urlscan.io logo urlscan.io
SecurityTrails logo

prog.world Open in urlscan Pro
185.154.53.221  Public Scan

Go To Rescan Add Verdict Report
URL: https://prog.world/operation-ta505-part-two-learning-the-servhelper-backdoor-with-netsupport-rat/
Submission: On December 23 via api from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 11 IPs in 5 countries across 10 domains to perform 48 HTTP transactions. The main IP is 185.154.53.221, located in Russian Federation and belongs to EUROBYTE Eurobyte LLC, Moscow, Russia, RU. The main domain is prog.world.
TLS certificate: Issued by Let's Encrypt Authority X3 on October 27th 2019. Valid for: 3 months.
This is the only time prog.world was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
6 185.154.53.221 210079 (EUROBYTE ...)
10 192.0.77.37 2635 (AUTOMATTIC)
15 2a00:1450:400... 15169 (GOOGLE)
1 192.0.77.32 2635 (AUTOMATTIC)
4 192.0.76.3 2635 (AUTOMATTIC)
2 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
7 192.0.77.2 2635 (AUTOMATTIC)
1 23.210.248.189 16625 (AKAMAI-AS)
1 2a03:2880:f01... 32934 (FACEBOOK)
48 11
6    185.154.53.221 (Russian Federation)

ASN210079 (EUROBYTE Eurobyte LLC, Moscow, Russia, RU)
PTR: androidelf.com
prog.world
10    192.0.77.37 (San Francisco, United States)

ASN2635 (AUTOMATTIC - Automattic, Inc, US)
PTR: wordpress.com
c0.wp.com
15    2a00:1450:4001:81a::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)
pagead2.googlesyndication.com
adservice.google.com
googleads.g.doubleclick.net
www.googletagservices.com
1    192.0.77.32 (San Francisco, United States)

ASN2635 (AUTOMATTIC - Automattic, Inc, US)
PTR: wordpress.com
s0.wp.com
4    192.0.76.3 (San Francisco, United States)

ASN2635 (AUTOMATTIC - Automattic, Inc, US)
stats.wp.com
pixel.wp.com
2    2a00:1450:4001:80b::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)
www.google-analytics.com
1    2a00:1450:4001:825::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)
adservice.google.de
7    192.0.77.2 (San Francisco, United States)

ASN2635 (AUTOMATTIC - Automattic, Inc, US)
PTR: i1.wp.com
i0.wp.com
i1.wp.com
i2.wp.com
1    23.210.248.189 (Netherlands)

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a23-210-248-189.deploy.static.akamaitechnologies.com
api.pinterest.com
1    2a03:2880:f01c:800e:face:b00c:0:2 (Ireland)

ASN32934 (FACEBOOK - Facebook, Inc., US)
graph.facebook.com
Domain Requested by
10 googleads.g.doubleclick.net pagead2.googlesyndication.com
10 c0.wp.com prog.world
6 prog.world prog.world
5 i0.wp.com c0.wp.com
prog.world
3 pixel.wp.com prog.world
3 pagead2.googlesyndication.com prog.world
pagead2.googlesyndication.com
2 www.google-analytics.com prog.world
1 i2.wp.com prog.world
1 i1.wp.com prog.world
1 www.googletagservices.com pagead2.googlesyndication.com
1 graph.facebook.com c0.wp.com
1 api.pinterest.com c0.wp.com
1 adservice.google.com pagead2.googlesyndication.com
1 adservice.google.de pagead2.googlesyndication.com
1 stats.wp.com prog.world
1 s0.wp.com prog.world
48 16

This site contains no links.

Subject Issuer Validity Valid
prog.world
Let's Encrypt Authority X3		 2019-10-27 -
2020-01-25		 3 months crt.sh
*.wp.com
Go Daddy Secure Certificate Authority - G2		 2018-04-10 -
2020-05-11		 2 years crt.sh
*.g.doubleclick.net
GTS CA 1O1		 2019-12-03 -
2020-02-25		 3 months crt.sh
*.google-analytics.com
GTS CA 1O1		 2019-12-03 -
2020-02-25		 3 months crt.sh
*.google.com
GTS CA 1O1		 2019-12-03 -
2020-02-25		 3 months crt.sh
*.pinterest.com
DigiCert SHA2 High Assurance Server CA		 2019-06-05 -
2020-07-22		 a year crt.sh
*.facebook.com
DigiCert SHA2 High Assurance Server CA		 2019-12-06 -
2020-03-05		 3 months crt.sh

This page contains 11 frames:

Primary Page: https://prog.world/operation-ta505-part-two-learning-the-servhelper-backdoor-with-netsupport-rat/
Frame ID: 4E7C4664F3559CB14CAB370AC128415F
Requests: 40 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20191205/r20190131/zrt_lookup.html
Frame ID: 0907F8D5B2ADFB8CB09F39C4A7E428A4
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5162050706337438&output=html&adk=1812271804&adf=3025194257&lmt=1577143829&plat=1%3A32776%2C2%3A32776%2C8%3A134250504%2C9%3A134250504%2C16%3A8388608%2C30%3A1081344%2C40%3A32&guci=1.2.0.0.2.2.0.0&format=0x0&url=https%3A%2F%2Fprog.world%2Foperation-ta505-part-two-learning-the-servhelper-backdoor-with-netsupport-rat%2F&ea=0&flash=0&pra=5&wgl=1&adsid=NT&dt=1577143829152&bpp=17&bdt=213&fdt=165&idt=165&shv=r20191205&cbv=r20190131&saldr=aa&abxe=1&nras=1&correlator=2893777381193&frm=20&pv=2&ga_vid=860469706.1577143829&ga_sid=1577143829&ga_hid=1027772194&ga_fc=0&iag=0&icsg=2323694336&dssz=31&mdo=0&mso=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=1585&bih=1200&scr_x=0&scr_y=0&eid=21065126&oid=3&pvsid=3492012320294137&rx=0&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=16&bc=31&ifi=0&uci=a!0&fsb=1&dtd=180
Frame ID: 3191C458977841C8590A07414121416C
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5162050706337438&output=html&h=191&adk=1403717728&adf=3956329708&w=763&lmt=1577143829&num_ads=1&rafmt=16&sem=mc&pwprc=4051386031&psa=0&guci=1.2.0.0.2.2.0.0&ad_type=text_image&format=763x191&url=https%3A%2F%2Fprog.world%2Foperation-ta505-part-two-learning-the-servhelper-backdoor-with-netsupport-rat%2F&flash=0&pra=3&wgl=1&fa=27&adsid=NT&dt=1577143829444&bpp=4&bdt=505&fdt=4&idt=5&shv=r20191205&cbv=r20190131&saldr=aa&abxe=1&prev_fmts=0x0&nras=2&correlator=2893777381193&frm=20&pv=1&ga_vid=860469706.1577143829&ga_sid=1577143829&ga_hid=1027772194&ga_fc=0&iag=0&icsg=36683432704&dssz=31&mdo=0&mso=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=213&ady=1272&biw=1585&bih=1200&scr_x=0&scr_y=0&eid=21065126&oid=3&pvsid=3492012320294137&rx=0&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=16&bc=31&ifi=1&uci=a!1&btvi=1&fsb=1&xpc=S7zDdX5HUE&p=https%3A//prog.world&dtd=7
Frame ID: 2ADF991073B261F485004A4C90E8DE9A
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5162050706337438&output=html&h=191&adk=1403717728&adf=1943000707&w=763&lmt=1577143829&num_ads=1&rafmt=16&sem=mc&pwprc=4051386031&psa=0&guci=1.2.0.0.2.2.0.0&ad_type=text_image&format=763x191&url=https%3A%2F%2Fprog.world%2Foperation-ta505-part-two-learning-the-servhelper-backdoor-with-netsupport-rat%2F&flash=0&pra=3&wgl=1&fa=27&adsid=NT&dt=1577143829458&bpp=2&bdt=519&fdt=3&idt=3&shv=r20191205&cbv=r20190131&saldr=aa&abxe=1&prev_fmts=0x0%2C763x191&nras=3&correlator=2893777381193&frm=20&pv=1&ga_vid=860469706.1577143829&ga_sid=1577143829&ga_hid=1027772194&ga_fc=0&iag=0&icsg=174122386176&dssz=32&mdo=0&mso=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=213&ady=1640&biw=1585&bih=1200&scr_x=0&scr_y=0&eid=21065126&oid=3&pvsid=3492012320294137&rx=0&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=16&bc=31&ifi=2&uci=a!2&btvi=2&fsb=1&xpc=q6hJFGiXUP&p=https%3A//prog.world&dtd=5
Frame ID: 8BD3146F90229108D85DB2449D87B7E9
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5162050706337438&output=html&h=191&adk=1403717728&adf=2464618102&w=763&lmt=1577143829&num_ads=1&rafmt=16&sem=mc&pwprc=4051386031&psa=0&guci=1.2.0.0.2.2.0.0&ad_type=text_image&format=763x191&url=https%3A%2F%2Fprog.world%2Foperation-ta505-part-two-learning-the-servhelper-backdoor-with-netsupport-rat%2F&flash=0&pra=3&wgl=1&fa=27&adsid=NT&dt=1577143829469&bpp=3&bdt=530&fdt=4&idt=4&shv=r20191205&cbv=r20190131&saldr=aa&abxe=1&prev_fmts=0x0%2C763x191%2C763x191&nras=4&correlator=2893777381193&frm=20&pv=1&ga_vid=860469706.1577143829&ga_sid=1577143829&ga_hid=1027772194&ga_fc=0&iag=0&icsg=174122386176&dssz=32&mdo=0&mso=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=213&ady=2535&biw=1585&bih=1200&scr_x=0&scr_y=0&eid=21065126&oid=3&pvsid=3492012320294137&rx=0&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=16&bc=31&ifi=3&uci=a!3&btvi=3&fsb=1&xpc=9Qaa4lM2QX&p=https%3A//prog.world&dtd=6
Frame ID: F7D7366F8CBC5B29669893825861A085
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5162050706337438&output=html&h=191&adk=1403717728&adf=1107306155&w=763&lmt=1577143829&num_ads=1&rafmt=16&sem=mc&pwprc=4051386031&psa=0&guci=1.2.0.0.2.2.0.0&ad_type=text_image&format=763x191&url=https%3A%2F%2Fprog.world%2Foperation-ta505-part-two-learning-the-servhelper-backdoor-with-netsupport-rat%2F&flash=0&pra=3&wgl=1&fa=27&adsid=NT&dt=1577143829479&bpp=3&bdt=540&fdt=4&idt=4&shv=r20191205&cbv=r20190131&saldr=aa&abxe=1&prev_fmts=0x0%2C763x191%2C763x191%2C763x191&nras=5&correlator=2893777381193&frm=20&pv=1&ga_vid=860469706.1577143829&ga_sid=1577143829&ga_hid=1027772194&ga_fc=0&iag=0&icsg=174122386176&dssz=32&mdo=0&mso=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=213&ady=2926&biw=1585&bih=1200&scr_x=0&scr_y=0&eid=21065126&oid=3&pvsid=3492012320294137&rx=0&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=16&bc=31&ifi=4&uci=a!4&btvi=4&fsb=1&xpc=fds5aq7sPb&p=https%3A//prog.world&dtd=6
Frame ID: 0701F63D0100334465FB1EBFCCEF4B46
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5162050706337438&output=html&h=191&adk=1403717728&adf=3119124659&w=763&lmt=1577143829&num_ads=1&rafmt=16&sem=mc&pwprc=4051386031&psa=0&guci=1.2.0.0.2.2.0.0&ad_type=text_image&format=763x191&url=https%3A%2F%2Fprog.world%2Foperation-ta505-part-two-learning-the-servhelper-backdoor-with-netsupport-rat%2F&flash=0&pra=3&wgl=1&fa=27&adsid=NT&dt=1577143829490&bpp=4&bdt=551&fdt=4&idt=4&shv=r20191205&cbv=r20190131&saldr=aa&abxe=1&prev_fmts=0x0%2C763x191%2C763x191%2C763x191%2C763x191&nras=6&correlator=2893777381193&frm=20&pv=1&ga_vid=860469706.1577143829&ga_sid=1577143829&ga_hid=1027772194&ga_fc=0&iag=0&icsg=174122386176&dssz=32&mdo=0&mso=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=213&ady=3497&biw=1585&bih=1200&scr_x=0&scr_y=0&eid=21065126&oid=3&pvsid=3492012320294137&rx=0&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=16&bc=31&ifi=5&uci=a!5&btvi=5&fsb=1&xpc=gXN5luqPKJ&p=https%3A//prog.world&dtd=7
Frame ID: 4A3277B979E0C516B53C6034F27940B8
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5162050706337438&output=html&h=191&adk=1403717728&adf=3021755706&w=763&lmt=1577143829&num_ads=1&rafmt=16&sem=mc&pwprc=4051386031&psa=0&guci=1.2.0.0.2.2.0.0&ad_type=text_image&format=763x191&url=https%3A%2F%2Fprog.world%2Foperation-ta505-part-two-learning-the-servhelper-backdoor-with-netsupport-rat%2F&flash=0&pra=3&wgl=1&fa=27&adsid=NT&dt=1577143829502&bpp=4&bdt=563&fdt=4&idt=5&shv=r20191205&cbv=r20190131&saldr=aa&abxe=1&prev_fmts=0x0%2C763x191%2C763x191%2C763x191%2C763x191%2C763x191&nras=7&correlator=2893777381193&frm=20&pv=1&ga_vid=860469706.1577143829&ga_sid=1577143829&ga_hid=1027772194&ga_fc=0&iag=0&icsg=174122386176&dssz=32&mdo=0&mso=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=213&ady=4293&biw=1585&bih=1200&scr_x=0&scr_y=0&eid=21065126&oid=3&pvsid=3492012320294137&rx=0&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=16&bc=31&ifi=6&uci=a!6&btvi=6&fsb=1&xpc=cDKLTj77Xy&p=https%3A//prog.world&dtd=7
Frame ID: 21EA6EB89667C10BF9D85AD1AFF4D1EC
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5162050706337438&output=html&h=191&adk=1403717728&adf=969266763&w=763&lmt=1577143829&num_ads=1&rafmt=16&sem=mc&pwprc=4051386031&psa=0&guci=1.2.0.0.2.2.0.0&ad_type=text_image&format=763x191&url=https%3A%2F%2Fprog.world%2Foperation-ta505-part-two-learning-the-servhelper-backdoor-with-netsupport-rat%2F&flash=0&pra=3&wgl=1&fa=27&adsid=NT&dt=1577143829514&bpp=3&bdt=575&fdt=4&idt=4&shv=r20191205&cbv=r20190131&saldr=aa&abxe=1&prev_fmts=0x0%2C763x191%2C763x191%2C763x191%2C763x191%2C763x191%2C763x191&nras=8&correlator=2893777381193&frm=20&pv=1&ga_vid=860469706.1577143829&ga_sid=1577143829&ga_hid=1027772194&ga_fc=0&iag=0&icsg=174122386176&dssz=32&mdo=0&mso=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=213&ady=5230&biw=1585&bih=1200&scr_x=0&scr_y=0&eid=21065126&oid=3&pvsid=3492012320294137&rx=0&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=16&bc=31&ifi=7&uci=a!7&btvi=7&fsb=1&xpc=QGMiGQi9w4&p=https%3A//prog.world&dtd=6
Frame ID: BA81EDF271D997AC8278A07518E1C51D
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5162050706337438&output=html&h=191&adk=1403717728&adf=3635304540&w=763&lmt=1577143829&num_ads=1&rafmt=16&sem=mc&pwprc=4051386031&psa=0&guci=1.2.0.0.2.2.0.0&ad_type=text_image&format=763x191&url=https%3A%2F%2Fprog.world%2Foperation-ta505-part-two-learning-the-servhelper-backdoor-with-netsupport-rat%2F&flash=0&pra=3&wgl=1&fa=27&adsid=NT&dt=1577143829524&bpp=3&bdt=586&fdt=3&idt=3&shv=r20191205&cbv=r20190131&saldr=aa&abxe=1&prev_fmts=0x0%2C763x191%2C763x191%2C763x191%2C763x191%2C763x191%2C763x191%2C763x191&nras=9&correlator=2893777381193&frm=20&pv=1&ga_vid=860469706.1577143829&ga_sid=1577143829&ga_hid=1027772194&ga_fc=0&iag=0&icsg=174122386176&dssz=32&mdo=0&mso=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=213&ady=6052&biw=1585&bih=1200&scr_x=0&scr_y=0&eid=21065126&oid=3&pvsid=3492012320294137&rx=0&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=16&bc=31&ifi=8&uci=a!8&btvi=8&fsb=1&xpc=BVgQiJIbz1&p=https%3A//prog.world&dtd=5
Frame ID: 524DB42F44E6569C62B34B07BD28EB79
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Detected technologies

Overall confidence: 100%
Detected patterns
  • html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
  • html /<link[^>]+s\d+\.wp\.com/i
  • headers link /rel="https:\/\/api\.w\.org\/"/i
Overall confidence: 100%
Detected patterns
  • html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
  • html /<link[^>]+s\d+\.wp\.com/i
  • headers link /rel="https:\/\/api\.w\.org\/"/i
Overall confidence: 100%
Detected patterns
  • html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
  • html /<link[^>]+s\d+\.wp\.com/i
  • headers link /rel="https:\/\/api\.w\.org\/"/i
Overall confidence: 100%
Detected patterns
  • headers server /nginx(?:\/([\d.]+))?/i
Overall confidence: 100%
Detected patterns
  • script /react.*\.js/i
Overall confidence: 100%
Detected patterns
  • script /googlesyndication\.com\//i

Page Statistics

48
Requests

100 %
HTTPS

40 %
IPv6

10
Domains

16
Subdomains

11
IPs

5
Countries

807 kB
Transfer

1821 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

48 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request Cookie set /
prog.world/operation-ta505-part-two-learning-the-servhelper-backdoor-with-netsupport-rat/ 		136 KB
30 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://prog.world/operation-ta505-part-two-learning-the-servhelper-backdoor-with-netsupport-rat/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
185.154.53.221 , Russian Federation, ASN210079 (EUROBYTE Eurobyte LLC, Moscow, Russia, RU),
Reverse DNS
androidelf.com
Software
nginx /
Resource Hash
85778e9fbfde68948ea3cd7487a809bd3e33bea16c89a7183a8b63dfdaaac616

Request headers

Host
prog.world
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-User
?1
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site
none
Sec-Fetch-Mode
navigate
Accept-Encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-User
?1

Response headers

Server
nginx
Date
Mon, 23 Dec 2019 23:30:28 GMT
Content-Type
text/html; charset=UTF-8
Transfer-Encoding
chunked
Connection
keep-alive
Keep-Alive
timeout=60
Expires
Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control
no-store, no-cache, must-revalidate
Pragma
no-cache
X-Pingback
https://prog.world/xmlrpc.php
Link
<https://prog.world/wp-json/>; rel="https://api.w.org/", <https://prog.world/?p=4520>; rel=shortlink
Set-Cookie
PHPSESSID=2vontk25abiljhinejkg8goieo; path=/
Vary
Accept-Encoding,User-Agent
Content-Encoding
gzip
style.min.css
c0.wp.com/c/5.3.2/wp-includes/css/dist/block-library/ 		40 KB
6 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://c0.wp.com/c/5.3.2/wp-includes/css/dist/block-library/style.min.css
Requested by
Host: prog.world
URL: https://prog.world/operation-ta505-part-two-learning-the-servhelper-backdoor-with-netsupport-rat/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.37 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
d9662b4b9ba6c2c3691ce0acd4572e027366eb97d6070550a13429262bb0037f
Security Headers
Name Value
Strict-Transport-Security max-age=15552000

Request headers

Referer
https://prog.world/operation-ta505-part-two-learning-the-servhelper-backdoor-with-netsupport-rat/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-nc
HIT ams 1
date
Mon, 23 Dec 2019 23:30:28 GMT
content-encoding
br
last-modified
Tue, 05 Nov 2019 22:06:04 GMT
server
nginx
vary
Accept-Encoding
content-type
text/css
status
200
cache-control
max-age=31536000
strict-transport-security
max-age=15552000
expires
Tue, 22 Dec 2020 23:30:28 GMT
9jnzq.css
prog.world/wp-content/cache/wpfc-minified/10o5mo21/ 		288 KB
40 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://prog.world/wp-content/cache/wpfc-minified/10o5mo21/9jnzq.css
Requested by
Host: prog.world
URL: https://prog.world/operation-ta505-part-two-learning-the-servhelper-backdoor-with-netsupport-rat/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
185.154.53.221 , Russian Federation, ASN210079 (EUROBYTE Eurobyte LLC, Moscow, Russia, RU),
Reverse DNS
androidelf.com
Software
nginx /
Resource Hash
2e9b800440481e8cf5c37b772cffd536c456a152e92e87f9fda1852134be280b

Request headers

Referer
https://prog.world/operation-ta505-part-two-learning-the-servhelper-backdoor-with-netsupport-rat/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 23 Dec 2019 23:30:28 GMT
Content-Encoding
br
Last-Modified
Mon, 11 Nov 2019 20:35:52 GMT
Server
nginx
ETag
W/"5dc9c628-47eea"
Transfer-Encoding
chunked
Content-Type
text/css
Cache-Control
max-age=315360000
Connection
keep-alive
Keep-Alive
timeout=60
Expires
Thu, 31 Dec 2037 23:55:55 GMT
social-logos.min.css
c0.wp.com/p/jetpack/7.9.1/_inc/social-logos/ 		26 KB
18 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://c0.wp.com/p/jetpack/7.9.1/_inc/social-logos/social-logos.min.css
Requested by
Host: prog.world
URL: https://prog.world/operation-ta505-part-two-learning-the-servhelper-backdoor-with-netsupport-rat/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.37 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
2e1ced1bd0736a56a0c44fd7b3bf8134850398ecddd52a0f5e6e437c5d527999
Security Headers
Name Value
Strict-Transport-Security max-age=15552000

Request headers

Referer
https://prog.world/operation-ta505-part-two-learning-the-servhelper-backdoor-with-netsupport-rat/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-nc
HIT ams 1
date
Mon, 23 Dec 2019 23:30:28 GMT
content-encoding
br
last-modified
Wed, 27 Jun 2018 01:03:44 GMT
server
nginx
vary
Accept-Encoding
content-type
text/css
status
200
cache-control
max-age=31536000
strict-transport-security
max-age=15552000
expires
Tue, 22 Dec 2020 23:30:28 GMT
jetpack.css
c0.wp.com/p/jetpack/7.9.1/css/ 		70 KB
12 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://c0.wp.com/p/jetpack/7.9.1/css/jetpack.css
Requested by
Host: prog.world
URL: https://prog.world/operation-ta505-part-two-learning-the-servhelper-backdoor-with-netsupport-rat/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.37 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
068e2f18d47e3c6e38eee71beaa5d568af8a7729e5f2be2c4be47eafb4e458de
Security Headers
Name Value
Strict-Transport-Security max-age=15552000

Request headers

Referer
https://prog.world/operation-ta505-part-two-learning-the-servhelper-backdoor-with-netsupport-rat/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-nc
HIT ams 1
date
Mon, 23 Dec 2019 23:30:28 GMT
content-encoding
br
last-modified
Tue, 22 Oct 2019 15:04:13 GMT
server
nginx
vary
Accept-Encoding
content-type
text/css
status
200
cache-control
max-age=31536000
strict-transport-security
max-age=15552000
expires
Tue, 22 Dec 2020 23:30:28 GMT
adsbygoogle.js
pagead2.googlesyndication.com/pagead/js/ 		104 KB
37 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js
Requested by
Host: prog.world
URL: https://prog.world/operation-ta505-part-two-learning-the-servhelper-backdoor-with-netsupport-rat/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
68bcdec2fdc6ce23468b97a8c39a3f9eb86233e03be5072bf3b438ac1433714d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://prog.world/operation-ta505-part-two-learning-the-servhelper-backdoor-with-netsupport-rat/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 23 Dec 2019 23:30:28 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
37933
x-xss-protection
0
server
cafe
etag
2924851815849280674
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600
timing-allow-origin
*
expires
Mon, 23 Dec 2019 23:30:28 GMT
devicepx-jetpack.js
s0.wp.com/wp-content/js/ 		10 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s0.wp.com/wp-content/js/devicepx-jetpack.js?ver=201952
Requested by
Host: prog.world
URL: https://prog.world/operation-ta505-part-two-learning-the-servhelper-backdoor-with-netsupport-rat/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
f32d41f2099a0be20e6b57c5e0d1b71c079d3e1345827b0f5c5b97c6e5e3f78d

Request headers

Referer
https://prog.world/operation-ta505-part-two-learning-the-servhelper-backdoor-with-netsupport-rat/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-nc
HIT ams 1
date
Mon, 23 Dec 2019 23:30:28 GMT
content-encoding
gzip
server
nginx
etag
W/"5c32dc59-52b6"
vary
Accept-Encoding
content-type
application/x-javascript
status
200
cache-control
max-age=31536000
x-ac
3.ams _dfw
expires
Mon, 21 Dec 2020 07:46:20 GMT
jquery.js
c0.wp.com/c/5.3.2/wp-includes/js/jquery/ 		95 KB
32 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://c0.wp.com/c/5.3.2/wp-includes/js/jquery/jquery.js
Requested by
Host: prog.world
URL: https://prog.world/operation-ta505-part-two-learning-the-servhelper-backdoor-with-netsupport-rat/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.37 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
1db21d816296e6939ba1f42962496e4134ae2b0081e26970864c40c6d02bb1df
Security Headers
Name Value
Strict-Transport-Security max-age=15552000

Request headers

Referer
https://prog.world/operation-ta505-part-two-learning-the-servhelper-backdoor-with-netsupport-rat/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-nc
HIT ams 1
date
Mon, 23 Dec 2019 23:30:28 GMT
content-encoding
br
last-modified
Fri, 17 May 2019 04:25:54 GMT
server
nginx
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
max-age=31536000
strict-transport-security
max-age=15552000
expires
Tue, 22 Dec 2020 23:30:28 GMT
jquery-migrate.min.js
c0.wp.com/c/5.3.2/wp-includes/js/jquery/ 		10 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://c0.wp.com/c/5.3.2/wp-includes/js/jquery/jquery-migrate.min.js
Requested by
Host: prog.world
URL: https://prog.world/operation-ta505-part-two-learning-the-servhelper-backdoor-with-netsupport-rat/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.37 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
48eb8b500ae6a38617b5738d2b3faec481922a7782246e31d2755c034a45cd5d
Security Headers
Name Value
Strict-Transport-Security max-age=15552000

Request headers

Referer
https://prog.world/operation-ta505-part-two-learning-the-servhelper-backdoor-with-netsupport-rat/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-nc
HIT ams 1
date
Mon, 23 Dec 2019 23:30:28 GMT
content-encoding
br
last-modified
Fri, 20 May 2016 06:11:28 GMT
server
nginx
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
max-age=31536000
strict-transport-security
max-age=15552000
expires
Tue, 22 Dec 2020 23:30:28 GMT
9jnzq.js
prog.world/wp-content/cache/wpfc-minified/1gki5f3y/ 		836 B
608 B 		Script
General
Check archive.org
Download Go to
Full URL
https://prog.world/wp-content/cache/wpfc-minified/1gki5f3y/9jnzq.js
Requested by
Host: prog.world
URL: https://prog.world/operation-ta505-part-two-learning-the-servhelper-backdoor-with-netsupport-rat/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
185.154.53.221 , Russian Federation, ASN210079 (EUROBYTE Eurobyte LLC, Moscow, Russia, RU),
Reverse DNS
androidelf.com
Software
nginx /
Resource Hash
15af8314f4d93f6768e3fb9a0009475fc9b32c216a52097e944ef70488c8a43d

Request headers

Referer
https://prog.world/operation-ta505-part-two-learning-the-servhelper-backdoor-with-netsupport-rat/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 23 Dec 2019 23:30:29 GMT
Content-Encoding
br
Last-Modified
Mon, 11 Nov 2019 20:35:52 GMT
Server
nginx
ETag
W/"5dc9c628-344"
Transfer-Encoding
chunked
Content-Type
application/javascript
Cache-Control
max-age=315360000
Connection
keep-alive
Keep-Alive
timeout=60
Expires
Thu, 31 Dec 2037 23:55:55 GMT
photon.min.js
c0.wp.com/p/jetpack/7.9.1/_inc/build/photon/ 		755 B
397 B 		Script
General
Check archive.org
Download Go to
Full URL
https://c0.wp.com/p/jetpack/7.9.1/_inc/build/photon/photon.min.js
Requested by
Host: prog.world
URL: https://prog.world/operation-ta505-part-two-learning-the-servhelper-backdoor-with-netsupport-rat/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.37 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
dc844732bd61279e509bda7247ed7fca55e5fced96db9c79eed48ca084e5ce0a
Security Headers
Name Value
Strict-Transport-Security max-age=15552000

Request headers

Referer
https://prog.world/operation-ta505-part-two-learning-the-servhelper-backdoor-with-netsupport-rat/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-nc
HIT ams 1
date
Mon, 23 Dec 2019 23:30:28 GMT
content-encoding
br
last-modified
Tue, 22 Oct 2019 15:04:13 GMT
server
nginx
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
max-age=31536000
strict-transport-security
max-age=15552000
expires
Tue, 22 Dec 2020 23:30:28 GMT
comment-reply.min.js
c0.wp.com/c/5.3.2/wp-includes/js/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://c0.wp.com/c/5.3.2/wp-includes/js/comment-reply.min.js
Requested by
Host: prog.world
URL: https://prog.world/operation-ta505-part-two-learning-the-servhelper-backdoor-with-netsupport-rat/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.37 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
73eb139b1371aed55b1dce74b7258f2d90991c5294d69fce852c3eed1af40068
Security Headers
Name Value
Strict-Transport-Security max-age=15552000

Request headers

Referer
https://prog.world/operation-ta505-part-two-learning-the-servhelper-backdoor-with-netsupport-rat/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-nc
HIT ams 1
date
Mon, 23 Dec 2019 23:30:28 GMT
content-encoding
br
last-modified
Mon, 11 Nov 2019 16:59:02 GMT
server
nginx
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
max-age=31536000
strict-transport-security
max-age=15552000
expires
Tue, 22 Dec 2020 23:30:28 GMT
9jnzq.js
prog.world/wp-content/cache/wpfc-minified/qha0rw1g/ 		128 KB
33 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://prog.world/wp-content/cache/wpfc-minified/qha0rw1g/9jnzq.js
Requested by
Host: prog.world
URL: https://prog.world/operation-ta505-part-two-learning-the-servhelper-backdoor-with-netsupport-rat/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
185.154.53.221 , Russian Federation, ASN210079 (EUROBYTE Eurobyte LLC, Moscow, Russia, RU),
Reverse DNS
androidelf.com
Software
nginx /
Resource Hash
fa2a1251e9904e2e8c67008d34a213b2f4c73e4710858140916581189da6b6c3

Request headers

Referer
https://prog.world/operation-ta505-part-two-learning-the-servhelper-backdoor-with-netsupport-rat/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 23 Dec 2019 23:30:29 GMT
Content-Encoding
br
Last-Modified
Mon, 11 Nov 2019 20:35:52 GMT
Server
nginx
ETag
W/"5dc9c628-1fed9"
Transfer-Encoding
chunked
Content-Type
application/javascript
Cache-Control
max-age=315360000
Connection
keep-alive
Keep-Alive
timeout=60
Expires
Thu, 31 Dec 2037 23:55:55 GMT
lazy-images.min.js
c0.wp.com/p/jetpack/7.9.1/_inc/build/lazy-images/js/ 		9 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://c0.wp.com/p/jetpack/7.9.1/_inc/build/lazy-images/js/lazy-images.min.js
Requested by
Host: prog.world
URL: https://prog.world/operation-ta505-part-two-learning-the-servhelper-backdoor-with-netsupport-rat/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.37 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
4c2d889ee46270fb2ae51c5ef8804efb7f03b4d5f2ab24a9fdd7a6400f75ea6c
Security Headers
Name Value
Strict-Transport-Security max-age=15552000

Request headers

Referer
https://prog.world/operation-ta505-part-two-learning-the-servhelper-backdoor-with-netsupport-rat/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-nc
HIT ams 1
date
Mon, 23 Dec 2019 23:30:29 GMT
content-encoding
br
last-modified
Fri, 21 Jun 2019 10:15:39 GMT
server
nginx
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
max-age=31536000
strict-transport-security
max-age=15552000
expires
Tue, 22 Dec 2020 23:30:29 GMT
wp-embed.min.js
c0.wp.com/c/5.3.2/wp-includes/js/ 		1 KB
698 B 		Script
General
Check archive.org
Download Go to
Full URL
https://c0.wp.com/c/5.3.2/wp-includes/js/wp-embed.min.js
Requested by
Host: prog.world
URL: https://prog.world/operation-ta505-part-two-learning-the-servhelper-backdoor-with-netsupport-rat/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.37 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
0284cbccebf1682452d62d06efa3665c874d642d4e03f5f5f9bb0f555da9251b
Security Headers
Name Value
Strict-Transport-Security max-age=15552000

Request headers

Referer
https://prog.world/operation-ta505-part-two-learning-the-servhelper-backdoor-with-netsupport-rat/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-nc
HIT ams 1
date
Mon, 23 Dec 2019 23:30:29 GMT
content-encoding
br
last-modified
Sat, 05 Oct 2019 19:49:10 GMT
server
nginx
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
max-age=31536000
strict-transport-security
max-age=15552000
expires
Tue, 22 Dec 2020 23:30:29 GMT
sharing.min.js
c0.wp.com/p/jetpack/7.9.1/_inc/build/sharedaddy/ 		8 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://c0.wp.com/p/jetpack/7.9.1/_inc/build/sharedaddy/sharing.min.js
Requested by
Host: prog.world
URL: https://prog.world/operation-ta505-part-two-learning-the-servhelper-backdoor-with-netsupport-rat/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.37 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
1e99034e4b75a1fb7ba372a3a950fa19ff4688d8561479b1a34dfcbde83ff3d8
Security Headers
Name Value
Strict-Transport-Security max-age=15552000

Request headers

Referer
https://prog.world/operation-ta505-part-two-learning-the-servhelper-backdoor-with-netsupport-rat/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-nc
HIT ams 1
date
Mon, 23 Dec 2019 23:30:28 GMT
content-encoding
br
last-modified
Tue, 27 Aug 2019 13:22:22 GMT
server
nginx
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
max-age=31536000
strict-transport-security
max-age=15552000
expires
Tue, 22 Dec 2020 23:30:28 GMT
e-201952.js
stats.wp.com/ 		9 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://stats.wp.com/e-201952.js
Requested by
Host: prog.world
URL: https://prog.world/operation-ta505-part-two-learning-the-servhelper-backdoor-with-netsupport-rat/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
Software
nginx /
Resource Hash
0ebbc7fba9a50d36ef5422345f624431710db4528f25749d1d438c2c10bb69f2

Request headers

Referer
https://prog.world/operation-ta505-part-two-learning-the-servhelper-backdoor-with-netsupport-rat/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 23 Dec 2019 23:30:29 GMT
content-encoding
gzip
server
nginx
etag
W/"5c6340e3-350a"
vary
Accept-Encoding
content-type
application/x-javascript
status
200
cache-control
max-age=31536000
expires
Mon, 21 Dec 2020 07:46:21 GMT
analytics.js
www.google-analytics.com/ 		43 KB
17 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: prog.world
URL: https://prog.world/operation-ta505-part-two-learning-the-servhelper-backdoor-with-netsupport-rat/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
dbb67c620eaabf6679a314db18d3ae43037aef71ab27422e6feec08ee987cc0a
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://prog.world/operation-ta505-part-two-learning-the-servhelper-backdoor-with-netsupport-rat/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Mon, 19 Aug 2019 17:22:41 GMT
server
Golfe2
age
3412
date
Mon, 23 Dec 2019 22:33:37 GMT
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=7200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
17803
expires
Tue, 24 Dec 2019 00:33:37 GMT
truncated
/ 		42 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/gif
ui-icomoon.ttf
prog.world/wp-content/themes/boombox/scss/icon-fonts/fonts/ 		52 KB
52 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://prog.world/wp-content/themes/boombox/scss/icon-fonts/fonts/ui-icomoon.ttf?18mp9r
Requested by
Host: prog.world
URL: https://prog.world/operation-ta505-part-two-learning-the-servhelper-backdoor-with-netsupport-rat/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
185.154.53.221 , Russian Federation, ASN210079 (EUROBYTE Eurobyte LLC, Moscow, Russia, RU),
Reverse DNS
androidelf.com
Software
nginx /
Resource Hash
3d7821112c3598b05a3a7912dfad318e1889152293d705903b3e1708d6d7361a

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer
https://prog.world/wp-content/cache/wpfc-minified/10o5mo21/9jnzq.css
Origin
https://prog.world

Response headers

Date
Mon, 23 Dec 2019 23:30:29 GMT
Last-Modified
Sat, 25 May 2019 19:34:42 GMT
Server
nginx
ETag
"5ce998d2-ce60"
Content-Type
application/octet-stream
Cache-Control
max-age=315360000
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=60
Content-Length
52832
Expires
Thu, 31 Dec 2037 23:55:55 GMT
truncated
/ 		18 KB
18 KB 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
895964971ebdb56ee76d08850bcb4c5a88ec4c65e6a235882304e8ff6767cd7c

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Origin
https://prog.world

Response headers

Content-Type
application/font-woff;charset=utf-8
integrator.js
adservice.google.de/adsid/ 		109 B
171 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adservice.google.de/adsid/integrator.js?domain=prog.world
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:825::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://prog.world/operation-ta505-part-two-learning-the-servhelper-backdoor-with-netsupport-rat/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 23 Dec 2019 23:30:29 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-type
application/javascript; charset=UTF-8
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
104
x-xss-protection
0
integrator.js
adservice.google.com/adsid/ 		109 B
171 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adservice.google.com/adsid/integrator.js?domain=prog.world
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://prog.world/operation-ta505-part-two-learning-the-servhelper-backdoor-with-netsupport-rat/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 23 Dec 2019 23:30:29 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-type
application/javascript; charset=UTF-8
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
104
x-xss-protection
0
show_ads_impl_fy2019.js
pagead2.googlesyndication.com/pagead/js/r20191205/r20190131/ 		225 KB
85 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/js/r20191205/r20190131/show_ads_impl_fy2019.js
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
20cdda5f0e51f5dac5693ffe15fb394528dd838e9887a785de1d02e3bb2a418f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://prog.world/operation-ta505-part-two-learning-the-servhelper-backdoor-with-netsupport-rat/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 23 Dec 2019 23:30:29 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
86385
x-xss-protection
0
server
cafe
etag
4513681422076315165
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=1209600
timing-allow-origin
*
expires
Mon, 23 Dec 2019 23:30:29 GMT
zrt_lookup.html
googleads.g.doubleclick.net/pagead/html/r20191205/r20190131/ Frame 0907 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/html/r20191205/r20190131/zrt_lookup.html
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
googleads.g.doubleclick.net
:scheme
https
:path
/pagead/html/r20191205/r20190131/zrt_lookup.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
cross-site
sec-fetch-mode
nested-navigate
referer
https://prog.world/operation-ta505-part-two-learning-the-servhelper-backdoor-with-netsupport-rat/
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer
https://prog.world/operation-ta505-part-two-learning-the-servhelper-backdoor-with-netsupport-rat/

Response headers

status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
vary
Accept-Encoding
date
Thu, 19 Dec 2019 17:43:23 GMT
expires
Thu, 02 Jan 2020 17:43:23 GMT
content-type
text/html; charset=UTF-8
etag
13309989325511048345
x-content-type-options
nosniff
content-encoding
gzip
server
cafe
content-length
6574
x-xss-protection
0
cache-control
public, max-age=1209600
age
366426
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
collect
www.google-analytics.com/r/ 		35 B
108 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google-analytics.com/r/collect?v=1&_v=j79&a=1027772194&t=pageview&_s=1&dl=https%3A%2F%2Fprog.world%2Foperation-ta505-part-two-learning-the-servhelper-backdoor-with-netsupport-rat%2F&ul=en-us&de=UTF-8&dt=Operation%20TA505%2C%20Part%20Two%3A%20Learning%20the%20ServHelper%20Backdoor%20with%20NetSupport%20RAT%20-%20Prog.world&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&_u=YEBAAUAB~&jid=1759084692&gjid=272608139&cid=860469706.1577143829&tid=UA-131810334-1&_gid=523180648.1577143829&_r=1&z=2135878145
Requested by
Host: prog.world
URL: https://prog.world/operation-ta505-part-two-learning-the-servhelper-backdoor-with-netsupport-rat/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://prog.world/operation-ta505-part-two-learning-the-servhelper-backdoor-with-netsupport-rat/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 23 Dec 2019 23:30:29 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
access-control-allow-origin
*
content-type
image/gif
status
200
cache-control
no-cache, no-store, must-revalidate
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
35
expires
Fri, 01 Jan 1990 00:00:00 GMT
ajax-loader.gif
i0.wp.com/prog.world/wp-content/themes/boombox/js/plugins/ 		4 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://i0.wp.com/prog.world/wp-content/themes/boombox/js/plugins/ajax-loader.gif
Requested by
Host: c0.wp.com
URL: https://c0.wp.com/c/5.3.2/wp-includes/js/jquery/jquery.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
i1.wp.com
Software
nginx /
Resource Hash
e7b44c86b050fca766a96ddac2d0932af0126da6f2305280342d909168dcce6b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://prog.world/wp-content/cache/wpfc-minified/10o5mo21/9jnzq.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-nc
HIT ams 6
date
Mon, 23 Dec 2019 23:30:29 GMT
x-content-type-options
nosniff
last-modified
Thu, 22 Aug 2019 13:24:47 GMT
server
nginx
etag
"aa055bdad97e2a37"
content-type
image/gif
status
200
cache-control
public, max-age=63115200
link
<http://prog.world/wp-content/themes/boombox/js/plugins/ajax-loader.gif>; rel="canonical"
content-length
4178
expires
Sun, 22 Aug 2021 01:24:47 GMT
count.json
api.pinterest.com/v1/urls/ 		154 B
400 B 		Script
General
Check archive.org
Download Go to
Full URL
https://api.pinterest.com/v1/urls/count.json?callback=WPCOMSharing.update_pinterest_count&url=https%3A%2F%2Fprog.world%2Foperation-ta505-part-two-learning-the-servhelper-backdoor-with-netsupport-rat%2F&_=1577143829190
Requested by
Host: c0.wp.com
URL: https://c0.wp.com/c/5.3.2/wp-includes/js/jquery/jquery.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.210.248.189 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-210-248-189.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
3220a2206cff5bd0d71e16a0662d9b951a9c783541e98b342015daf8cdeb66a1
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://prog.world/operation-ta505-part-two-learning-the-servhelper-backdoor-with-netsupport-rat/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 23 Dec 2019 23:30:29 GMT
x-content-type-options
nosniff
x-cdn
akamai
age
0
content-type
application/javascript
status
200
cache-control
private
x-envoy-upstream-service-time
2
x-pinterest-rid
1461143305208641
access-control-allow-origin
*
content-length
154
expires
Mon, 23 Dec 2019 23:45:29 GMT
/
graph.facebook.com/ 		268 B
613 B 		Script
General
Check archive.org
Download Go to
Full URL
https://graph.facebook.com/?callback=WPCOMSharing.update_facebook_count&ids=https%3A%2F%2Fprog.world%2Foperation-ta505-part-two-learning-the-servhelper-backdoor-with-netsupport-rat%2F&_=1577143829191
Requested by
Host: c0.wp.com
URL: https://c0.wp.com/c/5.3.2/wp-includes/js/jquery/jquery.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f01c:800e:face:b00c:0:2 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),
Reverse DNS
Software
/
Resource Hash
037ad0427ef67337bcb105d93b832b096760ecc8b66e65daab8d37eaf5f63ada
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload

Request headers

Referer
https://prog.world/operation-ta505-part-two-learning-the-servhelper-backdoor-with-netsupport-rat/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
content-encoding
br
x-app-usage
{"call_count":0,"total_cputime":0,"total_time":0}
status
200
date
Mon, 23 Dec 2019 23:30:29 GMT
x-fb-rev
1001567626
alt-svc
h3-24=":443"; ma=3600
content-length
141
pragma
no-cache
x-fb-debug
f813FcJXkFSTExTTIqTPi+ACfJoFg19Sg02DCQrR7cECmNikeUOd6tDlOYmmIDp1udI+5qGX9UNxGmJeKpZSNA==
x-fb-trace-id
EMww1JLokT6
etag
"ec99d42655fa1c5e1c119a1889b42f8af1563fab"
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
x-fb-request-id
AhGt43YkqgRxAwXtAyqh-no
cache-control
private, no-cache, no-store, must-revalidate
facebook-api-version
v2.11
expires
Sat, 01 Jan 2000 00:00:00 GMT
g.gif
pixel.wp.com/ 		50 B
92 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.wp.com/g.gif?v=wpcom-no-pv&x_sharing-count-request=pinterest&r=0.4747519522872916
Requested by
Host: prog.world
URL: https://prog.world/operation-ta505-part-two-learning-the-servhelper-backdoor-with-netsupport-rat/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
Software
nginx /
Resource Hash
f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1

Request headers

Referer
https://prog.world/operation-ta505-part-two-learning-the-servhelper-backdoor-with-netsupport-rat/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status
200
date
Mon, 23 Dec 2019 23:30:29 GMT
cache-control
no-cache
server
nginx
content-length
50
content-type
image/gif
g.gif
pixel.wp.com/ 		50 B
74 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.wp.com/g.gif?v=wpcom-no-pv&x_sharing-count-request=facebook&r=0.5402934208461496
Requested by
Host: prog.world
URL: https://prog.world/operation-ta505-part-two-learning-the-servhelper-backdoor-with-netsupport-rat/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
Software
nginx /
Resource Hash
f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1

Request headers

Referer
https://prog.world/operation-ta505-part-two-learning-the-servhelper-backdoor-with-netsupport-rat/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status
200
date
Mon, 23 Dec 2019 23:30:29 GMT
cache-control
no-cache
server
nginx
content-length
50
content-type
image/gif
ads
googleads.g.doubleclick.net/pagead/ Frame 3191 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5162050706337438&output=html&adk=1812271804&adf=3025194257&lmt=1577143829&plat=1%3A32776%2C2%3A32776%2C8%3A134250504%2C9%3A134250504%2C16%3A8388608%2C30%3A1081344%2C40%3A32&guci=1.2.0.0.2.2.0.0&format=0x0&url=https%3A%2F%2Fprog.world%2Foperation-ta505-part-two-learning-the-servhelper-backdoor-with-netsupport-rat%2F&ea=0&flash=0&pra=5&wgl=1&adsid=NT&dt=1577143829152&bpp=17&bdt=213&fdt=165&idt=165&shv=r20191205&cbv=r20190131&saldr=aa&abxe=1&nras=1&correlator=2893777381193&frm=20&pv=2&ga_vid=860469706.1577143829&ga_sid=1577143829&ga_hid=1027772194&ga_fc=0&iag=0&icsg=2323694336&dssz=31&mdo=0&mso=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=1585&bih=1200&scr_x=0&scr_y=0&eid=21065126&oid=3&pvsid=3492012320294137&rx=0&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=16&bc=31&ifi=0&uci=a!0&fsb=1&dtd=180
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20191205/r20190131/show_ads_impl_fy2019.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
googleads.g.doubleclick.net
:scheme
https
:path
/pagead/ads?client=ca-pub-5162050706337438&output=html&adk=1812271804&adf=3025194257&lmt=1577143829&plat=1%3A32776%2C2%3A32776%2C8%3A134250504%2C9%3A134250504%2C16%3A8388608%2C30%3A1081344%2C40%3A32&guci=1.2.0.0.2.2.0.0&format=0x0&url=https%3A%2F%2Fprog.world%2Foperation-ta505-part-two-learning-the-servhelper-backdoor-with-netsupport-rat%2F&ea=0&flash=0&pra=5&wgl=1&adsid=NT&dt=1577143829152&bpp=17&bdt=213&fdt=165&idt=165&shv=r20191205&cbv=r20190131&saldr=aa&abxe=1&nras=1&correlator=2893777381193&frm=20&pv=2&ga_vid=860469706.1577143829&ga_sid=1577143829&ga_hid=1027772194&ga_fc=0&iag=0&icsg=2323694336&dssz=31&mdo=0&mso=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=1585&bih=1200&scr_x=0&scr_y=0&eid=21065126&oid=3&pvsid=3492012320294137&rx=0&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=16&bc=31&ifi=0&uci=a!0&fsb=1&dtd=180
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
cross-site
sec-fetch-mode
nested-navigate
referer
https://prog.world/operation-ta505-part-two-learning-the-servhelper-backdoor-with-netsupport-rat/
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer
https://prog.world/operation-ta505-part-two-learning-the-servhelper-backdoor-with-netsupport-rat/

Response headers

status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
br
date
Mon, 23 Dec 2019 23:30:29 GMT
server
cafe
content-length
1105
x-xss-protection
0
set-cookie
test_cookie=CheckForPermission; expires=Mon, 23-Dec-2019 23:45:29 GMT; path=/; domain=.doubleclick.net
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
expires
Mon, 23 Dec 2019 23:30:29 GMT
cache-control
private
osd.js
www.googletagservices.com/activeview/js/current/ 		78 KB
29 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20191205/r20190131/show_ads_impl_fy2019.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
63890326f558587b0840eb0a6e6377f1bf39264e015e568f4c2a03aefce3f929
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://prog.world/operation-ta505-part-two-learning-the-servhelper-backdoor-with-netsupport-rat/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 23 Dec 2019 23:30:29 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1575654529893506"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
29463
x-xss-protection
0
expires
Mon, 23 Dec 2019 23:30:29 GMT
g.gif
pixel.wp.com/ 		50 B
74 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.wp.com/g.gif?v=ext&j=1%3A7.9.1&blog=162630077&post=4520&tz=3&srv=prog.world&host=prog.world&ref=&fcp=1046&rand=0.06531144563366964
Requested by
Host: prog.world
URL: https://prog.world/operation-ta505-part-two-learning-the-servhelper-backdoor-with-netsupport-rat/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
Software
nginx /
Resource Hash
f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1

Request headers

Referer
https://prog.world/operation-ta505-part-two-learning-the-servhelper-backdoor-with-netsupport-rat/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status
200
date
Mon, 23 Dec 2019 23:30:29 GMT
cache-control
no-cache
server
nginx
content-length
50
content-type
image/gif
tqicmdfgz5vzah4oqw6_i6mwan0.png
i0.wp.com/habrastorage.org/webt/tq/ic/md/ 		220 KB
221 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://i0.wp.com/habrastorage.org/webt/tq/ic/md/tqicmdfgz5vzah4oqw6_i6mwan0.png?w=1160&ssl=1
Requested by
Host: prog.world
URL: https://prog.world/operation-ta505-part-two-learning-the-servhelper-backdoor-with-netsupport-rat/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
i1.wp.com
Software
nginx /
Resource Hash
03d8339c72b67b14e9194282a68b43fd986c3c9e11d0b446169188cfad3d0d83
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://prog.world/operation-ta505-part-two-learning-the-servhelper-backdoor-with-netsupport-rat/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-nc
HIT ams 5
date
Mon, 23 Dec 2019 23:30:29 GMT
x-content-type-options
nosniff
x-bytes-saved
935517
last-modified
Mon, 23 Dec 2019 16:43:07 GMT
server
nginx
etag
"7bc60d04b644b667"
vary
Accept
content-type
image/webp
status
200
cache-control
public, max-age=63115200
link
<https://habrastorage.org/webt/tq/ic/md/tqicmdfgz5vzah4oqw6_i6mwan0.png>; rel="canonical"
content-length
225510
expires
Thu, 23 Dec 2021 04:43:07 GMT
cssqukxglw4w6ygse7dzg-kw2jw.png
i0.wp.com/habrastorage.org/webt/cs/sq/uk/ 		20 KB
21 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://i0.wp.com/habrastorage.org/webt/cs/sq/uk/cssqukxglw4w6ygse7dzg-kw2jw.png?w=1160&ssl=1
Requested by
Host: prog.world
URL: https://prog.world/operation-ta505-part-two-learning-the-servhelper-backdoor-with-netsupport-rat/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
i1.wp.com
Software
nginx /
Resource Hash
d529726dd572495a19a0b717a279f03a24b9353768c2cd7e383ae3e7634e5690
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://prog.world/operation-ta505-part-two-learning-the-servhelper-backdoor-with-netsupport-rat/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-nc
HIT ams 7
date
Mon, 23 Dec 2019 23:30:29 GMT
x-content-type-options
nosniff
x-bytes-saved
165201
last-modified
Mon, 23 Dec 2019 16:43:07 GMT
server
nginx
etag
"e675a994f97eaa46"
vary
Accept
content-type
image/webp
status
200
cache-control
public, max-age=63115200
link
<https://habrastorage.org/webt/cs/sq/uk/cssqukxglw4w6ygse7dzg-kw2jw.png>; rel="canonical"
content-length
20936
expires
Thu, 23 Dec 2021 04:43:07 GMT
h9hdg8qo0sxrox1jnippd8ka_zo.png
i0.wp.com/habrastorage.org/webt/h9/hd/g8/ 		6 KB
7 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://i0.wp.com/habrastorage.org/webt/h9/hd/g8/h9hdg8qo0sxrox1jnippd8ka_zo.png?w=1160&ssl=1
Requested by
Host: prog.world
URL: https://prog.world/operation-ta505-part-two-learning-the-servhelper-backdoor-with-netsupport-rat/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
i1.wp.com
Software
nginx /
Resource Hash
30bfd690f4eb58523676b89b2348f7a258b0dc941e4a57e5c541f00bc9bd2372
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://prog.world/operation-ta505-part-two-learning-the-servhelper-backdoor-with-netsupport-rat/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-nc
HIT ams 6
date
Mon, 23 Dec 2019 23:30:29 GMT
x-content-type-options
nosniff
x-bytes-saved
16494
last-modified
Mon, 23 Dec 2019 16:43:07 GMT
server
nginx
etag
"66db4772fb0282ed"
vary
Accept
content-type
image/webp
status
200
cache-control
public, max-age=63115200
link
<https://habrastorage.org/webt/h9/hd/g8/h9hdg8qo0sxrox1jnippd8ka_zo.png>; rel="canonical"
content-length
6568
expires
Thu, 23 Dec 2021 04:43:07 GMT
xtajnurxwbyfsilz4yamr5cckmq.png
i0.wp.com/habrastorage.org/webt/xt/aj/nu/ 		17 KB
17 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://i0.wp.com/habrastorage.org/webt/xt/aj/nu/xtajnurxwbyfsilz4yamr5cckmq.png?w=1160&ssl=1
Requested by
Host: prog.world
URL: https://prog.world/operation-ta505-part-two-learning-the-servhelper-backdoor-with-netsupport-rat/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
i1.wp.com
Software
nginx /
Resource Hash
d07d1851c730be48a9ec462e57db3a691cae2acf7913e4874278af2865d3c531
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://prog.world/operation-ta505-part-two-learning-the-servhelper-backdoor-with-netsupport-rat/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-nc
HIT ams 1
date
Mon, 23 Dec 2019 23:30:29 GMT
x-content-type-options
nosniff
x-bytes-saved
141384
last-modified
Mon, 23 Dec 2019 16:43:07 GMT
server
nginx
etag
"767ba90978095f44"
vary
Accept
content-type
image/webp
status
200
cache-control
public, max-age=63115200
link
<https://habrastorage.org/webt/xt/aj/nu/xtajnurxwbyfsilz4yamr5cckmq.png>; rel="canonical"
content-length
17278
expires
Thu, 23 Dec 2021 04:43:07 GMT
uoowr0t6nf0s2khnk2blkkgdk8c.png
i1.wp.com/habrastorage.org/webt/uo/ow/r0/ 		45 KB
45 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://i1.wp.com/habrastorage.org/webt/uo/ow/r0/uoowr0t6nf0s2khnk2blkkgdk8c.png?w=1160&ssl=1
Requested by
Host: prog.world
URL: https://prog.world/operation-ta505-part-two-learning-the-servhelper-backdoor-with-netsupport-rat/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
i1.wp.com
Software
nginx /
Resource Hash
59b89fe32a8e43a5b252d010cd721822b1acd09562cabf85fecf5c66ac422cc2
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://prog.world/operation-ta505-part-two-learning-the-servhelper-backdoor-with-netsupport-rat/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-nc
HIT ams 2
date
Mon, 23 Dec 2019 23:30:29 GMT
x-content-type-options
nosniff
x-bytes-saved
248648
last-modified
Mon, 23 Dec 2019 16:43:07 GMT
server
nginx
etag
"5919023a52401240"
vary
Accept
content-type
image/webp
status
200
cache-control
public, max-age=63115200
link
<https://habrastorage.org/webt/uo/ow/r0/uoowr0t6nf0s2khnk2blkkgdk8c.png>; rel="canonical"
content-length
46202
expires
Thu, 23 Dec 2021 04:43:07 GMT
_-150x150.
prog.world/wp-content/uploads/2019/12/ 		7 KB
8 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://prog.world/wp-content/uploads/2019/12/_-150x150.
Requested by
Host: prog.world
URL: https://prog.world/operation-ta505-part-two-learning-the-servhelper-backdoor-with-netsupport-rat/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
185.154.53.221 , Russian Federation, ASN210079 (EUROBYTE Eurobyte LLC, Moscow, Russia, RU),
Reverse DNS
androidelf.com
Software
nginx /
Resource Hash
4d45b13983392a12ce9f839415f01ecc927e79da7fe4bd91641706db24813336

Request headers

Referer
https://prog.world/operation-ta505-part-two-learning-the-servhelper-backdoor-with-netsupport-rat/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 23 Dec 2019 23:30:29 GMT
Last-Modified
Sun, 01 Dec 2019 00:16:30 GMT
Server
nginx
Vary
User-Agent
Content-Type
image/png
Cache-Control
max-age=31536000
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=60
Content-Length
7598
Expires
Tue, 22 Dec 2020 23:30:29 GMT
92jfgaauredp88wghccomuxmpjo.jpeg
i2.wp.com/prog.world/wp-content/uploads/2019/12/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://i2.wp.com/prog.world/wp-content/uploads/2019/12/92jfgaauredp88wghccomuxmpjo.jpeg?resize=150%2C150&ssl=1
Requested by
Host: prog.world
URL: https://prog.world/operation-ta505-part-two-learning-the-servhelper-backdoor-with-netsupport-rat/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
i1.wp.com
Software
nginx /
Resource Hash
74c2e956a092ababd36f6f3f6468c27683e387ff240b8b4dfa9087f2cfa646c4
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://prog.world/operation-ta505-part-two-learning-the-servhelper-backdoor-with-netsupport-rat/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-nc
MISS ams 1
date
Mon, 23 Dec 2019 23:30:29 GMT
x-content-type-options
nosniff
x-bytes-saved
228
last-modified
Mon, 23 Dec 2019 23:30:29 GMT
server
nginx
etag
"290e48802c7b3f3a"
vary
Accept
content-type
image/jpeg
status
200
cache-control
public, max-age=63115200
link
<https://prog.world/wp-content/uploads/2019/12/92jfgaauredp88wghccomuxmpjo.jpeg>; rel="canonical"
content-length
3263
expires
Thu, 23 Dec 2021 11:30:29 GMT
reactive_library_fy2019.js
pagead2.googlesyndication.com/pagead/js/r20191205/r20190131/ 		144 KB
52 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/js/r20191205/r20190131/reactive_library_fy2019.js
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20191205/r20190131/show_ads_impl_fy2019.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
c290698f0e77202918cddb863d62d904baed98a10f70a9f50679fad75ecee7c7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://prog.world/operation-ta505-part-two-learning-the-servhelper-backdoor-with-netsupport-rat/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 23 Dec 2019 23:30:29 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
53299
x-xss-protection
0
server
cafe
etag
1494722995872762464
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=1209600
timing-allow-origin
*
expires
Mon, 23 Dec 2019 23:30:29 GMT
ads
googleads.g.doubleclick.net/pagead/ Frame 2ADF 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5162050706337438&output=html&h=191&adk=1403717728&adf=3956329708&w=763&lmt=1577143829&num_ads=1&rafmt=16&sem=mc&pwprc=4051386031&psa=0&guci=1.2.0.0.2.2.0.0&ad_type=text_image&format=763x191&url=https%3A%2F%2Fprog.world%2Foperation-ta505-part-two-learning-the-servhelper-backdoor-with-netsupport-rat%2F&flash=0&pra=3&wgl=1&fa=27&adsid=NT&dt=1577143829444&bpp=4&bdt=505&fdt=4&idt=5&shv=r20191205&cbv=r20190131&saldr=aa&abxe=1&prev_fmts=0x0&nras=2&correlator=2893777381193&frm=20&pv=1&ga_vid=860469706.1577143829&ga_sid=1577143829&ga_hid=1027772194&ga_fc=0&iag=0&icsg=36683432704&dssz=31&mdo=0&mso=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=213&ady=1272&biw=1585&bih=1200&scr_x=0&scr_y=0&eid=21065126&oid=3&pvsid=3492012320294137&rx=0&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=16&bc=31&ifi=1&uci=a!1&btvi=1&fsb=1&xpc=S7zDdX5HUE&p=https%3A//prog.world&dtd=7
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20191205/r20190131/show_ads_impl_fy2019.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
googleads.g.doubleclick.net
:scheme
https
:path
/pagead/ads?client=ca-pub-5162050706337438&output=html&h=191&adk=1403717728&adf=3956329708&w=763&lmt=1577143829&num_ads=1&rafmt=16&sem=mc&pwprc=4051386031&psa=0&guci=1.2.0.0.2.2.0.0&ad_type=text_image&format=763x191&url=https%3A%2F%2Fprog.world%2Foperation-ta505-part-two-learning-the-servhelper-backdoor-with-netsupport-rat%2F&flash=0&pra=3&wgl=1&fa=27&adsid=NT&dt=1577143829444&bpp=4&bdt=505&fdt=4&idt=5&shv=r20191205&cbv=r20190131&saldr=aa&abxe=1&prev_fmts=0x0&nras=2&correlator=2893777381193&frm=20&pv=1&ga_vid=860469706.1577143829&ga_sid=1577143829&ga_hid=1027772194&ga_fc=0&iag=0&icsg=36683432704&dssz=31&mdo=0&mso=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=213&ady=1272&biw=1585&bih=1200&scr_x=0&scr_y=0&eid=21065126&oid=3&pvsid=3492012320294137&rx=0&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=16&bc=31&ifi=1&uci=a!1&btvi=1&fsb=1&xpc=S7zDdX5HUE&p=https%3A//prog.world&dtd=7
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
cross-site
sec-fetch-mode
nested-navigate
referer
https://prog.world/operation-ta505-part-two-learning-the-servhelper-backdoor-with-netsupport-rat/
accept-encoding
gzip, deflate, br
cookie
test_cookie=CheckForPermission
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer
https://prog.world/operation-ta505-part-two-learning-the-servhelper-backdoor-with-netsupport-rat/

Response headers

status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
br
date
Mon, 23 Dec 2019 23:30:29 GMT
server
cafe
content-length
26269
x-xss-protection
0
set-cookie
IDE=AHWqTUkT3ezbU-SOr5_xdO7W_1XCXAYkvKNYsZDYG7yS_haPQp9l85uSxtZxWCc8; expires=Sat, 16-Jan-2021 23:30:29 GMT; path=/; domain=.doubleclick.net; HttpOnly test_cookie=; domain=.doubleclick.net; path=/; expires=Mon, 21 Jul 2008 23:59:00 GMT
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
expires
Mon, 23 Dec 2019 23:30:29 GMT
cache-control
private
ads
googleads.g.doubleclick.net/pagead/ Frame 8BD3 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5162050706337438&output=html&h=191&adk=1403717728&adf=1943000707&w=763&lmt=1577143829&num_ads=1&rafmt=16&sem=mc&pwprc=4051386031&psa=0&guci=1.2.0.0.2.2.0.0&ad_type=text_image&format=763x191&url=https%3A%2F%2Fprog.world%2Foperation-ta505-part-two-learning-the-servhelper-backdoor-with-netsupport-rat%2F&flash=0&pra=3&wgl=1&fa=27&adsid=NT&dt=1577143829458&bpp=2&bdt=519&fdt=3&idt=3&shv=r20191205&cbv=r20190131&saldr=aa&abxe=1&prev_fmts=0x0%2C763x191&nras=3&correlator=2893777381193&frm=20&pv=1&ga_vid=860469706.1577143829&ga_sid=1577143829&ga_hid=1027772194&ga_fc=0&iag=0&icsg=174122386176&dssz=32&mdo=0&mso=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=213&ady=1640&biw=1585&bih=1200&scr_x=0&scr_y=0&eid=21065126&oid=3&pvsid=3492012320294137&rx=0&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=16&bc=31&ifi=2&uci=a!2&btvi=2&fsb=1&xpc=q6hJFGiXUP&p=https%3A//prog.world&dtd=5
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20191205/r20190131/show_ads_impl_fy2019.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
googleads.g.doubleclick.net
:scheme
https
:path
/pagead/ads?client=ca-pub-5162050706337438&output=html&h=191&adk=1403717728&adf=1943000707&w=763&lmt=1577143829&num_ads=1&rafmt=16&sem=mc&pwprc=4051386031&psa=0&guci=1.2.0.0.2.2.0.0&ad_type=text_image&format=763x191&url=https%3A%2F%2Fprog.world%2Foperation-ta505-part-two-learning-the-servhelper-backdoor-with-netsupport-rat%2F&flash=0&pra=3&wgl=1&fa=27&adsid=NT&dt=1577143829458&bpp=2&bdt=519&fdt=3&idt=3&shv=r20191205&cbv=r20190131&saldr=aa&abxe=1&prev_fmts=0x0%2C763x191&nras=3&correlator=2893777381193&frm=20&pv=1&ga_vid=860469706.1577143829&ga_sid=1577143829&ga_hid=1027772194&ga_fc=0&iag=0&icsg=174122386176&dssz=32&mdo=0&mso=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=213&ady=1640&biw=1585&bih=1200&scr_x=0&scr_y=0&eid=21065126&oid=3&pvsid=3492012320294137&rx=0&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=16&bc=31&ifi=2&uci=a!2&btvi=2&fsb=1&xpc=q6hJFGiXUP&p=https%3A//prog.world&dtd=5
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
cross-site
sec-fetch-mode
nested-navigate
referer
https://prog.world/operation-ta505-part-two-learning-the-servhelper-backdoor-with-netsupport-rat/
accept-encoding
gzip, deflate, br
cookie
test_cookie=CheckForPermission
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer
https://prog.world/operation-ta505-part-two-learning-the-servhelper-backdoor-with-netsupport-rat/

Response headers

status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
br
date
Mon, 23 Dec 2019 23:30:29 GMT
server
cafe
content-length
204
x-xss-protection
0
set-cookie
IDE=AHWqTUmRNgg1f2-DtTW_RX8lMMlNG5UurvtSj33JJt3r8ZUIpYlVbVhkZhZIdQvL; expires=Sat, 16-Jan-2021 23:30:29 GMT; path=/; domain=.doubleclick.net; HttpOnly test_cookie=; domain=.doubleclick.net; path=/; expires=Mon, 21 Jul 2008 23:59:00 GMT
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
expires
Mon, 23 Dec 2019 23:30:29 GMT
cache-control
private
ads
googleads.g.doubleclick.net/pagead/ Frame F7D7 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5162050706337438&output=html&h=191&adk=1403717728&adf=2464618102&w=763&lmt=1577143829&num_ads=1&rafmt=16&sem=mc&pwprc=4051386031&psa=0&guci=1.2.0.0.2.2.0.0&ad_type=text_image&format=763x191&url=https%3A%2F%2Fprog.world%2Foperation-ta505-part-two-learning-the-servhelper-backdoor-with-netsupport-rat%2F&flash=0&pra=3&wgl=1&fa=27&adsid=NT&dt=1577143829469&bpp=3&bdt=530&fdt=4&idt=4&shv=r20191205&cbv=r20190131&saldr=aa&abxe=1&prev_fmts=0x0%2C763x191%2C763x191&nras=4&correlator=2893777381193&frm=20&pv=1&ga_vid=860469706.1577143829&ga_sid=1577143829&ga_hid=1027772194&ga_fc=0&iag=0&icsg=174122386176&dssz=32&mdo=0&mso=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=213&ady=2535&biw=1585&bih=1200&scr_x=0&scr_y=0&eid=21065126&oid=3&pvsid=3492012320294137&rx=0&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=16&bc=31&ifi=3&uci=a!3&btvi=3&fsb=1&xpc=9Qaa4lM2QX&p=https%3A//prog.world&dtd=6
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20191205/r20190131/show_ads_impl_fy2019.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
googleads.g.doubleclick.net
:scheme
https
:path
/pagead/ads?client=ca-pub-5162050706337438&output=html&h=191&adk=1403717728&adf=2464618102&w=763&lmt=1577143829&num_ads=1&rafmt=16&sem=mc&pwprc=4051386031&psa=0&guci=1.2.0.0.2.2.0.0&ad_type=text_image&format=763x191&url=https%3A%2F%2Fprog.world%2Foperation-ta505-part-two-learning-the-servhelper-backdoor-with-netsupport-rat%2F&flash=0&pra=3&wgl=1&fa=27&adsid=NT&dt=1577143829469&bpp=3&bdt=530&fdt=4&idt=4&shv=r20191205&cbv=r20190131&saldr=aa&abxe=1&prev_fmts=0x0%2C763x191%2C763x191&nras=4&correlator=2893777381193&frm=20&pv=1&ga_vid=860469706.1577143829&ga_sid=1577143829&ga_hid=1027772194&ga_fc=0&iag=0&icsg=174122386176&dssz=32&mdo=0&mso=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=213&ady=2535&biw=1585&bih=1200&scr_x=0&scr_y=0&eid=21065126&oid=3&pvsid=3492012320294137&rx=0&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=16&bc=31&ifi=3&uci=a!3&btvi=3&fsb=1&xpc=9Qaa4lM2QX&p=https%3A//prog.world&dtd=6
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
cross-site
sec-fetch-mode
nested-navigate
referer
https://prog.world/operation-ta505-part-two-learning-the-servhelper-backdoor-with-netsupport-rat/
accept-encoding
gzip, deflate, br
cookie
test_cookie=CheckForPermission
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer
https://prog.world/operation-ta505-part-two-learning-the-servhelper-backdoor-with-netsupport-rat/

Response headers

status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
br
date
Mon, 23 Dec 2019 23:30:29 GMT
server
cafe
content-length
27183
x-xss-protection
0
set-cookie
IDE=AHWqTUld8M0J8mNNUlBU-z0KoBz8sw5GwHgWapKppNAU4pKwXfoWiX0UjMncKX2u; expires=Sat, 16-Jan-2021 23:30:29 GMT; path=/; domain=.doubleclick.net; HttpOnly test_cookie=; domain=.doubleclick.net; path=/; expires=Mon, 21 Jul 2008 23:59:00 GMT
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
expires
Mon, 23 Dec 2019 23:30:29 GMT
cache-control
private
ads
googleads.g.doubleclick.net/pagead/ Frame 0701 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5162050706337438&output=html&h=191&adk=1403717728&adf=1107306155&w=763&lmt=1577143829&num_ads=1&rafmt=16&sem=mc&pwprc=4051386031&psa=0&guci=1.2.0.0.2.2.0.0&ad_type=text_image&format=763x191&url=https%3A%2F%2Fprog.world%2Foperation-ta505-part-two-learning-the-servhelper-backdoor-with-netsupport-rat%2F&flash=0&pra=3&wgl=1&fa=27&adsid=NT&dt=1577143829479&bpp=3&bdt=540&fdt=4&idt=4&shv=r20191205&cbv=r20190131&saldr=aa&abxe=1&prev_fmts=0x0%2C763x191%2C763x191%2C763x191&nras=5&correlator=2893777381193&frm=20&pv=1&ga_vid=860469706.1577143829&ga_sid=1577143829&ga_hid=1027772194&ga_fc=0&iag=0&icsg=174122386176&dssz=32&mdo=0&mso=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=213&ady=2926&biw=1585&bih=1200&scr_x=0&scr_y=0&eid=21065126&oid=3&pvsid=3492012320294137&rx=0&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=16&bc=31&ifi=4&uci=a!4&btvi=4&fsb=1&xpc=fds5aq7sPb&p=https%3A//prog.world&dtd=6
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20191205/r20190131/show_ads_impl_fy2019.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
googleads.g.doubleclick.net
:scheme
https
:path
/pagead/ads?client=ca-pub-5162050706337438&output=html&h=191&adk=1403717728&adf=1107306155&w=763&lmt=1577143829&num_ads=1&rafmt=16&sem=mc&pwprc=4051386031&psa=0&guci=1.2.0.0.2.2.0.0&ad_type=text_image&format=763x191&url=https%3A%2F%2Fprog.world%2Foperation-ta505-part-two-learning-the-servhelper-backdoor-with-netsupport-rat%2F&flash=0&pra=3&wgl=1&fa=27&adsid=NT&dt=1577143829479&bpp=3&bdt=540&fdt=4&idt=4&shv=r20191205&cbv=r20190131&saldr=aa&abxe=1&prev_fmts=0x0%2C763x191%2C763x191%2C763x191&nras=5&correlator=2893777381193&frm=20&pv=1&ga_vid=860469706.1577143829&ga_sid=1577143829&ga_hid=1027772194&ga_fc=0&iag=0&icsg=174122386176&dssz=32&mdo=0&mso=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=213&ady=2926&biw=1585&bih=1200&scr_x=0&scr_y=0&eid=21065126&oid=3&pvsid=3492012320294137&rx=0&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=16&bc=31&ifi=4&uci=a!4&btvi=4&fsb=1&xpc=fds5aq7sPb&p=https%3A//prog.world&dtd=6
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
cross-site
sec-fetch-mode
nested-navigate
referer
https://prog.world/operation-ta505-part-two-learning-the-servhelper-backdoor-with-netsupport-rat/
accept-encoding
gzip, deflate, br
cookie
test_cookie=CheckForPermission
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer
https://prog.world/operation-ta505-part-two-learning-the-servhelper-backdoor-with-netsupport-rat/

Response headers

status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
br
date
Mon, 23 Dec 2019 23:30:29 GMT
server
cafe
content-length
24421
x-xss-protection
0
set-cookie
IDE=AHWqTUkArHgBMB9ZZgU8eXthvMsrWE-hhw4ekdvtxdKbwH3W0d8gc4KoMMOiNaVs; expires=Sat, 16-Jan-2021 23:30:29 GMT; path=/; domain=.doubleclick.net; HttpOnly; SameSite=none test_cookie=; domain=.doubleclick.net; path=/; expires=Mon, 21 Jul 2008 23:59:00 GMT; SameSite=none
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
expires
Mon, 23 Dec 2019 23:30:29 GMT
cache-control
private
ads
googleads.g.doubleclick.net/pagead/ Frame 4A32 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5162050706337438&output=html&h=191&adk=1403717728&adf=3119124659&w=763&lmt=1577143829&num_ads=1&rafmt=16&sem=mc&pwprc=4051386031&psa=0&guci=1.2.0.0.2.2.0.0&ad_type=text_image&format=763x191&url=https%3A%2F%2Fprog.world%2Foperation-ta505-part-two-learning-the-servhelper-backdoor-with-netsupport-rat%2F&flash=0&pra=3&wgl=1&fa=27&adsid=NT&dt=1577143829490&bpp=4&bdt=551&fdt=4&idt=4&shv=r20191205&cbv=r20190131&saldr=aa&abxe=1&prev_fmts=0x0%2C763x191%2C763x191%2C763x191%2C763x191&nras=6&correlator=2893777381193&frm=20&pv=1&ga_vid=860469706.1577143829&ga_sid=1577143829&ga_hid=1027772194&ga_fc=0&iag=0&icsg=174122386176&dssz=32&mdo=0&mso=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=213&ady=3497&biw=1585&bih=1200&scr_x=0&scr_y=0&eid=21065126&oid=3&pvsid=3492012320294137&rx=0&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=16&bc=31&ifi=5&uci=a!5&btvi=5&fsb=1&xpc=gXN5luqPKJ&p=https%3A//prog.world&dtd=7
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20191205/r20190131/show_ads_impl_fy2019.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
googleads.g.doubleclick.net
:scheme
https
:path
/pagead/ads?client=ca-pub-5162050706337438&output=html&h=191&adk=1403717728&adf=3119124659&w=763&lmt=1577143829&num_ads=1&rafmt=16&sem=mc&pwprc=4051386031&psa=0&guci=1.2.0.0.2.2.0.0&ad_type=text_image&format=763x191&url=https%3A%2F%2Fprog.world%2Foperation-ta505-part-two-learning-the-servhelper-backdoor-with-netsupport-rat%2F&flash=0&pra=3&wgl=1&fa=27&adsid=NT&dt=1577143829490&bpp=4&bdt=551&fdt=4&idt=4&shv=r20191205&cbv=r20190131&saldr=aa&abxe=1&prev_fmts=0x0%2C763x191%2C763x191%2C763x191%2C763x191&nras=6&correlator=2893777381193&frm=20&pv=1&ga_vid=860469706.1577143829&ga_sid=1577143829&ga_hid=1027772194&ga_fc=0&iag=0&icsg=174122386176&dssz=32&mdo=0&mso=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=213&ady=3497&biw=1585&bih=1200&scr_x=0&scr_y=0&eid=21065126&oid=3&pvsid=3492012320294137&rx=0&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=16&bc=31&ifi=5&uci=a!5&btvi=5&fsb=1&xpc=gXN5luqPKJ&p=https%3A//prog.world&dtd=7
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
cross-site
sec-fetch-mode
nested-navigate
referer
https://prog.world/operation-ta505-part-two-learning-the-servhelper-backdoor-with-netsupport-rat/
accept-encoding
gzip, deflate, br
cookie
test_cookie=CheckForPermission
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer
https://prog.world/operation-ta505-part-two-learning-the-servhelper-backdoor-with-netsupport-rat/

Response headers

status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
br
date
Mon, 23 Dec 2019 23:30:29 GMT
server
cafe
content-length
26372
x-xss-protection
0
set-cookie
IDE=AHWqTUk56z4DqVK2fqZJo238EykGMTxzTHtl_2v5CUOy0-4zCyRIOQPdIQXFU4nw; expires=Sat, 16-Jan-2021 23:30:29 GMT; path=/; domain=.doubleclick.net; HttpOnly test_cookie=; domain=.doubleclick.net; path=/; expires=Mon, 21 Jul 2008 23:59:00 GMT
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
expires
Mon, 23 Dec 2019 23:30:29 GMT
cache-control
private
ads
googleads.g.doubleclick.net/pagead/ Frame 21EA 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5162050706337438&output=html&h=191&adk=1403717728&adf=3021755706&w=763&lmt=1577143829&num_ads=1&rafmt=16&sem=mc&pwprc=4051386031&psa=0&guci=1.2.0.0.2.2.0.0&ad_type=text_image&format=763x191&url=https%3A%2F%2Fprog.world%2Foperation-ta505-part-two-learning-the-servhelper-backdoor-with-netsupport-rat%2F&flash=0&pra=3&wgl=1&fa=27&adsid=NT&dt=1577143829502&bpp=4&bdt=563&fdt=4&idt=5&shv=r20191205&cbv=r20190131&saldr=aa&abxe=1&prev_fmts=0x0%2C763x191%2C763x191%2C763x191%2C763x191%2C763x191&nras=7&correlator=2893777381193&frm=20&pv=1&ga_vid=860469706.1577143829&ga_sid=1577143829&ga_hid=1027772194&ga_fc=0&iag=0&icsg=174122386176&dssz=32&mdo=0&mso=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=213&ady=4293&biw=1585&bih=1200&scr_x=0&scr_y=0&eid=21065126&oid=3&pvsid=3492012320294137&rx=0&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=16&bc=31&ifi=6&uci=a!6&btvi=6&fsb=1&xpc=cDKLTj77Xy&p=https%3A//prog.world&dtd=7
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20191205/r20190131/show_ads_impl_fy2019.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
googleads.g.doubleclick.net
:scheme
https
:path
/pagead/ads?client=ca-pub-5162050706337438&output=html&h=191&adk=1403717728&adf=3021755706&w=763&lmt=1577143829&num_ads=1&rafmt=16&sem=mc&pwprc=4051386031&psa=0&guci=1.2.0.0.2.2.0.0&ad_type=text_image&format=763x191&url=https%3A%2F%2Fprog.world%2Foperation-ta505-part-two-learning-the-servhelper-backdoor-with-netsupport-rat%2F&flash=0&pra=3&wgl=1&fa=27&adsid=NT&dt=1577143829502&bpp=4&bdt=563&fdt=4&idt=5&shv=r20191205&cbv=r20190131&saldr=aa&abxe=1&prev_fmts=0x0%2C763x191%2C763x191%2C763x191%2C763x191%2C763x191&nras=7&correlator=2893777381193&frm=20&pv=1&ga_vid=860469706.1577143829&ga_sid=1577143829&ga_hid=1027772194&ga_fc=0&iag=0&icsg=174122386176&dssz=32&mdo=0&mso=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=213&ady=4293&biw=1585&bih=1200&scr_x=0&scr_y=0&eid=21065126&oid=3&pvsid=3492012320294137&rx=0&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=16&bc=31&ifi=6&uci=a!6&btvi=6&fsb=1&xpc=cDKLTj77Xy&p=https%3A//prog.world&dtd=7
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
cross-site
sec-fetch-mode
nested-navigate
referer
https://prog.world/operation-ta505-part-two-learning-the-servhelper-backdoor-with-netsupport-rat/
accept-encoding
gzip, deflate, br
cookie
test_cookie=CheckForPermission
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer
https://prog.world/operation-ta505-part-two-learning-the-servhelper-backdoor-with-netsupport-rat/

Response headers

status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
br
date
Mon, 23 Dec 2019 23:30:29 GMT
server
cafe
content-length
26312
x-xss-protection
0
set-cookie
IDE=AHWqTUmbNKcJn3nA5UnD3EztGHqriVRmJlNmK8XrHzV4Ds5Tdt9oMhw8OQgg7suM; expires=Sat, 16-Jan-2021 23:30:29 GMT; path=/; domain=.doubleclick.net; HttpOnly; SameSite=none test_cookie=; domain=.doubleclick.net; path=/; expires=Mon, 21 Jul 2008 23:59:00 GMT; SameSite=none
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
expires
Mon, 23 Dec 2019 23:30:29 GMT
cache-control
private
ads
googleads.g.doubleclick.net/pagead/ Frame BA81 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5162050706337438&output=html&h=191&adk=1403717728&adf=969266763&w=763&lmt=1577143829&num_ads=1&rafmt=16&sem=mc&pwprc=4051386031&psa=0&guci=1.2.0.0.2.2.0.0&ad_type=text_image&format=763x191&url=https%3A%2F%2Fprog.world%2Foperation-ta505-part-two-learning-the-servhelper-backdoor-with-netsupport-rat%2F&flash=0&pra=3&wgl=1&fa=27&adsid=NT&dt=1577143829514&bpp=3&bdt=575&fdt=4&idt=4&shv=r20191205&cbv=r20190131&saldr=aa&abxe=1&prev_fmts=0x0%2C763x191%2C763x191%2C763x191%2C763x191%2C763x191%2C763x191&nras=8&correlator=2893777381193&frm=20&pv=1&ga_vid=860469706.1577143829&ga_sid=1577143829&ga_hid=1027772194&ga_fc=0&iag=0&icsg=174122386176&dssz=32&mdo=0&mso=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=213&ady=5230&biw=1585&bih=1200&scr_x=0&scr_y=0&eid=21065126&oid=3&pvsid=3492012320294137&rx=0&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=16&bc=31&ifi=7&uci=a!7&btvi=7&fsb=1&xpc=QGMiGQi9w4&p=https%3A//prog.world&dtd=6
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20191205/r20190131/show_ads_impl_fy2019.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
googleads.g.doubleclick.net
:scheme
https
:path
/pagead/ads?client=ca-pub-5162050706337438&output=html&h=191&adk=1403717728&adf=969266763&w=763&lmt=1577143829&num_ads=1&rafmt=16&sem=mc&pwprc=4051386031&psa=0&guci=1.2.0.0.2.2.0.0&ad_type=text_image&format=763x191&url=https%3A%2F%2Fprog.world%2Foperation-ta505-part-two-learning-the-servhelper-backdoor-with-netsupport-rat%2F&flash=0&pra=3&wgl=1&fa=27&adsid=NT&dt=1577143829514&bpp=3&bdt=575&fdt=4&idt=4&shv=r20191205&cbv=r20190131&saldr=aa&abxe=1&prev_fmts=0x0%2C763x191%2C763x191%2C763x191%2C763x191%2C763x191%2C763x191&nras=8&correlator=2893777381193&frm=20&pv=1&ga_vid=860469706.1577143829&ga_sid=1577143829&ga_hid=1027772194&ga_fc=0&iag=0&icsg=174122386176&dssz=32&mdo=0&mso=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=213&ady=5230&biw=1585&bih=1200&scr_x=0&scr_y=0&eid=21065126&oid=3&pvsid=3492012320294137&rx=0&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=16&bc=31&ifi=7&uci=a!7&btvi=7&fsb=1&xpc=QGMiGQi9w4&p=https%3A//prog.world&dtd=6
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
cross-site
sec-fetch-mode
nested-navigate
referer
https://prog.world/operation-ta505-part-two-learning-the-servhelper-backdoor-with-netsupport-rat/
accept-encoding
gzip, deflate, br
cookie
test_cookie=CheckForPermission
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer
https://prog.world/operation-ta505-part-two-learning-the-servhelper-backdoor-with-netsupport-rat/

Response headers

status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
br
date
Mon, 23 Dec 2019 23:30:29 GMT
server
cafe
content-length
26335
x-xss-protection
0
set-cookie
IDE=AHWqTUmwmRHhfrWZDTbaey5DNPwJfy21gpXfbNDvgHR6S5Sp-g-FdDgVymqsz3Bv; expires=Sat, 16-Jan-2021 23:30:29 GMT; path=/; domain=.doubleclick.net; HttpOnly; SameSite=none test_cookie=; domain=.doubleclick.net; path=/; expires=Mon, 21 Jul 2008 23:59:00 GMT; SameSite=none
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
expires
Mon, 23 Dec 2019 23:30:29 GMT
cache-control
private
ads
googleads.g.doubleclick.net/pagead/ Frame 524D 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5162050706337438&output=html&h=191&adk=1403717728&adf=3635304540&w=763&lmt=1577143829&num_ads=1&rafmt=16&sem=mc&pwprc=4051386031&psa=0&guci=1.2.0.0.2.2.0.0&ad_type=text_image&format=763x191&url=https%3A%2F%2Fprog.world%2Foperation-ta505-part-two-learning-the-servhelper-backdoor-with-netsupport-rat%2F&flash=0&pra=3&wgl=1&fa=27&adsid=NT&dt=1577143829524&bpp=3&bdt=586&fdt=3&idt=3&shv=r20191205&cbv=r20190131&saldr=aa&abxe=1&prev_fmts=0x0%2C763x191%2C763x191%2C763x191%2C763x191%2C763x191%2C763x191%2C763x191&nras=9&correlator=2893777381193&frm=20&pv=1&ga_vid=860469706.1577143829&ga_sid=1577143829&ga_hid=1027772194&ga_fc=0&iag=0&icsg=174122386176&dssz=32&mdo=0&mso=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=213&ady=6052&biw=1585&bih=1200&scr_x=0&scr_y=0&eid=21065126&oid=3&pvsid=3492012320294137&rx=0&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=16&bc=31&ifi=8&uci=a!8&btvi=8&fsb=1&xpc=BVgQiJIbz1&p=https%3A//prog.world&dtd=5
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20191205/r20190131/show_ads_impl_fy2019.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
googleads.g.doubleclick.net
:scheme
https
:path
/pagead/ads?client=ca-pub-5162050706337438&output=html&h=191&adk=1403717728&adf=3635304540&w=763&lmt=1577143829&num_ads=1&rafmt=16&sem=mc&pwprc=4051386031&psa=0&guci=1.2.0.0.2.2.0.0&ad_type=text_image&format=763x191&url=https%3A%2F%2Fprog.world%2Foperation-ta505-part-two-learning-the-servhelper-backdoor-with-netsupport-rat%2F&flash=0&pra=3&wgl=1&fa=27&adsid=NT&dt=1577143829524&bpp=3&bdt=586&fdt=3&idt=3&shv=r20191205&cbv=r20190131&saldr=aa&abxe=1&prev_fmts=0x0%2C763x191%2C763x191%2C763x191%2C763x191%2C763x191%2C763x191%2C763x191&nras=9&correlator=2893777381193&frm=20&pv=1&ga_vid=860469706.1577143829&ga_sid=1577143829&ga_hid=1027772194&ga_fc=0&iag=0&icsg=174122386176&dssz=32&mdo=0&mso=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=213&ady=6052&biw=1585&bih=1200&scr_x=0&scr_y=0&eid=21065126&oid=3&pvsid=3492012320294137&rx=0&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=16&bc=31&ifi=8&uci=a!8&btvi=8&fsb=1&xpc=BVgQiJIbz1&p=https%3A//prog.world&dtd=5
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
cross-site
sec-fetch-mode
nested-navigate
referer
https://prog.world/operation-ta505-part-two-learning-the-servhelper-backdoor-with-netsupport-rat/
accept-encoding
gzip, deflate, br
cookie
test_cookie=CheckForPermission
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer
https://prog.world/operation-ta505-part-two-learning-the-servhelper-backdoor-with-netsupport-rat/

Response headers

status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
br
date
Mon, 23 Dec 2019 23:30:29 GMT
server
cafe
content-length
26224
x-xss-protection
0
set-cookie
IDE=AHWqTUlXBEXeDKdU-DhEshKQySmUpVyrPUqehtV4VDLq1fu41ExtwSc4iW1JkTvX; expires=Sat, 16-Jan-2021 23:30:29 GMT; path=/; domain=.doubleclick.net; HttpOnly test_cookie=; domain=.doubleclick.net; path=/; expires=Mon, 21 Jul 2008 23:59:00 GMT
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
expires
Mon, 23 Dec 2019 23:30:29 GMT
cache-control
private

Verdicts & Comments Add Verdict or Comment

104 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate string| GoogleAnalyticsObject function| ga object| Wpfcll function| wpfci object| google_js_reporting_queue number| google_srt object| google_ad_modifications object| google_logging_queue object| ggeac boolean| google_measure_js_timing object| googleToken object| googleIMState function| processGoogleToken object| google_reactive_ads_global_state object| adsbygoogle boolean| _gfp_a_ object| google_sa_queue object| google_sl_win function| google_process_slots function| google_spfd object| google_sv_map object| google_t12n_vars object| boombox_global_vars object| boombox_ajax_params object| sharing_js_options undefined| $ function| jQuery object| WPCOM_sharing_counts object| addComment object| wpcom_img_zoomer object| detectZoom object| google_tag_data object| gaplugins object| gaGlobal object| gaData function| getMaxVal function| numberToTwoDigits function| bbPageAnimate function| getSetFixedHeader function| getSetAdminBars function| getSetFloatingPagHeight function| getHeaderAreaHeight function| bbSideNav function| ShowFullPost function| setFormPlaceholders function| initializeTabs function| postMasonry function| mobileMenuToggle function| bbMobileNavigation function| showHideGoTopOnScroll function| showHideFixedNavOnScroll function| showHideElementsOnScroll function| bbFeaturedCarousel function| HyenaGIF function| featuredVideo function| GIFvideo function| GIFtoVideo function| toggleVideoPlaying function| animationPageTop function| disabledLinksBehaviour object| bb object| html5 object| Modernizr function| Waypoint function| jQueryBridget function| EvEmitter function| getSize function| matchesSelector object| fizzyUIUtils function| Outlayer function| Isotope function| Masonry object| jQuery112407293244755930834 function| jetpackLazyImagesModule object| wp object| WPCOMSharing undefined| windowOpen object| _stq function| Goog_AdSense_getAdAdapterInstance function| Goog_AdSense_OsdAdapter function| google_sa_impl object| google_jobrunner object| google_persistent_state_async object| __google_ad_urls number| google_global_correlator number| __google_ad_urls_id object| google_prev_clients object| ampInaboxIframes object| ampInaboxPendingMessages object| google_iframe_oncopy boolean| google_osd_loaded boolean| google_onload_fired function| st_go function| linktracker_init object| wpcom function| Goog_Osd_UnloadAdBlock function| Goog_Osd_UpdateElementToMeasure function| google_osd_amcb boolean| _gfp_p_ number| google_lpabyc number| google_unique_id object| google_llp

0 Cookies

1 Console Messages

Source Level URL
Text
console-api log URL: https://c0.wp.com/c/5.3.2/wp-includes/js/jquery/jquery-migrate.min.js(Line 2)
Message:
JQMIGRATE: Migrate is installed, version 1.4.1

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

adservice.google.com
adservice.google.de
api.pinterest.com
c0.wp.com
googleads.g.doubleclick.net
graph.facebook.com
i0.wp.com
i1.wp.com
i2.wp.com
pagead2.googlesyndication.com
pixel.wp.com
prog.world
s0.wp.com
stats.wp.com
www.google-analytics.com
www.googletagservices.com
185.154.53.221
192.0.76.3
192.0.77.2
192.0.77.32
192.0.77.37
23.210.248.189
2a00:1450:4001:80b::200e
2a00:1450:4001:81a::2002
2a00:1450:4001:825::2002
2a03:2880:f01c:800e:face:b00c:0:2
0284cbccebf1682452d62d06efa3665c874d642d4e03f5f5f9bb0f555da9251b
037ad0427ef67337bcb105d93b832b096760ecc8b66e65daab8d37eaf5f63ada
03d8339c72b67b14e9194282a68b43fd986c3c9e11d0b446169188cfad3d0d83
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
068e2f18d47e3c6e38eee71beaa5d568af8a7729e5f2be2c4be47eafb4e458de
0ebbc7fba9a50d36ef5422345f624431710db4528f25749d1d438c2c10bb69f2
15af8314f4d93f6768e3fb9a0009475fc9b32c216a52097e944ef70488c8a43d
1db21d816296e6939ba1f42962496e4134ae2b0081e26970864c40c6d02bb1df
1e99034e4b75a1fb7ba372a3a950fa19ff4688d8561479b1a34dfcbde83ff3d8
20cdda5f0e51f5dac5693ffe15fb394528dd838e9887a785de1d02e3bb2a418f
2e1ced1bd0736a56a0c44fd7b3bf8134850398ecddd52a0f5e6e437c5d527999
2e9b800440481e8cf5c37b772cffd536c456a152e92e87f9fda1852134be280b
30bfd690f4eb58523676b89b2348f7a258b0dc941e4a57e5c541f00bc9bd2372
3220a2206cff5bd0d71e16a0662d9b951a9c783541e98b342015daf8cdeb66a1
3d7821112c3598b05a3a7912dfad318e1889152293d705903b3e1708d6d7361a
48eb8b500ae6a38617b5738d2b3faec481922a7782246e31d2755c034a45cd5d
4c2d889ee46270fb2ae51c5ef8804efb7f03b4d5f2ab24a9fdd7a6400f75ea6c
4d45b13983392a12ce9f839415f01ecc927e79da7fe4bd91641706db24813336
59b89fe32a8e43a5b252d010cd721822b1acd09562cabf85fecf5c66ac422cc2
63890326f558587b0840eb0a6e6377f1bf39264e015e568f4c2a03aefce3f929
68bcdec2fdc6ce23468b97a8c39a3f9eb86233e03be5072bf3b438ac1433714d
73eb139b1371aed55b1dce74b7258f2d90991c5294d69fce852c3eed1af40068
74c2e956a092ababd36f6f3f6468c27683e387ff240b8b4dfa9087f2cfa646c4
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
85778e9fbfde68948ea3cd7487a809bd3e33bea16c89a7183a8b63dfdaaac616
895964971ebdb56ee76d08850bcb4c5a88ec4c65e6a235882304e8ff6767cd7c
c290698f0e77202918cddb863d62d904baed98a10f70a9f50679fad75ecee7c7
d07d1851c730be48a9ec462e57db3a691cae2acf7913e4874278af2865d3c531
d529726dd572495a19a0b717a279f03a24b9353768c2cd7e383ae3e7634e5690
d9662b4b9ba6c2c3691ce0acd4572e027366eb97d6070550a13429262bb0037f
dbb67c620eaabf6679a314db18d3ae43037aef71ab27422e6feec08ee987cc0a
dc844732bd61279e509bda7247ed7fca55e5fced96db9c79eed48ca084e5ce0a
e7b44c86b050fca766a96ddac2d0932af0126da6f2305280342d909168dcce6b
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f32d41f2099a0be20e6b57c5e0d1b71c079d3e1345827b0f5c5b97c6e5e3f78d
f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1
fa2a1251e9904e2e8c67008d34a213b2f4c73e4710858140916581189da6b6c3