www.seqrite.com Open in urlscan Pro
103.228.50.137 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/
Submission: On June 19 via api (June 19th 2024, 2:59:18 am UTC) from US — Scanned from DE

Summary HTTP 86 Redirects Links 14 Behaviour Indicators

Summary

This website contacted 10 IPs in 4 countries across 8 domains to perform 86 HTTP transactions. The main IP is 103.228.50.137, located in India and belongs to BALASAINET-AS Balasai Net Pvt. Ltd., IN. The main domain is www.seqrite.com.
TLS certificate: Issued by RapidSSL TLS RSA CA G1 on January 2nd 2024. Valid for: a year.

This is the only time www.seqrite.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
76	103.228.50.137 103.228.50.137	133288 (BALASAINE...) (BALASAINET-AS Balasai Net Pvt. Ltd.)
1	2a00:1450:400... 2a00:1450:4001:80f::2008	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:810::200a	15169 (GOOGLE) (GOOGLE)
2	2606:2800:234... 2606:2800:234:59:254c:406:2366:268c	15133 (EDGECAST) (EDGECAST)
1	2a00:1450:400... 2a00:1450:4001:80b::200a	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:828::200e	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:80b::2003	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:400c:c0b::9b	15169 (GOOGLE) (GOOGLE)
1	157.240.252.10 157.240.252.10	32934 (FACEBOOK) (FACEBOOK)
86	10

76 103.228.50.137 (India)

ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN)
PTR: ComputeH-pnq83.balasai.com

www.seqrite.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80f::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:810::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:2800:234:59:254c:406:2366:268c (United States)

ASN15133 (EDGECAST, US)

platform.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80b::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:828::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80b::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c0b::9b (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 157.240.252.10 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)
PTR: edge-star-shv-01-fra3.facebook.com

graph.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
76	seqrite.com www.seqrite.com	5 MB
2	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 68	21 KB
2	twitter.com platform.twitter.com — Cisco Umbrella Rank: 1430	28 KB
2	googleapis.com ajax.googleapis.com — Cisco Umbrella Rank: 457 fonts.googleapis.com — Cisco Umbrella Rank: 77	9 KB
1	facebook.com graph.facebook.com — Cisco Umbrella Rank: 161	319 B
1	doubleclick.net stats.g.doubleclick.net — Cisco Umbrella Rank: 132	346 B
1	gstatic.com fonts.gstatic.com	48 KB
1	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 79	71 KB
86	8

	Domain	Requested by
76	www.seqrite.com	www.seqrite.com
2	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com
2	platform.twitter.com	www.seqrite.com platform.twitter.com
1	graph.facebook.com	www.seqrite.com
1	stats.g.doubleclick.net	www.google-analytics.com
1	fonts.gstatic.com	fonts.googleapis.com
1	fonts.googleapis.com	ajax.googleapis.com
1	ajax.googleapis.com	www.seqrite.com
1	www.googletagmanager.com	www.seqrite.com
86	9

This site contains links to these domains. Also see Links.

Domain
www.facebook.com
twitter.com
www.linkedin.com
plus.google.com
www.youtube.com
api.whatsapp.com
blog.talosintelligence.com
dopt.gov.in
github.com
satyarthi.org.in
www.malwarebytes.com
www.welivesecurity.com
docs.seqrite.com

Subject Issuer	Validity	Valid
*.seqrite.com RapidSSL TLS RSA CA G1	`2024-01-02` - `2025-01-08`	a year	crt.sh
*.google-analytics.com WR2	`2024-05-27` - `2024-08-19`	3 months	crt.sh
upload.video.google.com WR2	`2024-05-27` - `2024-08-19`	3 months	crt.sh
*.twimg.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-07-28` - `2024-07-26`	a year	crt.sh
*.gstatic.com WR2	`2024-05-27` - `2024-08-19`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2024-05-27` - `2024-08-19`	3 months	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2024-03-28` - `2024-06-26`	3 months	crt.sh

This page contains 2 frames:

Primary Page: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/
Frame ID: 3E8F464AB3528CD7F954564B54B92B40
Requests: 89 HTTP requests in this frame

Frame: https://platform.twitter.com/widgets/widget_iframe.2f70fb173b9000da126c79afe2098f02.html?origin=https%3A%2F%2Fwww.seqrite.com
Frame ID: DE034DD435C51E3ACC1A941DA222A0F1
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Operation RusticWeb targets Indian Govt: From Rust-based malware to Web-service exfiltration

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

<link rel=["']stylesheet["'] [^>]+/wp-(?:content|includes)/
/wp-(?:content|includes)/
wp-embed\.min\.js\?ver=([\d.]+)

Yoast SEO (SEO) Expand

Overall confidence: 100%
Detected patterns

<!-- This site is optimized with the Yoast (?:WordPress )?SEO plugin v([\d.]+) -

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
<link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

googleapis\.com/.+webfont

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtag/js

Twitter (Widgets) Expand

Overall confidence: 100%
Detected patterns

//platform\.twitter\.com/widgets\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jQuery Migrate (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?

Page Statistics

86
Requests

100 %
HTTPS

78 %
IPv6

8
Domains

9
Subdomains

10
IPs

4
Countries

5785 kB
Transfer

6487 kB
Size

4
Cookies

14 Outgoing links

These are links going to different origins than the main page.

URL: https://www.facebook.com/seqrite

Search URL Search Domain Scan URL

URL: https://twitter.com/Seqrite

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/seqrite

Search URL Search Domain Scan URL

URL: https://plus.google.com/114969253508422817802/posts

Search URL Search Domain Scan URL

URL: https://www.youtube.com/channel/UCPgS-p40ag_l8i3mhMWW7Gg

Search URL Search Domain Scan URL

URL: https://api.whatsapp.com/send?text=Operation%20RusticWeb%20targets%20Indian%20Govt%3A%20From%20Rust-based%20malware%20to%20Web-service%20exfiltration%20https%3A%2F%2Fwww.seqrite.com%2Fblog%2Foperation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration%2F

Search URL Search Domain Scan URL

URL: https://blog.talosintelligence.com/operation-armor-piercer/
Title: Armor Piercer

Search URL Search Domain Scan URL

URL: https://dopt.gov.in/sites/default/files/BlankIPR.pdf
Title: website

Search URL Search Domain Scan URL

URL: https://github.com/somenonymous/OshiUpload
Title: OshiUpload

Search URL Search Domain Scan URL

URL: https://satyarthi.org.in/wp-content/uploads/2022/09/Assam.pdf
Title: website

Search URL Search Domain Scan URL

URL: https://www.malwarebytes.com/blog/news/2018/06/malware-analysis-decoding-emotet-part-2
Title: Emotet

Search URL Search Domain Scan URL

URL: https://github.com/danielbohannon/Invoke-Obfuscation/tree/master
Title: Invoke-Obfuscation

Search URL Search Domain Scan URL

URL: https://www.welivesecurity.com/en/eset-research/unlucky-kamran-android-malware-spying-urdu-speaking-residents-gilgit-baltistan/
Title: Unlucky Kamran

Search URL Search Domain Scan URL

URL: https://docs.seqrite.com/docs
Title: Manuals

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

86 HTTP transactions
4 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request / Show response
www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/ 134 KB
31 KB 3799ms
1530ms Document
text/html 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

1371e7ac1d5ba92d3497498e4a9810af0b66f065d9f17681f12d6f787aea905c

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

Cache-Control: max-age=2592000, private, must-revalidate
Connection: keep-alive, Keep-Alive
Content-Encoding: gzip
Content-Length: 30127
Content-Security-Policy: upgrade-insecure-requests
Content-Type: text/html; charset=UTF-8
Date: Wed, 19 Jun 2024 02:58:50 GMT
Expires: Fri, 19 Jul 2024 02:58:50 GMT
Keep-Alive: timeout=10, max=100
Link: <https://www.seqrite.com/blog/wp-json/>; rel="https://api.w.org/" <https://www.seqrite.com/blog/?p=5969>; rel=shortlink
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Referrer-Policy: no-referrer-when-downgrade
Server: Apache
Strict-Transport-Security: max-age=63072000; includeSubDomains
Vary: Accept-Encoding,User-Agent
X-Content-Type-Options: nosniff
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Pingback: https://www.seqrite.com/blog/xmlrpc.php
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK font-awesome.css
www.seqrite.com/blog/wp-content/themes/goblog/css/ 28 KB
7 KB 334ms
170ms Stylesheet
text/css 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.seqrite.com/blog/wp-content/themes/goblog/css/font-awesome.css

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

6f20c872577786195e3973e8b5f2f9063214f32171ccf196b90c4710b9df99ee

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Wed, 19 Jun 2024 02:58:52 GMT
Content-Security-Policy: upgrade-insecure-requests
Content-Encoding: gzip
Strict-Transport-Security: max-age=63072000; includeSubDomains
X-Content-Type-Options: nosniff
Connection: keep-alive, Keep-Alive
Content-Length: 5376
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Wed, 16 Feb 2022 06:49:58 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: text/css
Cache-Control: max-age=2592000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=99
Expires: Fri, 19 Jul 2024 02:58:52 GMT

GET
H/1.1 200
OK email-subscribers-public.css
www.seqrite.com/blog/wp-content/plugins/email-subscribers/public/css/ 807 B
2 KB 482ms
163ms Stylesheet
text/css 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.seqrite.com/blog/wp-content/plugins/email-subscribers/public/css/email-subscribers-public.css

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

f84eb4571c0eb40823ed47af468684cc9703ecfc89f6a38e569a470d504a3504

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Wed, 19 Jun 2024 02:58:52 GMT
Content-Security-Policy: upgrade-insecure-requests
Content-Encoding: gzip
Strict-Transport-Security: max-age=63072000; includeSubDomains
X-Content-Type-Options: nosniff
Connection: keep-alive, Keep-Alive
Content-Length: 363
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Mon, 05 Aug 2019 06:40:46 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: text/css
Cache-Control: max-age=2592000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=100
Expires: Fri, 19 Jul 2024 02:58:52 GMT

GET
H/1.1 200
OK style.css
www.seqrite.com/blog/wp-content/themes/goblog/ 73 KB
17 KB 496ms
174ms Stylesheet
text/css 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.seqrite.com/blog/wp-content/themes/goblog/style.css?ver=4.8.3

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

880701812604e09fd133b76474940aed0f05d802a80945c798cfae067d53bda0

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Wed, 19 Jun 2024 02:58:52 GMT
Content-Security-Policy: upgrade-insecure-requests
Content-Encoding: gzip
Strict-Transport-Security: max-age=63072000; includeSubDomains
X-Content-Type-Options: nosniff
Connection: keep-alive, Keep-Alive
Content-Length: 15516
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Wed, 12 Apr 2023 11:35:15 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: text/css
Cache-Control: max-age=2592000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=100
Expires: Fri, 19 Jul 2024 02:58:52 GMT

GET
H/1.1 200
OK magnific-popup.css
www.seqrite.com/blog/wp-content/themes/goblog/css/ 8 KB
3 KB 494ms
168ms Stylesheet
text/css 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.seqrite.com/blog/wp-content/themes/goblog/css/magnific-popup.css?ver=4.8.3

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

0fbf945eae1c5869be401c6db68da93f5a47f2c1ff6072151ebb4b2dea6d4f62

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Wed, 19 Jun 2024 02:58:52 GMT
Content-Security-Policy: upgrade-insecure-requests
Content-Encoding: gzip
Strict-Transport-Security: max-age=63072000; includeSubDomains
X-Content-Type-Options: nosniff
Connection: keep-alive, Keep-Alive
Content-Length: 1936
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Thu, 25 Feb 2016 09:40:14 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: text/css
Cache-Control: max-age=2592000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=100
Expires: Fri, 19 Jul 2024 02:58:52 GMT

GET
H/1.1 200
OK responsive.css
www.seqrite.com/blog/wp-content/themes/goblog/css/ 13 KB
5 KB 498ms
171ms Stylesheet
text/css 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.seqrite.com/blog/wp-content/themes/goblog/css/responsive.css?ver=4.8.3

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

93754643da5a46ca1b7e1f6ba4378655974e11e1cbb432e8c5cbf54804b722bc

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Wed, 19 Jun 2024 02:58:52 GMT
Content-Security-Policy: upgrade-insecure-requests
Content-Encoding: gzip
Strict-Transport-Security: max-age=63072000; includeSubDomains
X-Content-Type-Options: nosniff
Connection: keep-alive, Keep-Alive
Content-Length: 3334
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Thu, 25 Feb 2016 09:40:14 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: text/css
Cache-Control: max-age=2592000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=100
Expires: Fri, 19 Jul 2024 02:58:52 GMT

GET
H/1.1 200
OK wpp.css
www.seqrite.com/blog/wp-content/plugins/wordpress-popular-posts/style/ 889 B
2 KB 501ms
168ms Stylesheet
text/css 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.seqrite.com/blog/wp-content/plugins/wordpress-popular-posts/style/wpp.css?ver=3.2.2

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

b4ae8ad8c560bb87aa8fe03d597e2a69eef809072a35415d32ba68757e13ece6

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Wed, 19 Jun 2024 02:58:52 GMT
Content-Security-Policy: upgrade-insecure-requests
Content-Encoding: gzip
Strict-Transport-Security: max-age=63072000; includeSubDomains
X-Content-Type-Options: nosniff
Connection: keep-alive, Keep-Alive
Content-Length: 433
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Thu, 25 Feb 2016 09:41:46 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: text/css
Cache-Control: max-age=2592000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=98
Expires: Fri, 19 Jul 2024 02:58:52 GMT

GET
H/1.1 200
OK sassy-social-share-public.css
www.seqrite.com/blog/wp-content/plugins/sassy-social-share/public/css/ 30 KB
10 KB 512ms
176ms Stylesheet
text/css 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.seqrite.com/blog/wp-content/plugins/sassy-social-share/public/css/sassy-social-share-public.css?ver=3.2.3

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

680a80d356565114378e038218e6971571fb76e54ff0530999d38f2b3c99368f

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Wed, 19 Jun 2024 02:58:52 GMT
Content-Security-Policy: upgrade-insecure-requests
Content-Encoding: gzip
Strict-Transport-Security: max-age=63072000; includeSubDomains
X-Content-Type-Options: nosniff
Connection: keep-alive, Keep-Alive
Content-Length: 8569
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Tue, 03 Jul 2018 09:32:39 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: text/css
Cache-Control: max-age=2592000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=100
Expires: Fri, 19 Jul 2024 02:58:52 GMT

GET
H/1.1 200
OK sassy-social-share-svg.css
www.seqrite.com/blog/wp-content/plugins/sassy-social-share/admin/css/ 117 KB
37 KB 663ms
181ms Stylesheet
text/css 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.seqrite.com/blog/wp-content/plugins/sassy-social-share/admin/css/sassy-social-share-svg.css?ver=3.2.3

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

1c5fe2a18d6a2a223e6b8ee3f1876e841873b9235e2f170226eb583e073f587c

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Wed, 19 Jun 2024 02:58:52 GMT
Content-Security-Policy: upgrade-insecure-requests
Content-Encoding: gzip
Strict-Transport-Security: max-age=63072000; includeSubDomains
X-Content-Type-Options: nosniff
Connection: keep-alive, Keep-Alive
Content-Length: 36679
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Tue, 03 Jul 2018 09:32:39 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: text/css
Cache-Control: max-age=2592000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=99
Expires: Fri, 19 Jul 2024 02:58:52 GMT

GET
H/1.1 200
OK jquery-3.6.0.min.js Show response
www.seqrite.com/blog/wp-content/plugins/jquery-updater/js/ 87 KB
32 KB 673ms
179ms Script
application/javascript 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.seqrite.com/blog/wp-content/plugins/jquery-updater/js/jquery-3.6.0.min.js?ver=4.8.3

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Wed, 19 Jun 2024 02:58:52 GMT
Content-Security-Policy: upgrade-insecure-requests
Content-Encoding: gzip
Strict-Transport-Security: max-age=63072000; includeSubDomains
X-Content-Type-Options: nosniff
Connection: keep-alive, Keep-Alive
Content-Length: 30902
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Tue, 22 Jun 2021 11:50:20 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: application/javascript
Cache-Control: max-age=2592000, private
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=99
Expires: Fri, 19 Jul 2024 02:58:52 GMT

GET
H/1.1 200
OK jquery-migrate-3.3.2.min.js Show response
www.seqrite.com/blog/wp-content/plugins/jquery-updater/js/ 11 KB
6 KB 667ms
169ms Script
application/javascript 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.seqrite.com/blog/wp-content/plugins/jquery-updater/js/jquery-migrate-3.3.2.min.js?ver=4.8.3

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

f7e248392cea6eed6651423f5b9a4adafec5b15921a2f16ec54e1012be0aaee5

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Wed, 19 Jun 2024 02:58:52 GMT
Content-Security-Policy: upgrade-insecure-requests
Content-Encoding: gzip
Strict-Transport-Security: max-age=63072000; includeSubDomains
X-Content-Type-Options: nosniff
Connection: keep-alive, Keep-Alive
Content-Length: 4170
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Tue, 22 Jun 2021 11:50:20 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: application/javascript
Cache-Control: max-age=2592000, private
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=99
Expires: Fri, 19 Jul 2024 02:58:52 GMT

GET
H/1.1 200
OK email-subscribers-public.js Show response
www.seqrite.com/blog/wp-content/plugins/email-subscribers/public/js/ 3 KB
3 KB 668ms
167ms Script
application/javascript 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.seqrite.com/blog/wp-content/plugins/email-subscribers/public/js/email-subscribers-public.js

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

34e35f893b634d5439db39f3c4f202ddc21aaf406e5724e8c118d513f086752f

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Wed, 19 Jun 2024 02:58:52 GMT
Content-Security-Policy: upgrade-insecure-requests
Content-Encoding: gzip
Strict-Transport-Security: max-age=63072000; includeSubDomains
X-Content-Type-Options: nosniff
Connection: keep-alive, Keep-Alive
Content-Length: 1458
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Mon, 05 Aug 2019 06:40:50 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: application/javascript
Cache-Control: max-age=2592000, private
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=97
Expires: Fri, 19 Jul 2024 02:58:52 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 195 KB
71 KB 97ms
41ms Script
application/javascript 2a00:1450:4001:80f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-104093208-1

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

3f2997f52eed6e55d914a9fe15b1c90bc9ee7c9852d86cde65808ac25b895987

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 19 Jun 2024 02:59:10 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 72424
x-xss-protection: 0
last-modified: Wed, 19 Jun 2024 00:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Wed, 19 Jun 2024 02:59:10 GMT

GET
H2 200 webfont.js Show response
ajax.googleapis.com/ajax/libs/webfont/1.5.3/ 17 KB
7 KB 88ms
20ms Script
text/javascript 2a00:1450:4001:810::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/webfont/1.5.3/webfont.js

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

36ef095d011c4ced97b0acef551ca36d76b95299518595dc1acab792a2344601

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 18 Jun 2024 22:31:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 16048
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6791
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
vary: Accept-Encoding
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 18 Jun 2025 22:31:42 GMT

GET
H/1.1 200
OK logo-seqrite.png
www.seqrite.com/blog/wp-content/uploads/2024/04/ 5 KB
6 KB 430ms
164ms Image
image/png 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.seqrite.com/blog/wp-content/uploads/2024/04/logo-seqrite.png

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

34092036b671b8a82a328dbfe91a14db473da80b478b04c6261d8e436eb06d77

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Wed, 19 Jun 2024 02:58:53 GMT
Content-Security-Policy: upgrade-insecure-requests
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=63072000; includeSubDomains
Connection: keep-alive, Keep-Alive
Content-Length: 4653
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Tue, 02 Apr 2024 09:43:46 GMT
Server: Apache
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=31536000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=98
Expires: Thu, 19 Jun 2025 02:58:53 GMT

GET
H/1.1 200
OK SEQRITE-Blog-new-Dec23-3-770x360.png
www.seqrite.com/blog/wp-content/uploads/2023/12/ 285 KB
286 KB 170ms
169ms Image
image/png 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.seqrite.com/blog/wp-content/uploads/2023/12/SEQRITE-Blog-new-Dec23-3-770x360.png

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

22fc02e7d76274116ddfa068d8ec441b649c7006284975c3b291f583feddf81a

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Wed, 19 Jun 2024 02:58:52 GMT
Content-Security-Policy: upgrade-insecure-requests
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=63072000; includeSubDomains
Connection: keep-alive, Keep-Alive
Content-Length: 291655
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Thu, 21 Dec 2023 14:06:04 GMT
Server: Apache
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=31536000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=99
Expires: Thu, 19 Jun 2025 02:58:52 GMT

GET
H/1.1 200
OK Profile_Image-150x150.jpg
www.seqrite.com/blog/wp-content/uploads/2022/07/ 5 KB
6 KB 594ms
164ms Image
image/jpeg 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.seqrite.com/blog/wp-content/uploads/2022/07/Profile_Image-150x150.jpg

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

ca1f8476f46a20514a230649a5528e4af4d3656d421294c38d1f2e51e057cac5

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Wed, 19 Jun 2024 02:58:53 GMT
Content-Security-Policy: upgrade-insecure-requests
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=63072000; includeSubDomains
Connection: keep-alive, Keep-Alive
Content-Length: 4784
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Tue, 19 Jul 2022 09:27:40 GMT
Server: Apache
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: image/jpeg
Cache-Control: max-age=31536000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=97
Expires: Thu, 19 Jun 2025 02:58:53 GMT

GET
H/1.1 200
OK fig1-768x476.png
www.seqrite.com/blog/wp-content/uploads/2023/12/ 185 KB
186 KB 164ms
164ms Image
image/png 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.seqrite.com/blog/wp-content/uploads/2023/12/fig1-768x476.png

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

d4bba4938cf482e4223f68e4cfa386d1b23b58d9e0c065f12efd724383a86baa

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Wed, 19 Jun 2024 02:58:52 GMT
Content-Security-Policy: upgrade-insecure-requests
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=63072000; includeSubDomains
Connection: keep-alive, Keep-Alive
Content-Length: 189195
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Thu, 21 Dec 2023 10:24:50 GMT
Server: Apache
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=31536000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=99
Expires: Thu, 19 Jun 2025 02:58:52 GMT

GET
H/1.1 200
OK fig2.png
www.seqrite.com/blog/wp-content/uploads/2023/12/ 34 KB
35 KB 164ms
163ms Image
image/png 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.seqrite.com/blog/wp-content/uploads/2023/12/fig2.png

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

8cf8aef256196d3c5bba3a90abd73d85d270be262854a9b0e80788a2e0ebf9f3

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Wed, 19 Jun 2024 02:58:52 GMT
Content-Security-Policy: upgrade-insecure-requests
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=63072000; includeSubDomains
Connection: keep-alive, Keep-Alive
Content-Length: 34369
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Thu, 21 Dec 2023 10:24:51 GMT
Server: Apache
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=31536000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=98
Expires: Thu, 19 Jun 2025 02:58:52 GMT

GET
H/1.1 200
OK fig3.png
www.seqrite.com/blog/wp-content/uploads/2023/12/ 116 KB
117 KB 171ms
169ms Image
image/png 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.seqrite.com/blog/wp-content/uploads/2023/12/fig3.png

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

03d7b1434164c87fda632813fd8e478c74e8294d2568aeef58c043412b705214

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Wed, 19 Jun 2024 02:58:52 GMT
Content-Security-Policy: upgrade-insecure-requests
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=63072000; includeSubDomains
Connection: keep-alive, Keep-Alive
Content-Length: 118824
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Thu, 21 Dec 2023 10:24:52 GMT
Server: Apache
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=31536000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=96
Expires: Thu, 19 Jun 2025 02:58:52 GMT

GET
H/1.1 200
OK fig4-768x436.png
www.seqrite.com/blog/wp-content/uploads/2023/12/ 212 KB
214 KB 170ms
167ms Image
image/png 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.seqrite.com/blog/wp-content/uploads/2023/12/fig4-768x436.png

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

fe1199fe8302bbdbd4d734662f2c754e9623a8651395da0506b2619a6ce4165c

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Wed, 19 Jun 2024 02:58:52 GMT
Content-Security-Policy: upgrade-insecure-requests
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=63072000; includeSubDomains
Connection: keep-alive, Keep-Alive
Content-Length: 217300
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Thu, 21 Dec 2023 10:24:53 GMT
Server: Apache
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=31536000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=98
Expires: Thu, 19 Jun 2025 02:58:52 GMT

GET
H/1.1 200
OK fig5.png
www.seqrite.com/blog/wp-content/uploads/2023/12/ 126 KB
127 KB 164ms
163ms Image
image/png 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.seqrite.com/blog/wp-content/uploads/2023/12/fig5.png

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

464a3bda3235777abbbf05096e29b2bc452ef1859efebcd95284c61b4db711c0

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Wed, 19 Jun 2024 02:58:53 GMT
Content-Security-Policy: upgrade-insecure-requests
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=63072000; includeSubDomains
Connection: keep-alive, Keep-Alive
Content-Length: 128857
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Thu, 21 Dec 2023 10:24:54 GMT
Server: Apache
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=31536000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=92
Expires: Thu, 19 Jun 2025 02:58:53 GMT

GET
H/1.1 200
OK fig6-1024x451.png
www.seqrite.com/blog/wp-content/uploads/2023/12/ 319 KB
321 KB 169ms
169ms Image
image/png 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.seqrite.com/blog/wp-content/uploads/2023/12/fig6-1024x451.png

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

0cfee99a532fdf8862b93766578e586f71e1e733cb1ddb9a1f98960244fb6e3e

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Wed, 19 Jun 2024 02:58:53 GMT
Content-Security-Policy: upgrade-insecure-requests
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=63072000; includeSubDomains
Connection: keep-alive, Keep-Alive
Content-Length: 327095
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Thu, 21 Dec 2023 10:24:56 GMT
Server: Apache
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=31536000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=96
Expires: Thu, 19 Jun 2025 02:58:53 GMT

GET
H/1.1 200
OK fig7-768x132.png
www.seqrite.com/blog/wp-content/uploads/2023/12/ 106 KB
107 KB 169ms
169ms Image
image/png 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.seqrite.com/blog/wp-content/uploads/2023/12/fig7-768x132.png

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

dff383842eb1767aadbc28e6134d71d6d40435e6eb324bebe14627b77f0a2bfd

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Wed, 19 Jun 2024 02:58:53 GMT
Content-Security-Policy: upgrade-insecure-requests
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=63072000; includeSubDomains
Connection: keep-alive, Keep-Alive
Content-Length: 108150
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Thu, 21 Dec 2023 10:24:57 GMT
Server: Apache
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=31536000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=92
Expires: Thu, 19 Jun 2025 02:58:53 GMT

GET
H/1.1 200
OK fig8-768x543.png
www.seqrite.com/blog/wp-content/uploads/2023/12/ 184 KB
185 KB 170ms
170ms Image
image/png 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.seqrite.com/blog/wp-content/uploads/2023/12/fig8-768x543.png

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

d990de127a58a8fd1a16cd0b57aaa763437e614d8937a205c542867753df0bdd

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Wed, 19 Jun 2024 02:58:53 GMT
Content-Security-Policy: upgrade-insecure-requests
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=63072000; includeSubDomains
Connection: keep-alive, Keep-Alive
Content-Length: 188456
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Thu, 21 Dec 2023 10:24:58 GMT
Server: Apache
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=31536000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=95
Expires: Thu, 19 Jun 2025 02:58:53 GMT

GET
H/1.1 200
OK fig9.png
www.seqrite.com/blog/wp-content/uploads/2023/12/ 27 KB
28 KB 167ms
166ms Image
image/png 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.seqrite.com/blog/wp-content/uploads/2023/12/fig9.png

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

a8c2ea1e39a4f40c87b19bbf43c860306a05b083947740b5d4220118de529608

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Wed, 19 Jun 2024 02:58:53 GMT
Content-Security-Policy: upgrade-insecure-requests
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=63072000; includeSubDomains
Connection: keep-alive, Keep-Alive
Content-Length: 27255
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Thu, 21 Dec 2023 10:25:00 GMT
Server: Apache
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=31536000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=94
Expires: Thu, 19 Jun 2025 02:58:53 GMT

GET
H/1.1 200
OK fig10.png
www.seqrite.com/blog/wp-content/uploads/2023/12/ 17 KB
19 KB 166ms
165ms Image
image/png 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.seqrite.com/blog/wp-content/uploads/2023/12/fig10.png

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

a4a4a65efb763957f7b9b84ff412e05abe9b8fd316458c76621c3fe78e5bc703

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Wed, 19 Jun 2024 02:58:53 GMT
Content-Security-Policy: upgrade-insecure-requests
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=63072000; includeSubDomains
Connection: keep-alive, Keep-Alive
Content-Length: 17903
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Thu, 21 Dec 2023 10:25:01 GMT
Server: Apache
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=31536000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=93
Expires: Thu, 19 Jun 2025 02:58:53 GMT

GET
H/1.1 200
OK fig11-768x295.png
www.seqrite.com/blog/wp-content/uploads/2023/12/ 136 KB
138 KB 171ms
170ms Image
image/png 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.seqrite.com/blog/wp-content/uploads/2023/12/fig11-768x295.png

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

b7dbe1468d54f3430bb2769ecd4f0e9fc933bdbd06fa79e67144becfd3d4aed0

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Wed, 19 Jun 2024 02:58:53 GMT
Content-Security-Policy: upgrade-insecure-requests
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=63072000; includeSubDomains
Connection: keep-alive, Keep-Alive
Content-Length: 139594
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Thu, 21 Dec 2023 10:25:01 GMT
Server: Apache
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=31536000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=94
Expires: Thu, 19 Jun 2025 02:58:53 GMT

GET
H/1.1 200
OK fig12-768x326.png
www.seqrite.com/blog/wp-content/uploads/2023/12/ 154 KB
155 KB 165ms
165ms Image
image/png 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.seqrite.com/blog/wp-content/uploads/2023/12/fig12-768x326.png

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

e4d1991657b6c42f20f34c9465827a438b7db1f3242d64ab02439b1bc4c0d21a

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Wed, 19 Jun 2024 02:58:54 GMT
Content-Security-Policy: upgrade-insecure-requests
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=63072000; includeSubDomains
Connection: keep-alive, Keep-Alive
Content-Length: 157594
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Thu, 21 Dec 2023 10:25:02 GMT
Server: Apache
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=31536000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=92
Expires: Thu, 19 Jun 2025 02:58:54 GMT

GET
H/1.1 200
OK fig13-768x234.png
www.seqrite.com/blog/wp-content/uploads/2023/12/ 84 KB
85 KB 166ms
166ms Image
image/png 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.seqrite.com/blog/wp-content/uploads/2023/12/fig13-768x234.png

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

b0f41e5f22441a31b65024f6b66d6f6635c4c40b4b5588ddd7e56fb874c86e73

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Wed, 19 Jun 2024 02:58:54 GMT
Content-Security-Policy: upgrade-insecure-requests
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=63072000; includeSubDomains
Connection: keep-alive, Keep-Alive
Content-Length: 85825
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Thu, 21 Dec 2023 10:25:03 GMT
Server: Apache
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=31536000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=93
Expires: Thu, 19 Jun 2025 02:58:54 GMT

GET
H/1.1 200
OK fig14-768x321.png
www.seqrite.com/blog/wp-content/uploads/2023/12/ 143 KB
144 KB 165ms
165ms Image
image/png 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.seqrite.com/blog/wp-content/uploads/2023/12/fig14-768x321.png

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

745ab7fec5dcbbefaf33d6107625c3f5df089d8b9493ba5473a6fd856f3aec85

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Wed, 19 Jun 2024 02:58:54 GMT
Content-Security-Policy: upgrade-insecure-requests
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=63072000; includeSubDomains
Connection: keep-alive, Keep-Alive
Content-Length: 146348
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Thu, 21 Dec 2023 10:25:04 GMT
Server: Apache
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=31536000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=90
Expires: Thu, 19 Jun 2025 02:58:54 GMT

GET
H/1.1 200
OK fig15-768x331.png
www.seqrite.com/blog/wp-content/uploads/2023/12/ 176 KB
177 KB 167ms
166ms Image
image/png 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.seqrite.com/blog/wp-content/uploads/2023/12/fig15-768x331.png

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

0045dac432862ba981fabe48fe50b4e4b7233f8879abdeaf473d0622c9081e5a

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Wed, 19 Jun 2024 02:58:54 GMT
Content-Security-Policy: upgrade-insecure-requests
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=63072000; includeSubDomains
Connection: keep-alive, Keep-Alive
Content-Length: 179927
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Thu, 21 Dec 2023 10:25:05 GMT
Server: Apache
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=31536000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=95
Expires: Thu, 19 Jun 2025 02:58:54 GMT

GET
H/1.1 200
OK fig16-724x1024.png
www.seqrite.com/blog/wp-content/uploads/2023/12/ 616 KB
617 KB 169ms
169ms Image
image/png 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.seqrite.com/blog/wp-content/uploads/2023/12/fig16-724x1024.png

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

9ec464bdc0b6adbfe4cf5d8ef4ffe6a9e8964b6fb17e873fdd4f5261ee3c07cd

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Wed, 19 Jun 2024 02:58:54 GMT
Content-Security-Policy: upgrade-insecure-requests
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=63072000; includeSubDomains
Connection: keep-alive, Keep-Alive
Content-Length: 630517
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Thu, 21 Dec 2023 10:25:08 GMT
Server: Apache
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=31536000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=90
Expires: Thu, 19 Jun 2025 02:58:54 GMT

GET
H/1.1 200
OK fig17-768x626.png
www.seqrite.com/blog/wp-content/uploads/2023/12/ 148 KB
150 KB 170ms
170ms Image
image/png 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.seqrite.com/blog/wp-content/uploads/2023/12/fig17-768x626.png

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

d2b1594156eb55d2f4e746586a6973c546ff8e33cbbc05eb92704b51531922e9

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Wed, 19 Jun 2024 02:58:54 GMT
Content-Security-Policy: upgrade-insecure-requests
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=63072000; includeSubDomains
Connection: keep-alive, Keep-Alive
Content-Length: 151969
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Thu, 21 Dec 2023 10:25:09 GMT
Server: Apache
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=31536000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=93
Expires: Thu, 19 Jun 2025 02:58:54 GMT

GET
H/1.1 200
OK fig18-768x647.png
www.seqrite.com/blog/wp-content/uploads/2023/12/ 438 KB
439 KB 165ms
164ms Image
image/png 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.seqrite.com/blog/wp-content/uploads/2023/12/fig18-768x647.png

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

cdc24c892c2d49c40c4715522ae77eba3f63a4ec91a7e794c52e9cdecef6e230

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Wed, 19 Jun 2024 02:58:54 GMT
Content-Security-Policy: upgrade-insecure-requests
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=63072000; includeSubDomains
Connection: keep-alive, Keep-Alive
Content-Length: 448032
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Thu, 21 Dec 2023 10:25:10 GMT
Server: Apache
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=31536000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=91
Expires: Thu, 19 Jun 2025 02:58:54 GMT

GET
H/1.1 200
OK fig19.png
www.seqrite.com/blog/wp-content/uploads/2023/12/ 162 KB
164 KB 163ms
162ms Image
image/png 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.seqrite.com/blog/wp-content/uploads/2023/12/fig19.png

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

d59da15836d47c8f7e7f0ccd42d56c7fc92465b7df4190ffec8a404716dff7a0

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Wed, 19 Jun 2024 02:58:54 GMT
Content-Security-Policy: upgrade-insecure-requests
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=63072000; includeSubDomains
Connection: keep-alive, Keep-Alive
Content-Length: 166254
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Thu, 21 Dec 2023 10:25:11 GMT
Server: Apache
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=31536000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=89
Expires: Thu, 19 Jun 2025 02:58:54 GMT

GET
H/1.1 200
OK fig20.png
www.seqrite.com/blog/wp-content/uploads/2023/12/ 25 KB
26 KB 173ms
172ms Image
image/png 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.seqrite.com/blog/wp-content/uploads/2023/12/fig20.png

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

a6a7fa9936cb264730b6365abb4cb7dd01fc72d1f8f172c760efd17b80611226

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Wed, 19 Jun 2024 02:58:54 GMT
Content-Security-Policy: upgrade-insecure-requests
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=63072000; includeSubDomains
Connection: keep-alive, Keep-Alive
Content-Length: 25638
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Thu, 21 Dec 2023 10:25:13 GMT
Server: Apache
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=31536000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=94
Expires: Thu, 19 Jun 2025 02:58:54 GMT

GET
H/1.1 200
OK fig21.png
www.seqrite.com/blog/wp-content/uploads/2023/12/ 33 KB
35 KB 171ms
170ms Image
image/png 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.seqrite.com/blog/wp-content/uploads/2023/12/fig21.png

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

b954282c32e6b0598ed247ea46a5d23559857faa83c39206f97d16b3a9a163e6

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Wed, 19 Jun 2024 02:58:54 GMT
Content-Security-Policy: upgrade-insecure-requests
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=63072000; includeSubDomains
Connection: keep-alive, Keep-Alive
Content-Length: 34180
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Thu, 21 Dec 2023 10:25:13 GMT
Server: Apache
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=31536000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=92
Expires: Thu, 19 Jun 2025 02:58:54 GMT

GET
H/1.1 200
OK fig22.png
www.seqrite.com/blog/wp-content/uploads/2023/12/ 34 KB
35 KB 168ms
167ms Image
image/png 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.seqrite.com/blog/wp-content/uploads/2023/12/fig22.png

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

429061952b9dc6f53eb7162491b101372194f63df8dade2e5b10b55890ec351f

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Wed, 19 Jun 2024 02:58:54 GMT
Content-Security-Policy: upgrade-insecure-requests
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=63072000; includeSubDomains
Connection: keep-alive, Keep-Alive
Content-Length: 34562
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Thu, 21 Dec 2023 10:25:14 GMT
Server: Apache
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=31536000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=92
Expires: Thu, 19 Jun 2025 02:58:54 GMT

GET
H/1.1 200
OK fig23-768x405.png
www.seqrite.com/blog/wp-content/uploads/2023/12/ 236 KB
237 KB 163ms
163ms Image
image/png 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.seqrite.com/blog/wp-content/uploads/2023/12/fig23-768x405.png

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

9d2fbc3dfae0eac71f94c38d0ec178587c8059f765558021cfc0f12db3bd4284

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Wed, 19 Jun 2024 02:58:54 GMT
Content-Security-Policy: upgrade-insecure-requests
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=63072000; includeSubDomains
Connection: keep-alive, Keep-Alive
Content-Length: 241711
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Thu, 21 Dec 2023 10:25:15 GMT
Server: Apache
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=31536000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=88
Expires: Thu, 19 Jun 2025 02:58:54 GMT

GET
H/1.1 200
OK fig24.png
www.seqrite.com/blog/wp-content/uploads/2023/12/ 99 KB
101 KB 168ms
168ms Image
image/png 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.seqrite.com/blog/wp-content/uploads/2023/12/fig24.png

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

3a336b72abaf1ed63064d000f548ef33a49ebeb098c1904a4c78bb008895c582

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Wed, 19 Jun 2024 02:58:54 GMT
Content-Security-Policy: upgrade-insecure-requests
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=63072000; includeSubDomains
Connection: keep-alive, Keep-Alive
Content-Length: 101798
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Thu, 21 Dec 2023 10:25:16 GMT
Server: Apache
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=31536000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=93
Expires: Thu, 19 Jun 2025 02:58:54 GMT

GET
H/1.1 200
OK fig25.png
www.seqrite.com/blog/wp-content/uploads/2023/12/ 73 KB
74 KB 169ms
169ms Image
image/png 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.seqrite.com/blog/wp-content/uploads/2023/12/fig25.png

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

899872b8f08e607932db05ff8fa145cee686a77bbbc11f5bcf74244fe0eaf328

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Wed, 19 Jun 2024 02:58:54 GMT
Content-Security-Policy: upgrade-insecure-requests
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=63072000; includeSubDomains
Connection: keep-alive, Keep-Alive
Content-Length: 74276
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Thu, 21 Dec 2023 10:25:17 GMT
Server: Apache
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=31536000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=91
Expires: Thu, 19 Jun 2025 02:58:54 GMT

GET
H/1.1 200
OK fig26-768x123.png
www.seqrite.com/blog/wp-content/uploads/2023/12/ 83 KB
84 KB 172ms
170ms Image
image/png 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.seqrite.com/blog/wp-content/uploads/2023/12/fig26-768x123.png

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

f9e3b94483df727b9f9912da1c030eeee68fa815be4437b49f6295ae85cbfc57

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Wed, 19 Jun 2024 02:58:54 GMT
Content-Security-Policy: upgrade-insecure-requests
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=63072000; includeSubDomains
Connection: keep-alive, Keep-Alive
Content-Length: 84900
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Thu, 21 Dec 2023 10:25:17 GMT
Server: Apache
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=31536000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=91
Expires: Thu, 19 Jun 2025 02:58:54 GMT

GET
H/1.1 200
OK fig27.png
www.seqrite.com/blog/wp-content/uploads/2023/12/ 52 KB
54 KB 166ms
165ms Image
image/png 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.seqrite.com/blog/wp-content/uploads/2023/12/fig27.png

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

3ccc0c158cfc38726f2214fb8aca4f03d00a3d9d4cd7dba08c3971528d257556

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Wed, 19 Jun 2024 02:58:54 GMT
Content-Security-Policy: upgrade-insecure-requests
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=63072000; includeSubDomains
Connection: keep-alive, Keep-Alive
Content-Length: 53619
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Thu, 21 Dec 2023 10:25:18 GMT
Server: Apache
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=31536000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=90
Expires: Thu, 19 Jun 2025 02:58:54 GMT

GET
H/1.1 200
OK fig28.png
www.seqrite.com/blog/wp-content/uploads/2023/12/ 81 KB
83 KB 163ms
162ms Image
image/png 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.seqrite.com/blog/wp-content/uploads/2023/12/fig28.png

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

7be607eb6682c2f7254cc522d0908f8d74ce248745290bcf91a61bccd5603d82

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Wed, 19 Jun 2024 02:58:54 GMT
Content-Security-Policy: upgrade-insecure-requests
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=63072000; includeSubDomains
Connection: keep-alive, Keep-Alive
Content-Length: 83215
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Thu, 21 Dec 2023 10:25:19 GMT
Server: Apache
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=31536000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=87
Expires: Thu, 19 Jun 2025 02:58:54 GMT

GET
H/1.1 200
OK fig29-768x656.png
www.seqrite.com/blog/wp-content/uploads/2023/12/ 293 KB
295 KB 167ms
166ms Image
image/png 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.seqrite.com/blog/wp-content/uploads/2023/12/fig29-768x656.png

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

4a77f3cb4a3ce682ec6f4505921e7b7a723288fd49673bed7dd62695b153ceac

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Wed, 19 Jun 2024 02:58:54 GMT
Content-Security-Policy: upgrade-insecure-requests
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=63072000; includeSubDomains
Connection: keep-alive, Keep-Alive
Content-Length: 300341
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Thu, 21 Dec 2023 10:25:20 GMT
Server: Apache
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=31536000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=92
Expires: Thu, 19 Jun 2025 02:58:54 GMT

GET
H/1.1 200
OK fig30-768x322.png
www.seqrite.com/blog/wp-content/uploads/2023/12/ 237 KB
238 KB 170ms
169ms Image
image/png 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.seqrite.com/blog/wp-content/uploads/2023/12/fig30-768x322.png

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

06816e3f36b0bd5cba0ae6dcd9b35756fc7b73740cebc271e6628870e1f8d868

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Wed, 19 Jun 2024 02:58:54 GMT
Content-Security-Policy: upgrade-insecure-requests
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=63072000; includeSubDomains
Connection: keep-alive, Keep-Alive
Content-Length: 242718
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Thu, 21 Dec 2023 10:25:22 GMT
Server: Apache
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=31536000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=89
Expires: Thu, 19 Jun 2025 02:58:54 GMT

GET
H/1.1 200
OK Profile_Image-230x168.jpg
www.seqrite.com/blog/wp-content/uploads/2022/07/ 7 KB
9 KB 169ms
169ms Image
image/jpeg 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.seqrite.com/blog/wp-content/uploads/2022/07/Profile_Image-230x168.jpg

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

f2986872ddc78af97ea3b28505ce3bd94aa025f448b06ce13ebcef3984d901bd

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Wed, 19 Jun 2024 02:58:54 GMT
Content-Security-Policy: upgrade-insecure-requests
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=63072000; includeSubDomains
Connection: keep-alive, Keep-Alive
Content-Length: 7598
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Tue, 19 Jul 2022 09:27:39 GMT
Server: Apache
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: image/jpeg
Cache-Control: max-age=31536000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=90
Expires: Thu, 19 Jun 2025 02:58:54 GMT

GET
H/1.1 200
OK SEQRITE-Blog-APT-1-240x185.png
www.seqrite.com/blog/wp-content/uploads/2024/04/ 64 KB
65 KB 166ms
165ms Image
image/png 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.seqrite.com/blog/wp-content/uploads/2024/04/SEQRITE-Blog-APT-1-240x185.png

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

a8ad996c78806d8aa05cedcd8d03a61ead8b5eb94be657032fb0ae78d2065ab0

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Wed, 19 Jun 2024 02:58:54 GMT
Content-Security-Policy: upgrade-insecure-requests
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=63072000; includeSubDomains
Connection: keep-alive, Keep-Alive
Content-Length: 65372
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Tue, 23 Apr 2024 11:12:42 GMT
Server: Apache
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=31536000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=89
Expires: Thu, 19 Jun 2025 02:58:54 GMT

GET
H/1.1 200
OK SEQRITE-Blog-SideCopy-240x185.png
www.seqrite.com/blog/wp-content/uploads/2023/11/ 75 KB
77 KB 167ms
167ms Image
image/png 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.seqrite.com/blog/wp-content/uploads/2023/11/SEQRITE-Blog-SideCopy-240x185.png

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

4539d6573c1e0f33a30b515799949f0334aad19d18bc0ae1d0de4f4bca0677c9

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Wed, 19 Jun 2024 02:58:54 GMT
Content-Security-Policy: upgrade-insecure-requests
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=63072000; includeSubDomains
Connection: keep-alive, Keep-Alive
Content-Length: 77098
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Mon, 06 Nov 2023 09:18:49 GMT
Server: Apache
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=31536000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=90
Expires: Thu, 19 Jun 2025 02:58:54 GMT

GET
H/1.1 200
OK Seqrite_blog_image-240x185.png
www.seqrite.com/blog/wp-content/uploads/2023/06/ 79 KB
80 KB 163ms
162ms Image
image/png 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.seqrite.com/blog/wp-content/uploads/2023/06/Seqrite_blog_image-240x185.png

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

5eb7a0c7dfcdbd07a27253699c6b4ebd62d212673c5912e3adf86a8555a4d201

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Wed, 19 Jun 2024 02:58:54 GMT
Content-Security-Policy: upgrade-insecure-requests
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=63072000; includeSubDomains
Connection: keep-alive, Keep-Alive
Content-Length: 80629
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Thu, 15 Jun 2023 09:27:38 GMT
Server: Apache
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=31536000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=86
Expires: Thu, 19 Jun 2025 02:58:54 GMT

GET
H/1.1 200
OK securimage_show.php
www.seqrite.com/blog/wp-content/plugins/si-captcha-for-wordpress/captcha/ 19 KB
20 KB 237ms
237ms Image
image/png 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.seqrite.com/blog/wp-content/plugins/si-captcha-for-wordpress/captcha/securimage_show.php?si_form_id=com&prefix=aewcT4me8lSEzRgC

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

c3d145c1657cfe41efb63f4587c37c2f6769e73cad38b70b29660063da1832cb

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Wed, 19 Jun 2024 02:58:54 GMT
Content-Security-Policy: upgrade-insecure-requests
Content-Encoding: gzip
Strict-Transport-Security: max-age=63072000; includeSubDomains
X-Content-Type-Options: nosniff
Connection: keep-alive, Keep-Alive
Content-Length: 18730
X-XSS-Protection: 1; mode=block
Pragma: no-cache
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Wed, 19 Jun 2024 02:58:54GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: image/png
Cache-Control: no-store, no-cache, must-revalidate, private, must-revalidate, post-check=0, pre-check=0
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Keep-Alive: timeout=10, max=88
Expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H/1.1 200
OK refresh.png
www.seqrite.com/blog/wp-content/plugins/si-captcha-for-wordpress/captcha/images/ 1 KB
3 KB 171ms
170ms Image
image/png 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.seqrite.com/blog/wp-content/plugins/si-captcha-for-wordpress/captcha/images/refresh.png

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

7efa72f5d3878a1f7145d552d8d2186bac3942fce7b3d7e3a51550c3bc9ab3cb

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Wed, 19 Jun 2024 02:58:54 GMT
Content-Security-Policy: upgrade-insecure-requests
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=63072000; includeSubDomains
Connection: keep-alive, Keep-Alive
Content-Length: 1106
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Thu, 25 Feb 2016 09:42:14 GMT
Server: Apache
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=31536000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=89
Expires: Thu, 19 Jun 2025 02:58:54 GMT

GET
H/1.1 200
OK 6196-featured-80x81.png
www.seqrite.com/blog/wp-content/uploads/wordpress-popular-posts/ 12 KB
14 KB 727ms
165ms Image
image/png 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.seqrite.com/blog/wp-content/uploads/wordpress-popular-posts/6196-featured-80x81.png

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

0b1d63d50c2071f0aa800083df0e2f1f3f1edf80ec777782faf26ffd7414aa64

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Wed, 19 Jun 2024 02:58:53 GMT
Content-Security-Policy: upgrade-insecure-requests
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=63072000; includeSubDomains
Connection: keep-alive, Keep-Alive
Content-Length: 12685
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Fri, 31 May 2024 10:21:03 GMT
Server: Apache
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=31536000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=97
Expires: Thu, 19 Jun 2025 02:58:53 GMT

GET
H/1.1 200
OK 6151-featured-80x81.png
www.seqrite.com/blog/wp-content/uploads/wordpress-popular-posts/ 12 KB
13 KB 605ms
166ms Image
image/png 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.seqrite.com/blog/wp-content/uploads/wordpress-popular-posts/6151-featured-80x81.png

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

27ab347f66c6de5c468f5edead161d4e1abe4ba5acd9d0cc97f641a241554708

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Wed, 19 Jun 2024 02:58:53 GMT
Content-Security-Policy: upgrade-insecure-requests
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=63072000; includeSubDomains
Connection: keep-alive, Keep-Alive
Content-Length: 12056
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Fri, 26 Apr 2024 12:38:35 GMT
Server: Apache
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=31536000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=95
Expires: Thu, 19 Jun 2025 02:58:53 GMT

GET
H/1.1 200
OK 6186-featured-80x81.png
www.seqrite.com/blog/wp-content/uploads/wordpress-popular-posts/ 11 KB
13 KB 611ms
169ms Image
image/png 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.seqrite.com/blog/wp-content/uploads/wordpress-popular-posts/6186-featured-80x81.png

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

61cb8aeeac47576a2b56ddd298ae34f468da6a781d465da6276a625c2a7922ad

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Wed, 19 Jun 2024 02:58:53 GMT
Content-Security-Policy: upgrade-insecure-requests
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=63072000; includeSubDomains
Connection: keep-alive, Keep-Alive
Content-Length: 11552
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Tue, 28 May 2024 17:20:42 GMT
Server: Apache
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=31536000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=98
Expires: Thu, 19 Jun 2025 02:58:53 GMT

GET
H/1.1 200
OK favicon-seqrite.png
www.seqrite.com/blog/wp-content/uploads/2024/04/ 5 KB
7 KB 731ms
163ms Image
image/png 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.seqrite.com/blog/wp-content/uploads/2024/04/favicon-seqrite.png

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

ac3a4f50b88ecc84b7aa0ede2c8509f06d8257d136948d42d39d8bbc4310bc9d

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Wed, 19 Jun 2024 02:58:53 GMT
Content-Security-Policy: upgrade-insecure-requests
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=63072000; includeSubDomains
Connection: keep-alive, Keep-Alive
Content-Length: 5519
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Tue, 02 Apr 2024 10:18:04 GMT
Server: Apache
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=31536000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=96
Expires: Thu, 19 Jun 2025 02:58:53 GMT

GET
H/1.1 200
OK SK_Photo12-150x149.jpg
www.seqrite.com/blog/wp-content/uploads/2017/09/ 5 KB
6 KB 893ms
165ms Image
image/jpeg 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.seqrite.com/blog/wp-content/uploads/2017/09/SK_Photo12-150x149.jpg

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

c4594d5cd9d4ae7683d9af90f8946692ded44d22e423bc6700ff671c8fe2d00f

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Wed, 19 Jun 2024 02:58:53 GMT
Content-Security-Policy: upgrade-insecure-requests
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=63072000; includeSubDomains
Connection: keep-alive, Keep-Alive
Content-Length: 4765
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Mon, 25 Sep 2017 06:43:44 GMT
Server: Apache
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: image/jpeg
Cache-Control: max-age=31536000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=96
Expires: Thu, 19 Jun 2025 02:58:53 GMT

GET
H/1.1 200
OK MicrosoftTeams-image-223.png
www.seqrite.com/blog/wp-content/uploads/2023/12/ 16 KB
17 KB 758ms
162ms Image
image/png 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.seqrite.com/blog/wp-content/uploads/2023/12/MicrosoftTeams-image-223.png

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

c62716f2d2181727cdd1d399be91e6b96ab7a914e97c83157aeefcda38452d26

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Wed, 19 Jun 2024 02:58:53 GMT
Content-Security-Policy: upgrade-insecure-requests
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=63072000; includeSubDomains
Connection: keep-alive, Keep-Alive
Content-Length: 16119
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Wed, 13 Dec 2023 12:16:39 GMT
Server: Apache
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=31536000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=94
Expires: Thu, 19 Jun 2025 02:58:53 GMT

GET
H/1.1 200
OK spinner.gif
www.seqrite.com/blog/wp-content/plugins/email-subscribers/public/images/ 3 KB
5 KB 165ms
164ms Image
image/gif 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.seqrite.com/blog/wp-content/plugins/email-subscribers/public/images/spinner.gif

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

7837e876f1eef549b3250b78380ec2df00ad6da4da6c27667424b1636854df3c

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Wed, 19 Jun 2024 02:58:54 GMT
Content-Security-Policy: upgrade-insecure-requests
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=63072000; includeSubDomains
Connection: keep-alive, Keep-Alive
Content-Length: 3208
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Mon, 05 Aug 2019 06:40:50 GMT
Server: Apache
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: image/gif
Cache-Control: max-age=31536000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=88
Expires: Thu, 19 Jun 2025 02:58:54 GMT

GET
H/1.1 200
OK si_captcha.js Show response
www.seqrite.com/blog/wp-content/plugins/si-captcha-for-wordpress/captcha/ 685 B
2 KB 616ms
160ms Script
application/javascript 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.seqrite.com/blog/wp-content/plugins/si-captcha-for-wordpress/captcha/si_captcha.js?ver=1.0

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

c52d8ecaada50da7a9739ca285872b431fad51042eccf398e2c2ecad8013880b

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Wed, 19 Jun 2024 02:58:53 GMT
Content-Security-Policy: upgrade-insecure-requests
Content-Encoding: gzip
Strict-Transport-Security: max-age=63072000; includeSubDomains
X-Content-Type-Options: nosniff
Connection: keep-alive, Keep-Alive
Content-Length: 380
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Thu, 25 Feb 2016 09:42:14 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: application/javascript
Cache-Control: max-age=2592000, private
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=95
Expires: Fri, 19 Jul 2024 02:58:53 GMT

GET
H/1.1 200
OK slickQuiz.css
www.seqrite.com/blog/wp-content/plugins/slickquiz/slickquiz/css/ 908 B
2 KB 177ms
168ms Stylesheet
text/css 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.seqrite.com/blog/wp-content/plugins/slickquiz/slickquiz/css/slickQuiz.css?ver=4.8.3

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

48d1d7078b27223c895b4a9604916429879cc4e00e3a8772d64c76aa406711f6

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Wed, 19 Jun 2024 02:58:53 GMT
Content-Security-Policy: upgrade-insecure-requests
Content-Encoding: gzip
Strict-Transport-Security: max-age=63072000; includeSubDomains
X-Content-Type-Options: nosniff
Connection: keep-alive, Keep-Alive
Content-Length: 475
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Mon, 03 Apr 2017 09:41:26 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: text/css
Cache-Control: max-age=2592000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=94
Expires: Fri, 19 Jul 2024 02:58:53 GMT

GET
H/1.1 200
OK front.css
www.seqrite.com/blog/wp-content/plugins/slickquiz/css/ 3 KB
2 KB 184ms
170ms Stylesheet
text/css 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.seqrite.com/blog/wp-content/plugins/slickquiz/css/front.css?ver=4.8.3

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

0f8a76154e9d4d4f95724c6fa01caa18d4511ad594363004e03055859da90ccf

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Wed, 19 Jun 2024 02:58:53 GMT
Content-Security-Policy: upgrade-insecure-requests
Content-Encoding: gzip
Strict-Transport-Security: max-age=63072000; includeSubDomains
X-Content-Type-Options: nosniff
Connection: keep-alive, Keep-Alive
Content-Length: 929
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Mon, 03 Apr 2017 09:38:50 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: text/css
Cache-Control: max-age=2592000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=97
Expires: Fri, 19 Jul 2024 02:58:53 GMT

GET
H/1.1 200
OK comment-reply.min.js Show response
www.seqrite.com/blog/wp-includes/js/ 1 KB
2 KB 298ms
164ms Script
application/javascript 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.seqrite.com/blog/wp-includes/js/comment-reply.min.js?ver=4.8.3

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

1b1ca0f15010e0124bd4ca481404643c88f7eda1b276e9554d0ed83fb45b7e30

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Wed, 19 Jun 2024 02:58:53 GMT
Content-Security-Policy: upgrade-insecure-requests
Content-Encoding: gzip
Strict-Transport-Security: max-age=63072000; includeSubDomains
X-Content-Type-Options: nosniff
Connection: keep-alive, Keep-Alive
Content-Length: 589
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Thu, 19 Nov 2015 06:45:28 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: application/javascript
Cache-Control: max-age=2592000, private
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=95
Expires: Fri, 19 Jul 2024 02:58:53 GMT

GET
H/1.1 200
OK jquery.magnific-popup.min.js Show response
www.seqrite.com/blog/wp-content/themes/goblog/js/ 21 KB
9 KB 166ms
166ms Script
application/javascript 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.seqrite.com/blog/wp-content/themes/goblog/js/jquery.magnific-popup.min.js?ver=0.9.9

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

21afd5dde7c1a80e8227df99b65b838d02411ee25dd37c8c6de6ab9b4a6a11f9

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Wed, 19 Jun 2024 02:58:53 GMT
Content-Security-Policy: upgrade-insecure-requests
Content-Encoding: gzip
Strict-Transport-Security: max-age=63072000; includeSubDomains
X-Content-Type-Options: nosniff
Connection: keep-alive, Keep-Alive
Content-Length: 7840
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Thu, 25 Feb 2016 09:40:16 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: application/javascript
Cache-Control: max-age=2592000, private
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=93
Expires: Fri, 19 Jul 2024 02:58:53 GMT

GET
H/1.1 200
OK theme-scripts.js Show response
www.seqrite.com/blog/wp-content/themes/goblog/js/ 64 KB
16 KB 171ms
171ms Script
application/javascript 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.seqrite.com/blog/wp-content/themes/goblog/js/theme-scripts.js?ver=1.0

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

a46ad0cf194211eaa38d041861c834baca57d2531fa6bf7ed766441400f8c914

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Wed, 19 Jun 2024 02:58:53 GMT
Content-Security-Policy: upgrade-insecure-requests
Content-Encoding: gzip
Strict-Transport-Security: max-age=63072000; includeSubDomains
X-Content-Type-Options: nosniff
Connection: keep-alive, Keep-Alive
Content-Length: 14567
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Thu, 25 Feb 2016 09:40:16 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: application/javascript
Cache-Control: max-age=2592000, private
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=97
Expires: Fri, 19 Jul 2024 02:58:53 GMT

GET
H/1.1 200
OK sassy-social-share-public.js Show response
www.seqrite.com/blog/wp-content/plugins/sassy-social-share/public/js/ 46 KB
13 KB 173ms
173ms Script
application/javascript 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.seqrite.com/blog/wp-content/plugins/sassy-social-share/public/js/sassy-social-share-public.js?ver=3.2.3

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

d4e8aef3270141a3bd33cfa0c36a91d75a3960a1e4a7eb346aa72101fa99f34b

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Wed, 19 Jun 2024 02:58:53 GMT
Content-Security-Policy: upgrade-insecure-requests
Content-Encoding: gzip
Strict-Transport-Security: max-age=63072000; includeSubDomains
X-Content-Type-Options: nosniff
Connection: keep-alive, Keep-Alive
Content-Length: 11655
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Tue, 03 Jul 2018 09:32:39 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: application/javascript
Cache-Control: max-age=2592000, private
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=93
Expires: Fri, 19 Jul 2024 02:58:53 GMT

GET
H/1.1 200
OK wp-embed.min.js Show response
www.seqrite.com/blog/wp-includes/js/ 1 KB
2 KB 170ms
170ms Script
application/javascript 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.seqrite.com/blog/wp-includes/js/wp-embed.min.js?ver=4.8.3

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

dcb5e540e62fc85857254a1066afb6a7e8999279c6d4c583eef855d39f9289c0

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Wed, 19 Jun 2024 02:58:53 GMT
Content-Security-Policy: upgrade-insecure-requests
Content-Encoding: gzip
Strict-Transport-Security: max-age=63072000; includeSubDomains
X-Content-Type-Options: nosniff
Connection: keep-alive, Keep-Alive
Content-Length: 751
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Wed, 08 Nov 2017 07:20:23 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: application/javascript
Cache-Control: max-age=2592000, private
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=96
Expires: Fri, 19 Jul 2024 02:58:53 GMT

GET
H/1.1 200
OK slickQuiz.js Show response
www.seqrite.com/blog/wp-content/plugins/slickquiz/slickquiz/js/ 37 KB
9 KB 168ms
167ms Script
application/javascript 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.seqrite.com/blog/wp-content/plugins/slickquiz/slickquiz/js/slickQuiz.js?ver=4.8.3

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

5ac7017782855b44f36da92da024c5de980002bd06ca9c94dc631e8c26e9b57c

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Wed, 19 Jun 2024 02:58:53 GMT
Content-Security-Policy: upgrade-insecure-requests
Content-Encoding: gzip
Strict-Transport-Security: max-age=63072000; includeSubDomains
X-Content-Type-Options: nosniff
Connection: keep-alive, Keep-Alive
Content-Length: 7289
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Mon, 03 Apr 2017 09:41:43 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: application/javascript
Cache-Control: max-age=2592000, private
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=95
Expires: Fri, 19 Jul 2024 02:58:53 GMT

GET
H/1.1 200
OK widgets.js Show response
platform.twitter.com/ 91 KB
28 KB 128ms
19ms Script
application/javascript 2606:2800:234:59:254c:406:2366:268c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/widgets.js?ver=4.8.3
Requested by: Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (frb/67C1) /
Resource Hash: 173460e89e6a7244218badae2016f65c48a3eae9d400802273eeca18b07336f1

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Wed, 19 Jun 2024 02:59:10 GMT
Content-Encoding: gzip
Age: 212
x-amz-server-side-encryption: AES256
X-Cache: HIT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server-Timing: x-cache;desc= HIT,x-tw-cdn;desc=VZ
Content-Length: 27597
Last-Modified: Mon, 11 Dec 2023 17:20:28 GMT
Server: ECS (frb/67C1)
Etag: "824beb891744db98ccbd3a456e59e0f7+gzip"
Access-Control-Max-Age: 3000
Access-Control-Allow-Methods: GET
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
x-tw-cdn: VZ
Cache-Control: public, max-age=1800
Vary: Accept-Encoding

GET
H/1.1 200
OK main.min.js Show response
www.seqrite.com/blog/wp-content/plugins/icegram/assets/js/ 3 KB
2 KB 164ms
164ms Script
application/javascript 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.seqrite.com/blog/wp-content/plugins/icegram/assets/js/main.min.js?ver=1.10.16

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

9ebff7017dd268671621d8ee78f8d0fbbc8acf656f7f7988aec31da68be69e2a

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Wed, 19 Jun 2024 02:58:53 GMT
Content-Security-Policy: upgrade-insecure-requests
Content-Encoding: gzip
Strict-Transport-Security: max-age=63072000; includeSubDomains
X-Content-Type-Options: nosniff
Connection: keep-alive, Keep-Alive
Content-Length: 975
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Fri, 23 Mar 2018 10:38:53 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: application/javascript
Cache-Control: max-age=2592000, private
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=94
Expires: Fri, 19 Jul 2024 02:58:53 GMT

POST
H/1.1 200
OK admin-ajax.php Show response
www.seqrite.com/blog/wp-admin/ 41 B
2 KB 624ms
624ms XHR
text/html 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.seqrite.com/blog/wp-admin/admin-ajax.php

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

edfc2a17369ced8ebfc58840994507526d77d115998256fe10a515b0a69c4451

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-platform: "Win32"
Referer: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

Date: Wed, 19 Jun 2024 02:58:52 GMT
Content-Security-Policy: upgrade-insecure-requests
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=63072000; includeSubDomains
Connection: keep-alive, Keep-Alive
Content-Length: 41
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Server: Apache
X-Frame-Options: SAMEORIGIN, SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Vary: User-Agent
Content-Type: text/html; charset=UTF-8
Access-Control-Allow-Origin: https://www.seqrite.com
Cache-Control: no-cache, must-revalidate, max-age=0, private, must-revalidate
Access-Control-Allow-Credentials: true
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
X-Robots-Tag: noindex
Keep-Alive: timeout=10, max=98
Expires: Wed, 11 Jan 1984 05:00:00 GMT

GET
H/1.1 200
OK bg.png
www.seqrite.com/blog/wp-content/themes/goblog/images/ 95 B
2 KB 462ms
162ms Image
image/png 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.seqrite.com/blog/wp-content/themes/goblog/images/bg.png

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Wed, 19 Jun 2024 02:58:53 GMT
Content-Security-Policy: upgrade-insecure-requests
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=63072000; includeSubDomains
Connection: keep-alive, Keep-Alive
Content-Length: 95
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Thu, 25 Feb 2016 09:40:14 GMT
Server: Apache
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=31536000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=96
Expires: Thu, 19 Jun 2025 02:58:53 GMT

GET
DATA 200
OK truncated
/ 302 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b980f62a2d545d64f24e6f96902c8fbf5da0018569c369bc18f9e5b5fcf099ed

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=utf8

GET
DATA 200
OK truncated
/ 682 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c2e8b4fba49f90cfca5a43371c09879aed7447e0ba2ed4abd75b81448776c4f7

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=utf8

GET
DATA 200
OK truncated
/ 425 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 54c9560cb0117d8d1f955aefe0f88b843517964e118512d8f1a224a8a9b662f4

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=utf8

GET
DATA 200
OK truncated
/ 436 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 2662e0eef0f270830358bb255f079f695da71794ecbe8ba0825200862d8e9746

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=utf8

GET
H/1.1 200
OK fontawesome-webfont.woff
www.seqrite.com/blog/wp-content/themes/goblog/fonts/ 64 KB
65 KB 294ms
168ms Font
application/font-woff 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.seqrite.com/blog/wp-content/themes/goblog/fonts/fontawesome-webfont.woff?v=4.2.0

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/wp-content/themes/goblog/css/font-awesome.css

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

199411f659f41aaccb959bacb1b0de30e54f244352a48c6f9894e65ae0f8a9a1

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.seqrite.com/blog/wp-content/themes/goblog/css/font-awesome.css
Origin: https://www.seqrite.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Wed, 19 Jun 2024 02:58:52 GMT
Content-Security-Policy: upgrade-insecure-requests
Content-Encoding: gzip
Strict-Transport-Security: max-age=63072000; includeSubDomains
X-Content-Type-Options: nosniff
Connection: keep-alive, Keep-Alive
Content-Length: 65453
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Thu, 25 Feb 2016 09:40:18 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: application/font-woff
Cache-Control: max-age=31536000
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=97
Expires: Thu, 19 Jun 2025 02:58:52 GMT

GET
H2 200 css
fonts.googleapis.com/ 17 KB
2 KB 86ms
28ms Stylesheet
text/css 2a00:1450:4001:80b::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Open+Sans:400,700,600&display=swap

Requested by

Host: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/webfont/1.5.3/webfont.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

851699a18b631a7bd68efc99598701293a6065b463fced7b68d8d6d9227bd8e7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31536000
date: Wed, 19 Jun 2024 02:59:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Wed, 19 Jun 2024 02:59:10 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 19 Jun 2024 02:59:10 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 52 KB
21 KB 74ms
19ms Script
text/javascript 2a00:1450:4001:828::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-104093208-1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Wed, 19 Jun 2024 02:29:07 GMT
last-modified: Tue, 12 Dec 2023 18:09:08 GMT
server: Golfe2
age: 1803
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20994
expires: Wed, 19 Jun 2024 04:29:07 GMT

GET
H2 200 memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v40/ 47 KB
48 KB 70ms
18ms Font
font/woff2 2a00:1450:4001:80b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:400,700,600&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3c4d6a1421c7ddb7e404521fe8c4cd5be5af446d7689cd880be26612eaad3cfa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://fonts.googleapis.com/
Origin: https://www.seqrite.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 18 Jun 2024 14:53:43 GMT
x-content-type-options: nosniff
age: 43527
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 48236
x-xss-protection: 0
last-modified: Thu, 14 Dec 2023 02:08:40 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 18 Jun 2025 14:53:43 GMT

POST
H2 200 collect Show response
www.google-analytics.com/j/ 2 B
207 B 28ms
27ms XHR
text/plain 2a00:1450:4001:828::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=199202835&t=pageview&_s=1&dl=https%3A%2F%2Fwww.seqrite.com%2Fblog%2Foperation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration%2F&ul=de-de&de=UTF-8&dt=Operation%20RusticWeb%20targets%20Indian%20Govt%3A%20From%20Rust-based%20malware%20to%20Web-service%20exfiltration&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAUABAAAAACAAI~&jid=419781689&gjid=1233711286&cid=38586578.1718765951&tid=UA-104093208-1&_gid=5473065.1718765951&_r=1&gtm=457e46h0za200&gcd=13l3l3l2l1&dma_cps=sypham&dma=1&tag_exp=0&jsscut=1&npa=1&z=1274080131

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-platform: "Win32"
Referer: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Wed, 19 Jun 2024 02:59:10 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.seqrite.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 1 B
346 B 97ms
27ms XHR
text/plain 2a00:1450:400c:c0b::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-104093208-1&cid=38586578.1718765951&jid=419781689&gjid=1233711286&_gid=5473065.1718765951&npa=1&_u=YEBAAUAAAAAAACAAI~&z=1386890500

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c0b::9b Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-platform: "Win32"
Referer: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Wed, 19 Jun 2024 02:59:10 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.seqrite.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK frontend.min.css
www.seqrite.com/blog/wp-content/plugins/icegram/assets/css/ 19 KB
4 KB 185ms
164ms Stylesheet
text/css 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.seqrite.com/blog/wp-content/plugins/icegram/assets/css/frontend.min.css?var=1.10.16

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/wp-content/plugins/jquery-updater/js/jquery-3.6.0.min.js?ver=4.8.3

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

92d8884bb3f73093e6d0d49afb2d4e3129c7f92f5f9b0b741d2dc61a75dff904

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Wed, 19 Jun 2024 02:58:53 GMT
Content-Security-Policy: upgrade-insecure-requests
Content-Encoding: gzip
Strict-Transport-Security: max-age=63072000; includeSubDomains
X-Content-Type-Options: nosniff
Connection: keep-alive, Keep-Alive
Content-Length: 2386
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Fri, 23 Mar 2018 10:38:15 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: text/css
Cache-Control: max-age=2592000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=91
Expires: Fri, 19 Jul 2024 02:58:53 GMT

GET
H/1.1 200
OK popup.min.css
www.seqrite.com/blog/wp-content/plugins/icegram/message-types/popup/themes/ 21 KB
6 KB 219ms
169ms Stylesheet
text/css 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.seqrite.com/blog/wp-content/plugins/icegram/message-types/popup/themes/popup.min.css?var=1.10.16

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/wp-content/plugins/jquery-updater/js/jquery-3.6.0.min.js?ver=4.8.3

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

2fea67957caea31ef5c4541c83f121cb0dd690da9c3e16c8a1a88ab60b7fcccb

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Wed, 19 Jun 2024 02:58:53 GMT
Content-Security-Policy: upgrade-insecure-requests
Content-Encoding: gzip
Strict-Transport-Security: max-age=63072000; includeSubDomains
X-Content-Type-Options: nosniff
Connection: keep-alive, Keep-Alive
Content-Length: 4400
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Fri, 23 Mar 2018 10:39:41 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: text/css
Cache-Control: max-age=2592000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=91
Expires: Fri, 19 Jul 2024 02:58:53 GMT

GET
H/1.1 200
OK icegram.min.js Show response
www.seqrite.com/blog/wp-content/plugins/icegram/assets/js/ 45 KB
14 KB 171ms
171ms Script
application/javascript 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.seqrite.com/blog/wp-content/plugins/icegram/assets/js/icegram.min.js?var=1.10.16

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/wp-content/plugins/jquery-updater/js/jquery-3.6.0.min.js?ver=4.8.3

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

9bfbc0be0ca1c7fc6220860de2077caec179c03c5ff29e68bbeb148fe23d657c

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Wed, 19 Jun 2024 02:58:54 GMT
Content-Security-Policy: upgrade-insecure-requests
Content-Encoding: gzip
Strict-Transport-Security: max-age=63072000; includeSubDomains
X-Content-Type-Options: nosniff
Connection: keep-alive, Keep-Alive
Content-Length: 13287
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Fri, 23 Mar 2018 10:38:53 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: application/javascript
Cache-Control: max-age=2592000, private
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=89
Expires: Fri, 19 Jul 2024 02:58:54 GMT

GET
H/1.1 200
OK widget_iframe.2f70fb173b9000da126c79afe2098f02.html
platform.twitter.com/widgets/ Frame DE03 0
0 72ms
18ms Document
text/html 2606:2800:234:59:254c:406:2366:268c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/widgets/widget_iframe.2f70fb173b9000da126c79afe2098f02.html?origin=https%3A%2F%2Fwww.seqrite.com
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js?ver=4.8.3
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (frb/67C0) /
Resource Hash

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

Access-Control-Allow-Methods: GET
Access-Control-Allow-Origin: *
Age: 7426709
Cache-Control: public, max-age=315360000
Content-Encoding: gzip
Content-Length: 105429
Content-Type: text/html; charset=utf-8
Date: Wed, 19 Jun 2024 02:59:11 GMT
Etag: "81267302efdfb3e4524a22631a8fc99e+gzip"
Last-Modified: Mon, 11 Dec 2023 17:19:49 GMT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server: ECS (frb/67C0)
Server-Timing: x-cache;desc= HIT,x-tw-cdn;desc=VZ
Vary: Accept-Encoding
X-Cache: HIT
x-amz-server-side-encryption: AES256
x-tw-cdn: VZ

GET
H/1.1 200
OK admin-ajax.php Show response
www.seqrite.com/blog/wp-admin/ 342 B
2 KB 3071ms
3071ms XHR
text/html 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.seqrite.com/blog/wp-admin/admin-ajax.php?action=heateor_sss_sharing_count&urls%5B%5D=https%3A%2F%2Fwww.seqrite.com%2Fblog%2Foperation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration%2F

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/wp-content/plugins/jquery-updater/js/jquery-3.6.0.min.js?ver=4.8.3

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

99af7a6b3595fc40fc8406618c3300c8dc13873c8a84cb5a6e086d49fa580d46

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Accept: application/json, text/javascript, */*; q=0.01
Referer: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/
X-Requested-With: XMLHttpRequest
sec-ch-ua-platform: "Win32"

Response headers

Date: Wed, 19 Jun 2024 02:58:55 GMT
Content-Security-Policy: upgrade-insecure-requests
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=63072000; includeSubDomains
Content-Encoding: gzip
Connection: keep-alive, Keep-Alive
Content-Length: 182
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Server: Apache
X-Frame-Options: SAMEORIGIN, SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Vary: Accept-Encoding,User-Agent
Content-Type: text/html; charset=UTF-8
Cache-Control: no-cache, must-revalidate, max-age=0, private, must-revalidate
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
X-Robots-Tag: noindex
Keep-Alive: timeout=10, max=88
Expires: Wed, 11 Jan 1984 05:00:00 GMT

GET
H/1.1 200
OK favicon.png
www.seqrite.com/blog/wp-content/uploads/2015/07/ 1 KB
3 KB 164ms
164ms Other
image/png 103.228.50.137
BALASAINET-AS Bal...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.seqrite.com/blog/wp-content/uploads/2015/07/favicon.png

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

103.228.50.137 , India, ASN133288 (BALASAINET-AS Balasai Net Pvt. Ltd., IN),

Reverse DNS

ComputeH-pnq83.balasai.com

Software

Apache /

Resource Hash

b1c27546d4683a5082ca81f6fdb6bfcbe595aa47d744d3ce2419ce82d440977e

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Wed, 19 Jun 2024 02:58:55 GMT
Content-Security-Policy: upgrade-insecure-requests
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=63072000; includeSubDomains
Connection: keep-alive, Keep-Alive
Content-Length: 1399
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Tue, 02 Apr 2024 09:52:30 GMT
Server: Apache
X-FRAME-OPTIONS: SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=31536000, public
Permissions-Policy: geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=87
Expires: Thu, 19 Jun 2025 02:58:55 GMT

GET
H3 400 / Show response
graph.facebook.com/ 202 B
319 B 91ms
54ms XHR
application/json 157.240.252.10
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://graph.facebook.com/?id=https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/

Requested by

Host: www.seqrite.com
URL: https://www.seqrite.com/blog/wp-content/plugins/jquery-updater/js/jquery-3.6.0.min.js?ver=4.8.3

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.252.10 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

edge-star-shv-01-fra3.facebook.com

Software

Resource Hash

31b123e9ed321d152b3372f6c47f3596347f9b037587e50ecc6e6300c4830bae

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Accept: application/json, text/javascript, */*; q=0.01
Referer: https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=15552000; preload
date: Wed, 19 Jun 2024 02:59:15 GMT
www-authenticate: OAuth "Facebook Platform" "invalid_request" "(#2) Service temporarily unavailable"
x-fb-rev: 1014326238
alt-svc: h3=":443"; ma=86400
content-length: 202
proxy-status: http_request_error; e_fb_configversion="AcItFFNDYoUgRzuDq0Bxpu-ODIV66Q9Ah2Om-9QUWohvcO1LWEPLiFTBvGVhLw"; e_fb_vipport="AcLVSbrcTr-4qSWHgmQq7DJ92VUAuA7V1bepVf13HdJOA3tmD0AwaU1hujHh"; e_upip="AcKi_NWpqR7Nu5L-QRoYEXyh2PiEp1yTbDOOFJf0zA4NkQKDyCL-t0xnUleSYMYbHeR5-NubnPRBgd94HPf93iC-gN9Zu1nKpw"; e_fb_requestsequencenumber="AcK-UJzhjj9_EObLrzPTZoyx5uM08L7COXR3LYzciWI-K-lnibv0D3V8Z07-"; e_fb_responsebytes="AcKuZSEW-ws2aH0pc3Y3p4lpPcDAt9vSfwDRzZf26w9NchsRRALta9zwVGfC"; e_fb_hostheader="AcINdh6Fxn_VXUkYy_e-r_OjH2htreDQ6dcnmtwZo9yCZVUedRzWrokN_eKMudSK31nMq60qtDr8g7mb"; e_fb_vipaddr="AcKxivR2UKH1yMIwgW4aJ3OeyMHeXthwY5JxPUp8UQIli_jDwsYx0TI2RMrBx7_JrA7G7WUD6eHEvzGBv4jyQOFjGEV0ggkqfw"; e_fb_requesthandler="AcKmywOf9DX3I6KOyosc44GfGV3QKzO0N6ZmetFjcgbmqNVLxlyWTJ35PIEnEzj7TWiiFX3S5CE"; e_fb_requesttime="AcIAV_24eof49IrdqHp1buw0pxEQW9-2bq2dpMmZaEF2jaY3z4124id38uVtFat3dUfrAbS2lA"; e_fb_builduser="AcJIVjvKpbgzTcj1ra8IrxK86-m1UII0bHsjb-ZIDj7ZmIGKUqQw2_lRRcPkjx2jjlA"; e_fb_httpversion="AcLW6674uquoyVbD0eowYCiMJGNlDPhVUlQ-ZsdjmztKdA_w41Srf8lQUr9m"; e_fb_binaryversion="AcIVOTurp-SyIbqDUF1e_r-YqxdBWpZOQNQzu_pNgIf9wE8DmYcRKcIkKOnvcMDwPfmoFU0603rYCQxV8RiIhJM-_eBUWkXYjIU"; e_proxy="AcJV_N5P97wBUH2j_J54QqTmxGVu-GU0BfboVtjUYgJhgp5GgAhJ4nct3N7pJbHr-AS1bd93DelH6r2m3GqC", http_request_error; e_fb_configversion="AcKg8kcqGFdgC9qDechzejHDXEuhYkHprARRxg3eCRVaepw8Hi_RAli_rBLgjQ"; e_fb_vipport="AcIWsoErPDWhPogThoRlj56PA1L2WAfUqPUGpsNFZHXJhZ_vt5FjZ_r1O006"; e_upip="AcKe36iNPbq6q9X26PmbJ249nr1W9dZT8EtOCASkqG0u0LE0Ln4qGdfVZBwpQkLo3FLgC7Og3cNSVHw7B60tuMQa04FAw9SEbw"; e_fb_requestsequencenumber="AcKE6YeZeQbYGNEXrxeo58coDJuZZ1LvwR2dFrMNSZNulQ3uxMSHvdzgZw"; e_fb_responsebytes="AcL7iQpsu2-p-EIdD9-_x83n3mRw8H7Ip7axlPTr9kq0k_rwKwjGOUbZMVc_"; e_fb_hostheader="AcKCtTWwTj8iLzxYD19Ay-lm0WRle48a9Ae-hgt1c2IkQ40GlW6GJAOQ5wrkpAt6k_fItZQWniKDBKP2"; e_fb_vipaddr="AcJlwLFqBhEF33mOrntfVLLvNXR-QdrnfQmUDZoORdRppKPFG27htCWqZcdPC4QMxyPfRzy0LgE"; e_fb_requesthandler="AcLPkv6sridhnKlrhUU3kL0YctApRyBrjB4gdreUZvpbgOWAN_OwUpXaagoyhNWuPo9MqTUgIVo"; e_fb_requesttime="AcIoVGt_0T_pC3iYLWSVpmXWx5LpiAG2aBjoFtabfFzSCYKwCZupYndl_GCSZEZ37_-NLhjLXA"; e_fb_builduser="AcI2Au1fAaVZ96E_d3Bp9EkIdVFAVs9pcDqtFRX0-wXFKni7n-RuB953fYQAXdqa6_c"; e_fb_httpversion="AcL64Zh7EHsLIgdZwilp-q4tX8kfNnG0ivI3aIVgROg0ocWcY0bT7eTG0pXQ"; e_fb_binaryversion="AcJxeP8IvnXEsWhf0T_YFVH1bXDgvyabd6mv1cLySI0t0wF_M_yb8n8lJdpw2A7rdrBzkADZbuXzMdQ__dI3yeDw0ejYd7FI3iE"; e_proxy="AcLbB0pYb8FwZuldRrUT6jnvVr3zzzs90ulJ2MzYZ6XvIXYbk1_5XFMUe8elVZkOEXs97qGz2h0v_wc"
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=19, rtx=0, c=23, mss=1232, tbw=4289, tp=9, tpl=0, uplat=33, ullat=0
pragma: no-cache
x-fb-debug: xymtNs+dum3Y9zRY9ZlvtMVFg7Bm92dHnCsrIUhAXlbe34FD6fHRc6+CpEx1uVZJ85IxorsVri7bzMxXjIiNYw==
x-fb-trace-id: BLE8A+ib6sK
vary: Origin
content-type: application/json
access-control-allow-origin: *
x-fb-request-id: A83IsXvXSSc2tRO86sncvNx
cache-control: no-store
facebook-api-version: v14.0
priority: u=1,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

Verdicts & Comments Add Verdict or Comment

78 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

4 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.seqrite.com/	1970-01-21 07:02:05	Name: _ga Value: GA1.2.38586578.1718765951
.seqrite.com/	1970-01-20 21:27:32	Name: _gid Value: GA1.2.5473065.1718765951
.seqrite.com/	1970-01-20 21:26:06	Name: _gat_gtag_UA_104093208_1 Value: 1
www.seqrite.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: gefhdp4hkek6tm894rm5an68l0

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	error	Message: Error with Permissions-Policy header: Parse of permissions policy failed because of errors reported by structured header parser.
network	error	URL: https://graph.facebook.com/?id=https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/ Message: Failed to load resource: the server responded with a status of 400 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://quickheal.com/, ALLOW-FROM https://quickheal.co.in/, ALLOW-FROM https://marketingplus.zoho.in/, ALLOW-FROM https://www.doubleclick.net/, ALLOW-FROM https://www.googletagmanager.com/, ALLOW-FROM https://www.youtube.com/, ALLOW-FROM https://facebook.com/, ALLOW-FROM https://samespace.com/, ALLOW-FROM https://messaging.samespace.com/, ALLOW-FROM https://seqrite.verloop.io/, ALLOW-FROM https://marketingplus.zoho.in/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
fonts.googleapis.com
fonts.gstatic.com
graph.facebook.com
platform.twitter.com
stats.g.doubleclick.net
www.google-analytics.com
www.googletagmanager.com
www.seqrite.com
103.228.50.137
157.240.252.10
2606:2800:234:59:254c:406:2366:268c
2a00:1450:4001:80b::2003
2a00:1450:4001:80b::200a
2a00:1450:4001:80f::2008
2a00:1450:4001:810::200a
2a00:1450:4001:828::200e
2a00:1450:400c:c0b::9b
0045dac432862ba981fabe48fe50b4e4b7233f8879abdeaf473d0622c9081e5a
03d7b1434164c87fda632813fd8e478c74e8294d2568aeef58c043412b705214
06816e3f36b0bd5cba0ae6dcd9b35756fc7b73740cebc271e6628870e1f8d868
0b1d63d50c2071f0aa800083df0e2f1f3f1edf80ec777782faf26ffd7414aa64
0cfee99a532fdf8862b93766578e586f71e1e733cb1ddb9a1f98960244fb6e3e
0f8a76154e9d4d4f95724c6fa01caa18d4511ad594363004e03055859da90ccf
0fbf945eae1c5869be401c6db68da93f5a47f2c1ff6072151ebb4b2dea6d4f62
1371e7ac1d5ba92d3497498e4a9810af0b66f065d9f17681f12d6f787aea905c
173460e89e6a7244218badae2016f65c48a3eae9d400802273eeca18b07336f1
199411f659f41aaccb959bacb1b0de30e54f244352a48c6f9894e65ae0f8a9a1
1b1ca0f15010e0124bd4ca481404643c88f7eda1b276e9554d0ed83fb45b7e30
1c5fe2a18d6a2a223e6b8ee3f1876e841873b9235e2f170226eb583e073f587c
21afd5dde7c1a80e8227df99b65b838d02411ee25dd37c8c6de6ab9b4a6a11f9
22fc02e7d76274116ddfa068d8ec441b649c7006284975c3b291f583feddf81a
2662e0eef0f270830358bb255f079f695da71794ecbe8ba0825200862d8e9746
27ab347f66c6de5c468f5edead161d4e1abe4ba5acd9d0cc97f641a241554708
2fea67957caea31ef5c4541c83f121cb0dd690da9c3e16c8a1a88ab60b7fcccb
31b123e9ed321d152b3372f6c47f3596347f9b037587e50ecc6e6300c4830bae
34092036b671b8a82a328dbfe91a14db473da80b478b04c6261d8e436eb06d77
34e35f893b634d5439db39f3c4f202ddc21aaf406e5724e8c118d513f086752f
36ef095d011c4ced97b0acef551ca36d76b95299518595dc1acab792a2344601
3a336b72abaf1ed63064d000f548ef33a49ebeb098c1904a4c78bb008895c582
3c4d6a1421c7ddb7e404521fe8c4cd5be5af446d7689cd880be26612eaad3cfa
3ccc0c158cfc38726f2214fb8aca4f03d00a3d9d4cd7dba08c3971528d257556
3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517
3f2997f52eed6e55d914a9fe15b1c90bc9ee7c9852d86cde65808ac25b895987
429061952b9dc6f53eb7162491b101372194f63df8dade2e5b10b55890ec351f
4539d6573c1e0f33a30b515799949f0334aad19d18bc0ae1d0de4f4bca0677c9
464a3bda3235777abbbf05096e29b2bc452ef1859efebcd95284c61b4db711c0
48d1d7078b27223c895b4a9604916429879cc4e00e3a8772d64c76aa406711f6
4a77f3cb4a3ce682ec6f4505921e7b7a723288fd49673bed7dd62695b153ceac
54c9560cb0117d8d1f955aefe0f88b843517964e118512d8f1a224a8a9b662f4
5ac7017782855b44f36da92da024c5de980002bd06ca9c94dc631e8c26e9b57c
5eb7a0c7dfcdbd07a27253699c6b4ebd62d212673c5912e3adf86a8555a4d201
61cb8aeeac47576a2b56ddd298ae34f468da6a781d465da6276a625c2a7922ad
680a80d356565114378e038218e6971571fb76e54ff0530999d38f2b3c99368f
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
6f20c872577786195e3973e8b5f2f9063214f32171ccf196b90c4710b9df99ee
745ab7fec5dcbbefaf33d6107625c3f5df089d8b9493ba5473a6fd856f3aec85
7837e876f1eef549b3250b78380ec2df00ad6da4da6c27667424b1636854df3c
7be607eb6682c2f7254cc522d0908f8d74ce248745290bcf91a61bccd5603d82
7efa72f5d3878a1f7145d552d8d2186bac3942fce7b3d7e3a51550c3bc9ab3cb
851699a18b631a7bd68efc99598701293a6065b463fced7b68d8d6d9227bd8e7
880701812604e09fd133b76474940aed0f05d802a80945c798cfae067d53bda0
899872b8f08e607932db05ff8fa145cee686a77bbbc11f5bcf74244fe0eaf328
8cf8aef256196d3c5bba3a90abd73d85d270be262854a9b0e80788a2e0ebf9f3
92d8884bb3f73093e6d0d49afb2d4e3129c7f92f5f9b0b741d2dc61a75dff904
93754643da5a46ca1b7e1f6ba4378655974e11e1cbb432e8c5cbf54804b722bc
99af7a6b3595fc40fc8406618c3300c8dc13873c8a84cb5a6e086d49fa580d46
9bfbc0be0ca1c7fc6220860de2077caec179c03c5ff29e68bbeb148fe23d657c
9d2fbc3dfae0eac71f94c38d0ec178587c8059f765558021cfc0f12db3bd4284
9ebff7017dd268671621d8ee78f8d0fbbc8acf656f7f7988aec31da68be69e2a
9ec464bdc0b6adbfe4cf5d8ef4ffe6a9e8964b6fb17e873fdd4f5261ee3c07cd
a46ad0cf194211eaa38d041861c834baca57d2531fa6bf7ed766441400f8c914
a4a4a65efb763957f7b9b84ff412e05abe9b8fd316458c76621c3fe78e5bc703
a6a7fa9936cb264730b6365abb4cb7dd01fc72d1f8f172c760efd17b80611226
a8ad996c78806d8aa05cedcd8d03a61ead8b5eb94be657032fb0ae78d2065ab0
a8c2ea1e39a4f40c87b19bbf43c860306a05b083947740b5d4220118de529608
ac3a4f50b88ecc84b7aa0ede2c8509f06d8257d136948d42d39d8bbc4310bc9d
b0f41e5f22441a31b65024f6b66d6f6635c4c40b4b5588ddd7e56fb874c86e73
b1c27546d4683a5082ca81f6fdb6bfcbe595aa47d744d3ce2419ce82d440977e
b4ae8ad8c560bb87aa8fe03d597e2a69eef809072a35415d32ba68757e13ece6
b7dbe1468d54f3430bb2769ecd4f0e9fc933bdbd06fa79e67144becfd3d4aed0
b954282c32e6b0598ed247ea46a5d23559857faa83c39206f97d16b3a9a163e6
b980f62a2d545d64f24e6f96902c8fbf5da0018569c369bc18f9e5b5fcf099ed
c2e8b4fba49f90cfca5a43371c09879aed7447e0ba2ed4abd75b81448776c4f7
c3d145c1657cfe41efb63f4587c37c2f6769e73cad38b70b29660063da1832cb
c4594d5cd9d4ae7683d9af90f8946692ded44d22e423bc6700ff671c8fe2d00f
c52d8ecaada50da7a9739ca285872b431fad51042eccf398e2c2ecad8013880b
c62716f2d2181727cdd1d399be91e6b96ab7a914e97c83157aeefcda38452d26
ca1f8476f46a20514a230649a5528e4af4d3656d421294c38d1f2e51e057cac5
cdc24c892c2d49c40c4715522ae77eba3f63a4ec91a7e794c52e9cdecef6e230
d2b1594156eb55d2f4e746586a6973c546ff8e33cbbc05eb92704b51531922e9
d4bba4938cf482e4223f68e4cfa386d1b23b58d9e0c065f12efd724383a86baa
d4e8aef3270141a3bd33cfa0c36a91d75a3960a1e4a7eb346aa72101fa99f34b
d59da15836d47c8f7e7f0ccd42d56c7fc92465b7df4190ffec8a404716dff7a0
d990de127a58a8fd1a16cd0b57aaa763437e614d8937a205c542867753df0bdd
dcb5e540e62fc85857254a1066afb6a7e8999279c6d4c583eef855d39f9289c0
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
dff383842eb1767aadbc28e6134d71d6d40435e6eb324bebe14627b77f0a2bfd
e4d1991657b6c42f20f34c9465827a438b7db1f3242d64ab02439b1bc4c0d21a
edfc2a17369ced8ebfc58840994507526d77d115998256fe10a515b0a69c4451
f2986872ddc78af97ea3b28505ce3bd94aa025f448b06ce13ebcef3984d901bd
f7e248392cea6eed6651423f5b9a4adafec5b15921a2f16ec54e1012be0aaee5
f84eb4571c0eb40823ed47af468684cc9703ecfc89f6a38e569a470d504a3504
f9e3b94483df727b9f9912da1c030eeee68fa815be4437b49f6295ae85cbfc57
fe1199fe8302bbdbd4d734662f2c754e9623a8651395da0506b2619a6ce4165c
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

www.seqrite.com Open in urlscan Pro 103.228.50.137 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

86 Requests

100 %HTTPS

78 %IPv6

8 Domains

9 Subdomains

10 IPs

4 Countries

5785 kBTransfer

6487 kBSize

4 Cookies

14 Outgoing links

Redirected requests

86 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 4 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

www.seqrite.com Open in urlscan Pro
103.228.50.137 Public Scan

Screenshot
Live screenshot

Full Image

86
Requests

100 %
HTTPS

78 %
IPv6

8
Domains

9
Subdomains

10
IPs

4
Countries

5785 kB
Transfer

6487 kB
Size

4
Cookies

86 HTTP transactions
4 data transactions