bc1dfeebcec9ca5
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
52a86f59fd1312a60def6374184c8055b7fa03858e8494a7c35d25f619156b0f
547dda3c14b284819be511be1e410da94a5efc6ccc4a9afe1c75394f9333191a
5486d67c53956813c2ab1fdef773516ee85aff7adae4ae0186cf09e398c1e28f
57a50c99a31ef4e89e86664e96f6dfbdde163a2eb96e88b3b492c49aa4be2f37
5a8c1e7681318caa29e9f44e8a6e271f6a4067a2703e9916dfd4fe9099241db7
5ae64d93a741f65b963259f6f6985cf60f834b4966e67c65dc68a3de17674baf
5fd50e41f2ce65b53589fb6ca59a03d2fc269d65db66f8c0b29fc5bc8ba84d08
65158a29c17b7bd93fcb3409b97eda74a7c090d932a9ce494adb9f82d737894d
655ae452d922f501b62c7028fc35e238138de989387381cc1ed9cea9085864db
6912f7388531e949bd5406b5668cd6b55fea4cc7e2d123dbaed489054dd98438
698b89c0da3d319754d6a837b5e6d4e6a42dc402d9ffd7559b8c4cb29c644340
6c52384c7b0641dd1ead85d079c22d39bcc6dc5f2537afb1e6396bb619771a3f
6cf390024b9fb02ae1756d257499f568393acc60c76ae6b13ce986a46f396e34
6f3b3eda120231c8b7775699ee027905ac6a8f998e7dddefe9bdab0a0b32219f
73a1f126cf805ced3f24d65132d3163821ed2bb33a62e83e4a305687045dcce5
7859a62e04b0acb06516eb12454de6673883ecfaeaed6c254659bca7cd59c050
7bdc4fd1b52f88617553782da88299fc8551f6921d5a30c5a29b96cb8b4c3eae
7d5b7824ea3c7db497bfc2acc4777d3e0839bdf626cd1bab42431e4321b63f91
7ee08c60d39f5712a56938fda3e2ab10fe3ef23ec98aeb3c9a29e54f6f31ffe1
814005c14007af177ca97da8fdc108fa76b6765c1e2ed546280c7645a0a63ccd
83d04fa061be70b12909406d9cdb1d5ba40596f512fc3c716ae04b645527648c
97470c6fac60d3431c7309907a10d67d0356b563c7bab67f7a44301d4164ac38
979ecfccf369304d36462e46ba32946508ac53031b4f936ccf3513e6f5d7b8bd
9b53ba79fa63e6281e11715289c6da0ab79aeb98f98b3901685efbd32e708791
9c1989ecd392a0c54fb799409154242706940a8e6d800542ba579dfda576bb9d
b7908a015a567ec2363011df2475368dbff34360e9da3fdff50604d6395fb646
bf4d20b28de8c7f77428b24325ec3afb39b6f7e277f6b61666f3a0a17cc3b42b
c1a9a3e223bad631dff12d33b5499eb145cb08d8621c20d9d73870e78d97afe4
c21e5a2b32c47bc5f9d9efc97bc0e29fd081946d1d3ebffc5621cfafb1d3960e
c59f8ce89d8016bba0fd065c18aa463688563cf18eb79226df9cb62e8e096533
c63a636fec47c33c1f90b009d2f95830d3492083c04e429cda86914834714967
ca7752fb33cf3a98c0f29bc4eec563112025da4109a0dcc69dabf5f861751258
cb45a5a7cef4f74f99afa05c6d5c244ed8f36799f372504b042a3e7e6c3d54b7
cb6f2d32c49d1c2b25e9ffc9aaafa3f83075346c01bcd4ae6eb187392a4292cf
ccd31ffa708d025833f954b3e0560cedd58df9a0d2706b2ccee5f501c5b2467b
d3ad83af3a48c24913133f351cc69b135c950df64ec6f0fefd414bc79249c6ba
d51089ba164e46643145dc475cce83e53896a1e6541c68b20d841c1ab24e65b9
d947b55573f76b9876038798590599aef4ec471cd0b44a41438b02ae00fcee5b
da9ed5720b674f0d297fe621ac2d8d518c4e622bef1e9b0d4ae489dee9aa43f8
df0ec8330290d184b1084527076cb87d41b33ba706ff5ab579d761f0cb6a744b
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e3f281a93c5293be122ec933426887f46ae314ffada3e3da98ac76f5ee5992cd
f349f68dd834591897a2b648193d96446427a388772b17163e166c17bf4bb5f4
f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1
f3b0e2a3800f73c56a4dc78562fc32130a8eec6887982d10e6a5dcf6497969c6
f99ea61de5d3dbaf01e20bf1efd0b8b834bc2ca576c6e4f7b68ab25b62e73a6f
fab005de52ce54d75f373c5a020e7ddd194caea5b4bf6e87886196e5d4451adc
fbe820b6140ad28e86f34ffae507d807cf591a22697a05b71958f2014e96a9e4