urlscan.io logo urlscan.io
SecurityTrails logo

www.tucloudserver.com Open in urlscan Pro
46.105.201.91  Public Scan

Go To Rescan Add Verdict Report
URL: https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
Submission: On September 28 via api from GB — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 17 IPs in 5 countries across 15 domains to perform 55 HTTP transactions. The main IP is 46.105.201.91, located in France and belongs to OVH, FR. The main domain is www.tucloudserver.com.
TLS certificate: Issued by R3 on July 29th 2021. Valid for: 3 months.
This is the only time www.tucloudserver.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

33    46.105.201.91 (France)

ASN16276 (OVH, FR)
www.tucloudserver.com
1    2a00:1450:4001:830::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.googletagmanager.com
1    2a00:1450:4001:813::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.googleapis.com
1    185.25.112.88 (Spain)

ASN16371 (ACENS_AS Spain Hosting, housing and VPN services, ES)
PTR: wh05.tcsws.net
www.criptomercados.eu
2    2606:2800:234:59:254c:406:2366:268c (United States)

ASN15133 (EDGECAST, US)
platform.twitter.com
1    132.148.165.11 (Ashburn, United States)

ASN26496 (AS-26496-GO-DADDY-COM-LLC, US)
PTR: ip-132-148-165-11.ip.secureserver.net
www.fiboquantum.net
1    143.204.95.142 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-95-142.fra50.r.cloudfront.net
z-na.amazon-adsystem.com
2    2a00:1450:4001:831::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google-analytics.com
1    2a00:1450:4001:827::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.gstatic.com
2    2606:4700:10::6814:7d2e (United States)

ASN13335 (CLOUDFLARENET, US)
www.time4vps.com
4    148.251.1.246 (Germany)

ASN24940 (HETZNER-AS, DE)
PTR: static.246.1.251.148.clients.your-server.de
ad.a-ads.com
static.a-ads.com
2    2a03:2880:f01c:216:face:b00c:0:3 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)
connect.facebook.net
1    2a00:1450:400c:c01::9d (Brussels, Belgium)

ASN15169 (GOOGLE, US)
stats.g.doubleclick.net
1    2a00:1450:4001:827::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google.com
1    2a00:1450:4001:810::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google.de
1    104.244.42.136 (United States)

ASN13414 (TWITTER, US)
syndication.twitter.com
Domain Requested by
33 www.tucloudserver.com www.tucloudserver.com
2 static.a-ads.com ad.a-ads.com
2 connect.facebook.net www.tucloudserver.com
connect.facebook.net
2 ad.a-ads.com www.tucloudserver.com
2 www.time4vps.com www.tucloudserver.com
2 www.google-analytics.com www.googletagmanager.com
www.google-analytics.com
2 platform.twitter.com www.tucloudserver.com
platform.twitter.com
1 syndication.twitter.com platform.twitter.com
1 www.google.de www.tucloudserver.com
1 www.google.com www.tucloudserver.com
1 stats.g.doubleclick.net www.google-analytics.com
1 fonts.gstatic.com fonts.googleapis.com
1 z-na.amazon-adsystem.com www.tucloudserver.com
1 www.fiboquantum.net www.tucloudserver.com
1 www.criptomercados.eu www.tucloudserver.com
1 fonts.googleapis.com www.tucloudserver.com
1 www.googletagmanager.com www.tucloudserver.com
55 17
Subject Issuer Validity Valid
criptomercados.net
R3		 2021-07-29 -
2021-10-27		 3 months crt.sh
*.google-analytics.com
GTS CA 1C3		 2021-08-30 -
2021-11-22		 3 months crt.sh
upload.video.google.com
GTS CA 1C3		 2021-08-30 -
2021-11-22		 3 months crt.sh
criptomercados.eu
Let's Encrypt Authority X3		 2020-09-01 -
2020-11-30		 3 months crt.sh
*.twimg.com
DigiCert TLS RSA SHA256 2020 CA1		 2020-11-05 -
2021-11-09		 a year crt.sh
fiboquantum.net
R3		 2021-09-06 -
2021-12-05		 3 months crt.sh
z-na.amazon-adsystem.com
Amazon		 2020-12-12 -
2022-01-10		 a year crt.sh
*.gstatic.com
GTS CA 1C3		 2021-08-30 -
2021-11-22		 3 months crt.sh
*.time4vps.com
Sectigo RSA Domain Validation Secure Server CA		 2021-01-12 -
2022-02-12		 a year crt.sh
*.a-ads.com
Sectigo ECC Domain Validation Secure Server CA		 2020-12-02 -
2022-01-02		 a year crt.sh
*.facebook.com
DigiCert SHA2 High Assurance Server CA		 2021-09-09 -
2021-12-08		 3 months crt.sh
*.g.doubleclick.net
GTS CA 1C3		 2021-08-30 -
2021-11-22		 3 months crt.sh
www.google.com
GTS CA 1C3		 2021-08-30 -
2021-11-22		 3 months crt.sh
www.google.de
GTS CA 1C3		 2021-08-30 -
2021-11-22		 3 months crt.sh
syndication.twitter.com
DigiCert TLS RSA SHA256 2020 CA1		 2021-02-05 -
2022-02-04		 a year crt.sh

This page contains 4 frames:

Primary Page: https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
Frame ID: 703E808EDBB353B9616E9B044F9D5347
Requests: 50 HTTP requests in this frame

Frame: https://ad.a-ads.com/1007080?size=300x250
Frame ID: 64E448C150702A5E531BFAB1B4C447AE
Requests: 3 HTTP requests in this frame

Frame: https://ad.a-ads.com/1007080?size=300x250
Frame ID: 56BB89BAD843EE5A795EB2F66C307DD8
Requests: 3 HTTP requests in this frame

Frame: https://platform.twitter.com/widgets/widget_iframe.f88235f49a156f8b4cab34c7bc1a0acc.html?origin=https%3A%2F%2Fwww.tucloudserver.com
Frame ID: 0F65B4A5714415330F3F8D2C17641E6E
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Russian Turla APT Group Deploying New Backdoor on Targeted Systems – Tu Cloud Server

Detected technologies

Overall confidence: 100%
Detected patterns
  • <a[^>]*href=[^>]*/Cart
Overall confidence: 100%
Detected patterns
  • <link rel=["']stylesheet["'] [^>]+/wp-(?:content|includes)/
  • /wp-(?:content|includes)/
  • wp-embed\.min\.js\?ver=([\d.]+)
Overall confidence: 100%
Detected patterns
  • //connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js
Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
  • <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
  • (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
Overall confidence: 100%
Detected patterns
  • google-analytics\.com/(?:ga|urchin|analytics)\.js
Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com
Overall confidence: 100%
Detected patterns
  • googletagmanager\.com/gtag/js
Overall confidence: 100%
Detected patterns
  • //platform\.twitter\.com/widgets\.js
Overall confidence: 100%
Detected patterns
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Overall confidence: 100%
Detected patterns
  • jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?

Page Statistics

55
Requests

98 %
HTTPS

63 %
IPv6

15
Domains

17
Subdomains

17
IPs

5
Countries

2261 kB
Transfer

3203 kB
Size

3
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

55 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/ 		93 KB
15 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
46.105.201.91 , France, ASN16276 (OVH, FR),
Reverse DNS
Software
/
Resource Hash
b37aabcf47b6571242c758a28d17c3b8ceaf6ddd8c76b0156811a375bf48b5b6

Request headers

:method
GET
:authority
www.tucloudserver.com
:scheme
https
:path
/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language
de-DE,de;q=0.9
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language
de-DE,de;q=0.9

Response headers

date
Tue, 28 Sep 2021 05:22:32 GMT
content-type
text/html; charset=UTF-8
link
<https://www.tucloudserver.com/wp-json/>; rel="https://api.w.org/", <https://www.tucloudserver.com/wp-json/wp/v2/posts/24734>; rel="alternate"; type="application/json", <https://www.tucloudserver.com/?p=24734>; rel=shortlink
vary
Accept-Encoding
x-request-id
526321433
content-encoding
br
cache-control
max-age=1800
x-cdn-pop
sbg
x-cdn-pop-ip
137.74.120.0/27
x-cacheable
Cacheable
accept-ranges
bytes
js
www.googletagmanager.com/gtag/ 		96 KB
39 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=UA-34803829-1
Requested by
Host: www.tucloudserver.com
URL: https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:830::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
a18c8b71301dcd47cc8dd850af83110077476dfa33c4031ca523f6d8b981c0cc
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.tucloudserver.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 28 Sep 2021 05:22:32 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
38966
x-xss-protection
0
last-modified
Tue, 28 Sep 2021 03:00:00 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Tue, 28 Sep 2021 05:22:32 GMT
style.min.css
www.tucloudserver.com/wp-includes/css/dist/block-library/ 		79 KB
10 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.tucloudserver.com/wp-includes/css/dist/block-library/style.min.css?ver=5.8.1
Requested by
Host: www.tucloudserver.com
URL: https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
46.105.201.91 , France, ASN16276 (OVH, FR),
Reverse DNS
Software
/
Resource Hash
9110fc122dda3067c424d9b8ff7747e2030b0bd9298f69a3683d399ad3373a6a

Request headers

:path
/wp-includes/css/dist/block-library/style.min.css?ver=5.8.1
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
text/css,*/*;q=0.1
cache-control
no-cache
sec-fetch-dest
style
:authority
www.tucloudserver.com
referer
https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 28 Sep 2021 05:22:32 GMT
content-encoding
br
last-modified
Thu, 02 Sep 2021 07:40:08 GMT
x-cdn-pop-ip
137.74.120.0/27
etag
W/"13abe-5cafe4ac655d9"
x-cacheable
Cacheable
vary
Accept-Encoding
content-type
text/css
cache-control
max-age=1800
x-cdn-pop
sbg
accept-ranges
bytes
x-request-id
526321434
wp-automatic.css
www.tucloudserver.com/wp-content/plugins/wp-automatic/css/ 		3 KB
795 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.tucloudserver.com/wp-content/plugins/wp-automatic/css/wp-automatic.css?ver=1.0.0
Requested by
Host: www.tucloudserver.com
URL: https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
46.105.201.91 , France, ASN16276 (OVH, FR),
Reverse DNS
Software
/
Resource Hash
898e474ff096c8984854cc7e8f3b4d3611cebb7e29a59f3e66429e88b29dc7bf

Request headers

:path
/wp-content/plugins/wp-automatic/css/wp-automatic.css?ver=1.0.0
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
text/css,*/*;q=0.1
cache-control
no-cache
sec-fetch-dest
style
:authority
www.tucloudserver.com
referer
https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 28 Sep 2021 05:22:32 GMT
content-encoding
br
last-modified
Tue, 25 Sep 2018 16:13:41 GMT
x-cdn-pop-ip
137.74.120.0/27
etag
W/"a87-576b4639d5740"
x-cacheable
Cacheable
vary
Accept-Encoding
content-type
text/css
cache-control
max-age=1800
x-cdn-pop
sbg
accept-ranges
bytes
x-request-id
526321435
style.css
www.tucloudserver.com/wp-content/themes/mh-magazine/ 		85 KB
14 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.tucloudserver.com/wp-content/themes/mh-magazine/style.css?ver=3.8.3
Requested by
Host: www.tucloudserver.com
URL: https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
46.105.201.91 , France, ASN16276 (OVH, FR),
Reverse DNS
Software
/
Resource Hash
518a9d587bdaecdd96340e67db078e823ff43f9f23f2f0d9f0ceafe4cca72a0f

Request headers

:path
/wp-content/themes/mh-magazine/style.css?ver=3.8.3
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
text/css,*/*;q=0.1
cache-control
no-cache
sec-fetch-dest
style
:authority
www.tucloudserver.com
referer
https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 28 Sep 2021 05:22:32 GMT
content-encoding
br
last-modified
Tue, 25 Sep 2018 13:47:33 GMT
x-cdn-pop-ip
137.74.120.0/27
etag
W/"1557c-576b259004740"
x-cacheable
Cacheable
vary
Accept-Encoding
content-type
text/css
cache-control
max-age=1800
x-cdn-pop
sbg
accept-ranges
bytes
x-request-id
526321436
font-awesome.min.css
www.tucloudserver.com/wp-content/themes/mh-magazine/includes/ 		30 KB
7 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.tucloudserver.com/wp-content/themes/mh-magazine/includes/font-awesome.min.css
Requested by
Host: www.tucloudserver.com
URL: https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
46.105.201.91 , France, ASN16276 (OVH, FR),
Reverse DNS
Software
/
Resource Hash
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd

Request headers

:path
/wp-content/themes/mh-magazine/includes/font-awesome.min.css
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
text/css,*/*;q=0.1
cache-control
no-cache
sec-fetch-dest
style
:authority
www.tucloudserver.com
referer
https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 28 Sep 2021 05:22:32 GMT
content-encoding
br
last-modified
Tue, 25 Sep 2018 13:47:33 GMT
x-cdn-pop-ip
137.74.120.0/27
etag
W/"7918-576b259004740"
x-cacheable
Cacheable
vary
Accept-Encoding
content-type
text/css
cache-control
max-age=1800
x-cdn-pop
sbg
accept-ranges
bytes
x-request-id
526321437
css
fonts.googleapis.com/ 		13 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Open+Sans:300,400,400italic,600,700
Requested by
Host: www.tucloudserver.com
URL: https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:813::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
7abf50e8b9a4e1abed1eedb0afc0828f2dd637bdd9077f6e7a36e43df1e013ea
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.tucloudserver.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Tue, 28 Sep 2021 04:07:21 GMT
server
ESF
date
Tue, 28 Sep 2021 05:22:32 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Tue, 28 Sep 2021 05:22:32 GMT
frontend-gtag.min.js
www.tucloudserver.com/wp-content/plugins/google-analytics-dashboard-for-wp/assets/js/ 		9 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.tucloudserver.com/wp-content/plugins/google-analytics-dashboard-for-wp/assets/js/frontend-gtag.min.js?ver=6.7.0
Requested by
Host: www.tucloudserver.com
URL: https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
46.105.201.91 , France, ASN16276 (OVH, FR),
Reverse DNS
Software
/
Resource Hash
40dd348a0a40e3117ce5a9b3d0fc49651749e4821c342e82b89039f4847b791d

Request headers

:path
/wp-content/plugins/google-analytics-dashboard-for-wp/assets/js/frontend-gtag.min.js?ver=6.7.0
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
www.tucloudserver.com
referer
https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 28 Sep 2021 05:22:32 GMT
content-encoding
br
last-modified
Fri, 02 Jul 2021 12:23:46 GMT
x-cdn-pop-ip
137.74.120.0/27
etag
W/"23ab-5c62306f54471"
x-cacheable
Cacheable
vary
Accept-Encoding
content-type
application/javascript
cache-control
max-age=1800
x-cdn-pop
sbg
accept-ranges
bytes
content-length
2592
x-request-id
526321438
jquery.min.js
www.tucloudserver.com/wp-includes/js/jquery/ 		87 KB
30 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.tucloudserver.com/wp-includes/js/jquery/jquery.min.js?ver=3.6.0
Requested by
Host: www.tucloudserver.com
URL: https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
46.105.201.91 , France, ASN16276 (OVH, FR),
Reverse DNS
Software
/
Resource Hash
bd4de6a3fc0fb68d6f76ba7b93514b96a92e585c295b5351c31ad92a4b0777ea

Request headers

:path
/wp-includes/js/jquery/jquery.min.js?ver=3.6.0
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
www.tucloudserver.com
referer
https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 28 Sep 2021 05:22:32 GMT
content-encoding
br
last-modified
Thu, 02 Sep 2021 07:40:09 GMT
x-cdn-pop-ip
137.74.120.0/27
etag
W/"15db1-5cafe4aced1bb"
x-cacheable
Cacheable
vary
Accept-Encoding
content-type
application/javascript
cache-control
max-age=1800
x-cdn-pop
sbg
accept-ranges
bytes
x-request-id
526321439
jquery-migrate.min.js
www.tucloudserver.com/wp-includes/js/jquery/ 		11 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.tucloudserver.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.3.2
Requested by
Host: www.tucloudserver.com
URL: https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
46.105.201.91 , France, ASN16276 (OVH, FR),
Reverse DNS
Software
/
Resource Hash
029e0a2e809fd6b5dbe76abe8b7a74936be306c9a8c27c814c4d44aa54623300

Request headers

:path
/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.3.2
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
www.tucloudserver.com
referer
https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 28 Sep 2021 05:22:32 GMT
content-encoding
br
last-modified
Sun, 07 Mar 2021 16:21:48 GMT
x-cdn-pop-ip
137.74.120.0/27
etag
W/"2bd8-5bcf4b6d0d1ab"
x-cacheable
Cacheable
vary
Accept-Encoding
content-type
application/javascript
cache-control
max-age=1800
x-cdn-pop
sbg
accept-ranges
bytes
x-request-id
526321440
main-front.js
www.tucloudserver.com/wp-content/plugins/wp-automatic/js/ 		888 B
550 B 		Script
General
Check archive.org
Download Go to
Full URL
https://www.tucloudserver.com/wp-content/plugins/wp-automatic/js/main-front.js?ver=5.8.1
Requested by
Host: www.tucloudserver.com
URL: https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
46.105.201.91 , France, ASN16276 (OVH, FR),
Reverse DNS
Software
/
Resource Hash
935dab74871e52fa1c7d7a963f793fdb9b04da01f0b2a762dab146eca5e37b2c

Request headers

:path
/wp-content/plugins/wp-automatic/js/main-front.js?ver=5.8.1
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
www.tucloudserver.com
referer
https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 28 Sep 2021 05:22:32 GMT
content-encoding
br
last-modified
Tue, 25 Sep 2018 16:13:41 GMT
x-cdn-pop-ip
137.74.120.0/27
etag
W/"378-576b4639d5740"
x-cacheable
Cacheable
vary
Accept-Encoding
content-type
application/javascript
cache-control
max-age=1800
x-cdn-pop
sbg
accept-ranges
bytes
x-request-id
526321441
scripts.js
www.tucloudserver.com/wp-content/themes/mh-magazine/js/ 		38 KB
12 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.tucloudserver.com/wp-content/themes/mh-magazine/js/scripts.js?ver=3.8.3
Requested by
Host: www.tucloudserver.com
URL: https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
46.105.201.91 , France, ASN16276 (OVH, FR),
Reverse DNS
Software
/
Resource Hash
8df7667db11a1cbae8ba0332258e0d3da3c26d2bab794bdcf8805df869482200

Request headers

:path
/wp-content/themes/mh-magazine/js/scripts.js?ver=3.8.3
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
www.tucloudserver.com
referer
https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 28 Sep 2021 05:22:32 GMT
content-encoding
br
last-modified
Tue, 25 Sep 2018 13:47:33 GMT
x-cdn-pop-ip
137.74.120.0/27
etag
W/"9836-576b259004740"
x-cacheable
Cacheable
vary
Accept-Encoding
content-type
application/javascript
cache-control
max-age=1800
x-cdn-pop
sbg
accept-ranges
bytes
x-request-id
526321442
cropped-tcs300x60_transparente.png
www.tucloudserver.com/wp-content/uploads/2018/09/ 		6 KB
6 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.tucloudserver.com/wp-content/uploads/2018/09/cropped-tcs300x60_transparente.png
Requested by
Host: www.tucloudserver.com
URL: https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
46.105.201.91 , France, ASN16276 (OVH, FR),
Reverse DNS
Software
/
Resource Hash
e3295f3b4091c690f71e917d46c6dafae4d6c89adf08c5210866deeadd6763a1

Request headers

:path
/wp-content/uploads/2018/09/cropped-tcs300x60_transparente.png
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
www.tucloudserver.com
referer
https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 28 Sep 2021 05:22:33 GMT
last-modified
Tue, 25 Sep 2018 14:18:36 GMT
x-cdn-pop-ip
137.74.120.0/27
etag
"18b5-576b2c80b6700"
x-cacheable
Cacheable
content-type
image/png
cache-control
max-age=1800
x-cdn-pop
sbg
accept-ranges
bytes
content-length
6325
x-request-id
526321444
600_200-new2.jpg
www.criptomercados.eu/wp-content/uploads/2018/09/ 		13 KB
13 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.criptomercados.eu/wp-content/uploads/2018/09/600_200-new2.jpg
Requested by
Host: www.tucloudserver.com
URL: https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.25.112.88 , Spain, ASN16371 (ACENS_AS Spain Hosting, housing and VPN services, ES),
Reverse DNS
wh05.tcsws.net
Software
Apache/2.4.25 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.tucloudserver.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date
Tue, 28 Sep 2021 05:22:33 GMT
Content-Encoding
gzip
Last-Modified
Mon, 13 Sep 2021 14:06:20 GMT
Server
Apache/2.4.25
ETag
"f1ffa-5cbe0f82bc1b7-gzip"
Vary
Accept-Encoding
Content-Type
text/html
Transfer-Encoding
chunked
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Russian-Turla-APT-Group-Deploying-New-Backdoor-on-Targeted-Systems-678x380.jpg
www.tucloudserver.com/wp-content/uploads/2021/09/ 		24 KB
25 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.tucloudserver.com/wp-content/uploads/2021/09/Russian-Turla-APT-Group-Deploying-New-Backdoor-on-Targeted-Systems-678x380.jpg
Requested by
Host: www.tucloudserver.com
URL: https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
46.105.201.91 , France, ASN16276 (OVH, FR),
Reverse DNS
Software
/
Resource Hash
5ec8578bab0f92bd6d81243575284297db42b82d7e605613f4d9cadf4e7f744f

Request headers

:path
/wp-content/uploads/2021/09/Russian-Turla-APT-Group-Deploying-New-Backdoor-on-Targeted-Systems-678x380.jpg
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
www.tucloudserver.com
referer
https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 28 Sep 2021 05:22:33 GMT
last-modified
Mon, 27 Sep 2021 14:22:20 GMT
x-cdn-pop-ip
137.74.120.0/27
etag
"6142-5ccfad3336483"
x-cacheable
Cacheable
content-type
image/jpeg
cache-control
max-age=1800
x-cdn-pop
sbg
accept-ranges
bytes
content-length
24898
x-request-id
526321445
1632752535_509_Russian-Turla-APT-Group-Deploying-New-Backdoor-on-Targeted-Systems.jpg
www.tucloudserver.com/wp-content/uploads/2021/09/ 		70 KB
70 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.tucloudserver.com/wp-content/uploads/2021/09/1632752535_509_Russian-Turla-APT-Group-Deploying-New-Backdoor-on-Targeted-Systems.jpg
Requested by
Host: www.tucloudserver.com
URL: https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
46.105.201.91 , France, ASN16276 (OVH, FR),
Reverse DNS
Software
/
Resource Hash
80aa1d8beb4753806b9a66ef6f53456fcdc065833e325c1d39d7b4894e158373

Request headers

:path
/wp-content/uploads/2021/09/1632752535_509_Russian-Turla-APT-Group-Deploying-New-Backdoor-on-Targeted-Systems.jpg
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
www.tucloudserver.com
referer
https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 28 Sep 2021 05:22:33 GMT
last-modified
Mon, 27 Sep 2021 14:22:15 GMT
x-cdn-pop-ip
137.74.120.0/27
etag
"118a5-5ccfad2e33133"
x-cacheable
Cacheable
content-type
image/jpeg
cache-control
max-age=1800
x-cdn-pop
sbg
accept-ranges
bytes
content-length
71845
x-request-id
526321446
widgets.js
platform.twitter.com/ 		96 KB
29 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://platform.twitter.com/widgets.js
Requested by
Host: www.tucloudserver.com
URL: https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (frb/6762) /
Resource Hash
8db61f95a8f3554830efc6c3942b7322efef09b9d7f0cbfe32135e0fac106d18

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.tucloudserver.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date
Tue, 28 Sep 2021 05:22:32 GMT
Content-Encoding
gzip
Vary
Accept-Encoding
Age
953
X-Cache
HIT
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Content-Length
28872
x-tw-cdn
VZ
Last-Modified
Mon, 02 Aug 2021 20:34:57 GMT
Server
ECS (frb/6762)
Etag
"d405b816322f9770c70cbd10cfa87be4+gzip"
Access-Control-Max-Age
3000
Access-Control-Allow-Methods
GET
Content-Type
application/javascript; charset=utf-8
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=1800
728x90.gif
www.fiboquantum.net/banners/ 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.fiboquantum.net/banners/728x90.gif
Requested by
Host: www.tucloudserver.com
URL: https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
132.148.165.11 Ashburn, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
ip-132-148-165-11.ip.secureserver.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.tucloudserver.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers
onejs
z-na.amazon-adsystem.com/widgets/ 		24 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://z-na.amazon-adsystem.com/widgets/onejs?MarketPlace=US
Requested by
Host: www.tucloudserver.com
URL: https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.95.142 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-95-142.fra50.r.cloudfront.net
Software
Server /
Resource Hash
d76d93c447eb952ebe33d26df61e486f0d05ecee74187dd613931f8853a41676

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.tucloudserver.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Mon, 27 Sep 2021 05:38:15 GMT
content-encoding
gzip
age
85457
x-edge-origin-shield-skipped
0
x-cache
Hit from cloudfront
content-length
7941
pragma
Public
access-control-allow-origin
*
server
Server
content-type
application/javascript;charset=UTF-8
via
1.1 d627b75d0c1aedd3691390ac8498d3b0.cloudfront.net (CloudFront)
charset
UTF-8
cache-control
public,max-age=86400,s-maxage=86400,no-transform
x-amz-cf-pop
FRA50-C1
x-amz-cf-id
CMg7cEN7MQZ6yep_Wje7-nRre6Mox2BpNK0ymI-ZuCXLh30otMQemw==
expires
Tue, 28 Sep 2021 05:38:15 GMT
wp-embed.min.js
www.tucloudserver.com/wp-includes/js/ 		1 KB
949 B 		Script
General
Check archive.org
Download Go to
Full URL
https://www.tucloudserver.com/wp-includes/js/wp-embed.min.js?ver=5.8.1
Requested by
Host: www.tucloudserver.com
URL: https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
46.105.201.91 , France, ASN16276 (OVH, FR),
Reverse DNS
Software
/
Resource Hash
5be614bce53f767993a5f5f14a6badd6aae6bf3af7cbdbf4d31520de49e27991

Request headers

:path
/wp-includes/js/wp-embed.min.js?ver=5.8.1
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
www.tucloudserver.com
referer
https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 28 Sep 2021 05:22:33 GMT
content-encoding
br
last-modified
Sun, 07 Mar 2021 16:21:48 GMT
x-cdn-pop-ip
137.74.120.0/27
etag
W/"592-5bcf4b6c83689"
x-cacheable
Cacheable
vary
Accept-Encoding
content-type
application/javascript
cache-control
max-age=1800
x-cdn-pop
sbg
accept-ranges
bytes
content-length
664
x-request-id
526321443
analytics.js
www.google-analytics.com/ 		48 KB
20 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-34803829-1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:831::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
fd222137f245c06ddb4c4d44db41f12138dad6cf8ef5d4d4a5e500f38f0c8c62
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.tucloudserver.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Wed, 11 Aug 2021 00:32:57 GMT
server
Golfe2
age
1832
date
Tue, 28 Sep 2021 04:52:00 GMT
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
19747
expires
Tue, 28 Sep 2021 06:52:00 GMT
wp-emoji-release.min.js
www.tucloudserver.com/wp-includes/js/ 		18 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.tucloudserver.com/wp-includes/js/wp-emoji-release.min.js?ver=5.8.1
Requested by
Host: www.tucloudserver.com
URL: https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
46.105.201.91 , France, ASN16276 (OVH, FR),
Reverse DNS
Software
/
Resource Hash
def5de6254be138b8b35d680d1fdd8b07827d03b8626daebfeeb4157ec330ea7

Request headers

:path
/wp-includes/js/wp-emoji-release.min.js?ver=5.8.1
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
www.tucloudserver.com
referer
https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 28 Sep 2021 05:22:33 GMT
content-encoding
br
last-modified
Thu, 02 Sep 2021 07:40:09 GMT
x-cdn-pop-ip
137.74.120.0/27
etag
W/"4705-5cafe4acde75a"
x-cacheable
Cacheable
vary
Accept-Encoding
content-type
application/javascript
cache-control
max-age=1800
x-cdn-pop
sbg
accept-ranges
bytes
x-request-id
526321447
truncated
/ 		103 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
688a1e2444a1171a4cfbc8674c62d53bc663bf35a7825eb3563851e79694411c

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Content-Type
image/png
memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v26/ 		44 KB
44 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/opensans/v26/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:300,400,400italic,600,700
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
538dd4ff6e384a44155168326ac40a6c20a93cd212b1fbf88ae7b0c44f9ab0bd
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.tucloudserver.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Thu, 23 Sep 2021 17:03:52 GMT
x-content-type-options
nosniff
age
389921
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
44760
x-xss-protection
0
last-modified
Thu, 23 Sep 2021 16:50:17 GMT
server
sffe
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="apps-themes"
expires
Fri, 23 Sep 2022 17:03:52 GMT
fontawesome-webfont.woff2
www.tucloudserver.com/wp-content/themes/mh-magazine/fonts/ 		75 KB
76 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://www.tucloudserver.com/wp-content/themes/mh-magazine/fonts/fontawesome-webfont.woff2?v=4.7.0
Requested by
Host: www.tucloudserver.com
URL: https://www.tucloudserver.com/wp-content/themes/mh-magazine/includes/font-awesome.min.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
46.105.201.91 , France, ASN16276 (OVH, FR),
Reverse DNS
Software
/
Resource Hash
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe

Request headers

:path
/wp-content/themes/mh-magazine/fonts/fontawesome-webfont.woff2?v=4.7.0
pragma
no-cache
origin
https://www.tucloudserver.com
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
font
:authority
www.tucloudserver.com
referer
https://www.tucloudserver.com/wp-content/themes/mh-magazine/includes/font-awesome.min.css
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://www.tucloudserver.com/wp-content/themes/mh-magazine/includes/font-awesome.min.css
Origin
https://www.tucloudserver.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 28 Sep 2021 05:22:33 GMT
last-modified
Tue, 25 Sep 2018 13:47:33 GMT
x-cdn-pop-ip
137.74.120.0/27
etag
"12d68-576b259004740"
x-cacheable
Cacheable
cache-control
max-age=1800
x-cdn-pop
sbg
accept-ranges
bytes
content-length
77160
x-request-id
526321448
Time4VPS_728_90.png
www.time4vps.com/banners/affiliate/ 		29 KB
29 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.time4vps.com/banners/affiliate/Time4VPS_728_90.png
Requested by
Host: www.tucloudserver.com
URL: https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::6814:7d2e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d1324967c9e1a3a0abd84ddfc5decf25194b59548e4927e71b63b9e739acfe59
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.tucloudserver.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 28 Sep 2021 05:22:33 GMT
vary
Accept
cf-cache-status
HIT
age
1283899
cf-polished
origFmt=png, origSize=33584
content-disposition
inline; filename="Time4VPS_728_90.webp"
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length
29648
last-modified
Tue, 09 Apr 2019 07:40:21 GMT
server
cloudflare
etag
"8330-5861410be808a"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000
content-type
image/webp
expires
Fri, 08 Oct 2021 21:35:03 GMT
cache-control
max-age=2592000
accept-ranges
bytes
cf-ray
695a88dc58335c7a-FRA
cf-bgj
imgq:100,h2pri
1007080
ad.a-ads.com/ Frame 64E4 		6 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ad.a-ads.com/1007080?size=300x250
Requested by
Host: www.tucloudserver.com
URL: https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
148.251.1.246 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.246.1.251.148.clients.your-server.de
Software
nginx/1.18.0 (Ubuntu) / Phusion Passenger(R)
Resource Hash
7f10769aade4d48a30fad3022dd47c351e0d4bb863b2d7290760ad1a8f07a059
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Host
ad.a-ads.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
iframe
Referer
https://www.tucloudserver.com/
Accept-Encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://www.tucloudserver.com/

Response headers

Server
nginx/1.18.0 (Ubuntu)
Date
Tue, 28 Sep 2021 05:22:33 GMT
Content-Type
text/html;charset=utf-8
Transfer-Encoding
chunked
Connection
keep-alive
Vary
Accept-Encoding Accept-Encoding
Status
200 OK
X-XSS-Protection
1; mode=block
X-Content-Type-Options
nosniff
X-Powered-By
Phusion Passenger(R)
X-Original-Referer
https://www.tucloudserver.com/
Content-Encoding
gzip
1007080
ad.a-ads.com/ Frame 56BB 		6 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ad.a-ads.com/1007080?size=300x250
Requested by
Host: www.tucloudserver.com
URL: https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
148.251.1.246 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.246.1.251.148.clients.your-server.de
Software
nginx/1.18.0 (Ubuntu) / Phusion Passenger(R)
Resource Hash
f4488fec2e44dc15d9d30f9022b8c8193df586784b600cdfd372aadd9f98fd08
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Host
ad.a-ads.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
iframe
Referer
https://www.tucloudserver.com/
Accept-Encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://www.tucloudserver.com/

Response headers

Server
nginx/1.18.0 (Ubuntu)
Date
Tue, 28 Sep 2021 05:22:33 GMT
Content-Type
text/html;charset=utf-8
Transfer-Encoding
chunked
Connection
keep-alive
Vary
Accept-Encoding Accept-Encoding
Status
200 OK
X-XSS-Protection
1; mode=block
X-Content-Type-Options
nosniff
X-Powered-By
Phusion Passenger(R)
X-Original-Referer
https://www.tucloudserver.com/
Content-Encoding
gzip
The-haptic-Surface-pen-can-help-you-get-a-more-accurate-grip-80x60.jpg
www.tucloudserver.com/wp-content/uploads/2021/09/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.tucloudserver.com/wp-content/uploads/2021/09/The-haptic-Surface-pen-can-help-you-get-a-more-accurate-grip-80x60.jpg
Requested by
Host: www.tucloudserver.com
URL: https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
46.105.201.91 , France, ASN16276 (OVH, FR),
Reverse DNS
Software
/
Resource Hash
412d8ca60006e1a8940523ef356e3c1367ad3a13a59c0a63ae2a4bb445414ad7

Request headers

:path
/wp-content/uploads/2021/09/The-haptic-Surface-pen-can-help-you-get-a-more-accurate-grip-80x60.jpg
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
www.tucloudserver.com
referer
https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 28 Sep 2021 05:22:33 GMT
last-modified
Mon, 27 Sep 2021 13:35:56 GMT
x-cdn-pop-ip
137.74.120.0/27
etag
"7b6-5ccfa2d389d98"
x-cacheable
Cacheable
content-type
image/jpeg
cache-control
max-age=1800
x-cdn-pop
sbg
accept-ranges
bytes
content-length
1974
x-request-id
526321449
Amazon-announces-new-tools-for-its-cloud-hosted-call-center-software-80x60.jpg
www.tucloudserver.com/wp-content/uploads/2021/09/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.tucloudserver.com/wp-content/uploads/2021/09/Amazon-announces-new-tools-for-its-cloud-hosted-call-center-software-80x60.jpg
Requested by
Host: www.tucloudserver.com
URL: https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
46.105.201.91 , France, ASN16276 (OVH, FR),
Reverse DNS
Software
/
Resource Hash
4ce13b5c3f0bfc40cf5b3a4eefcdb7e687c4c4edeb3412ba57b90fef2fab8292

Request headers

:path
/wp-content/uploads/2021/09/Amazon-announces-new-tools-for-its-cloud-hosted-call-center-software-80x60.jpg
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
www.tucloudserver.com
referer
https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 28 Sep 2021 05:22:33 GMT
last-modified
Mon, 27 Sep 2021 15:41:17 GMT
x-cdn-pop-ip
137.74.120.0/27
etag
"82e-5ccfbed8c933a"
x-cacheable
Cacheable
content-type
image/jpeg
cache-control
max-age=1800
x-cdn-pop
sbg
accept-ranges
bytes
content-length
2094
x-request-id
526321450
300x600.gif
www.time4vps.com/banners/affiliate/ 		199 KB
199 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.time4vps.com/banners/affiliate/300x600.gif
Requested by
Host: www.tucloudserver.com
URL: https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::6814:7d2e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
fc623dc0180f2e1c28ed669fd980e77d7fe2f56c711005c693740f6dc3b17d11
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.tucloudserver.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 28 Sep 2021 05:22:33 GMT
vary
Accept
cf-cache-status
HIT
age
603950
cf-polished
origFmt=gif, origSize=251014
content-disposition
inline; filename="300x600.webp"
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length
203868
last-modified
Tue, 05 Jun 2018 11:41:41 GMT
server
cloudflare
etag
"3d486-56de388a3e740"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000
content-type
image/webp
expires
Sun, 03 Oct 2021 07:48:50 GMT
cache-control
max-age=2592000
accept-ranges
bytes
cf-ray
695a88dc58355c7a-FRA
cf-bgj
imgq:100,h2pri
1543969900_Employees-switch-apps-more-than-1100-times-a-day-decreasing-productivity-80x60.jpg
www.tucloudserver.com/wp-content/uploads/2018/12/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.tucloudserver.com/wp-content/uploads/2018/12/1543969900_Employees-switch-apps-more-than-1100-times-a-day-decreasing-productivity-80x60.jpg
Requested by
Host: www.tucloudserver.com
URL: https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
46.105.201.91 , France, ASN16276 (OVH, FR),
Reverse DNS
Software
/
Resource Hash
9a251f880dd4f90209fb54eefabc3f4a861d622237374b283bfeccc8f0e1a122

Request headers

:path
/wp-content/uploads/2018/12/1543969900_Employees-switch-apps-more-than-1100-times-a-day-decreasing-productivity-80x60.jpg
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
www.tucloudserver.com
referer
https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 28 Sep 2021 05:22:33 GMT
last-modified
Wed, 05 Dec 2018 00:31:40 GMT
x-cdn-pop-ip
137.74.120.0/27
etag
"a2f-57c3b816ef300"
x-cacheable
Cacheable
content-type
image/jpeg
cache-control
max-age=1800
x-cdn-pop
sbg
accept-ranges
bytes
content-length
2607
x-request-id
526321451
Elder-care-facilities-using-wearables-and-apps-for-coronavirus-contact-tracing-80x60.jpg
www.tucloudserver.com/wp-content/uploads/2020/07/ 		2 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.tucloudserver.com/wp-content/uploads/2020/07/Elder-care-facilities-using-wearables-and-apps-for-coronavirus-contact-tracing-80x60.jpg
Requested by
Host: www.tucloudserver.com
URL: https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
46.105.201.91 , France, ASN16276 (OVH, FR),
Reverse DNS
Software
/
Resource Hash
ecf4173f8b3465360fa7947982d1f7bae4e4e4b6d4f1693d33177314e4989ea9

Request headers

:path
/wp-content/uploads/2020/07/Elder-care-facilities-using-wearables-and-apps-for-coronavirus-contact-tracing-80x60.jpg
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
www.tucloudserver.com
referer
https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 28 Sep 2021 05:22:33 GMT
last-modified
Fri, 24 Jul 2020 05:30:24 GMT
x-cdn-pop-ip
137.74.120.0/27
etag
"911-5ab294513bb91"
x-cacheable
Cacheable
content-type
image/jpeg
cache-control
max-age=1800
x-cdn-pop
sbg
accept-ranges
bytes
content-length
2321
x-request-id
526321452
How-to-integrate-Dropbox-into-Slack-80x60.jpg
www.tucloudserver.com/wp-content/uploads/2019/11/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.tucloudserver.com/wp-content/uploads/2019/11/How-to-integrate-Dropbox-into-Slack-80x60.jpg
Requested by
Host: www.tucloudserver.com
URL: https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
46.105.201.91 , France, ASN16276 (OVH, FR),
Reverse DNS
Software
/
Resource Hash
04dd5d8ce9ed508e57e1d3370214dee049d6fcadc1641ed4000e71ae471b0632

Request headers

:path
/wp-content/uploads/2019/11/How-to-integrate-Dropbox-into-Slack-80x60.jpg
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
www.tucloudserver.com
referer
https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 28 Sep 2021 05:22:33 GMT
last-modified
Fri, 15 Nov 2019 01:24:43 GMT
x-cdn-pop-ip
137.74.120.0/27
etag
"701-5975876680cc0"
x-cacheable
Cacheable
content-type
image/jpeg
cache-control
max-age=1800
x-cdn-pop
sbg
accept-ranges
bytes
content-length
1793
x-request-id
526321453
The-3-most-valuable-IT-skills-that-will-advance-your-career-80x60.jpg
www.tucloudserver.com/wp-content/uploads/2018/10/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.tucloudserver.com/wp-content/uploads/2018/10/The-3-most-valuable-IT-skills-that-will-advance-your-career-80x60.jpg
Requested by
Host: www.tucloudserver.com
URL: https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
46.105.201.91 , France, ASN16276 (OVH, FR),
Reverse DNS
Software
/
Resource Hash
79f91fbbe681bf278b49bcd1f60c366b40b057d26b271f598959a9300ad6ed36

Request headers

:path
/wp-content/uploads/2018/10/The-3-most-valuable-IT-skills-that-will-advance-your-career-80x60.jpg
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
www.tucloudserver.com
referer
https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 28 Sep 2021 05:22:33 GMT
last-modified
Sat, 13 Oct 2018 14:13:01 GMT
x-cdn-pop-ip
137.74.120.0/27
etag
"841-5781ccd387540"
x-cacheable
Cacheable
content-type
image/jpeg
cache-control
max-age=1800
x-cdn-pop
sbg
accept-ranges
bytes
content-length
2113
x-request-id
526321454
Windows-10-three-years-later-Why-this-is-as-good-as-it-gets-80x60.jpg
www.tucloudserver.com/wp-content/uploads/2019/07/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.tucloudserver.com/wp-content/uploads/2019/07/Windows-10-three-years-later-Why-this-is-as-good-as-it-gets-80x60.jpg
Requested by
Host: www.tucloudserver.com
URL: https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
46.105.201.91 , France, ASN16276 (OVH, FR),
Reverse DNS
Software
/
Resource Hash
323ffc294ad745b5e095fe8d4f8c51289ab7c765b0d878108dd93783f9c167b2

Request headers

:path
/wp-content/uploads/2019/07/Windows-10-three-years-later-Why-this-is-as-good-as-it-gets-80x60.jpg
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
www.tucloudserver.com
referer
https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 28 Sep 2021 05:22:33 GMT
last-modified
Wed, 17 Jul 2019 02:25:06 GMT
x-cdn-pop-ip
137.74.120.0/27
etag
"6b3-58dd7338e4480"
x-cacheable
Cacheable
content-type
image/jpeg
cache-control
max-age=1800
x-cdn-pop
sbg
accept-ranges
bytes
content-length
1715
x-request-id
526321455
QSnatch-Data-Stealing-Malware-Infected-Over-62000-QNAP-NAS-Devices-80x60.jpg
www.tucloudserver.com/wp-content/uploads/2020/07/ 		2 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.tucloudserver.com/wp-content/uploads/2020/07/QSnatch-Data-Stealing-Malware-Infected-Over-62000-QNAP-NAS-Devices-80x60.jpg
Requested by
Host: www.tucloudserver.com
URL: https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
46.105.201.91 , France, ASN16276 (OVH, FR),
Reverse DNS
Software
/
Resource Hash
b1fcb55b36ecaf34e55f2574abe157c873bcbb358e98e017c0aa733ffbdcebc4

Request headers

:path
/wp-content/uploads/2020/07/QSnatch-Data-Stealing-Malware-Infected-Over-62000-QNAP-NAS-Devices-80x60.jpg
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
www.tucloudserver.com
referer
https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 28 Sep 2021 05:22:33 GMT
last-modified
Tue, 28 Jul 2020 06:51:29 GMT
x-cdn-pop-ip
137.74.120.0/27
etag
"933-5ab7ade64dc2a"
x-cacheable
Cacheable
content-type
image/jpeg
cache-control
max-age=1800
x-cdn-pop
sbg
accept-ranges
bytes
content-length
2355
x-request-id
526321456
A-Visual-Take-on-Email-Authentication-and-Security-80x60.gif
www.tucloudserver.com/wp-content/uploads/2021/07/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.tucloudserver.com/wp-content/uploads/2021/07/A-Visual-Take-on-Email-Authentication-and-Security-80x60.gif
Requested by
Host: www.tucloudserver.com
URL: https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
46.105.201.91 , France, ASN16276 (OVH, FR),
Reverse DNS
Software
/
Resource Hash
1710934d47d6ee00c81885b87fd6aa238c69764df7f9c68a04a1e950266e825a

Request headers

:path
/wp-content/uploads/2021/07/A-Visual-Take-on-Email-Authentication-and-Security-80x60.gif
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
www.tucloudserver.com
referer
https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 28 Sep 2021 05:22:33 GMT
last-modified
Mon, 26 Jul 2021 11:31:21 GMT
x-cdn-pop-ip
137.74.120.0/27
etag
"a42-5c80517adc0bc"
x-cacheable
Cacheable
content-type
image/gif
cache-control
max-age=1800
x-cdn-pop
sbg
accept-ranges
bytes
content-length
2626
x-request-id
526321457
1539363823_Facebook-says-attackers-stole-details-from-29-million-users-80x60.
www.tucloudserver.com/wp-content/uploads/2018/10/ 		2 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.tucloudserver.com/wp-content/uploads/2018/10/1539363823_Facebook-says-attackers-stole-details-from-29-million-users-80x60.
Requested by
Host: www.tucloudserver.com
URL: https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
46.105.201.91 , France, ASN16276 (OVH, FR),
Reverse DNS
Software
/
Resource Hash
46910be144f63668241218c9975b1bf504a4469d28b385a01caf8dc2636c6bf1

Request headers

:path
/wp-content/uploads/2018/10/1539363823_Facebook-says-attackers-stole-details-from-29-million-users-80x60.
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
www.tucloudserver.com
referer
https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 28 Sep 2021 05:22:33 GMT
last-modified
Fri, 12 Oct 2018 17:03:44 GMT
x-cdn-pop-ip
137.74.120.0/27
etag
"977-5780b11e8dc00"
x-cacheable
Cacheable
cache-control
max-age=1800
x-cdn-pop
sbg
accept-ranges
bytes
content-length
2423
x-request-id
526321458
How-will-Semantic-Machines-and-its-conversational-engine-transform-Cortana-and-the-Bot-Framework-80x60.jpg
www.tucloudserver.com/wp-content/uploads/2019/07/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.tucloudserver.com/wp-content/uploads/2019/07/How-will-Semantic-Machines-and-its-conversational-engine-transform-Cortana-and-the-Bot-Framework-80x60.jpg
Requested by
Host: www.tucloudserver.com
URL: https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
46.105.201.91 , France, ASN16276 (OVH, FR),
Reverse DNS
Software
/
Resource Hash
2138b561a77266b6c6fc1850709ba52e2c58750822a52a740ba2f73ee3dbbfdf

Request headers

:path
/wp-content/uploads/2019/07/How-will-Semantic-Machines-and-its-conversational-engine-transform-Cortana-and-the-Bot-Framework-80x60.jpg
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
www.tucloudserver.com
referer
https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 28 Sep 2021 05:22:33 GMT
last-modified
Thu, 11 Jul 2019 11:58:54 GMT
x-cdn-pop-ip
137.74.120.0/27
etag
"797-58d6684939b80"
x-cacheable
Cacheable
content-type
image/jpeg
cache-control
max-age=1800
x-cdn-pop
sbg
accept-ranges
bytes
content-length
1943
x-request-id
526321459
How-to-avoid-a-disappearing-page-number-in-Microsoft-Word-80x60.jpg
www.tucloudserver.com/wp-content/uploads/2020/12/ 		2 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.tucloudserver.com/wp-content/uploads/2020/12/How-to-avoid-a-disappearing-page-number-in-Microsoft-Word-80x60.jpg
Requested by
Host: www.tucloudserver.com
URL: https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
46.105.201.91 , France, ASN16276 (OVH, FR),
Reverse DNS
Software
/
Resource Hash
249e359b467f0b70578bad7d27a8665cf5e41bdae25e7e817671f5cde0e7e152

Request headers

:path
/wp-content/uploads/2020/12/How-to-avoid-a-disappearing-page-number-in-Microsoft-Word-80x60.jpg
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
www.tucloudserver.com
referer
https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 28 Sep 2021 05:22:33 GMT
last-modified
Tue, 15 Dec 2020 04:40:06 GMT
x-cdn-pop-ip
137.74.120.0/27
etag
"95e-5b6795a542790"
x-cacheable
Cacheable
content-type
image/jpeg
cache-control
max-age=1800
x-cdn-pop
sbg
accept-ranges
bytes
content-length
2398
x-request-id
526321460
1538852902_Cybersecurity-investments-Why-ROI-calculations-may-not-tell-the-whole-story-80x60.jpg
www.tucloudserver.com/wp-content/uploads/2018/10/ 		2 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.tucloudserver.com/wp-content/uploads/2018/10/1538852902_Cybersecurity-investments-Why-ROI-calculations-may-not-tell-the-whole-story-80x60.jpg
Requested by
Host: www.tucloudserver.com
URL: https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
46.105.201.91 , France, ASN16276 (OVH, FR),
Reverse DNS
Software
/
Resource Hash
05bd227f744fc4c98b473a3ddbc585285bbeb50bf66c45966392b2a7b534dad2

Request headers

:path
/wp-content/uploads/2018/10/1538852902_Cybersecurity-investments-Why-ROI-calculations-may-not-tell-the-whole-story-80x60.jpg
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
www.tucloudserver.com
referer
https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 28 Sep 2021 05:22:33 GMT
last-modified
Sat, 06 Oct 2018 19:08:22 GMT
x-cdn-pop-ip
137.74.120.0/27
etag
"9f8-577941c95d580"
x-cacheable
Cacheable
content-type
image/jpeg
cache-control
max-age=1800
x-cdn-pop
sbg
accept-ranges
bytes
content-length
2552
x-request-id
526321461
New-SMS-malware-targets-Android-users-through-fake-COVID-messages-80x60.jpg
www.tucloudserver.com/wp-content/uploads/2021/09/ 		2 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.tucloudserver.com/wp-content/uploads/2021/09/New-SMS-malware-targets-Android-users-through-fake-COVID-messages-80x60.jpg
Requested by
Host: www.tucloudserver.com
URL: https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
46.105.201.91 , France, ASN16276 (OVH, FR),
Reverse DNS
Software
/
Resource Hash
8531aa93f4b62bb1a0348900c821b8d808e187ff798a4b1a8788536672e705ff

Request headers

:path
/wp-content/uploads/2021/09/New-SMS-malware-targets-Android-users-through-fake-COVID-messages-80x60.jpg
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
www.tucloudserver.com
referer
https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 28 Sep 2021 05:22:33 GMT
last-modified
Tue, 28 Sep 2021 03:00:37 GMT
x-cdn-pop-ip
137.74.120.0/27
etag
"97f-5cd056aff4adc"
x-cacheable
Cacheable
content-type
image/jpeg
cache-control
max-age=1800
x-cdn-pop
sbg
accept-ranges
bytes
content-length
2431
x-request-id
526321462
1537893719_Apple-iOS-12-Cheat-sheet-80x60.jpg
www.tucloudserver.com/wp-content/uploads/2018/09/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.tucloudserver.com/wp-content/uploads/2018/09/1537893719_Apple-iOS-12-Cheat-sheet-80x60.jpg
Requested by
Host: www.tucloudserver.com
URL: https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
46.105.201.91 , France, ASN16276 (OVH, FR),
Reverse DNS
Software
/
Resource Hash
ece7ed89228a902342b4e2c93b0b9fd66cdee4a094d2b5f07f3f53f1410fbefa

Request headers

:path
/wp-content/uploads/2018/09/1537893719_Apple-iOS-12-Cheat-sheet-80x60.jpg
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
www.tucloudserver.com
referer
https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 28 Sep 2021 05:22:33 GMT
last-modified
Tue, 25 Sep 2018 16:41:59 GMT
x-cdn-pop-ip
137.74.120.0/27
etag
"82a-576b4c8d2c3c0"
x-cacheable
Cacheable
content-type
image/jpeg
cache-control
max-age=1800
x-cdn-pop
sbg
accept-ranges
bytes
content-length
2090
x-request-id
526321463
1537897378_Why-mainframe-computing-is-still-relevant-10-benefits-to-your-business-80x60.jpg
www.tucloudserver.com/wp-content/uploads/2018/09/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.tucloudserver.com/wp-content/uploads/2018/09/1537897378_Why-mainframe-computing-is-still-relevant-10-benefits-to-your-business-80x60.jpg
Requested by
Host: www.tucloudserver.com
URL: https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
46.105.201.91 , France, ASN16276 (OVH, FR),
Reverse DNS
Software
/
Resource Hash
7f9a4eeb16633897d74c5bf7c376bc08e915489abc5f82fd8e500cba7d2bfa2c

Request headers

:path
/wp-content/uploads/2018/09/1537897378_Why-mainframe-computing-is-still-relevant-10-benefits-to-your-business-80x60.jpg
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
www.tucloudserver.com
referer
https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 28 Sep 2021 05:22:33 GMT
last-modified
Tue, 25 Sep 2018 17:42:58 GMT
x-cdn-pop-ip
137.74.120.0/27
etag
"8d7-576b5a2eaac80"
x-cacheable
Cacheable
content-type
image/jpeg
cache-control
max-age=1800
x-cdn-pop
sbg
accept-ranges
bytes
content-length
2263
x-request-id
526321464
1537901097_My-first-IT-job-TechRepublic-80x60.jpg
www.tucloudserver.com/wp-content/uploads/2018/09/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.tucloudserver.com/wp-content/uploads/2018/09/1537901097_My-first-IT-job-TechRepublic-80x60.jpg
Requested by
Host: www.tucloudserver.com
URL: https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
46.105.201.91 , France, ASN16276 (OVH, FR),
Reverse DNS
Software
/
Resource Hash
02c1c9ddf25168ce553505b5997942ef7aa9e9f2f2470014aeba80d48bb2d226

Request headers

:path
/wp-content/uploads/2018/09/1537901097_My-first-IT-job-TechRepublic-80x60.jpg
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
www.tucloudserver.com
referer
https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 28 Sep 2021 05:22:33 GMT
last-modified
Tue, 25 Sep 2018 18:44:57 GMT
x-cdn-pop-ip
137.74.120.0/27
etag
"a90-576b680961c40"
x-cacheable
Cacheable
content-type
image/jpeg
cache-control
max-age=1800
x-cdn-pop
sbg
accept-ranges
bytes
content-length
2704
x-request-id
526321465
collect
www.google-analytics.com/j/ 		2 B
211 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j93&a=1315899782&t=pageview&_s=1&dl=https%3A%2F%2Fwww.tucloudserver.com%2F2021%2F09%2F27%2Frussian-turla-apt-group-deploying-new-backdoor-on-targeted-systems%2F&ul=en-us&de=UTF-8&dt=Russian%20Turla%20APT%20Group%20Deploying%20New%20Backdoor%20on%20Targeted%20Systems%20%E2%80%93%20Tu%20Cloud%20Server&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAUABAAAAAC~&jid=1321462538&gjid=427661107&cid=111542808.1632806553&tid=UA-34803829-1&_gid=194192722.1632806553&_r=1&gtm=2ou9r0&did=dNDMyYj&z=1627020306
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:831::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.tucloudserver.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 28 Sep 2021 05:22:33 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.tucloudserver.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2
expires
Fri, 01 Jan 1990 00:00:00 GMT
sdk.js
connect.facebook.net/en_US/ 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://connect.facebook.net/en_US/sdk.js
Requested by
Host: www.tucloudserver.com
URL: https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f01c:216:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
5b73140259e53fa9c5ef520616b501e279bb5cad6ac35f3c57be61f18d128d68
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.tucloudserver.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; preload; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
content-md5
XSQQc/lFaMn3l1+f1OrDNg==
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=3600,h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length
1686
x-fb-rlafr
0
x-fb-debug
PcxEWJGrZmejOsc75v+r+KE4KRflFDdrkObKDkgIO3z3ovnInsUwhCxK7bLRKjVE2qK5vkskFoy5LmdtCm9j5w==
x-fb-trip-id
686109401
x-fb-content-md5
97a2832454fa4921b6c05d64f29938a1
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
DENY
date
Tue, 28 Sep 2021 05:22:33 GMT
vary
Accept-Encoding
content-type
application/x-javascript; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
X-FB-Content-MD5
cache-control
public,max-age=1200,stale-while-revalidate=3600
etag
"6707e83ccc06d4f2bb859ce4eb465bdf"
timing-allow-origin
*
priority
u=3,i
expires
Tue, 28 Sep 2021 05:36:48 GMT
collect
stats.g.doubleclick.net/j/ 		4 B
467 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j93&tid=UA-34803829-1&cid=111542808.1632806553&jid=1321462538&gjid=427661107&_gid=194192722.1632806553&_u=YEBAAUAAAAAAAC~&z=2068306521
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400c:c01::9d Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.tucloudserver.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
strict-transport-security
max-age=10886400; includeSubDomains; preload
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
date
Tue, 28 Sep 2021 05:22:33 GMT
content-type
text/plain
access-control-allow-origin
https://www.tucloudserver.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
4
expires
Fri, 01 Jan 1990 00:00:00 GMT
widget_iframe.f88235f49a156f8b4cab34c7bc1a0acc.html
platform.twitter.com/widgets/ Frame 0F65 		319 KB
103 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://platform.twitter.com/widgets/widget_iframe.f88235f49a156f8b4cab34c7bc1a0acc.html?origin=https%3A%2F%2Fwww.tucloudserver.com
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (frb/6724) /
Resource Hash
c6d03b7a5561687268e57b13d9d4a6a4c71ee570ea74718040ce9227676e3e5e

Request headers

Host
platform.twitter.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
iframe
Referer
https://www.tucloudserver.com/
Accept-Encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://www.tucloudserver.com/

Response headers

Content-Encoding
gzip
Access-Control-Allow-Methods
GET
Access-Control-Allow-Origin
*
Age
1236178
Cache-Control
public, max-age=315360000
Content-Type
text/html; charset=utf-8
Date
Tue, 28 Sep 2021 05:22:33 GMT
Etag
"8321d7cf58d70200c1423dfa0bca40f6+gzip"
Last-Modified
Mon, 02 Aug 2021 20:33:53 GMT
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server
ECS (frb/6724)
Vary
Accept-Encoding
X-Cache
HIT
x-tw-cdn
VZ
Content-Length
105433
300x250
static.a-ads.com/a-ads-banners/118229/ Frame 56BB 		682 KB
683 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://static.a-ads.com/a-ads-banners/118229/300x250?region=eu-central-1
Requested by
Host: ad.a-ads.com
URL: https://ad.a-ads.com/1007080?size=300x250
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
148.251.1.246 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.246.1.251.148.clients.your-server.de
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
b81d1d6dc8129dde051254463257a664dfe1bb49b78f0f4cd37dafbb3f960f93

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ad.a-ads.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date
Tue, 28 Sep 2021 05:22:33 GMT
Last-Modified
Sun, 26 Apr 2020 07:21:07 GMT
Server
nginx/1.18.0 (Ubuntu)
x-amz-request-id
VC23ZZ51WK52Y1QK
ETag
"ce8c5673a039ad9769d3265284d8f5f4"
Content-Type
image/gif
Cache-Control
max-age=315360000
Content-Length
698412
Connection
keep-alive
Accept-Ranges
bytes
x-amz-version-id
UQkZBCfcjGWdsi6lCz_51AvW3yIHMTsf
x-amz-id-2
q7xj8UmauMExib5ZlvhbLPMeI/RfU9uaJ3rVFp7SD7vCwYE7ByvwR1jjTKkir4tLPwteYnRjxCQ=
Expires
Thu, 31 Dec 2037 23:55:55 GMT
300x250
static.a-ads.com/a-ads-banners/103763/ Frame 64E4 		686 KB
687 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://static.a-ads.com/a-ads-banners/103763/300x250?region=eu-central-1
Requested by
Host: ad.a-ads.com
URL: https://ad.a-ads.com/1007080?size=300x250
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
148.251.1.246 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.246.1.251.148.clients.your-server.de
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
2191d31c59541b9c44346fde06c4e0ea2900c7ff88d084e8871ef13d2daa1326

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ad.a-ads.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date
Tue, 28 Sep 2021 05:22:33 GMT
Last-Modified
Fri, 27 Dec 2019 12:20:30 GMT
Server
nginx/1.18.0 (Ubuntu)
x-amz-request-id
DNQ9HJ0JWNENK9BQ
ETag
"28dd56aa4c3448923f2e06f6f90e1017"
Content-Type
image/gif
Cache-Control
max-age=315360000
Content-Length
702864
Connection
keep-alive
Accept-Ranges
bytes
x-amz-version-id
KIPQ8aj2AKbgfuqCDbQF8bZCjZrg7.Bd
x-amz-id-2
IqApmEy8NzIm5tcMavxQqZlmnazLibLARFM/D0i2Rkv+Ujggk3EpKU7hoJCuSzi3uutvenm530A=
Expires
Thu, 31 Dec 2037 23:55:55 GMT
sdk.js
connect.facebook.net/en_US/ 		269 KB
77 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://connect.facebook.net/en_US/sdk.js?hash=79abf8a598cc79ffd35e877d613a28b1
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/sdk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f01c:216:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
a54f1765dee568b4aeb4a509e1c5504b6a1a44f855dfc35e294bea92a1ad01c7
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

Referer
https://www.tucloudserver.com/
Origin
https://www.tucloudserver.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; preload; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
content-md5
W8WwbUwelRdVqGOkq//ZbA==
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=3600,h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length
77722
x-fb-rlafr
0
x-fb-debug
xdgm/Abke9Llya/8BqzJQdEsirijf5D5v6Qc+3Q+lFyIepQZiGy07lsx+tFJkEJ+aY5gqCeDByRaT91CNjGOCw==
x-fb-trip-id
686109401
x-fb-content-md5
c6a3c41a2449216162f886cc1d934986
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
DENY
date
Tue, 28 Sep 2021 05:22:33 GMT
vary
Accept-Encoding
content-type
application/x-javascript; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
X-FB-Content-MD5
cache-control
public,max-age=31536000,stale-while-revalidate=3600,immutable
etag
"d1446a73140314078c5f42907347fe21"
timing-allow-origin
*
priority
u=3,i
expires
Wed, 28 Sep 2022 01:14:05 GMT
ga-audiences
www.google.com/ads/ 		42 B
522 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j93&tid=UA-34803829-1&cid=111542808.1632806553&jid=1321462538&_u=YEBAAUAAAAAAAC~&z=1699030286
Requested by
Host: www.tucloudserver.com
URL: https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:827::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.tucloudserver.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 28 Sep 2021 05:22:33 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.de/ads/ 		42 B
522 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j93&tid=UA-34803829-1&cid=111542808.1632806553&jid=1321462538&_u=YEBAAUAAAAAAAC~&z=1699030286
Requested by
Host: www.tucloudserver.com
URL: https://www.tucloudserver.com/2021/09/27/russian-turla-apt-group-deploying-new-backdoor-on-targeted-systems/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.tucloudserver.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 28 Sep 2021 05:22:33 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
truncated
/ Frame 64E4 		305 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
95347f5a02237a0ff92fc87be7ad78f0fb44eebc125ffb61edc17da98a6d23d7

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ Frame 56BB 		305 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
95347f5a02237a0ff92fc87be7ad78f0fb44eebc125ffb61edc17da98a6d23d7

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Content-Type
image/png
settings
syndication.twitter.com/ Frame 0F65 		232 B
432 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://syndication.twitter.com/settings?session_id=f13acfaaf19cf772e1c1cdb358e27c3c459fa0c2
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/widgets/widget_iframe.f88235f49a156f8b4cab34c7bc1a0acc.html?origin=https%3A%2F%2Fwww.tucloudserver.com
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.136 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
726906ee6ce6dfe1b6e35ddad151196c50277e31520de30e916e9cd9affc0ef3
Security Headers
Name Value
Strict-Transport-Security max-age=631138519

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://platform.twitter.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 28 Sep 2021 05:22:32 GMT
content-encoding
gzip
last-modified
Tue, 28 Sep 2021 05:22:33 GMT
server
tsa_o
vary
Origin
strict-transport-security
max-age=631138519
content-type
application/json; charset=utf-8
access-control-allow-origin
https://platform.twitter.com
cache-control
must-revalidate, max-age=600
access-control-allow-credentials
true
x-connection-hash
547467827d65301351c710e0d8bd55c47af2c2f0765d3191daf7f17a9713b5c9
content-length
166

Verdicts & Comments Add Verdict or Comment

56 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 object| 3 object| onbeforexrselect boolean| originAgentCluster object| google_tag_manager object| dataLayer string| em_version boolean| em_track_user string| em_no_track_reason string| disableStr function| __gtagTrackerIsOptedOut function| __gtagTrackerOptout function| gaOptout function| __gtagTracker object| google_tag_data string| GoogleAnalyticsObject function| ga function| gtag function| __gaTracker object| _wpemojiSettings object| exactmetrics_frontend function| ExactMetrics object| ExactMetricsObject undefined| $ function| jQuery object| html5 object| Modernizr object| gaplugins object| gaGlobal object| gaData object| __twttrll object| twttr object| __twttr function| amazon_assoc_ir_f_call_associates_ads function| amazon_assoc_ir_f_call function| amzn_assoc_ad_spec_type object| amzn_assoc_ad_spec object| amzn_assoc_ad_async_spec object| adUnitDeliveryNetwork object| slotCounter function| cmManager object| amzn_assoc_cm boolean| amzn_assoc_enable_abs object| amzn_assoc_internal_params function| assocUtilsMaker object| amzn_assoc_utils object| nativeAdLayoutComputer object| amzn_assoc_ad object| blockedMarketPlacesJson object| blockedViewerCountriesJson object| wp boolean| _isScrolled object| FB object| twemoji

3 Cookies

Domain/Path Name / Value
.tucloudserver.com/ Name: _ga
Value: GA1.2.111542808.1632806553
.tucloudserver.com/ Name: _gid
Value: GA1.2.194192722.1632806553
.tucloudserver.com/ Name: _gat_gtag_UA_34803829_1
Value: 1

1 Console Messages

Source Level URL
Text
network error URL: https://www.fiboquantum.net/banners/728x90.gif
Message:
Failed to load resource: the server responded with a status of 404 (Not Found)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ad.a-ads.com
connect.facebook.net
fonts.googleapis.com
fonts.gstatic.com
platform.twitter.com
static.a-ads.com
stats.g.doubleclick.net
syndication.twitter.com
www.criptomercados.eu
www.fiboquantum.net
www.google-analytics.com
www.google.com
www.google.de
www.googletagmanager.com
www.time4vps.com
www.tucloudserver.com
z-na.amazon-adsystem.com
104.244.42.136
132.148.165.11
143.204.95.142
148.251.1.246
185.25.112.88
2606:2800:234:59:254c:406:2366:268c
2606:4700:10::6814:7d2e
2a00:1450:4001:810::2003
2a00:1450:4001:813::200a
2a00:1450:4001:827::2003
2a00:1450:4001:827::2004
2a00:1450:4001:830::2008
2a00:1450:4001:831::200e
2a00:1450:400c:c01::9d
2a03:2880:f01c:216:face:b00c:0:3
46.105.201.91
029e0a2e809fd6b5dbe76abe8b7a74936be306c9a8c27c814c4d44aa54623300
02c1c9ddf25168ce553505b5997942ef7aa9e9f2f2470014aeba80d48bb2d226
04dd5d8ce9ed508e57e1d3370214dee049d6fcadc1641ed4000e71ae471b0632
05bd227f744fc4c98b473a3ddbc585285bbeb50bf66c45966392b2a7b534dad2
1710934d47d6ee00c81885b87fd6aa238c69764df7f9c68a04a1e950266e825a
2138b561a77266b6c6fc1850709ba52e2c58750822a52a740ba2f73ee3dbbfdf
2191d31c59541b9c44346fde06c4e0ea2900c7ff88d084e8871ef13d2daa1326
249e359b467f0b70578bad7d27a8665cf5e41bdae25e7e817671f5cde0e7e152
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe
323ffc294ad745b5e095fe8d4f8c51289ab7c765b0d878108dd93783f9c167b2
40dd348a0a40e3117ce5a9b3d0fc49651749e4821c342e82b89039f4847b791d
412d8ca60006e1a8940523ef356e3c1367ad3a13a59c0a63ae2a4bb445414ad7
46910be144f63668241218c9975b1bf504a4469d28b385a01caf8dc2636c6bf1
4ce13b5c3f0bfc40cf5b3a4eefcdb7e687c4c4edeb3412ba57b90fef2fab8292
518a9d587bdaecdd96340e67db078e823ff43f9f23f2f0d9f0ceafe4cca72a0f
538dd4ff6e384a44155168326ac40a6c20a93cd212b1fbf88ae7b0c44f9ab0bd
5b73140259e53fa9c5ef520616b501e279bb5cad6ac35f3c57be61f18d128d68
5be614bce53f767993a5f5f14a6badd6aae6bf3af7cbdbf4d31520de49e27991
5ec8578bab0f92bd6d81243575284297db42b82d7e605613f4d9cadf4e7f744f
688a1e2444a1171a4cfbc8674c62d53bc663bf35a7825eb3563851e79694411c
726906ee6ce6dfe1b6e35ddad151196c50277e31520de30e916e9cd9affc0ef3
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
79f91fbbe681bf278b49bcd1f60c366b40b057d26b271f598959a9300ad6ed36
7abf50e8b9a4e1abed1eedb0afc0828f2dd637bdd9077f6e7a36e43df1e013ea
7f10769aade4d48a30fad3022dd47c351e0d4bb863b2d7290760ad1a8f07a059
7f9a4eeb16633897d74c5bf7c376bc08e915489abc5f82fd8e500cba7d2bfa2c
80aa1d8beb4753806b9a66ef6f53456fcdc065833e325c1d39d7b4894e158373
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
8531aa93f4b62bb1a0348900c821b8d808e187ff798a4b1a8788536672e705ff
898e474ff096c8984854cc7e8f3b4d3611cebb7e29a59f3e66429e88b29dc7bf
8db61f95a8f3554830efc6c3942b7322efef09b9d7f0cbfe32135e0fac106d18
8df7667db11a1cbae8ba0332258e0d3da3c26d2bab794bdcf8805df869482200
9110fc122dda3067c424d9b8ff7747e2030b0bd9298f69a3683d399ad3373a6a
935dab74871e52fa1c7d7a963f793fdb9b04da01f0b2a762dab146eca5e37b2c
95347f5a02237a0ff92fc87be7ad78f0fb44eebc125ffb61edc17da98a6d23d7
9a251f880dd4f90209fb54eefabc3f4a861d622237374b283bfeccc8f0e1a122
a18c8b71301dcd47cc8dd850af83110077476dfa33c4031ca523f6d8b981c0cc
a54f1765dee568b4aeb4a509e1c5504b6a1a44f855dfc35e294bea92a1ad01c7
b1fcb55b36ecaf34e55f2574abe157c873bcbb358e98e017c0aa733ffbdcebc4
b37aabcf47b6571242c758a28d17c3b8ceaf6ddd8c76b0156811a375bf48b5b6
b81d1d6dc8129dde051254463257a664dfe1bb49b78f0f4cd37dafbb3f960f93
bd4de6a3fc0fb68d6f76ba7b93514b96a92e585c295b5351c31ad92a4b0777ea
c6d03b7a5561687268e57b13d9d4a6a4c71ee570ea74718040ce9227676e3e5e
d1324967c9e1a3a0abd84ddfc5decf25194b59548e4927e71b63b9e739acfe59
d76d93c447eb952ebe33d26df61e486f0d05ecee74187dd613931f8853a41676
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
def5de6254be138b8b35d680d1fdd8b07827d03b8626daebfeeb4157ec330ea7
e3295f3b4091c690f71e917d46c6dafae4d6c89adf08c5210866deeadd6763a1
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ece7ed89228a902342b4e2c93b0b9fd66cdee4a094d2b5f07f3f53f1410fbefa
ecf4173f8b3465360fa7947982d1f7bae4e4e4b6d4f1693d33177314e4989ea9
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f4488fec2e44dc15d9d30f9022b8c8193df586784b600cdfd372aadd9f98fd08
fc623dc0180f2e1c28ed669fd980e77d7fe2f56c711005c693740f6dc3b17d11
fd222137f245c06ddb4c4d44db41f12138dad6cf8ef5d4d4a5e500f38f0c8c62