securityaffairs.co
Open in
urlscan Pro
2001:8d8:100f:f000::289
Public Scan
URL:
https://securityaffairs.co/wordpress/85881/malware/winnti-backdoor-linux.html
Submission: On May 22 via manual from IN
Submission: On May 22 via manual from IN
Summary
This website contacted 22 IPs
in 5 countries
across 17 domains to perform 126 HTTP transactions.
The main IP is 2001:8d8:100f:f000::289, located in
Germany and
belongs to ONEANDONE-AS Brauerstrasse 48, DE.
The main domain is securityaffairs.co.
TLS certificate: Issued by GeoTrust RSA CA 2018 on February 21st 2019. Valid for: a year.
This is the only time securityaffairs.co was scanned on urlscan.io!
TLS certificate: Issued by GeoTrust RSA CA 2018 on February 21st 2019. Valid for: a year.
This is the only time securityaffairs.co was scanned on urlscan.io!
urlscan.io Verdict: No classification
Domain & IP information
1
209.197.3.15
(Phoenix, United States)
ASN20446 (,)
PTR: vip0x00f.map2.ssl.hwcdn.net
ASN20446 (,)
PTR: vip0x00f.map2.ssl.hwcdn.net
| maxcdn.bootstrapcdn.com |
1
184.31.86.25
(Netherlands)
ASN20940 (AKAMAI-ASN1, US)
PTR: a184-31-86-25.deploy.static.akamaitechnologies.com
ASN20940 (AKAMAI-ASN1, US)
PTR: a184-31-86-25.deploy.static.akamaitechnologies.com
| ws.sharethis.com |
2
2.19.43.118
(Ascension Island)
ASN20940 (AKAMAI-ASN1, US)
PTR: a2-19-43-118.deploy.static.akamaitechnologies.com
ASN20940 (AKAMAI-ASN1, US)
PTR: a2-19-43-118.deploy.static.akamaitechnologies.com
| platform-api.sharethis.com | |
| buttons-config.sharethis.com |
9
192.0.77.2
(San Francisco, United States)
ASN2635 (,)
PTR: i1.wp.com
ASN2635 (,)
PTR: i1.wp.com
| i0.wp.com | |
| i1.wp.com | |
| i2.wp.com |
20
104.111.214.39
(Netherlands)
ASN16625 (,)
PTR: a104-111-214-39.deploy.static.akamaitechnologies.com
ASN16625 (,)
PTR: a104-111-214-39.deploy.static.akamaitechnologies.com
| contextual.media.net | |
| lg3.media.net |
1
2.16.186.146
(Ascension Island)
ASN20940 (AKAMAI-ASN1, US)
PTR: a2-16-186-146.deploy.static.akamaitechnologies.com
ASN20940 (AKAMAI-ASN1, US)
PTR: a2-16-186-146.deploy.static.akamaitechnologies.com
| c.sharethis.mgr.consensu.org |
3
3.120.53.177
(Frankfurt am Main, Germany)
ASN16509 (,)
PTR: ec2-3-120-53-177.eu-central-1.compute.amazonaws.com
ASN16509 (,)
PTR: ec2-3-120-53-177.eu-central-1.compute.amazonaws.com
| l.sharethis.com |
17
172.217.22.66
(United States)
ASN15169 (,)
PTR: fra15s17-in-f66.1e100.net
ASN15169 (,)
PTR: fra15s17-in-f66.1e100.net
| www.googletagservices.com | |
| securepubads.g.doubleclick.net |
2
54.193.49.97
(San Jose, United States)
ASN16509 (,)
PTR: ec2-54-193-49-97.us-west-1.compute.amazonaws.com
ASN16509 (,)
PTR: ec2-54-193-49-97.us-west-1.compute.amazonaws.com
| navvy.media.net |
5
23.62.140.165
(Netherlands)
ASN16625 (,)
PTR: a23-62-140-165.deploy.static.akamaitechnologies.com
ASN16625 (,)
PTR: a23-62-140-165.deploy.static.akamaitechnologies.com
| hbx-lg.media.net |
1
2.16.186.67
(Ascension Island)
ASN20940 (AKAMAI-ASN1, US)
PTR: a2-16-186-67.deploy.static.akamaitechnologies.com
ASN20940 (AKAMAI-ASN1, US)
PTR: a2-16-186-67.deploy.static.akamaitechnologies.com
| qsearch-a.akamaihd.net |
| Domain | Requested by | |
|---|---|---|
| 42 | securityaffairs.co |
1 redirects
securityaffairs.co
|
| 14 | contextual.media.net |
securityaffairs.co
contextual.media.net |
| 10 | securepubads.g.doubleclick.net |
www.googletagservices.com
securepubads.g.doubleclick.net securityaffairs.co |
| 7 | www.googletagservices.com |
securityaffairs.co
securepubads.g.doubleclick.net |
| 6 | lg3.media.net |
securityaffairs.co
contextual.media.net |
| 5 | hbx-lg.media.net |
securityaffairs.co
|
| 5 | tpc.googlesyndication.com |
securepubads.g.doubleclick.net
|
| 4 | i1.wp.com |
securityaffairs.co
|
| 3 | adservice.google.com |
www.googletagservices.com
|
| 3 | adservice.google.de |
www.googletagservices.com
|
| 3 | l.sharethis.com |
1 redirects
securityaffairs.co
|
| 3 | i0.wp.com |
securityaffairs.co
|
| 2 | navvy.media.net |
contextual.media.net
|
| 2 | connect.facebook.net |
securityaffairs.co
connect.facebook.net |
| 2 | i2.wp.com |
securityaffairs.co
|
| 1 | www.google-analytics.com | |
| 1 | google-analytics.com |
securityaffairs.co
|
| 1 | qsearch-a.akamaihd.net | |
| 1 | pixel.wp.com |
securityaffairs.co
|
| 1 | staticxx.facebook.com |
connect.facebook.net
|
| 1 | c.sharethis.mgr.consensu.org |
ws.sharethis.com
|
| 1 | buttons-config.sharethis.com |
platform-api.sharethis.com
|
| 1 | stats.wp.com |
securityaffairs.co
|
| 1 | s0.wp.com |
securityaffairs.co
|
| 1 | secure.gravatar.com |
securityaffairs.co
|
| 1 | platform-api.sharethis.com |
securityaffairs.co
|
| 1 | ws.sharethis.com |
securityaffairs.co
|
| 1 | maxcdn.bootstrapcdn.com |
securityaffairs.co
|
| 0 | fonts.googleapis.com Failed |
securityaffairs.co
|
| 126 | 29 |
This site contains links to these domains. Also see Links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| www.securityaffairs.co GeoTrust RSA CA 2018 |
2019-02-21 - 2020-03-22 |
a year | crt.sh |
| *.bootstrapcdn.com COMODO RSA Domain Validation Secure Server CA |
2018-10-03 - 2019-10-12 |
a year | crt.sh |
| *.sharethis.com DigiCert SHA2 Secure Server CA |
2018-12-16 - 2020-03-16 |
a year | crt.sh |
| *.wp.com Go Daddy Secure Certificate Authority - G2 |
2018-04-10 - 2020-05-11 |
2 years | crt.sh |
| *.media.net DigiCert SHA2 Secure Server CA |
2018-12-30 - 2020-03-30 |
a year | crt.sh |
| *.gravatar.com COMODO RSA Domain Validation Secure Server CA |
2018-09-06 - 2020-09-05 |
2 years | crt.sh |
| *.facebook.com DigiCert SHA2 High Assurance Server CA |
2019-04-22 - 2019-07-21 |
3 months | crt.sh |
| *.sharethis.mgr.consensu.org DigiCert ECC Secure Server CA |
2018-07-31 - 2019-07-31 |
a year | crt.sh |
| *.g.doubleclick.net Google Internet Authority G3 |
2019-04-30 - 2019-07-23 |
3 months | crt.sh |
| *.google.com Google Internet Authority G3 |
2019-04-30 - 2019-07-23 |
3 months | crt.sh |
| tpc.googlesyndication.com Google Internet Authority G3 |
2019-04-30 - 2019-07-23 |
3 months | crt.sh |
| a248.e.akamai.net DigiCert ECC Secure Server CA |
2018-10-18 - 2019-10-18 |
a year | crt.sh |
| *.google-analytics.com Google Internet Authority G3 |
2019-04-30 - 2019-07-23 |
3 months | crt.sh |
This page contains 17 frames:
Primary Page:
https://securityaffairs.co/wordpress/85881/malware/winnti-backdoor-linux.html
Frame ID: E8EEF73E908F41E7C0FE310C8D480911
Requests: 83 HTTP requests in this frame
Frame:
https://c.sharethis.mgr.consensu.org/v1.0/cmp/portal.html
Frame ID: 1753C41FFEB45D7B6EC45FD43A9DBF15
Requests: 1 HTTP requests in this frame
Frame:
https://contextual.media.net/checksync.php?&vsSync=1&cs=1&hb=1&cv=37&ndec=1&cid=8HB41O6BH&prvid=80%2C82%2C97%2C109&rtime=6&https=1&gdpr=1&gdprconsent=2
Frame ID: 89520E02B2666B154764CACF04BF54CC
Requests: 1 HTTP requests in this frame
Frame:
https://contextual.media.net/fcmdynet.js?&gdpr=1&cid=8CU5BD6EW&cpcd=RlAcVccC-RdUYIl-LjF9ag%3D%3D&crid=762221962&size=300x250&cc=DE&https=1&vif=1&requrl=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F85881%2Fmalware%2Fwinnti-backdoor-linux.html&nse=3&vi=1558514709901426700&lw=1&ugd=4&re=1&rtbs=1&hlt=1&dfp=1&nb=1
Frame ID: 605912199A5FB0DB259FDCBD7483F647
Requests: 2 HTTP requests in this frame
Frame:
https://www.googletagservices.com/tag/js/gpt.js
Frame ID: 5D1EB4FAB473DF719EB9646E6C468A6A
Requests: 8 HTTP requests in this frame
Frame:
https://contextual.media.net/fcmdynet.js?&gdpr=1&cid=8CU5BD6EW&cpcd=RlAcVccC-RdUYIl-LjF9ag%3D%3D&crid=184323154&size=300x250&cc=DE&https=1&vif=1&requrl=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F85881%2Fmalware%2Fwinnti-backdoor-linux.html&nse=3&vi=1558514709901263397&lw=1&ugd=4&re=1&rtbs=1&hlt=1&dfp=1&nb=1
Frame ID: 47B5EC70528B5C18088B37FFE9462DE6
Requests: 1 HTTP requests in this frame
Frame:
https://www.googletagservices.com/tag/js/gpt.js
Frame ID: A8D0FCE1D017690CB4BA3B9421FB5221
Requests: 8 HTTP requests in this frame
Frame:
https://contextual.media.net/fcmdynet.js?&gdpr=1&cid=8CU5BD6EW&cpcd=RlAcVccC-RdUYIl-LjF9ag%3D%3D&crid=639665355&size=300x600&cc=DE&https=1&vif=1&requrl=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F85881%2Fmalware%2Fwinnti-backdoor-linux.html&nse=3&vi=1558514709547616901&lw=1&ugd=4&re=1&rtbs=1&hlt=1&dfp=1&nb=1
Frame ID: CBD091A95D01C1643EBAC70C87A29A06
Requests: 1 HTTP requests in this frame
Frame:
https://www.googletagservices.com/tag/js/gpt.js
Frame ID: AA6D1BA2BF726FCB9E63F6F8912E26A2
Requests: 8 HTTP requests in this frame
Frame:
https://staticxx.facebook.com/connect/xd_arbiter.php?version=44
Frame ID: 19A3E4DDB5742A4C1D1586A3027595AB
Requests: 1 HTTP requests in this frame
Frame:
https://contextual.media.net/mediamain.html?&cid=8CU5BD6EW&cpcd=RlAcVccC-RdUYIl-LjF9ag%3D%3D&crid=762221962&pid=8POV70GQX&size=300x250&cpnet=yVb1sHm-0KIh29BOFTjjrEBbIZGw_v2fXpyZXRW3WVE%3D&cme=hmi3FHRUKMmzKimfb0JIDAbp_fyjVK7depiARrivsoxRj_hLfG7Sh7pIMMFBEH3GQmWMN5-SfqQXYweHSH8KKnPGVgvGQ_aPSf0OGKC6cBSpFVbTXU3f6_1duVJnBmigo-643UevFDALT110G-ESfQ%3D%3D%7C%7CNDHRnZ9Gz3KXlI-i9OnZqQ%3D%3D%7C5gDUJdTGiJzedmq9hanWYg%3D%3D%7CN7fu2vKt8_s%3D%7Cb55qwzjHy0vjHJKcPi_v7dgJxFhNbuAURNNZlHieqPOyUyLlEhsRmpDUXo_ZUywIsaN611BpbudwaGdyD9gma8AHbmOVAnOgHH0uY7wz0Mc%3D%7CsRBSg3CPSiQ%3D%7C&https=1&cc=DE&bf=0&staticIframe=1&vif=1&nse=3&vi=1558514709901426700&lw=1&ugd=4&ib=0&katid=801338173&katbid=-21&nb=1
Frame ID: 0CF7188270D0EB9A848DBD1224C78AA8
Requests: 1 HTTP requests in this frame
Frame:
https://contextual.media.net/mediamain.html?&cid=8CU5BD6EW&cpcd=RlAcVccC-RdUYIl-LjF9ag%3D%3D&crid=184323154&pid=8POV70GQX&size=300x250&cpnet=yVb1sHm-0KIh29BOFTjjrHvHwrQGlpByWaOO1vn303s%3D&cme=ddF3tVt6Jgwc0vmFKxq3sxZQnh0iZwpa5KhKGcDHJFxEgLz35A0naNpam52fKJe_u9tIkCm3_lVs8UO_TWiOPSCbQBfwxs5LQx8hOuBd8dcPClRiQGYMWhkgJLSjI5BzpX_yLx7ECLkDeliuUBQP2w%3D%3D%7C%7CNDHRnZ9Gz3KXlI-i9OnZqQ%3D%3D%7C5gDUJdTGiJzedmq9hanWYg%3D%3D%7CN7fu2vKt8_s%3D%7Cb55qwzjHy0vjHJKcPi_v7dgJxFhNbuAURNNZlHieqPOyUyLlEhsRmpDUXo_ZUywIsaN611BpbudwaGdyD9gma8AHbmOVAnOgHH0uY7wz0Mc%3D%7CsRBSg3CPSiQ%3D%7C&https=1&cc=DE&bf=0&staticIframe=1&vif=1&nse=3&vi=1558514709901263397&lw=1&ugd=4&ib=0&katid=801338178&katbid=-21&nb=1
Frame ID: CEBB171028C9C0F1081E3BABD04320DE
Requests: 1 HTTP requests in this frame
Frame:
https://contextual.media.net/mediamain.html?&cid=8CU5BD6EW&cpcd=RlAcVccC-RdUYIl-LjF9ag%3D%3D&crid=639665355&pid=8POV70GQX&size=300x600&cpnet=yVb1sHm-0KIh29BOFTjjrOMbY3Wy7OSYfNFL7sC0vVY%3D&cme=hmi3FHRUKMkilTzseEeahYBK0Dc9Iehoc--eJ91ZbJOU32yPMPHcgTcILw-vm_YLN7Vl26zwtvAWFY8-y5nJkY74VltIAgM5qiRWJ1RL1t9F_RjSHP5de0JanKU1hKV6Xa5xAjKNU5clkdmKXRb2-Q%3D%3D%7C%7CNDHRnZ9Gz3KXlI-i9OnZqQ%3D%3D%7C5gDUJdTGiJzedmq9hanWYg%3D%3D%7CN7fu2vKt8_s%3D%7Cb55qwzjHy0vjHJKcPi_v7dgJxFhNbuAURNNZlHieqPOyUyLlEhsRmpDUXo_ZUywIsaN611BpbudwaGdyD9gma8AHbmOVAnOgHH0uY7wz0Mc%3D%7CsRBSg3CPSiQ%3D%7C&https=1&cc=DE&bf=0&staticIframe=1&vif=1&nse=3&vi=1558514709547616901&lw=1&ugd=4&ib=0&katid=801333249&katbid=-21&nb=1
Frame ID: 5539A4E4C46CC4846F2E1CC1B8EE7575
Requests: 1 HTTP requests in this frame
Frame:
https://tpc.googlesyndication.com/safeframe/1-0-33/html/container.html?n=1
Frame ID: ECB9886CE50765C7DBC7CD7337B8617E
Requests: 1 HTTP requests in this frame
Frame:
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsspfBIopXHEMXSOvPNixNcRZovp-qX78PEnv8eRyxS1wxXWNCmU6F4vVD9T3RB_Ui2gRdRSRrvsIuISzfyhs5SCwzFBeSl4Dvy-KypYXUdSqiWw01m3l8XSgDb4l36Kmc144kc4fGlSbhsfThd6JJRL7PkprY6DbX6HS0ODAvmWKaF5S4Q_kGQo5ZzeIRwfFTsrcbXy-OZHqbe3ONF6hGjyXKCulfdxsLiPZFHBRZmEhIwZ3z2bGym_xM25erDboMkElU6UP_V9BGp_5CDMP1MzOAV0McYlbr33Y9epy8r5-P7LF7WE6L4pzzbqKg&sai=AMfl-YSEfevJlGiOv2At9ErauKVVOzskAxe4ADLs1WB1Qw777LIUsUP_2VbfsTBAIXbxB3NSTE-6zbDS24WgR9LyTA7JWZR3nqpFm4WigjUnHg&sig=Cg0ArKJSzFBkmlgKrmUwEAE&urlfix=1&adurl=
Frame ID: 5689085352D191BEE83F55A19B7481CE
Requests: 2 HTTP requests in this frame
Frame:
https://contextual.media.net/__media__/js/util/nrrV6122.js
Frame ID: 389A76A061400E0DBE1E419AC3285143
Requests: 5 HTTP requests in this frame
Frame:
https://tpc.googlesyndication.com/safeframe/1-0-33/html/container.html?n=1
Frame ID: 539997AFBADACE6BFDB588288B3D83E7
Requests: 1 HTTP requests in this frame
Screenshot
Detected technologies
MediaElement.js
(Video Players)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- env /^mejs$/i
Apache
(Web Servers)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i
Yoast SEO
(SEO)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- html /<!-- This site is optimized with the Yoast/i
Facebook
(Widgets)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- script /\/\/connect\.facebook\.net\/[^\/]*\/[a-z]*\.js/i
Google Analytics
(Analytics)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- script /google-analytics\.com\/(?:ga|urchin|(analytics))\.js/i
- env /^gaGlobal$/i
Twitter Emoji (Twemoji) (Miscellaneous) Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- env /^twemoji$/i
jQuery
(JavaScript Libraries)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- env /^jQuery$/i
Page Statistics
20 Outgoing links
These are links going to different origins than the main page.
URL: https://www.securityweek.com/winnti-spies-use-bootkit-persistence-distributing-backdoors
Title: Winnti
Title: Winnti
Search URL Search Domain Scan URL
URL: https://cloudblogs.microsoft.com/microsoftsecure/2017/01/25/detecting-threat-actors-in-recent-german-industrial-attacks-with-windows-defender-atp/
Title: BARIUM, LEAD
Title: BARIUM, LEAD
Search URL Search Domain Scan URL
URL: https://blog.cylance.com/digitally-signed-malware-targeting-gaming-companies
Title: PassCV
Title: PassCV
Search URL Search Domain Scan URL
URL: https://medium.com/chronicle-blog/winnti-more-than-just-windows-and-gates-e4f03436031a
Title: analysis
Title: analysis
Search URL Search Domain Scan URL
URL: https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/20134508/winnti-more-than-just-a-game-130410.pdf
Title: Winnti 2.0
Title: Winnti 2.0
Search URL Search Domain Scan URL
URL: https://www.novetta.com/wp-content/uploads/2015/04/novetta_winntianalysis.pdf
Title: 2015 Novetta
Title: 2015 Novetta
Search URL Search Domain Scan URL
URL: https://github.com/TKCERT/winnti-nmap-script
Title: Nmap
Title: Nmap
Search URL Search Domain Scan URL
URL: https://www.surveymonkey.com/r/EUBloggerAwards2018
Title: If you appreciate my effort in spreading cybersecurity awareness, please vote for Security Affairs in the section “Your Vote for the Best EU Security Tweeter”
Title: If you appreciate my effort in spreading cybersecurity awareness, please vote for Security Affairs in the section “Your Vote for the Best EU Security Tweeter”
Search URL Search Domain Scan URL
URL: http://www.linkedin.com/pub/pierluigi-paganini/b/742/559
Title: Pierluigi Paganini
Title: Pierluigi Paganini
Search URL Search Domain Scan URL
URL: http://www.facebook.com/sharer.php?u=https://securityaffairs.co/wordpress/85881/malware/winnti-backdoor-linux.html
Title: Facebook
Title: Facebook
Search URL Search Domain Scan URL
URL: http://twitter.com/share?url=https://securityaffairs.co/wordpress/85881/malware/winnti-backdoor-linux.html&text=Chronicle%20experts%20spotted%20a%20Linux%20variant%20of%20the%20Winnti%20backdoor%20
Title: Twitter
Title: Twitter
Search URL Search Domain Scan URL
URL: http://www.linkedin.com/shareArticle?mini=true&url=https://securityaffairs.co/wordpress/85881/malware/winnti-backdoor-linux.html
Title: Linkedin
Title: Linkedin
Search URL Search Domain Scan URL
URL: http://reddit.com/submit?url=https://securityaffairs.co/wordpress/85881/malware/winnti-backdoor-linux.html&title=Chronicle%20experts%20spotted%20a%20Linux%20variant%20of%20the%20Winnti%20backdoor
Title: Reddit
Title: Reddit
Search URL Search Domain Scan URL
URL: https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F85881%2Fmalware%2Fwinnti-backdoor-linux.html
Search URL Search Domain Scan URL
URL: https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F85881%2Fmalware%2Fwinnti-backdoor-linux.html&url=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F85881%2Fmalware%2Fwinnti-backdoor-linux.html
Search URL Search Domain Scan URL
URL: http://www.pinterest.com/pin/create/button/?url=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F85881%2Fmalware%2Fwinnti-backdoor-linux.html&media=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2Fwp-includes%2Fimages%2Fmedia%2Fdefault.png
Search URL Search Domain Scan URL
URL: https://plus.google.com/share?url=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F85881%2Fmalware%2Fwinnti-backdoor-linux.html
Search URL Search Domain Scan URL
URL: http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F85881%2Fmalware%2Fwinnti-backdoor-linux.html
Search URL Search Domain Scan URL
URL: http://www.tumblr.com/share/link?url=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F85881%2Fmalware%2Fwinnti-backdoor-linux.html
Search URL Search Domain Scan URL
URL: https://blog.yoroi.company/
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 63- https://l.sharethis.com/pview?event=pview&version=st_insights.js&lang=en&fpc=6f69f6a-16adeb733e9-6f6cc4ab-1&sessionID=1558514709482.77627&hostname=securityaffairs.co&location=%2Fwordpress%2F85881%2Fmalware%2Fwinnti-backdoor-linux.html&product=simpleshare&fcmp=false&publisher=4d48b7c5-0ae3-43d4-bfbe-3ff8c17a8ae6&url=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F85881%2Fmalware%2Fwinnti-backdoor-linux.html&sharURL=&buttonType=ERROR&destination=ERROR&source=ERROR&title=Chronicle%20experts%20spotted%20a%20Linux%20variant%20of%20the%20Winnti%20backdoorSecurity%20Affairs&ts1558514709482.0=&sop=false HTTP 301
- https://l.sharethis.com/sc?cm=ZGAXpVzlDBUAAAASPAuPAw%3D%3D&uid=true&url=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F85881%2Fmalware%2Fwinnti-backdoor-linux.html&sop=false
- https://securityaffairs.co/wordpress?ga_action=googleanalytics_get_script HTTP 301
- https://securityaffairs.co/wordpress/?ga_action=googleanalytics_get_script
126 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H2 |
Primary Request
winnti-backdoor-linux.html
securityaffairs.co/wordpress/85881/malware/ |
72 KB 20 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
style.css
securityaffairs.co/wordpress/wp-includes/css/dist/block-library/ |
35 KB 35 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
cookie-law-info-public.css
securityaffairs.co/wordpress/wp-content/plugins/cookie-law-info/public/css/ |
3 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
cookie-law-info-gdpr.css
securityaffairs.co/wordpress/wp-content/plugins/cookie-law-info/public/css/ |
12 KB 12 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
font-awesome.min.css
maxcdn.bootstrapcdn.com/font-awesome/4.3.0/css/ |
23 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
custom.css
securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/jqueryui/ |
19 KB 20 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
tipsy.css
securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/ |
539 B 683 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
flexslider.css
securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/flexslider/ |
6 KB 6 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
mediaelementplayer-legacy.min.css
securityaffairs.co/wordpress/wp-includes/js/mediaelement/ |
11 KB 11 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
animation.css
securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/ |
2 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
font-awesome.min.css
securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/ |
17 KB 18 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
swipebox.css
securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/ |
4 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
jquery.circliful.css
securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/ |
334 B 478 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
screen.css
securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/ |
110 KB 110 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
custom-css.php
securityaffairs.co/wordpress/wp-content/themes/rigel_old/templates/ |
12 KB 12 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
grid.css
securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/ |
49 KB 50 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
jquery.js
securityaffairs.co/wordpress/wp-includes/js/jquery/ |
95 KB 95 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
jquery-migrate.js
securityaffairs.co/wordpress/wp-includes/js/jquery/ |
23 KB 23 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
cookie-law-info-public.js
securityaffairs.co/wordpress/wp-content/plugins/cookie-law-info/public/js/ |
16 KB 16 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
st_insights.js
ws.sharethis.com/button/ |
22 KB 7 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
sharethis.js
platform-api.sharethis.com/js/ |
91 KB 28 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
logo_SecurityAffairs.png
securityaffairs.co/wordpress/wp-content/uploads/2015/12/ |
44 KB 44 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
Chinese-hackers-espionage.jpg
i0.wp.com/securityaffairs.co/wordpress/wp-content/uploads/2014/07/ |
11 KB 11 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
dmedianet.js
contextual.media.net/ |
322 KB 106 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
facebook.png
i1.wp.com/securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/buttons/somacro/ |
830 B 1 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
twitter.png
i1.wp.com/securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/buttons/somacro/ |
1 KB 1 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
linkedin.png
i0.wp.com/securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/buttons/somacro/ |
1 KB 1 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
reddit.png
i2.wp.com/securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/buttons/somacro/ |
2 KB 2 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
pinterest.png
i0.wp.com/securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/buttons/somacro/ |
2 KB 2 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
f00db26378ef7df7c440a8ee60ead62b
secure.gravatar.com/avatar/ |
1 KB 1 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
windows-zero-day.png
securityaffairs.co/wordpress/wp-content/uploads/2016/11/ |
336 KB 336 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
ransomware-wallpaper.jpg
securityaffairs.co/wordpress/wp-content/uploads/2016/07/ |
81 KB 81 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
Digging-The-Deep-Web.png
i1.wp.com/securityaffairs.co/wordpress/wp-content/uploads/2018/03/ |
6 KB 6 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
yoroi.png
i1.wp.com/securityaffairs.co/wordpress/wp-content/uploads/2017/06/ |
6 KB 6 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
Huawei-hacked-by-NSA.jpg
i2.wp.com/securityaffairs.co/wordpress/wp-content/uploads/2014/03/ |
7 KB 7 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
sdk.js
connect.facebook.net/en_US/ |
3 KB 2 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
ssba.css
securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/css/ |
105 KB 105 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
photon.js
securityaffairs.co/wordpress/wp-content/plugins/jetpack/modules/photon/ |
2 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
jquery.adrotate.clicktracker.js
securityaffairs.co/wordpress/wp-content/plugins/adrotate/library/ |
1 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
devicepx-jetpack.js
s0.wp.com/wp-content/js/ |
10 KB 3 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
ssba.js
securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/js/ |
2 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
hint.js
securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/ |
987 B 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
jquery.tipsy.js
securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/ |
4 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
jquery.easing.js
securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/ |
8 KB 8 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
browser.js
securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/ |
3 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
jquery.flexslider-min.js
securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/flexslider/ |
21 KB 21 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
waypoints.min.js
securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/ |
8 KB 8 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
mediaelement-and-player.min.js
securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/mediaelement/ |
69 KB 70 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
jquery.swipebox.min.js
securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/ |
11 KB 11 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
jquery.circliful.min.js
securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/ |
3 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
jquery.smarticker.min.js
securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/ |
13 KB 13 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
custom.js
securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/ |
12 KB 13 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
wp-embed.js
securityaffairs.co/wordpress/wp-includes/js/ |
3 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
e-201921.js
stats.wp.com/ |
9 KB 3 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
twemoji.js
securityaffairs.co/wordpress/wp-includes/js/ |
27 KB 27 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
wp-emoji.js
securityaffairs.co/wordpress/wp-includes/js/ |
9 KB 9 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
css
fonts.googleapis.com/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
css
fonts.googleapis.com/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
css
fonts.googleapis.com/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
css
fonts.googleapis.com/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
5b71b64b04b9a500117b1015.js
buttons-config.sharethis.com/js/ |
30 B 450 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
fontawesome-webfont.woff
securityaffairs.co/wordpress/wp-content/themes/rigel_old/fonts/ |
43 KB 44 KB |
Font
application/font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
portal.html
c.sharethis.mgr.consensu.org/v1.0/cmp/ Frame 1753 |
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
sdk.js
connect.facebook.net/en_US/ |
195 KB 58 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
sc
l.sharethis.com/ Redirect Chain
|
0 -1 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
 Cookie set
checksync.php
contextual.media.net/ Frame 8952 |
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
rtbsmpubs.php
contextual.media.net/ |
2 KB 1 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
fcmdynet.js
contextual.media.net/ Frame 6059 |
40 KB 15 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
gpt.js
www.googletagservices.com/tag/js/ Frame 5D1E |
32 KB 11 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
fcmdynet.js
contextual.media.net/ Frame 47B5 |
40 KB 15 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
gpt.js
www.googletagservices.com/tag/js/ Frame A8D0 |
32 KB 10 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
POST H2 |
bping.php
navvy.media.net/ |
807 B 1 KB |
Other
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
rtbsmpubs.php
contextual.media.net/ |
3 KB 2 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
fcmdynet.js
contextual.media.net/ Frame CBD0 |
40 KB 15 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
gpt.js
www.googletagservices.com/tag/js/ Frame AA6D |
32 KB 10 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
bping.php
lg3.media.net/ |
35 B 280 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
bping.php
lg3.media.net/ |
35 B 280 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
sc
l.sharethis.com/ |
51 B 476 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
xd_arbiter.php
staticxx.facebook.com/connect/ Frame 19A3 |
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
integrator.js
adservice.google.de/adsid/ Frame A8D0 |
109 B 171 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
integrator.js
adservice.google.com/adsid/ Frame A8D0 |
109 B 171 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
pubads_impl_2019051601.js
securepubads.g.doubleclick.net/gpt/ Frame A8D0 |
148 KB 54 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
integrator.js
adservice.google.de/adsid/ Frame 5D1E |
109 B 171 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
integrator.js
adservice.google.com/adsid/ Frame 5D1E |
109 B 171 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
pubads_impl_2019051601.js
securepubads.g.doubleclick.net/gpt/ Frame 5D1E |
148 KB 54 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
integrator.js
adservice.google.de/adsid/ Frame AA6D |
109 B 171 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
integrator.js
adservice.google.com/adsid/ Frame AA6D |
109 B 171 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
pubads_impl_2019051601.js
securepubads.g.doubleclick.net/gpt/ Frame AA6D |
148 KB 54 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
nrrV6122.js
contextual.media.net/__media__/js/util/ Frame 6059 |
62 KB 21 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
mediamain.html
contextual.media.net/ Frame 0CF7 |
59 KB 15 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
/
securityaffairs.co/wordpress/ Redirect Chain
|
493 B 470 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
mediamain.html
contextual.media.net/ Frame CEBB |
60 KB 15 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
g.gif
pixel.wp.com/ |
50 B 115 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
ads
securepubads.g.doubleclick.net/gampad/ Frame A8D0 |
38 KB 12 KB |
XHR
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
pubads_impl_rendering_2019051601.js
securepubads.g.doubleclick.net/gpt/ Frame A8D0 |
65 KB 25 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
container.html
tpc.googlesyndication.com/safeframe/1-0-33/html/ Frame A8D0 |
0 0 |
Other
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers |
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
mediamain.html
contextual.media.net/ Frame 5539 |
73 KB 16 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
log
hbx-lg.media.net/ |
35 B 319 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
ads
securepubads.g.doubleclick.net/gampad/ Frame 5D1E |
43 KB 13 KB |
XHR
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
pubads_impl_rendering_2019051601.js
securepubads.g.doubleclick.net/gpt/ Frame 5D1E |
65 KB 25 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
container.html
tpc.googlesyndication.com/safeframe/1-0-33/html/ Frame 5D1E |
0 0 |
Other
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers |
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
ads
securepubads.g.doubleclick.net/gampad/ Frame AA6D |
4 KB 2 KB |
XHR
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
pubads_impl_rendering_2019051601.js
securepubads.g.doubleclick.net/gpt/ Frame AA6D |
65 KB 25 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
container.html
tpc.googlesyndication.com/safeframe/1-0-33/html/ Frame AA6D |
0 0 |
Other
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers |
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
log
hbx-lg.media.net/ |
35 B 319 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
log
hbx-lg.media.net/ |
35 B 319 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
container.html
tpc.googlesyndication.com/safeframe/1-0-33/html/ Frame ECB9 |
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
osd.js
www.googletagservices.com/activeview/js/current/ Frame A8D0 |
76 KB 28 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
rtblog.php
lg3.media.net/ |
35 B 280 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
view
securepubads.g.doubleclick.net/pcs/ Frame 5689 |
0 129 B |
Fetch
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
nrrV6122.js
contextual.media.net/__media__/js/util/ Frame 389A |
62 KB 21 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
10441_505bb4db55aaa1165fa3b242bf39701b.png
contextual.media.net/__media__/images/800000006/ Frame 389A |
4 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
bullet3.woff
contextual.media.net/__media__/fonts/bullet3/ Frame 389A |
2 KB 2 KB |
Font
application/font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
osd_listener.js
www.googletagservices.com/activeview/js/current/ Frame 5689 |
75 KB 28 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
osd.js
www.googletagservices.com/activeview/js/current/ Frame AA6D |
76 KB 28 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
log
hbx-lg.media.net/ |
35 B 319 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
/
qsearch-a.akamaihd.net/log/ |
35 B 319 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
log
hbx-lg.media.net/ |
35 B 319 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
container.html
tpc.googlesyndication.com/safeframe/1-0-33/html/ Frame 5399 |
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
osd.js
www.googletagservices.com/activeview/js/current/ Frame 5D1E |
76 KB 28 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
rtblog.php
lg3.media.net/ |
35 B 280 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
bql.php
lg3.media.net/ Frame 389A |
15 B 355 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
POST H2 |
log
navvy.media.net/ Frame 389A |
807 B 997 B |
Other
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
analytics.js
google-analytics.com/ |
43 KB 18 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
collect
www.google-analytics.com/r/ |
35 B 111 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
bqi.php
lg3.media.net/ |
15 B 15 B |
Image
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- fonts.googleapis.com
- URL
- http://fonts.googleapis.com/css?family=Roboto+Condensed%3A400italic%2C700italic%2C400%2C700&subset=latin%2Ccyrillic-ext%2Cgreek-ext%2Cgreek%2Ccyrillic%2Clatin-ext%2Cvietnamese&ver=318c6717f9163f5538c41eece8581406
- Domain
- fonts.googleapis.com
- URL
- http://fonts.googleapis.com/css?family=Lato%3A400%2C700%2C400italic%2C700italic&ver=318c6717f9163f5538c41eece8581406
- Domain
- fonts.googleapis.com
- URL
- http://fonts.googleapis.com/css?family=Playfair+Display%3A400%2C700%2C400italic&subset=latin%2Ccyrillic-ext%2Cgreek-ext%2Ccyrillic&ver=318c6717f9163f5538c41eece8581406
- Domain
- fonts.googleapis.com
- URL
- http://fonts.googleapis.com/css?family=Oswald%3A400%2C700%2C400italic&subset=latin%2Ccyrillic-ext%2Cgreek-ext%2Ccyrillic&ver=318c6717f9163f5538c41eece8581406
Verdicts & Comments Add Verdict or Comment
66 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onselectstart object| onselectionchange function| queueMicrotask object| _wpemojiSettings undefined| $ function| jQuery object| Cli_Data object| log_object object| CLI_Cookie object| CLI string| CLI_ACCEPT_COOKIE_NAME number| CLI_ACCEPT_COOKIE_EXPIRE boolean| CLI_COOKIEBAR_AS_POPUP object| stlib boolean| tpcCookiesEnableCheckingDone boolean| tpcCookiesEnabledStatus boolean| sop_pview_logged string| stWidgetVersion object| stLight boolean| st_showing object| __stdos__ function| __sharethis__docReady object| __sharethis__ number| cli_flush_cache object| _mNHandle string| medianet_versionId string| cli_cookiebar_settings object| click_object object| FB object| wpcom_img_zoomer object| detectZoom object| Main object| BrowserDetect object| _mN function| setup string| _mN_Idf string| _mN_ctrM number| _mN_ctr object| hbCMBidxc function| _cR function| _cD object| _mNDetails function| _cmL1Require function| _cmL1Define object| _mN_dy object| jQuery112408387453613800406 object| mejs function| onYouTubePlayerAPIReady function| onYouTubePlayerReady function| MediaElement function| MediaElementPlayer object| wp function| $j function| imagePreview object| _stq function| st_go function| linktracker_init object| wpcom object| google_reactive_ads_global_state object| twemoji string| GoogleAnalyticsObject function| ga object| google_tag_data object| gaplugins object| gaGlobal object| gaData6 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
| Domain/Path | Expires | Name / Value |
|---|---|---|
| .media.net/ | Name: data Value: |||||||||||||||||||||||||||||||||||||||||||||||| |
|
| securityaffairs.co/ | Name: hbcm_sd Value: 1%7C1558514709712 |
|
| .media.net/ | Name: gdpr_status Value: 1 |
|
| securityaffairs.co/ | Name: session_depth Value: securityaffairs.co%3D1%7C762221962%3D1%7C184323154%3D1%7C639665355%3D1 |
|
| .media.net/ | Name: visitor-id Value: 2015163099586387000V10 |
|
| .securityaffairs.co/ | Name: __unam Value: 6f69f6a-16adeb733e9-6f6cc4ab-1 |
5 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
| Source | Level | URL Text |
|---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
adservice.google.com
adservice.google.de
buttons-config.sharethis.com
c.sharethis.mgr.consensu.org
connect.facebook.net
contextual.media.net
fonts.googleapis.com
google-analytics.com
hbx-lg.media.net
i0.wp.com
i1.wp.com
i2.wp.com
l.sharethis.com
lg3.media.net
maxcdn.bootstrapcdn.com
navvy.media.net
pixel.wp.com
platform-api.sharethis.com
qsearch-a.akamaihd.net
s0.wp.com
secure.gravatar.com
securepubads.g.doubleclick.net
securityaffairs.co
staticxx.facebook.com
stats.wp.com
tpc.googlesyndication.com
ws.sharethis.com
www.google-analytics.com
www.googletagservices.com
fonts.googleapis.com
104.111.214.39
172.217.22.66
184.31.86.25
192.0.76.3
192.0.77.2
192.0.77.32
2.16.186.146
2.16.186.67
2.19.43.118
2001:8d8:100f:f000::289
209.197.3.15
23.62.140.165
2a00:1450:4001:814::2001
2a00:1450:4001:817::200e
2a00:1450:4001:81d::2002
2a00:1450:4001:820::2002
2a00:1450:4001:821::2004
2a03:2880:f006:21:face:b00c:0:3
2a04:fa87:fffe::c000:4902
3.120.53.177
54.193.49.97
00a4c9aeb6f61ae7f260eea51d5d19a651544c01d202363463375992ef021960
00d534b6d1d7adf2faa7861ce9557403c3c08304e2791fd4301029b0e142c286
00f28fdb987ce0f9edc935ffe381123a2e1f79fcc0f55759a7bb4a83b4a88584
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
0757f7ff6e5f6a581922a5e2d42c5e0cf7475d880885a9802e8bdd5e4188dd34
0915fad60bc9b61b6dcd82d05da7ec4bc0232a647e75b8507c3cba6d4d6602f9
09d1f3b47ffb96bce53952a4e2ad163d11bd8c8396db8372ab2e57229dbc82ee
0a4c16b7f5c1b1ecefc9ffb4fcf1b457f9282d0863fa61d4dd32ad98dafa9a60
0b38483d984a81aafd0a0627636e7a84490e16156c55ea6d68f1b2dfff4afe5e
0bf3f6e79af33723b0c1a822f59a484a35583303ab76fa9227b694b1e719364f
0c27a9c1aee9eacb73655f930a6bbf9ec721006695e5c38405296081cdbcb878
0e53466218d7ff174e0a083ecce89b1c090c67ccbe55775eddca03e930ff9e35
0ebbc7fba9a50d36ef5422345f624431710db4528f25749d1d438c2c10bb69f2
0fd28fece9ebd606b8b071460ebd3fc2ed7bc7a66ef91c8834f11dfacab4a849
13b61826fde5b78966364a0bfe1f2309da1f0ccd75923528a5014978b7276742
173e05cb7fecee270d29de68d331f58f0150a94ead32b7262cd184a41cb53827
1832a6ee34745b08b1fcae42c24468086358b43071d7679a738951aa7dc243ea
18d61b5ee68a57bd7a4733f776f9f8aa5c353e7f35a420881523b6edbf7c6b19
1aaab3c3d6f974416ae34893cebe3a544aea17931439b2449ec392061d11ec82
1c35cc019ebd91bb80f2cb7fc582fb4817452c4720b905048d2d559b5a4ba36b
1db21d816296e6939ba1f42962496e4134ae2b0081e26970864c40c6d02bb1df
1e9a9ba24042f2effe58a5d585f70a7bc4b917e60ddcb9a780ad03817a78381f
2199990352edbb7ec586e01d26e2f6a7010a2fce1517711019b614dcec353ba3
2333802e4a0c86b4cc4c71b376fc0aedc3b03039bfc777d96105f82231215732
25828e937e993ca19df9dcecfcacf886ce7777a9918147097153f2710de2ccc6
2b5f13628bffe97912f39919629726b3a0de90159a05741ddfd553dc43bf5308
2c29defe29114d0e8b948e78d50ebb281035df53a9167089deb1e77e801bbd2f
2cbb8dfc4483c9ce680df342866531ac656e8bed029dcd37a1872327023da5f8
2f64b025cec8c93dcb01fe88f0e79c134bc0a6c751787360153865dfa9f3a962
3357b8342aa25a1e46ea87cdd7b41c07b5c76178685b4d22cd5785add6cd7c33
35fcd4f7f9800c2cae4132d3542dd381037d318674b8a3ad9435b8b67a291492
3655f81d27d6769c7bae09d9792edb674e2bdeed0a023e8ebb0fdfc8013e65b4
45185c8f6cd2f9b42e3a02b78af40edc7d61328fac3167a0490c9c69bbecaaa6
50a526e6661dae725aa686cb4e5c8660c617e76bfc4a4182d4124bb9e7e401b0
529a8625b1d79f8a672375f5acdefd683f86f29327461266fa428aa734cb697b
541ac58217a8ade1a5e292a65a0661dc9db7a49ae13654943817a4fbc6761afd
5525d57ced576560de8777ea78e4bc0c9d55396c0b668a7563b354de9c165aee
59a7f48a8aee780fdcb4a0157e25b448e543bc4159b119e74dfd5c26c941b439
5d9acf0072a476d1ad64e2ebfb7054af0cd5969f0cd297a04d02206af807da25
639b4509780048ed50d9f5cd861010522112bcf8c9c2d26f5ddec78c7e739a5b
643a860832456b5a74825b79d625434b5c4c2a344b8f9bef3614b327bea52646
7478123ab457a28ecf9df78f2832fbdbefc205eaef0930b4f6666903e756be46
759949fb0ffaa47eb3755d704adfee7be3ab4fd3d3fa2f37381ca6ea8b9506b1
76a18f5f0637e0d73ce1afece898ce8b0fa75bb6b1c1990ae4a7ac6b083045ce
796c46ec10bc9105545f6f90d51593921b69956bd9087eb72bee83f40ad86f90
7a8cf6b7fce01f318e416ae1904132265526ca2b6ef3003f7fe831186a7380a0
7bd161f7d082ed35e662124df2889b3cc1a8fcb5cc20b05c209de629e419ec0a
7dff09578729615fcd15c840a32c9f82a33fe2331a851e4ac40be03cb111b3f0
7eee3c9ad9cbc20c9906e76e087aac24ea48851679b0c1a68163b5dcda0d67f9
7f6771cd7b2aa306099f8ea576ea1b07bb4f45ff9ccfba847e2c7db90507e3ab
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
8d732b3483eb44546a848a82cc9d6a584c81860aae7255f7ac589dcb3f130535
95b796379104c20b9f92b3c24062529aedae83a5d4aafedb4ba1893ad9c7f98b
97a13f1d35f37b867136346e9d8d3b57a94bed091b748259afe3cc9790d6076e
98216aa6037ea9301c7b5b2a4d95382d95f971d25433bdbf95a2debd1fdeb01b
9a47abcc220084cd32dd51bd76f84ff7839e2dbf1a132fb970e8a1437f03726b
9eade11ffd772c4492d46969c94db94238be90cb2fc9ed98b199a64113d33920
9fd67e46f6efde4f1c719a86e8e741885d29673dd596f47a425b735f930baffc
a0fded691aed767f851011cd3185b928619298a21a0fbdad4808a9e88b490833
a3f4f49e3d10df61add7ab0c75ff366daabe6aefd949e0986d2efe037f8bce3b
aecbb7494580f4902d9b6686614623951c0d599a7a21fe0f855491b0f52987a7
b12c1cd811f54d11bfdcb5e235e73934a8b8a7a85eafb8529117f9a5bb64ccf8
b5b86414cb6d3be973b33e1b2102c00f6668fa88325741d374dbe276de54dab1
b87092d2e9ee42f19dcd43da6fe826d1ef1889c789a901ca4c0a6bd9ab02f0eb
ba45c5c7f93291d62df4a8d2a62dedfceed8e33ef4e6e9791f5609375101adc8
bf59c6832eb9df82772307968b03faa3ed06bf8b2bd2bd994e5ac900e7ac58da
c026c385573035118cb24fe5315dceea3f26646af3e91df1ad530e49121753d0
c067a7d5bc50ed4ba554421966d6c4b0140ff2ed4574640fd5abcfa1ab35be11
c787e9dd6dc8ea3c935f5f0f30e3b9e4a3e066b4619bb244f569883f8e318a24
c86f74fea14d421a5166b1a28b49efd224d223b7b4e9d2a1b2e7ee865d338ee0
d127a8059b6ab52281937321cef6722bd17ae45a322e9a8fda5e9a3d810f819b
d71d5d3c7599fea2708a390106f99aff6c764e5e043b8095a2c7d2e85e392ddd
d931ba2089021a1357761939c18bcc09aa856d39be2a707ea450333f5b3443c4
d99ea9db1da8549489666d36c9e3fb717842550eed1554e96860af8d30c3b008
dbe018eba09f8ba6649cde77090213072bfdf207011d43949246e686b3273337
dce50148adaff4dccd1d95c9b25563011436e398272d530e974193b8685340a2
e10c40f7a3e5d3474ff8e4ce6adef5afffffb13baa23bded5b8f5ededb845fb1
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e89bbc7723c5114f9cf138c6019bbca4e4f5e13f6b9febaa38c92c4c3584a964
f08920f16a4fb284b9f0b2f9d7453ef80388854e7eed8a00260886db6dd16103
f0c6d2d27de284102b03e30cd74be808801ec53ca49f30b4d15620ee84ea39f5
f18a045b26a9d37b6e3c7a365cf2b72be7cc8711506c3d342c7a2651937db8f1
f23972b03bf765069dbe9f3b4a45c8d1f9b245c628e708cc7dd0ad55d245ddaf
f32d41f2099a0be20e6b57c5e0d1b71c079d3e1345827b0f5c5b97c6e5e3f78d
f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1
f89a3824993ded1e2a79b24f445f2f8de2dd401cd94cd453eee11d21a9ff3d26
fae9b4ec3d58bbe5b7915990b5b7ed42f2b71302a4a662b6d533a9f27beca154
fc613e8b3ab1a194871ae3cafffe9015fec2086454a55ce0fbe1a39affef56a3
ffa31f5802b20d64a10c71ad93394c1e2b4b16f33e2f479d8274fd02ce0a594f