urlscan.io logo urlscan.io
SecurityTrails logo

www.tucloudserver.com Open in urlscan Pro
46.105.201.91  Public Scan

Go To Rescan Add Verdict Report
URL: https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
Submission: On September 28 via api from GB — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 17 IPs in 5 countries across 15 domains to perform 55 HTTP transactions. The main IP is 46.105.201.91, located in France and belongs to OVH, FR. The main domain is www.tucloudserver.com.
TLS certificate: Issued by R3 on July 29th 2021. Valid for: 3 months.
This is the only time www.tucloudserver.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

33    46.105.201.91 (France)

ASN16276 (OVH, FR)
www.tucloudserver.com
1    2a00:1450:4001:831::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.googletagmanager.com
1    2a00:1450:4001:811::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.googleapis.com
1    185.25.112.88 (Spain)

ASN16371 (ACENS_AS Spain Hosting, housing and VPN services, ES)
PTR: wh05.tcsws.net
www.criptomercados.eu
2    2606:2800:234:46c:e8b:1e2f:2bd:694 (United States)

ASN15133 (EDGECAST, US)
platform.twitter.com
1    132.148.165.11 (Ashburn, United States)

ASN26496 (AS-26496-GO-DADDY-COM-LLC, US)
PTR: ip-132-148-165-11.ip.secureserver.net
www.fiboquantum.net
1    13.224.185.14 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-224-185-14.fra2.r.cloudfront.net
z-na.amazon-adsystem.com
2    2a00:1450:4001:80f::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google-analytics.com
1    2a00:1450:4001:800::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.gstatic.com
2    2606:4700:10::6814:7d2e (United States)

ASN13335 (CLOUDFLARENET, US)
www.time4vps.com
4    148.251.13.139 (Germany)

ASN24940 (HETZNER-AS, DE)
PTR: static.139.13.251.148.clients.your-server.de
ad.a-ads.com
static.a-ads.com
2    2a03:2880:f01c:216:face:b00c:0:3 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)
connect.facebook.net
1    2a00:1450:400c:c08::9b (Brussels, Belgium)

ASN15169 (GOOGLE, US)
stats.g.doubleclick.net
1    2a00:1450:4001:828::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google.com
1    2a00:1450:4001:827::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google.de
1    104.244.42.136 (United States)

ASN13414 (TWITTER, US)
syndication.twitter.com
Domain Requested by
33 www.tucloudserver.com www.tucloudserver.com
2 static.a-ads.com ad.a-ads.com
2 connect.facebook.net www.tucloudserver.com
connect.facebook.net
2 ad.a-ads.com www.tucloudserver.com
2 www.time4vps.com www.tucloudserver.com
2 www.google-analytics.com www.googletagmanager.com
www.google-analytics.com
2 platform.twitter.com www.tucloudserver.com
platform.twitter.com
1 syndication.twitter.com platform.twitter.com
1 www.google.de www.tucloudserver.com
1 www.google.com www.tucloudserver.com
1 stats.g.doubleclick.net www.google-analytics.com
1 fonts.gstatic.com fonts.googleapis.com
1 z-na.amazon-adsystem.com www.tucloudserver.com
1 www.fiboquantum.net www.tucloudserver.com
1 www.criptomercados.eu www.tucloudserver.com
1 fonts.googleapis.com www.tucloudserver.com
1 www.googletagmanager.com www.tucloudserver.com
55 17
Subject Issuer Validity Valid
criptomercados.net
R3		 2021-07-29 -
2021-10-27		 3 months crt.sh
*.google-analytics.com
GTS CA 1C3		 2021-09-13 -
2021-11-20		 2 months crt.sh
upload.video.google.com
GTS CA 1C3		 2021-08-30 -
2021-11-22		 3 months crt.sh
criptomercados.eu
Let's Encrypt Authority X3		 2020-09-01 -
2020-11-30		 3 months crt.sh
*.twimg.com
DigiCert TLS RSA SHA256 2020 CA1		 2020-11-05 -
2021-11-09		 a year crt.sh
fiboquantum.net
R3		 2021-09-06 -
2021-12-05		 3 months crt.sh
z-na.amazon-adsystem.com
Amazon		 2020-12-12 -
2022-01-10		 a year crt.sh
*.gstatic.com
GTS CA 1C3		 2021-08-30 -
2021-11-22		 3 months crt.sh
*.time4vps.com
Sectigo RSA Domain Validation Secure Server CA		 2021-01-12 -
2022-02-12		 a year crt.sh
*.a-ads.com
Sectigo ECC Domain Validation Secure Server CA		 2020-12-02 -
2022-01-02		 a year crt.sh
*.facebook.com
DigiCert SHA2 High Assurance Server CA		 2021-09-09 -
2021-12-08		 3 months crt.sh
*.g.doubleclick.net
GTS CA 1C3		 2021-08-30 -
2021-11-22		 3 months crt.sh
www.google.com
GTS CA 1C3		 2021-08-30 -
2021-11-22		 3 months crt.sh
www.google.de
GTS CA 1C3		 2021-08-30 -
2021-11-22		 3 months crt.sh
syndication.twitter.com
DigiCert TLS RSA SHA256 2020 CA1		 2021-02-05 -
2022-02-04		 a year crt.sh

This page contains 4 frames:

Primary Page: https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
Frame ID: AC6A57CC49776CC8FAE0B5181330A01F
Requests: 50 HTTP requests in this frame

Frame: https://ad.a-ads.com/1007080?size=300x250
Frame ID: 0445A2EE8AA82C137773F8A8AD0006C0
Requests: 3 HTTP requests in this frame

Frame: https://ad.a-ads.com/1007080?size=300x250
Frame ID: 55A157DA76C713915EBB648B4873335F
Requests: 3 HTTP requests in this frame

Frame: https://platform.twitter.com/widgets/widget_iframe.f88235f49a156f8b4cab34c7bc1a0acc.html?origin=https%3A%2F%2Fwww.tucloudserver.com
Frame ID: EDF4D86CB527B1AD9DA1DF3E01A3F881
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Russian Turla APT Group Deploying New Backdoor on Targeted Systems – Tu Cloud Server

Detected technologies

Overall confidence: 100%
Detected patterns
  • <a[^>]*href=[^>]*/Cart
Overall confidence: 100%
Detected patterns
  • <link rel=["']stylesheet["'] [^>]+/wp-(?:content|includes)/
  • /wp-(?:content|includes)/
  • wp-embed\.min\.js\?ver=([\d.]+)
Overall confidence: 100%
Detected patterns
  • //connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js
Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
  • <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
  • (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
Overall confidence: 100%
Detected patterns
  • google-analytics\.com/(?:ga|urchin|analytics)\.js
Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com
Overall confidence: 100%
Detected patterns
  • googletagmanager\.com/gtag/js
Overall confidence: 100%
Detected patterns
  • //platform\.twitter\.com/widgets\.js
Overall confidence: 100%
Detected patterns
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Overall confidence: 100%
Detected patterns
  • jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?

Page Statistics

55
Requests

98 %
HTTPS

63 %
IPv6

15
Domains

17
Subdomains

17
IPs

5
Countries

1762 kB
Transfer

2703 kB
Size

3
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

55 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/ 		92 KB
15 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
46.105.201.91 , France, ASN16276 (OVH, FR),
Reverse DNS
Software
/
Resource Hash
8344de8bf79ab17f82687a382232f1d76d620b876da83aa0d13546151298fdd5

Request headers

:method
GET
:authority
www.tucloudserver.com
:scheme
https
:path
/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language
de-DE,de;q=0.9
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language
de-DE,de;q=0.9

Response headers

date
Tue, 28 Sep 2021 05:28:14 GMT
content-type
text/html; charset=UTF-8
link
<https://www.tucloudserver.com/wp-json/>; rel="https://api.w.org/", <https://www.tucloudserver.com/wp-json/wp/v2/posts/24734>; rel="alternate"; type="application/json", <https://www.tucloudserver.com/?p=24734>; rel=shortlink
vary
Accept-Encoding
x-request-id
65015485
content-encoding
br
cache-control
max-age=1800
x-cdn-pop
sbg
x-cdn-pop-ip
137.74.120.0/27
x-cacheable
Cacheable
accept-ranges
bytes
js
www.googletagmanager.com/gtag/ 		96 KB
39 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=UA-34803829-1
Requested by
Host: www.tucloudserver.com
URL: https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:831::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
efe9850fc8c77956cd1bb6fd3d8f8e27e27bf8e41b29ff6193916821ef4c4348
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.tucloudserver.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 28 Sep 2021 05:28:14 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
38967
x-xss-protection
0
last-modified
Tue, 28 Sep 2021 03:00:00 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Tue, 28 Sep 2021 05:28:14 GMT
style.min.css
www.tucloudserver.com/wp-includes/css/dist/block-library/ 		79 KB
10 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.tucloudserver.com/wp-includes/css/dist/block-library/style.min.css?ver=5.8.1
Requested by
Host: www.tucloudserver.com
URL: https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
46.105.201.91 , France, ASN16276 (OVH, FR),
Reverse DNS
Software
/
Resource Hash
9110fc122dda3067c424d9b8ff7747e2030b0bd9298f69a3683d399ad3373a6a

Request headers

:path
/wp-includes/css/dist/block-library/style.min.css?ver=5.8.1
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
text/css,*/*;q=0.1
cache-control
no-cache
sec-fetch-dest
style
:authority
www.tucloudserver.com
referer
https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 28 Sep 2021 05:28:15 GMT
content-encoding
br
last-modified
Thu, 02 Sep 2021 07:40:08 GMT
x-cdn-pop-ip
137.74.120.0/27
etag
W/"13abe-5cafe4ac655d9"
x-cacheable
Cacheable
vary
Accept-Encoding
content-type
text/css
cache-control
max-age=1800
x-cdn-pop
sbg
accept-ranges
bytes
x-request-id
65015486
wp-automatic.css
www.tucloudserver.com/wp-content/plugins/wp-automatic/css/ 		3 KB
794 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.tucloudserver.com/wp-content/plugins/wp-automatic/css/wp-automatic.css?ver=1.0.0
Requested by
Host: www.tucloudserver.com
URL: https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
46.105.201.91 , France, ASN16276 (OVH, FR),
Reverse DNS
Software
/
Resource Hash
898e474ff096c8984854cc7e8f3b4d3611cebb7e29a59f3e66429e88b29dc7bf

Request headers

:path
/wp-content/plugins/wp-automatic/css/wp-automatic.css?ver=1.0.0
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
text/css,*/*;q=0.1
cache-control
no-cache
sec-fetch-dest
style
:authority
www.tucloudserver.com
referer
https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 28 Sep 2021 05:28:15 GMT
content-encoding
br
last-modified
Tue, 25 Sep 2018 16:13:41 GMT
x-cdn-pop-ip
137.74.120.0/27
etag
W/"a87-576b4639d5740"
x-cacheable
Cacheable
vary
Accept-Encoding
content-type
text/css
cache-control
max-age=1800
x-cdn-pop
sbg
accept-ranges
bytes
x-request-id
65015487
style.css
www.tucloudserver.com/wp-content/themes/mh-magazine/ 		85 KB
14 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.tucloudserver.com/wp-content/themes/mh-magazine/style.css?ver=3.8.3
Requested by
Host: www.tucloudserver.com
URL: https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
46.105.201.91 , France, ASN16276 (OVH, FR),
Reverse DNS
Software
/
Resource Hash
518a9d587bdaecdd96340e67db078e823ff43f9f23f2f0d9f0ceafe4cca72a0f

Request headers

:path
/wp-content/themes/mh-magazine/style.css?ver=3.8.3
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
text/css,*/*;q=0.1
cache-control
no-cache
sec-fetch-dest
style
:authority
www.tucloudserver.com
referer
https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 28 Sep 2021 05:28:15 GMT
content-encoding
br
last-modified
Tue, 25 Sep 2018 13:47:33 GMT
x-cdn-pop-ip
137.74.120.0/27
etag
W/"1557c-576b259004740"
x-cacheable
Cacheable
vary
Accept-Encoding
content-type
text/css
cache-control
max-age=1800
x-cdn-pop
sbg
accept-ranges
bytes
x-request-id
65015488
font-awesome.min.css
www.tucloudserver.com/wp-content/themes/mh-magazine/includes/ 		30 KB
7 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.tucloudserver.com/wp-content/themes/mh-magazine/includes/font-awesome.min.css
Requested by
Host: www.tucloudserver.com
URL: https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
46.105.201.91 , France, ASN16276 (OVH, FR),
Reverse DNS
Software
/
Resource Hash
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd

Request headers

:path
/wp-content/themes/mh-magazine/includes/font-awesome.min.css
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
text/css,*/*;q=0.1
cache-control
no-cache
sec-fetch-dest
style
:authority
www.tucloudserver.com
referer
https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 28 Sep 2021 05:28:15 GMT
content-encoding
br
last-modified
Tue, 25 Sep 2018 13:47:33 GMT
x-cdn-pop-ip
137.74.120.0/27
etag
W/"7918-576b259004740"
x-cacheable
Cacheable
vary
Accept-Encoding
content-type
text/css
cache-control
max-age=1800
x-cdn-pop
sbg
accept-ranges
bytes
x-request-id
65015489
css
fonts.googleapis.com/ 		13 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Open+Sans:300,400,400italic,600,700
Requested by
Host: www.tucloudserver.com
URL: https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:811::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
7abf50e8b9a4e1abed1eedb0afc0828f2dd637bdd9077f6e7a36e43df1e013ea
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.tucloudserver.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Tue, 28 Sep 2021 05:20:55 GMT
server
ESF
date
Tue, 28 Sep 2021 05:28:14 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Tue, 28 Sep 2021 05:28:14 GMT
frontend-gtag.min.js
www.tucloudserver.com/wp-content/plugins/google-analytics-dashboard-for-wp/assets/js/ 		9 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.tucloudserver.com/wp-content/plugins/google-analytics-dashboard-for-wp/assets/js/frontend-gtag.min.js?ver=6.7.0
Requested by
Host: www.tucloudserver.com
URL: https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
46.105.201.91 , France, ASN16276 (OVH, FR),
Reverse DNS
Software
/
Resource Hash
40dd348a0a40e3117ce5a9b3d0fc49651749e4821c342e82b89039f4847b791d

Request headers

:path
/wp-content/plugins/google-analytics-dashboard-for-wp/assets/js/frontend-gtag.min.js?ver=6.7.0
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
www.tucloudserver.com
referer
https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 28 Sep 2021 05:28:15 GMT
content-encoding
br
last-modified
Fri, 02 Jul 2021 12:23:46 GMT
x-cdn-pop-ip
137.74.120.0/27
etag
W/"23ab-5c62306f54471"
x-cacheable
Cacheable
vary
Accept-Encoding
content-type
application/javascript
cache-control
max-age=1800
x-cdn-pop
sbg
accept-ranges
bytes
x-request-id
65015490
jquery.min.js
www.tucloudserver.com/wp-includes/js/jquery/ 		87 KB
30 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.tucloudserver.com/wp-includes/js/jquery/jquery.min.js?ver=3.6.0
Requested by
Host: www.tucloudserver.com
URL: https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
46.105.201.91 , France, ASN16276 (OVH, FR),
Reverse DNS
Software
/
Resource Hash
bd4de6a3fc0fb68d6f76ba7b93514b96a92e585c295b5351c31ad92a4b0777ea

Request headers

:path
/wp-includes/js/jquery/jquery.min.js?ver=3.6.0
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
www.tucloudserver.com
referer
https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 28 Sep 2021 05:28:15 GMT
content-encoding
br
last-modified
Thu, 02 Sep 2021 07:40:09 GMT
x-cdn-pop-ip
137.74.120.0/27
etag
W/"15db1-5cafe4aced1bb"
x-cacheable
Cacheable
vary
Accept-Encoding
content-type
application/javascript
cache-control
max-age=1800
x-cdn-pop
sbg
accept-ranges
bytes
x-request-id
65015491
jquery-migrate.min.js
www.tucloudserver.com/wp-includes/js/jquery/ 		11 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.tucloudserver.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.3.2
Requested by
Host: www.tucloudserver.com
URL: https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
46.105.201.91 , France, ASN16276 (OVH, FR),
Reverse DNS
Software
/
Resource Hash
029e0a2e809fd6b5dbe76abe8b7a74936be306c9a8c27c814c4d44aa54623300

Request headers

:path
/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.3.2
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
www.tucloudserver.com
referer
https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 28 Sep 2021 05:28:15 GMT
content-encoding
br
last-modified
Sun, 07 Mar 2021 16:21:48 GMT
x-cdn-pop-ip
137.74.120.0/27
etag
W/"2bd8-5bcf4b6d0d1ab"
x-cacheable
Cacheable
vary
Accept-Encoding
content-type
application/javascript
cache-control
max-age=1800
x-cdn-pop
sbg
accept-ranges
bytes
content-length
3989
x-request-id
65015492
main-front.js
www.tucloudserver.com/wp-content/plugins/wp-automatic/js/ 		888 B
549 B 		Script
General
Check archive.org
Download Go to
Full URL
https://www.tucloudserver.com/wp-content/plugins/wp-automatic/js/main-front.js?ver=5.8.1
Requested by
Host: www.tucloudserver.com
URL: https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
46.105.201.91 , France, ASN16276 (OVH, FR),
Reverse DNS
Software
/
Resource Hash
935dab74871e52fa1c7d7a963f793fdb9b04da01f0b2a762dab146eca5e37b2c

Request headers

:path
/wp-content/plugins/wp-automatic/js/main-front.js?ver=5.8.1
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
www.tucloudserver.com
referer
https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 28 Sep 2021 05:28:15 GMT
content-encoding
br
last-modified
Tue, 25 Sep 2018 16:13:41 GMT
x-cdn-pop-ip
137.74.120.0/27
etag
W/"378-576b4639d5740"
x-cacheable
Cacheable
vary
Accept-Encoding
content-type
application/javascript
cache-control
max-age=1800
x-cdn-pop
sbg
accept-ranges
bytes
x-request-id
65015493
scripts.js
www.tucloudserver.com/wp-content/themes/mh-magazine/js/ 		38 KB
12 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.tucloudserver.com/wp-content/themes/mh-magazine/js/scripts.js?ver=3.8.3
Requested by
Host: www.tucloudserver.com
URL: https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
46.105.201.91 , France, ASN16276 (OVH, FR),
Reverse DNS
Software
/
Resource Hash
8df7667db11a1cbae8ba0332258e0d3da3c26d2bab794bdcf8805df869482200

Request headers

:path
/wp-content/themes/mh-magazine/js/scripts.js?ver=3.8.3
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
www.tucloudserver.com
referer
https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 28 Sep 2021 05:28:15 GMT
content-encoding
br
last-modified
Tue, 25 Sep 2018 13:47:33 GMT
x-cdn-pop-ip
137.74.120.0/27
etag
W/"9836-576b259004740"
x-cacheable
Cacheable
vary
Accept-Encoding
content-type
application/javascript
cache-control
max-age=1800
x-cdn-pop
sbg
accept-ranges
bytes
x-request-id
65015494
cropped-tcs300x60_transparente.png
www.tucloudserver.com/wp-content/uploads/2018/09/ 		6 KB
6 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.tucloudserver.com/wp-content/uploads/2018/09/cropped-tcs300x60_transparente.png
Requested by
Host: www.tucloudserver.com
URL: https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
46.105.201.91 , France, ASN16276 (OVH, FR),
Reverse DNS
Software
/
Resource Hash
e3295f3b4091c690f71e917d46c6dafae4d6c89adf08c5210866deeadd6763a1

Request headers

:path
/wp-content/uploads/2018/09/cropped-tcs300x60_transparente.png
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
www.tucloudserver.com
referer
https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 28 Sep 2021 05:28:15 GMT
last-modified
Tue, 25 Sep 2018 14:18:36 GMT
x-cdn-pop-ip
137.74.120.0/27
etag
"18b5-576b2c80b6700"
x-cacheable
Cacheable
content-type
image/png
cache-control
max-age=1800
x-cdn-pop
sbg
accept-ranges
bytes
content-length
6325
x-request-id
65015496
600_200-new2.jpg
www.criptomercados.eu/wp-content/uploads/2018/09/ 		13 KB
13 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.criptomercados.eu/wp-content/uploads/2018/09/600_200-new2.jpg
Requested by
Host: www.tucloudserver.com
URL: https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.25.112.88 , Spain, ASN16371 (ACENS_AS Spain Hosting, housing and VPN services, ES),
Reverse DNS
wh05.tcsws.net
Software
Apache/2.4.25 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.tucloudserver.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date
Tue, 28 Sep 2021 05:28:15 GMT
Content-Encoding
gzip
Last-Modified
Mon, 13 Sep 2021 14:06:20 GMT
Server
Apache/2.4.25
ETag
"f1ffa-5cbe0f82bc1b7-gzip"
Vary
Accept-Encoding
Content-Type
text/html
Transfer-Encoding
chunked
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Russian-Turla-APT-Group-Deploying-New-Backdoor-on-Targeted-Systems-678x380.jpg
www.tucloudserver.com/wp-content/uploads/2021/09/ 		24 KB
25 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.tucloudserver.com/wp-content/uploads/2021/09/Russian-Turla-APT-Group-Deploying-New-Backdoor-on-Targeted-Systems-678x380.jpg
Requested by
Host: www.tucloudserver.com
URL: https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
46.105.201.91 , France, ASN16276 (OVH, FR),
Reverse DNS
Software
/
Resource Hash
5ec8578bab0f92bd6d81243575284297db42b82d7e605613f4d9cadf4e7f744f

Request headers

:path
/wp-content/uploads/2021/09/Russian-Turla-APT-Group-Deploying-New-Backdoor-on-Targeted-Systems-678x380.jpg
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
www.tucloudserver.com
referer
https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 28 Sep 2021 05:28:15 GMT
last-modified
Mon, 27 Sep 2021 14:22:20 GMT
x-cdn-pop-ip
137.74.120.0/27
etag
"6142-5ccfad3336483"
x-cacheable
Cacheable
content-type
image/jpeg
cache-control
max-age=1800
x-cdn-pop
sbg
accept-ranges
bytes
content-length
24898
x-request-id
65015497
1632752535_509_Russian-Turla-APT-Group-Deploying-New-Backdoor-on-Targeted-Systems.jpg
www.tucloudserver.com/wp-content/uploads/2021/09/ 		70 KB
70 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.tucloudserver.com/wp-content/uploads/2021/09/1632752535_509_Russian-Turla-APT-Group-Deploying-New-Backdoor-on-Targeted-Systems.jpg
Requested by
Host: www.tucloudserver.com
URL: https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
46.105.201.91 , France, ASN16276 (OVH, FR),
Reverse DNS
Software
/
Resource Hash
80aa1d8beb4753806b9a66ef6f53456fcdc065833e325c1d39d7b4894e158373

Request headers

:path
/wp-content/uploads/2021/09/1632752535_509_Russian-Turla-APT-Group-Deploying-New-Backdoor-on-Targeted-Systems.jpg
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
www.tucloudserver.com
referer
https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 28 Sep 2021 05:28:15 GMT
last-modified
Mon, 27 Sep 2021 14:22:15 GMT
x-cdn-pop-ip
137.74.120.0/27
etag
"118a5-5ccfad2e33133"
x-cacheable
Cacheable
content-type
image/jpeg
cache-control
max-age=1800
x-cdn-pop
sbg
accept-ranges
bytes
content-length
71845
x-request-id
65015498
widgets.js
platform.twitter.com/ 		96 KB
29 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://platform.twitter.com/widgets.js
Requested by
Host: www.tucloudserver.com
URL: https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:234:46c:e8b:1e2f:2bd:694 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (mil/6CEE) /
Resource Hash
8db61f95a8f3554830efc6c3942b7322efef09b9d7f0cbfe32135e0fac106d18

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.tucloudserver.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date
Tue, 28 Sep 2021 05:28:15 GMT
Content-Encoding
gzip
Last-Modified
Mon, 02 Aug 2021 20:34:57 GMT
Server
ECS (mil/6CEE)
Age
1375
Etag
"d405b816322f9770c70cbd10cfa87be4+gzip"
Vary
Accept-Encoding
x-tw-cdn
VZ
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=1800
X-Cache
HIT
Access-Control-Allow-Methods
GET
Content-Type
application/javascript; charset=utf-8
Content-Length
28872
728x90.gif
www.fiboquantum.net/banners/ 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.fiboquantum.net/banners/728x90.gif
Requested by
Host: www.tucloudserver.com
URL: https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
132.148.165.11 Ashburn, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
ip-132-148-165-11.ip.secureserver.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.tucloudserver.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers
placeholder-small.png
www.tucloudserver.com/wp-content/themes/mh-magazine/images/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.tucloudserver.com/wp-content/themes/mh-magazine/images/placeholder-small.png
Requested by
Host: www.tucloudserver.com
URL: https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
46.105.201.91 , France, ASN16276 (OVH, FR),
Reverse DNS
Software
/
Resource Hash
480d80961c1279cf353b0f8b0affccb075b6cc95c1d9ab8c0ae8caeb644669a2

Request headers

:path
/wp-content/themes/mh-magazine/images/placeholder-small.png
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
www.tucloudserver.com
referer
https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 28 Sep 2021 05:28:15 GMT
last-modified
Tue, 25 Sep 2018 13:47:33 GMT
x-cdn-pop-ip
137.74.120.0/27
etag
"78d-576b259004740"
x-cacheable
Cacheable
content-type
image/png
cache-control
max-age=1800
x-cdn-pop
sbg
accept-ranges
bytes
content-length
1933
x-request-id
65015499
onejs
z-na.amazon-adsystem.com/widgets/ 		24 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://z-na.amazon-adsystem.com/widgets/onejs?MarketPlace=US
Requested by
Host: www.tucloudserver.com
URL: https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.224.185.14 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-224-185-14.fra2.r.cloudfront.net
Software
Server /
Resource Hash
d76d93c447eb952ebe33d26df61e486f0d05ecee74187dd613931f8853a41676

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.tucloudserver.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Mon, 27 Sep 2021 05:38:15 GMT
content-encoding
gzip
age
85800
x-edge-origin-shield-skipped
0
x-cache
Hit from cloudfront
content-length
7941
pragma
Public
access-control-allow-origin
*
server
Server
content-type
application/javascript;charset=UTF-8
via
1.1 430fc75cac3bdd04869a39405c45fba2.cloudfront.net (CloudFront)
charset
UTF-8
cache-control
public,max-age=86400,s-maxage=86400,no-transform
x-amz-cf-pop
FRA2-C1
x-amz-cf-id
wb__UmYh0Eh5ypGWXnBruWWNDxvnTWPWc2esnzQjoiuGYK1vjtLIkA==
expires
Tue, 28 Sep 2021 05:38:15 GMT
wp-embed.min.js
www.tucloudserver.com/wp-includes/js/ 		1 KB
942 B 		Script
General
Check archive.org
Download Go to
Full URL
https://www.tucloudserver.com/wp-includes/js/wp-embed.min.js?ver=5.8.1
Requested by
Host: www.tucloudserver.com
URL: https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
46.105.201.91 , France, ASN16276 (OVH, FR),
Reverse DNS
Software
/
Resource Hash
5be614bce53f767993a5f5f14a6badd6aae6bf3af7cbdbf4d31520de49e27991

Request headers

:path
/wp-includes/js/wp-embed.min.js?ver=5.8.1
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
www.tucloudserver.com
referer
https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 28 Sep 2021 05:28:15 GMT
content-encoding
br
last-modified
Sun, 07 Mar 2021 16:21:48 GMT
x-cdn-pop-ip
137.74.120.0/27
etag
W/"592-5bcf4b6c83689"
x-cacheable
Cacheable
vary
Accept-Encoding
content-type
application/javascript
cache-control
max-age=1800
x-cdn-pop
sbg
accept-ranges
bytes
x-request-id
65015495
analytics.js
www.google-analytics.com/ 		48 KB
20 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-34803829-1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
fd222137f245c06ddb4c4d44db41f12138dad6cf8ef5d4d4a5e500f38f0c8c62
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.tucloudserver.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Wed, 11 Aug 2021 00:32:57 GMT
server
Golfe2
age
2478
date
Tue, 28 Sep 2021 04:46:57 GMT
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
19747
expires
Tue, 28 Sep 2021 06:46:57 GMT
wp-emoji-release.min.js
www.tucloudserver.com/wp-includes/js/ 		18 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.tucloudserver.com/wp-includes/js/wp-emoji-release.min.js?ver=5.8.1
Requested by
Host: www.tucloudserver.com
URL: https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
46.105.201.91 , France, ASN16276 (OVH, FR),
Reverse DNS
Software
/
Resource Hash
def5de6254be138b8b35d680d1fdd8b07827d03b8626daebfeeb4157ec330ea7

Request headers

:path
/wp-includes/js/wp-emoji-release.min.js?ver=5.8.1
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
www.tucloudserver.com
referer
https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 28 Sep 2021 05:28:15 GMT
content-encoding
br
last-modified
Thu, 02 Sep 2021 07:40:09 GMT
x-cdn-pop-ip
137.74.120.0/27
etag
W/"4705-5cafe4acde75a"
x-cacheable
Cacheable
vary
Accept-Encoding
content-type
application/javascript
cache-control
max-age=1800
x-cdn-pop
sbg
accept-ranges
bytes
content-length
4508
x-request-id
65015500
truncated
/ 		103 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
688a1e2444a1171a4cfbc8674c62d53bc663bf35a7825eb3563851e79694411c

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Content-Type
image/png
memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v26/ 		44 KB
44 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/opensans/v26/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:300,400,400italic,600,700
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
538dd4ff6e384a44155168326ac40a6c20a93cd212b1fbf88ae7b0c44f9ab0bd
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.tucloudserver.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Thu, 23 Sep 2021 17:04:31 GMT
x-content-type-options
nosniff
age
390224
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
44760
x-xss-protection
0
last-modified
Thu, 23 Sep 2021 16:50:17 GMT
server
sffe
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="apps-themes"
expires
Fri, 23 Sep 2022 17:04:31 GMT
fontawesome-webfont.woff2
www.tucloudserver.com/wp-content/themes/mh-magazine/fonts/ 		75 KB
76 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://www.tucloudserver.com/wp-content/themes/mh-magazine/fonts/fontawesome-webfont.woff2?v=4.7.0
Requested by
Host: www.tucloudserver.com
URL: https://www.tucloudserver.com/wp-content/themes/mh-magazine/includes/font-awesome.min.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
46.105.201.91 , France, ASN16276 (OVH, FR),
Reverse DNS
Software
/
Resource Hash
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe

Request headers

:path
/wp-content/themes/mh-magazine/fonts/fontawesome-webfont.woff2?v=4.7.0
pragma
no-cache
origin
https://www.tucloudserver.com
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
font
:authority
www.tucloudserver.com
referer
https://www.tucloudserver.com/wp-content/themes/mh-magazine/includes/font-awesome.min.css
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://www.tucloudserver.com/wp-content/themes/mh-magazine/includes/font-awesome.min.css
Origin
https://www.tucloudserver.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 28 Sep 2021 05:28:15 GMT
last-modified
Tue, 25 Sep 2018 13:47:33 GMT
x-cdn-pop-ip
137.74.120.0/27
etag
"12d68-576b259004740"
x-cacheable
Cacheable
cache-control
max-age=1800
x-cdn-pop
sbg
accept-ranges
bytes
content-length
77160
x-request-id
65015501
Time4VPS_728_90.png
www.time4vps.com/banners/affiliate/ 		29 KB
29 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.time4vps.com/banners/affiliate/Time4VPS_728_90.png
Requested by
Host: www.tucloudserver.com
URL: https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::6814:7d2e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d1324967c9e1a3a0abd84ddfc5decf25194b59548e4927e71b63b9e739acfe59
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.tucloudserver.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 28 Sep 2021 05:28:15 GMT
vary
Accept
cf-cache-status
HIT
age
1284241
cf-polished
origFmt=png, origSize=33584
content-disposition
inline; filename="Time4VPS_728_90.webp"
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length
29648
last-modified
Tue, 09 Apr 2019 07:40:21 GMT
server
cloudflare
etag
"8330-5861410be808a"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000
content-type
image/webp
expires
Fri, 08 Oct 2021 21:35:03 GMT
cache-control
max-age=2592000
accept-ranges
bytes
cf-ray
695a9136ef831772-FRA
cf-bgj
imgq:100,h2pri
1007080
ad.a-ads.com/ Frame 0445 		6 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ad.a-ads.com/1007080?size=300x250
Requested by
Host: www.tucloudserver.com
URL: https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
148.251.13.139 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.139.13.251.148.clients.your-server.de
Software
nginx/1.18.0 (Ubuntu) / Phusion Passenger(R)
Resource Hash
de6b47cbc35df5c3aaf4ec7b8dfac77a9cac72b52362e3c8087ba9fd1db03d20
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Host
ad.a-ads.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
iframe
Referer
https://www.tucloudserver.com/
Accept-Encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://www.tucloudserver.com/

Response headers

Server
nginx/1.18.0 (Ubuntu)
Date
Tue, 28 Sep 2021 05:28:15 GMT
Content-Type
text/html;charset=utf-8
Transfer-Encoding
chunked
Connection
keep-alive
Vary
Accept-Encoding Accept-Encoding
Status
200 OK
X-XSS-Protection
1; mode=block
X-Content-Type-Options
nosniff
X-Powered-By
Phusion Passenger(R)
X-Original-Referer
https://www.tucloudserver.com/
Content-Encoding
gzip
1007080
ad.a-ads.com/ Frame 55A1 		6 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ad.a-ads.com/1007080?size=300x250
Requested by
Host: www.tucloudserver.com
URL: https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
148.251.13.139 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.139.13.251.148.clients.your-server.de
Software
nginx/1.18.0 (Ubuntu) / Phusion Passenger(R)
Resource Hash
ae78aa60dbba9b96e951432535b7113538a2038223ab6b9924dd959873fe790e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Host
ad.a-ads.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
iframe
Referer
https://www.tucloudserver.com/
Accept-Encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://www.tucloudserver.com/

Response headers

Server
nginx/1.18.0 (Ubuntu)
Date
Tue, 28 Sep 2021 05:28:15 GMT
Content-Type
text/html;charset=utf-8
Transfer-Encoding
chunked
Connection
keep-alive
Vary
Accept-Encoding Accept-Encoding
Status
200 OK
X-XSS-Protection
1; mode=block
X-Content-Type-Options
nosniff
X-Powered-By
Phusion Passenger(R)
X-Original-Referer
https://www.tucloudserver.com/
Content-Encoding
gzip
The-haptic-Surface-pen-can-help-you-get-a-more-accurate-grip-80x60.jpg
www.tucloudserver.com/wp-content/uploads/2021/09/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.tucloudserver.com/wp-content/uploads/2021/09/The-haptic-Surface-pen-can-help-you-get-a-more-accurate-grip-80x60.jpg
Requested by
Host: www.tucloudserver.com
URL: https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
46.105.201.91 , France, ASN16276 (OVH, FR),
Reverse DNS
Software
/
Resource Hash
412d8ca60006e1a8940523ef356e3c1367ad3a13a59c0a63ae2a4bb445414ad7

Request headers

:path
/wp-content/uploads/2021/09/The-haptic-Surface-pen-can-help-you-get-a-more-accurate-grip-80x60.jpg
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
www.tucloudserver.com
referer
https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 28 Sep 2021 05:28:15 GMT
last-modified
Mon, 27 Sep 2021 13:35:56 GMT
x-cdn-pop-ip
137.74.120.0/27
etag
"7b6-5ccfa2d389d98"
x-cacheable
Cacheable
content-type
image/jpeg
cache-control
max-age=1800
x-cdn-pop
sbg
accept-ranges
bytes
content-length
1974
x-request-id
65015502
Amazon-announces-new-tools-for-its-cloud-hosted-call-center-software-80x60.jpg
www.tucloudserver.com/wp-content/uploads/2021/09/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.tucloudserver.com/wp-content/uploads/2021/09/Amazon-announces-new-tools-for-its-cloud-hosted-call-center-software-80x60.jpg
Requested by
Host: www.tucloudserver.com
URL: https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
46.105.201.91 , France, ASN16276 (OVH, FR),
Reverse DNS
Software
/
Resource Hash
4ce13b5c3f0bfc40cf5b3a4eefcdb7e687c4c4edeb3412ba57b90fef2fab8292

Request headers

:path
/wp-content/uploads/2021/09/Amazon-announces-new-tools-for-its-cloud-hosted-call-center-software-80x60.jpg
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
www.tucloudserver.com
referer
https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 28 Sep 2021 05:28:15 GMT
last-modified
Mon, 27 Sep 2021 15:41:17 GMT
x-cdn-pop-ip
137.74.120.0/27
etag
"82e-5ccfbed8c933a"
x-cacheable
Cacheable
content-type
image/jpeg
cache-control
max-age=1800
x-cdn-pop
sbg
accept-ranges
bytes
content-length
2094
x-request-id
65015503
300x600.gif
www.time4vps.com/banners/affiliate/ 		199 KB
199 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.time4vps.com/banners/affiliate/300x600.gif
Requested by
Host: www.tucloudserver.com
URL: https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::6814:7d2e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
fc623dc0180f2e1c28ed669fd980e77d7fe2f56c711005c693740f6dc3b17d11
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.tucloudserver.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 28 Sep 2021 05:28:15 GMT
vary
Accept
cf-cache-status
HIT
age
604292
cf-polished
origFmt=gif, origSize=251014
content-disposition
inline; filename="300x600.webp"
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length
203868
last-modified
Tue, 05 Jun 2018 11:41:41 GMT
server
cloudflare
etag
"3d486-56de388a3e740"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000
content-type
image/webp
expires
Sun, 03 Oct 2021 07:48:50 GMT
cache-control
max-age=2592000
accept-ranges
bytes
cf-ray
695a9136ef851772-FRA
cf-bgj
imgq:100,h2pri
Salesforce-introduces-three-new-low-code-Einstein-Automate-products-80x60.jpg
www.tucloudserver.com/wp-content/uploads/2021/09/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.tucloudserver.com/wp-content/uploads/2021/09/Salesforce-introduces-three-new-low-code-Einstein-Automate-products-80x60.jpg
Requested by
Host: www.tucloudserver.com
URL: https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
46.105.201.91 , France, ASN16276 (OVH, FR),
Reverse DNS
Software
/
Resource Hash
61c872af16c2457d09d0d702794b54391683711b9827fd6a551f0ab12eb9b0f7

Request headers

:path
/wp-content/uploads/2021/09/Salesforce-introduces-three-new-low-code-Einstein-Automate-products-80x60.jpg
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
www.tucloudserver.com
referer
https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 28 Sep 2021 05:28:15 GMT
last-modified
Thu, 16 Sep 2021 17:41:17 GMT
x-cdn-pop-ip
137.74.120.0/27
etag
"795-5cc205268be0a"
x-cacheable
Cacheable
content-type
image/jpeg
cache-control
max-age=1800
x-cdn-pop
sbg
accept-ranges
bytes
content-length
1941
x-request-id
65015504
The-best-app-for-viewing-RSS-on-Android-80x60.jpg
www.tucloudserver.com/wp-content/uploads/2021/06/ 		2 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.tucloudserver.com/wp-content/uploads/2021/06/The-best-app-for-viewing-RSS-on-Android-80x60.jpg
Requested by
Host: www.tucloudserver.com
URL: https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
46.105.201.91 , France, ASN16276 (OVH, FR),
Reverse DNS
Software
/
Resource Hash
b768dce1ffed646188ef0fc0dc2ff503faee2c456de6ef7c9e9a354d63ae2507

Request headers

:path
/wp-content/uploads/2021/06/The-best-app-for-viewing-RSS-on-Android-80x60.jpg
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
www.tucloudserver.com
referer
https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 28 Sep 2021 05:28:15 GMT
last-modified
Tue, 01 Jun 2021 14:56:00 GMT
x-cdn-pop-ip
137.74.120.0/27
etag
"9af-5c3b58a51b6d6"
x-cacheable
Cacheable
content-type
image/jpeg
cache-control
max-age=1800
x-cdn-pop
sbg
accept-ranges
bytes
content-length
2479
x-request-id
65015505
Don039t-be-a-bad-manager-7-tips-to-being-a-great-leader-80x60.jpg
www.tucloudserver.com/wp-content/uploads/2019/06/ 		2 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.tucloudserver.com/wp-content/uploads/2019/06/Don039t-be-a-bad-manager-7-tips-to-being-a-great-leader-80x60.jpg
Requested by
Host: www.tucloudserver.com
URL: https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
46.105.201.91 , France, ASN16276 (OVH, FR),
Reverse DNS
Software
/
Resource Hash
1c815a21a9b981460bab547b470ee6cf8d720931de5425a1377fb7d0970b6e00

Request headers

:path
/wp-content/uploads/2019/06/Don039t-be-a-bad-manager-7-tips-to-being-a-great-leader-80x60.jpg
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
www.tucloudserver.com
referer
https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 28 Sep 2021 05:28:15 GMT
last-modified
Fri, 28 Jun 2019 22:16:18 GMT
x-cdn-pop-ip
137.74.120.0/27
etag
"99f-58c69a0a25080"
x-cacheable
Cacheable
content-type
image/jpeg
cache-control
max-age=1800
x-cdn-pop
sbg
accept-ranges
bytes
content-length
2463
x-request-id
65015506
1538572908_The-6-most-popular-cyberattack-methods-hackers-use-to-attack-your-business-80x60.jpg
www.tucloudserver.com/wp-content/uploads/2018/10/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.tucloudserver.com/wp-content/uploads/2018/10/1538572908_The-6-most-popular-cyberattack-methods-hackers-use-to-attack-your-business-80x60.jpg
Requested by
Host: www.tucloudserver.com
URL: https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
46.105.201.91 , France, ASN16276 (OVH, FR),
Reverse DNS
Software
/
Resource Hash
1c1c5adc7ec51e2b13ced86c3783dfda3e0adfc0dd14400997a3259cb1bd25b0

Request headers

:path
/wp-content/uploads/2018/10/1538572908_The-6-most-popular-cyberattack-methods-hackers-use-to-attack-your-business-80x60.jpg
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
www.tucloudserver.com
referer
https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 28 Sep 2021 05:28:15 GMT
last-modified
Wed, 03 Oct 2018 13:21:49 GMT
x-cdn-pop-ip
137.74.120.0/27
etag
"82c-57752ebb3b540"
x-cacheable
Cacheable
content-type
image/jpeg
cache-control
max-age=1800
x-cdn-pop
sbg
accept-ranges
bytes
content-length
2092
x-request-id
65015507
IBM-and-Red-Hat-services-help-expedite-edge-computing-in-a-5G-world-80x60.jpg
www.tucloudserver.com/wp-content/uploads/2020/05/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.tucloudserver.com/wp-content/uploads/2020/05/IBM-and-Red-Hat-services-help-expedite-edge-computing-in-a-5G-world-80x60.jpg
Requested by
Host: www.tucloudserver.com
URL: https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
46.105.201.91 , France, ASN16276 (OVH, FR),
Reverse DNS
Software
/
Resource Hash
7991c5f04f9c487e8e131ea6faca43f219e27ea661c8901f50f7ff33d29ddf79

Request headers

:path
/wp-content/uploads/2020/05/IBM-and-Red-Hat-services-help-expedite-edge-computing-in-a-5G-world-80x60.jpg
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
www.tucloudserver.com
referer
https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 28 Sep 2021 05:28:15 GMT
last-modified
Tue, 05 May 2020 05:08:15 GMT
x-cdn-pop-ip
137.74.120.0/27
etag
"a09-5a4dfa2967c8c"
x-cacheable
Cacheable
content-type
image/jpeg
cache-control
max-age=1800
x-cdn-pop
sbg
accept-ranges
bytes
content-length
2569
x-request-id
65015508
What-best-practices-can-ensure-help-desk-chatbot-success-80x60.jpg
www.tucloudserver.com/wp-content/uploads/2021/04/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.tucloudserver.com/wp-content/uploads/2021/04/What-best-practices-can-ensure-help-desk-chatbot-success-80x60.jpg
Requested by
Host: www.tucloudserver.com
URL: https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
46.105.201.91 , France, ASN16276 (OVH, FR),
Reverse DNS
Software
/
Resource Hash
dabe342caabb5842321a4d5bc92137db797c29e365ae6f5b37b921b2d06954af

Request headers

:path
/wp-content/uploads/2021/04/What-best-practices-can-ensure-help-desk-chatbot-success-80x60.jpg
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
www.tucloudserver.com
referer
https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 28 Sep 2021 05:28:15 GMT
last-modified
Thu, 01 Apr 2021 05:12:13 GMT
x-cdn-pop-ip
137.74.120.0/27
etag
"b1f-5bee24636c5d7"
x-cacheable
Cacheable
content-type
image/jpeg
cache-control
max-age=1800
x-cdn-pop
sbg
accept-ranges
bytes
content-length
2847
x-request-id
65015509
1538577802_How-to-monitor-your-data-center-Linux-server-with-osquery-80x60.jpg
www.tucloudserver.com/wp-content/uploads/2018/10/ 		2 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.tucloudserver.com/wp-content/uploads/2018/10/1538577802_How-to-monitor-your-data-center-Linux-server-with-osquery-80x60.jpg
Requested by
Host: www.tucloudserver.com
URL: https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
46.105.201.91 , France, ASN16276 (OVH, FR),
Reverse DNS
Software
/
Resource Hash
7278028b400fa4f49af0e2f5f45b7cf13ba05746edbf7c2da91a55247350adfe

Request headers

:path
/wp-content/uploads/2018/10/1538577802_How-to-monitor-your-data-center-Linux-server-with-osquery-80x60.jpg
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
www.tucloudserver.com
referer
https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 28 Sep 2021 05:28:15 GMT
last-modified
Wed, 03 Oct 2018 14:43:23 GMT
x-cdn-pop-ip
137.74.120.0/27
etag
"90e-577540f6838c0"
x-cacheable
Cacheable
content-type
image/jpeg
cache-control
max-age=1800
x-cdn-pop
sbg
accept-ranges
bytes
content-length
2318
x-request-id
65015510
1543969900_Employees-switch-apps-more-than-1100-times-a-day-decreasing-productivity-80x60.jpg
www.tucloudserver.com/wp-content/uploads/2018/12/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.tucloudserver.com/wp-content/uploads/2018/12/1543969900_Employees-switch-apps-more-than-1100-times-a-day-decreasing-productivity-80x60.jpg
Requested by
Host: www.tucloudserver.com
URL: https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
46.105.201.91 , France, ASN16276 (OVH, FR),
Reverse DNS
Software
/
Resource Hash
9a251f880dd4f90209fb54eefabc3f4a861d622237374b283bfeccc8f0e1a122

Request headers

:path
/wp-content/uploads/2018/12/1543969900_Employees-switch-apps-more-than-1100-times-a-day-decreasing-productivity-80x60.jpg
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
www.tucloudserver.com
referer
https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 28 Sep 2021 05:28:15 GMT
last-modified
Wed, 05 Dec 2018 00:31:40 GMT
x-cdn-pop-ip
137.74.120.0/27
etag
"a2f-57c3b816ef300"
x-cacheable
Cacheable
content-type
image/jpeg
cache-control
max-age=1800
x-cdn-pop
sbg
accept-ranges
bytes
content-length
2607
x-request-id
65015511
Continued-Threat-Actor-Exploitation-Post-Pulse-Secure-VPN-Patching-80x60.png
www.tucloudserver.com/wp-content/uploads/2020/07/ 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.tucloudserver.com/wp-content/uploads/2020/07/Continued-Threat-Actor-Exploitation-Post-Pulse-Secure-VPN-Patching-80x60.png
Requested by
Host: www.tucloudserver.com
URL: https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
46.105.201.91 , France, ASN16276 (OVH, FR),
Reverse DNS
Software
/
Resource Hash
11a8eee068857addeca94b653ac0669ed4822cad95f417c8eff7c1f286ba6d63

Request headers

:path
/wp-content/uploads/2020/07/Continued-Threat-Actor-Exploitation-Post-Pulse-Secure-VPN-Patching-80x60.png
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
www.tucloudserver.com
referer
https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 28 Sep 2021 05:28:15 GMT
last-modified
Tue, 07 Jul 2020 19:36:28 GMT
x-cdn-pop-ip
137.74.120.0/27
etag
"435-5a9df1b92674a"
x-cacheable
Cacheable
content-type
image/png
cache-control
max-age=1800
x-cdn-pop
sbg
accept-ranges
bytes
content-length
1077
x-request-id
65015512
1538852902_Cybersecurity-investments-Why-ROI-calculations-may-not-tell-the-whole-story-80x60.jpg
www.tucloudserver.com/wp-content/uploads/2018/10/ 		2 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.tucloudserver.com/wp-content/uploads/2018/10/1538852902_Cybersecurity-investments-Why-ROI-calculations-may-not-tell-the-whole-story-80x60.jpg
Requested by
Host: www.tucloudserver.com
URL: https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
46.105.201.91 , France, ASN16276 (OVH, FR),
Reverse DNS
Software
/
Resource Hash
05bd227f744fc4c98b473a3ddbc585285bbeb50bf66c45966392b2a7b534dad2

Request headers

:path
/wp-content/uploads/2018/10/1538852902_Cybersecurity-investments-Why-ROI-calculations-may-not-tell-the-whole-story-80x60.jpg
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
www.tucloudserver.com
referer
https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 28 Sep 2021 05:28:15 GMT
last-modified
Sat, 06 Oct 2018 19:08:22 GMT
x-cdn-pop-ip
137.74.120.0/27
etag
"9f8-577941c95d580"
x-cacheable
Cacheable
content-type
image/jpeg
cache-control
max-age=1800
x-cdn-pop
sbg
accept-ranges
bytes
content-length
2552
x-request-id
65015513
New-SMS-malware-targets-Android-users-through-fake-COVID-messages-80x60.jpg
www.tucloudserver.com/wp-content/uploads/2021/09/ 		2 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.tucloudserver.com/wp-content/uploads/2021/09/New-SMS-malware-targets-Android-users-through-fake-COVID-messages-80x60.jpg
Requested by
Host: www.tucloudserver.com
URL: https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
46.105.201.91 , France, ASN16276 (OVH, FR),
Reverse DNS
Software
/
Resource Hash
8531aa93f4b62bb1a0348900c821b8d808e187ff798a4b1a8788536672e705ff

Request headers

:path
/wp-content/uploads/2021/09/New-SMS-malware-targets-Android-users-through-fake-COVID-messages-80x60.jpg
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
www.tucloudserver.com
referer
https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 28 Sep 2021 05:28:15 GMT
last-modified
Tue, 28 Sep 2021 03:00:37 GMT
x-cdn-pop-ip
137.74.120.0/27
etag
"97f-5cd056aff4adc"
x-cacheable
Cacheable
content-type
image/jpeg
cache-control
max-age=1800
x-cdn-pop
sbg
accept-ranges
bytes
content-length
2431
x-request-id
65015514
1537893719_Apple-iOS-12-Cheat-sheet-80x60.jpg
www.tucloudserver.com/wp-content/uploads/2018/09/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.tucloudserver.com/wp-content/uploads/2018/09/1537893719_Apple-iOS-12-Cheat-sheet-80x60.jpg
Requested by
Host: www.tucloudserver.com
URL: https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
46.105.201.91 , France, ASN16276 (OVH, FR),
Reverse DNS
Software
/
Resource Hash
ece7ed89228a902342b4e2c93b0b9fd66cdee4a094d2b5f07f3f53f1410fbefa

Request headers

:path
/wp-content/uploads/2018/09/1537893719_Apple-iOS-12-Cheat-sheet-80x60.jpg
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
www.tucloudserver.com
referer
https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 28 Sep 2021 05:28:15 GMT
last-modified
Tue, 25 Sep 2018 16:41:59 GMT
x-cdn-pop-ip
137.74.120.0/27
etag
"82a-576b4c8d2c3c0"
x-cacheable
Cacheable
content-type
image/jpeg
cache-control
max-age=1800
x-cdn-pop
sbg
accept-ranges
bytes
content-length
2090
x-request-id
65015515
1537897378_Why-mainframe-computing-is-still-relevant-10-benefits-to-your-business-80x60.jpg
www.tucloudserver.com/wp-content/uploads/2018/09/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.tucloudserver.com/wp-content/uploads/2018/09/1537897378_Why-mainframe-computing-is-still-relevant-10-benefits-to-your-business-80x60.jpg
Requested by
Host: www.tucloudserver.com
URL: https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
46.105.201.91 , France, ASN16276 (OVH, FR),
Reverse DNS
Software
/
Resource Hash
7f9a4eeb16633897d74c5bf7c376bc08e915489abc5f82fd8e500cba7d2bfa2c

Request headers

:path
/wp-content/uploads/2018/09/1537897378_Why-mainframe-computing-is-still-relevant-10-benefits-to-your-business-80x60.jpg
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
www.tucloudserver.com
referer
https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 28 Sep 2021 05:28:15 GMT
last-modified
Tue, 25 Sep 2018 17:42:58 GMT
x-cdn-pop-ip
137.74.120.0/27
etag
"8d7-576b5a2eaac80"
x-cacheable
Cacheable
content-type
image/jpeg
cache-control
max-age=1800
x-cdn-pop
sbg
accept-ranges
bytes
content-length
2263
x-request-id
65015516
1537901097_My-first-IT-job-TechRepublic-80x60.jpg
www.tucloudserver.com/wp-content/uploads/2018/09/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.tucloudserver.com/wp-content/uploads/2018/09/1537901097_My-first-IT-job-TechRepublic-80x60.jpg
Requested by
Host: www.tucloudserver.com
URL: https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
46.105.201.91 , France, ASN16276 (OVH, FR),
Reverse DNS
Software
/
Resource Hash
02c1c9ddf25168ce553505b5997942ef7aa9e9f2f2470014aeba80d48bb2d226

Request headers

:path
/wp-content/uploads/2018/09/1537901097_My-first-IT-job-TechRepublic-80x60.jpg
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
www.tucloudserver.com
referer
https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 28 Sep 2021 05:28:15 GMT
last-modified
Tue, 25 Sep 2018 18:44:57 GMT
x-cdn-pop-ip
137.74.120.0/27
etag
"a90-576b680961c40"
x-cacheable
Cacheable
content-type
image/jpeg
cache-control
max-age=1800
x-cdn-pop
sbg
accept-ranges
bytes
content-length
2704
x-request-id
65015517
collect
www.google-analytics.com/j/ 		2 B
211 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j93&a=1597659820&t=pageview&_s=1&dl=https%3A%2F%2Fwww.tucloudserver.com%2F2021%2F09%2F27%2Frussian-turla-apt-group-deploying-new-backdoor-on-targeted-systems%2F&ul=en-us&de=UTF-8&dt=Russian%20Turla%20APT%20Group%20Deploying%20New%20Backdoor%20on%20Targeted%20Systems%20%E2%80%93%20Tu%20Cloud%20Server&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAUABAAAAAC~&jid=1051474394&gjid=64223173&cid=198036437.1632806895&tid=UA-34803829-1&_gid=47353209.1632806895&_r=1&gtm=2ou9r0&did=dNDMyYj&z=1870377474
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.tucloudserver.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 28 Sep 2021 05:28:15 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.tucloudserver.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2
expires
Fri, 01 Jan 1990 00:00:00 GMT
sdk.js
connect.facebook.net/en_US/ 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://connect.facebook.net/en_US/sdk.js
Requested by
Host: www.tucloudserver.com
URL: https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f01c:216:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
5b73140259e53fa9c5ef520616b501e279bb5cad6ac35f3c57be61f18d128d68
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.tucloudserver.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; preload; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
content-md5
XSQQc/lFaMn3l1+f1OrDNg==
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=3600,h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length
1686
x-fb-rlafr
0
x-fb-debug
PcxEWJGrZmejOsc75v+r+KE4KRflFDdrkObKDkgIO3z3ovnInsUwhCxK7bLRKjVE2qK5vkskFoy5LmdtCm9j5w==
x-fb-trip-id
686109401
x-fb-content-md5
97a2832454fa4921b6c05d64f29938a1
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
DENY
date
Tue, 28 Sep 2021 05:28:15 GMT
vary
Accept-Encoding
content-type
application/x-javascript; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
X-FB-Content-MD5
cache-control
public,max-age=1200,stale-while-revalidate=3600
etag
"6707e83ccc06d4f2bb859ce4eb465bdf"
timing-allow-origin
*
priority
u=3,i
expires
Tue, 28 Sep 2021 05:36:48 GMT
collect
stats.g.doubleclick.net/j/ 		4 B
467 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j93&tid=UA-34803829-1&cid=198036437.1632806895&jid=1051474394&gjid=64223173&_gid=47353209.1632806895&_u=YEBAAUAAAAAAAC~&z=577918270
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400c:c08::9b Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.tucloudserver.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
strict-transport-security
max-age=10886400; includeSubDomains; preload
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
date
Tue, 28 Sep 2021 05:28:15 GMT
content-type
text/plain
access-control-allow-origin
https://www.tucloudserver.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
4
expires
Fri, 01 Jan 1990 00:00:00 GMT
300x250
static.a-ads.com/a-ads-banners/118229/ Frame 55A1 		682 KB
683 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://static.a-ads.com/a-ads-banners/118229/300x250?region=eu-central-1
Requested by
Host: ad.a-ads.com
URL: https://ad.a-ads.com/1007080?size=300x250
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
148.251.13.139 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.139.13.251.148.clients.your-server.de
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
b81d1d6dc8129dde051254463257a664dfe1bb49b78f0f4cd37dafbb3f960f93

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ad.a-ads.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date
Tue, 28 Sep 2021 05:28:15 GMT
Last-Modified
Sun, 26 Apr 2020 07:21:07 GMT
Server
nginx/1.18.0 (Ubuntu)
x-amz-request-id
CN832KR5YP5ABDWT
ETag
"ce8c5673a039ad9769d3265284d8f5f4"
Content-Type
image/gif
Cache-Control
max-age=315360000
Content-Length
698412
Connection
keep-alive
Accept-Ranges
bytes
x-amz-version-id
UQkZBCfcjGWdsi6lCz_51AvW3yIHMTsf
x-amz-id-2
+K0/oYmZ2lGJ2+/3vprtewetE6J6g4ZgqwDgjhQwQnWfmmqieuXqo2YEVqpmz3jJciOTKU0QlxQ=
Expires
Thu, 31 Dec 2037 23:55:55 GMT
300x250
static.a-ads.com/a-ads-banners/117617/ Frame 0445 		187 KB
187 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://static.a-ads.com/a-ads-banners/117617/300x250?region=eu-central-1
Requested by
Host: ad.a-ads.com
URL: https://ad.a-ads.com/1007080?size=300x250
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
148.251.13.139 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.139.13.251.148.clients.your-server.de
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
2e31c9bab999580b0a194dccb45a2f79378237ef53082e01ea3f539976c8780f

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ad.a-ads.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date
Tue, 28 Sep 2021 05:28:15 GMT
Last-Modified
Sun, 19 Apr 2020 16:08:09 GMT
Server
nginx/1.18.0 (Ubuntu)
x-amz-request-id
KF4AGWT959S0QJK4
ETag
"5896f969c3c0d5de143c2f56c20489d9"
Content-Type
image/gif
Cache-Control
max-age=315360000
Content-Length
191448
Connection
keep-alive
Accept-Ranges
bytes
x-amz-version-id
9rF0H2vdVY_HJMQUZBdQKii0bOEwqr9J
x-amz-id-2
wgIFRpYMNG8GobuEV8rQV9QBcQve0BSgipFEYZ7XUERKxOabYa1fADD50mYxU5jHKSFztP21lJ8=
Expires
Thu, 31 Dec 2037 23:55:55 GMT
truncated
/ Frame 0445 		305 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
95347f5a02237a0ff92fc87be7ad78f0fb44eebc125ffb61edc17da98a6d23d7

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ Frame 55A1 		305 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
95347f5a02237a0ff92fc87be7ad78f0fb44eebc125ffb61edc17da98a6d23d7

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Content-Type
image/png
sdk.js
connect.facebook.net/en_US/ 		269 KB
77 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://connect.facebook.net/en_US/sdk.js?hash=79abf8a598cc79ffd35e877d613a28b1
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/sdk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f01c:216:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
a54f1765dee568b4aeb4a509e1c5504b6a1a44f855dfc35e294bea92a1ad01c7
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

Referer
https://www.tucloudserver.com/
Origin
https://www.tucloudserver.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; preload; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
content-md5
W8WwbUwelRdVqGOkq//ZbA==
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=3600,h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length
77722
x-fb-rlafr
0
x-fb-debug
xdgm/Abke9Llya/8BqzJQdEsirijf5D5v6Qc+3Q+lFyIepQZiGy07lsx+tFJkEJ+aY5gqCeDByRaT91CNjGOCw==
x-fb-trip-id
686109401
x-fb-content-md5
c6a3c41a2449216162f886cc1d934986
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
DENY
date
Tue, 28 Sep 2021 05:28:15 GMT
vary
Accept-Encoding
content-type
application/x-javascript; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
X-FB-Content-MD5
cache-control
public,max-age=31536000,stale-while-revalidate=3600,immutable
etag
"d1446a73140314078c5f42907347fe21"
timing-allow-origin
*
priority
u=3,i
expires
Wed, 28 Sep 2022 01:14:05 GMT
widget_iframe.f88235f49a156f8b4cab34c7bc1a0acc.html
platform.twitter.com/widgets/ Frame EDF4 		319 KB
103 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://platform.twitter.com/widgets/widget_iframe.f88235f49a156f8b4cab34c7bc1a0acc.html?origin=https%3A%2F%2Fwww.tucloudserver.com
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:234:46c:e8b:1e2f:2bd:694 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (mil/6CE2) /
Resource Hash
c6d03b7a5561687268e57b13d9d4a6a4c71ee570ea74718040ce9227676e3e5e

Request headers

Host
platform.twitter.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
iframe
Referer
https://www.tucloudserver.com/
Accept-Encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://www.tucloudserver.com/

Response headers

Content-Encoding
gzip
Access-Control-Allow-Methods
GET
Access-Control-Allow-Origin
*
Age
1236521
Cache-Control
public, max-age=315360000
Content-Type
text/html; charset=utf-8
Date
Tue, 28 Sep 2021 05:28:15 GMT
Etag
"8321d7cf58d70200c1423dfa0bca40f6+gzip"
Last-Modified
Mon, 02 Aug 2021 20:33:53 GMT
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server
ECS (mil/6CE2)
Vary
Accept-Encoding
X-Cache
HIT
x-tw-cdn
VZ
Content-Length
105433
ga-audiences
www.google.com/ads/ 		42 B
522 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j93&tid=UA-34803829-1&cid=198036437.1632806895&jid=1051474394&_u=YEBAAUAAAAAAAC~&z=1299558873
Requested by
Host: www.tucloudserver.com
URL: https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:828::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.tucloudserver.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 28 Sep 2021 05:28:15 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.de/ads/ 		42 B
522 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j93&tid=UA-34803829-1&cid=198036437.1632806895&jid=1051474394&_u=YEBAAUAAAAAAAC~&z=1299558873
Requested by
Host: www.tucloudserver.com
URL: https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.tucloudserver.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 28 Sep 2021 05:28:15 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
settings
syndication.twitter.com/ Frame EDF4 		232 B
431 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://syndication.twitter.com/settings?session_id=2b0c27c80d86ba92fd22f1e7af2f6215e5359175
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/widgets/widget_iframe.f88235f49a156f8b4cab34c7bc1a0acc.html?origin=https%3A%2F%2Fwww.tucloudserver.com
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.136 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
726906ee6ce6dfe1b6e35ddad151196c50277e31520de30e916e9cd9affc0ef3
Security Headers
Name Value
Strict-Transport-Security max-age=631138519

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://platform.twitter.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 28 Sep 2021 05:28:15 GMT
content-encoding
gzip
last-modified
Tue, 28 Sep 2021 05:28:15 GMT
server
tsa_o
vary
Origin
strict-transport-security
max-age=631138519
content-type
application/json; charset=utf-8
access-control-allow-origin
https://platform.twitter.com
cache-control
must-revalidate, max-age=600
access-control-allow-credentials
true
x-connection-hash
b630668d9d15447b03deb46bd4a2f2aa0edcb125c1a42d890dcbdcba531d26b0
content-length
166

Verdicts & Comments Add Verdict or Comment

56 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 object| 3 object| onbeforexrselect boolean| originAgentCluster object| google_tag_manager object| dataLayer string| em_version boolean| em_track_user string| em_no_track_reason string| disableStr function| __gtagTrackerIsOptedOut function| __gtagTrackerOptout function| gaOptout function| __gtagTracker object| google_tag_data string| GoogleAnalyticsObject function| ga function| gtag function| __gaTracker object| _wpemojiSettings object| exactmetrics_frontend function| ExactMetrics object| ExactMetricsObject undefined| $ function| jQuery object| html5 object| Modernizr object| gaplugins object| gaGlobal object| gaData function| amazon_assoc_ir_f_call_associates_ads function| amazon_assoc_ir_f_call function| amzn_assoc_ad_spec_type object| amzn_assoc_ad_spec object| amzn_assoc_ad_async_spec object| adUnitDeliveryNetwork object| slotCounter function| cmManager object| amzn_assoc_cm boolean| amzn_assoc_enable_abs object| amzn_assoc_internal_params function| assocUtilsMaker object| amzn_assoc_utils object| nativeAdLayoutComputer object| amzn_assoc_ad object| blockedMarketPlacesJson object| blockedViewerCountriesJson object| wp boolean| _isScrolled object| twemoji object| FB object| __twttrll object| twttr object| __twttr

3 Cookies

Domain/Path Name / Value
.tucloudserver.com/ Name: _ga
Value: GA1.2.198036437.1632806895
.tucloudserver.com/ Name: _gid
Value: GA1.2.47353209.1632806895
.tucloudserver.com/ Name: _gat_gtag_UA_34803829_1
Value: 1

1 Console Messages

Source Level URL
Text
network error URL: https://www.fiboquantum.net/banners/728x90.gif
Message:
Failed to load resource: the server responded with a status of 404 (Not Found)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ad.a-ads.com
connect.facebook.net
fonts.googleapis.com
fonts.gstatic.com
platform.twitter.com
static.a-ads.com
stats.g.doubleclick.net
syndication.twitter.com
www.criptomercados.eu
www.fiboquantum.net
www.google-analytics.com
www.google.com
www.google.de
www.googletagmanager.com
www.time4vps.com
www.tucloudserver.com
z-na.amazon-adsystem.com
104.244.42.136
13.224.185.14
132.148.165.11
148.251.13.139
185.25.112.88
2606:2800:234:46c:e8b:1e2f:2bd:694
2606:4700:10::6814:7d2e
2a00:1450:4001:800::2003
2a00:1450:4001:80f::200e
2a00:1450:4001:811::200a
2a00:1450:4001:827::2003
2a00:1450:4001:828::2004
2a00:1450:4001:831::2008
2a00:1450:400c:c08::9b
2a03:2880:f01c:216:face:b00c:0:3
46.105.201.91
029e0a2e809fd6b5dbe76abe8b7a74936be306c9a8c27c814c4d44aa54623300
02c1c9ddf25168ce553505b5997942ef7aa9e9f2f2470014aeba80d48bb2d226
05bd227f744fc4c98b473a3ddbc585285bbeb50bf66c45966392b2a7b534dad2
11a8eee068857addeca94b653ac0669ed4822cad95f417c8eff7c1f286ba6d63
1c1c5adc7ec51e2b13ced86c3783dfda3e0adfc0dd14400997a3259cb1bd25b0
1c815a21a9b981460bab547b470ee6cf8d720931de5425a1377fb7d0970b6e00
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe
2e31c9bab999580b0a194dccb45a2f79378237ef53082e01ea3f539976c8780f
40dd348a0a40e3117ce5a9b3d0fc49651749e4821c342e82b89039f4847b791d
412d8ca60006e1a8940523ef356e3c1367ad3a13a59c0a63ae2a4bb445414ad7
480d80961c1279cf353b0f8b0affccb075b6cc95c1d9ab8c0ae8caeb644669a2
4ce13b5c3f0bfc40cf5b3a4eefcdb7e687c4c4edeb3412ba57b90fef2fab8292
518a9d587bdaecdd96340e67db078e823ff43f9f23f2f0d9f0ceafe4cca72a0f
538dd4ff6e384a44155168326ac40a6c20a93cd212b1fbf88ae7b0c44f9ab0bd
5b73140259e53fa9c5ef520616b501e279bb5cad6ac35f3c57be61f18d128d68
5be614bce53f767993a5f5f14a6badd6aae6bf3af7cbdbf4d31520de49e27991
5ec8578bab0f92bd6d81243575284297db42b82d7e605613f4d9cadf4e7f744f
61c872af16c2457d09d0d702794b54391683711b9827fd6a551f0ab12eb9b0f7
688a1e2444a1171a4cfbc8674c62d53bc663bf35a7825eb3563851e79694411c
726906ee6ce6dfe1b6e35ddad151196c50277e31520de30e916e9cd9affc0ef3
7278028b400fa4f49af0e2f5f45b7cf13ba05746edbf7c2da91a55247350adfe
7991c5f04f9c487e8e131ea6faca43f219e27ea661c8901f50f7ff33d29ddf79
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
7abf50e8b9a4e1abed1eedb0afc0828f2dd637bdd9077f6e7a36e43df1e013ea
7f9a4eeb16633897d74c5bf7c376bc08e915489abc5f82fd8e500cba7d2bfa2c
80aa1d8beb4753806b9a66ef6f53456fcdc065833e325c1d39d7b4894e158373
8344de8bf79ab17f82687a382232f1d76d620b876da83aa0d13546151298fdd5
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
8531aa93f4b62bb1a0348900c821b8d808e187ff798a4b1a8788536672e705ff
898e474ff096c8984854cc7e8f3b4d3611cebb7e29a59f3e66429e88b29dc7bf
8db61f95a8f3554830efc6c3942b7322efef09b9d7f0cbfe32135e0fac106d18
8df7667db11a1cbae8ba0332258e0d3da3c26d2bab794bdcf8805df869482200
9110fc122dda3067c424d9b8ff7747e2030b0bd9298f69a3683d399ad3373a6a
935dab74871e52fa1c7d7a963f793fdb9b04da01f0b2a762dab146eca5e37b2c
95347f5a02237a0ff92fc87be7ad78f0fb44eebc125ffb61edc17da98a6d23d7
9a251f880dd4f90209fb54eefabc3f4a861d622237374b283bfeccc8f0e1a122
a54f1765dee568b4aeb4a509e1c5504b6a1a44f855dfc35e294bea92a1ad01c7
ae78aa60dbba9b96e951432535b7113538a2038223ab6b9924dd959873fe790e
b768dce1ffed646188ef0fc0dc2ff503faee2c456de6ef7c9e9a354d63ae2507
b81d1d6dc8129dde051254463257a664dfe1bb49b78f0f4cd37dafbb3f960f93
bd4de6a3fc0fb68d6f76ba7b93514b96a92e585c295b5351c31ad92a4b0777ea
c6d03b7a5561687268e57b13d9d4a6a4c71ee570ea74718040ce9227676e3e5e
d1324967c9e1a3a0abd84ddfc5decf25194b59548e4927e71b63b9e739acfe59
d76d93c447eb952ebe33d26df61e486f0d05ecee74187dd613931f8853a41676
dabe342caabb5842321a4d5bc92137db797c29e365ae6f5b37b921b2d06954af
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
de6b47cbc35df5c3aaf4ec7b8dfac77a9cac72b52362e3c8087ba9fd1db03d20
def5de6254be138b8b35d680d1fdd8b07827d03b8626daebfeeb4157ec330ea7
e3295f3b4091c690f71e917d46c6dafae4d6c89adf08c5210866deeadd6763a1
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ece7ed89228a902342b4e2c93b0b9fd66cdee4a094d2b5f07f3f53f1410fbefa
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
efe9850fc8c77956cd1bb6fd3d8f8e27e27bf8e41b29ff6193916821ef4c4348
fc623dc0180f2e1c28ed669fd980e77d7fe2f56c711005c693740f6dc3b17d11
fd222137f245c06ddb4c4d44db41f12138dad6cf8ef5d4d4a5e500f38f0c8c62