![](/screenshots/85d99c9d-dc3f-4d28-8566-863bb29993ee.png)
pylos.co
Open in
urlscan Pro
162.241.219.164
Public Scan
Submission: On June 20 via api from US — Scanned from DE
Summary
TLS certificate: Issued by R3 on April 20th 2022. Valid for: 3 months.
This is the only time pylos.co was scanned on urlscan.io!
urlscan.io Verdict: No classification
Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
23 | 162.241.219.164 162.241.219.164 | 46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1) | |
2 | 2a00:1450:400... 2a00:1450:4001:82a::200a | 15169 (GOOGLE) (GOOGLE) | |
2 | 192.0.76.3 192.0.76.3 | 2635 (AUTOMATTIC) (AUTOMATTIC) | |
2 | 2a00:1450:400... 2a00:1450:4001:828::2003 | 15169 (GOOGLE) (GOOGLE) | |
4 | 192.0.77.32 192.0.77.32 | 2635 (AUTOMATTIC) (AUTOMATTIC) | |
1 | 192.0.78.22 192.0.78.22 | 2635 (AUTOMATTIC) (AUTOMATTIC) | |
34 | 7 |
ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: box5655.bluehost.com
pylos.co |
ASN2635 (AUTOMATTIC, US)
PTR: wordpress.com
widgets.wp.com | |
s0.wp.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
23 |
pylos.co
pylos.co |
267 KB |
6 |
wp.com
stats.wp.com — Cisco Umbrella Rank: 2946 widgets.wp.com — Cisco Umbrella Rank: 11112 pixel.wp.com — Cisco Umbrella Rank: 2681 s0.wp.com — Cisco Umbrella Rank: 6896 |
27 KB |
2 |
gstatic.com
fonts.gstatic.com |
46 KB |
2 |
googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 67 |
2 KB |
1 |
wordpress.com
public-api.wordpress.com — Cisco Umbrella Rank: 7860 |
4 KB |
34 | 5 |
Domain | Requested by | |
---|---|---|
23 | pylos.co |
pylos.co
|
3 | s0.wp.com |
widgets.wp.com
public-api.wordpress.com |
2 | fonts.gstatic.com |
fonts.googleapis.com
|
2 | fonts.googleapis.com |
pylos.co
|
1 | public-api.wordpress.com |
s0.wp.com
|
1 | pixel.wp.com |
pylos.co
|
1 | widgets.wp.com |
pylos.co
|
1 | stats.wp.com |
pylos.co
|
34 | 8 |
This site contains links to these domains. Also see Links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
webdisk.pylos.co R3 |
2022-04-20 - 2022-07-19 |
3 months | crt.sh |
upload.video.google.com GTS CA 1C3 |
2022-05-30 - 2022-08-22 |
3 months | crt.sh |
*.wp.com Sectigo RSA Domain Validation Secure Server CA |
2022-06-11 - 2023-07-12 |
a year | crt.sh |
*.gstatic.com GTS CA 1C3 |
2022-05-30 - 2022-08-22 |
3 months | crt.sh |
*.wordpress.com Sectigo RSA Domain Validation Secure Server CA |
2020-08-12 - 2022-11-14 |
2 years | crt.sh |
This page contains 3 frames:
Primary Page:
https://pylos.co/2018/11/18/cozybear-in-from-the-cold/
Frame ID: 78090C6F77E82DB8ABEB25EC6EC02A12
Requests: 30 HTTP requests in this frame
Frame:
https://widgets.wp.com/likes/master.html?ver=202225
Frame ID: D3E39923AF983D1C6E3F049F3EEE3BD3
Requests: 3 HTTP requests in this frame
Frame:
https://public-api.wordpress.com/wp-admin/rest-proxy/
Frame ID: C62E55ED75636BEBB0786BE16BF92DCC
Requests: 2 HTTP requests in this frame
Screenshot
![](/screenshots/85d99c9d-dc3f-4d28-8566-863bb29993ee.png)
Page Title
CozyBear – In from the Cold? – Stranded on PylosDetected technologies
Detected patterns
- <link rel=["']stylesheet["'] [^>]+/wp-(?:content|includes)/
- <link[^>]+s\d+\.wp\.com
- /wp-(?:content|includes)/
![](/vendor/wappa/icons/Bootstrap.png)
Detected patterns
- <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
![](/vendor/wappa/icons/Google Font API.png)
Detected patterns
- <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com
Detected patterns
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Detected patterns
- jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?
Page Statistics
33 Outgoing links
These are links going to different origins than the main page.
Title: CozyBear
Search URL Search Domain Scan URL
Title: APT29
Search URL Search Domain Scan URL
Title: CozyDuke
Search URL Search Domain Scan URL
Title: The Dukes
Search URL Search Domain Scan URL
Title: Office Monkeys
Search URL Search Domain Scan URL
Title: back
Search URL Search Domain Scan URL
Title: reporting
Search URL Search Domain Scan URL
Title: Skepticism
Search URL Search Domain Scan URL
Title: crept
Search URL Search Domain Scan URL
Title: fairly
Search URL Search Domain Scan URL
Title: Turla
Search URL Search Domain Scan URL
Title: tradecraft
Search URL Search Domain Scan URL
Title: theme
Search URL Search Domain Scan URL
Title: LNK
Search URL Search Domain Scan URL
Title: legitimate services
Search URL Search Domain Scan URL
Title: pattern
Search URL Search Domain Scan URL
Title: activity
Search URL Search Domain Scan URL
Title: past observations
Search URL Search Domain Scan URL
Title: military deception
Search URL Search Domain Scan URL
Title: Occam’s razor
Search URL Search Domain Scan URL
Title: recently
Search URL Search Domain Scan URL
Title: observed
Search URL Search Domain Scan URL
Title: Dutch
Search URL Search Domain Scan URL
Title: behaviors
Search URL Search Domain Scan URL
Title: how many angels can dance on the head of this pin
Search URL Search Domain Scan URL
Title: cop out
Search URL Search Domain Scan URL
Title: retributive justice
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Title: Nuovi IOC APT 29 (Cozy Bear) – NOVEMBRE 2018 – theVirus00
Search URL Search Domain Scan URL
Title: https://iec56w4ibovnb4wc.onion
Search URL Search Domain Scan URL
Title: IT Security Weekend Catch Up – November 25, 2018 – BadCyber
Search URL Search Domain Scan URL
Title: ThemeIsle
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
34 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
pylos.co/2018/11/18/cozybear-in-from-the-cold/ |
94 KB 32 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
style.min.css
pylos.co/wp-includes/css/dist/block-library/ |
87 KB 16 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
mediaelementplayer-legacy.min.css
pylos.co/wp-includes/js/mediaelement/ |
11 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
wp-mediaelement.min.css
pylos.co/wp-includes/js/mediaelement/ |
4 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.css
pylos.co/wp-content/themes/hestia/assets/bootstrap/css/ |
71 KB 18 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
style.css
pylos.co/wp-content/themes/hestia/ |
171 KB 40 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
font-sizes.min.css
pylos.co/wp-content/themes/hestia/assets/css/ |
4 KB 878 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
style.css
pylos.co/wp-content/themes/orfeo/ |
70 KB 15 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
12 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
6 KB 677 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
social-logos.min.css
pylos.co/wp-content/plugins/jetpack/_inc/social-logos/ |
12 KB 8 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jetpack.css
pylos.co/wp-content/plugins/jetpack/css/ |
86 KB 24 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
wp-emoji-release.min.js
pylos.co/wp-includes/js/ |
18 KB 5 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
related-posts.min.js
pylos.co/wp-content/plugins/jetpack/_inc/build/related-posts/ |
6 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
pylos.co/wp-includes/js/jquery/ |
87 KB 38 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-migrate.min.js
pylos.co/wp-includes/js/jquery/ |
11 KB 5 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
photon.min.js
pylos.co/wp-content/plugins/jetpack/_inc/build/photon/ |
685 B 405 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
comment-reply.min.js
pylos.co/wp-includes/js/ |
3 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.js
pylos.co/wp-content/themes/hestia/assets/bootstrap/js/ |
23 KB 9 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
core.min.js
pylos.co/wp-includes/js/jquery/ui/ |
20 KB 8 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
script.min.js
pylos.co/wp-content/themes/hestia/assets/js/ |
21 KB 7 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
queuehandler.min.js
pylos.co/wp-content/plugins/jetpack/_inc/build/likes/ |
6 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sharing.min.js
pylos.co/wp-content/plugins/jetpack/_inc/build/sharedaddy/ |
11 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
e-202225.js
stats.wp.com/ |
9 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
JTUSjIg1_i6t8kCHKm459Wlhyw.woff2
fonts.gstatic.com/s/montserrat/v24/ |
30 KB 30 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
master.html
widgets.wp.com/likes/ Frame D3E3 |
3 KB 1 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
cozy_bear_and_fancy_bear_by_forthebluesy-da6qu13-e1542510600795.jpg
pylos.co/wp-content/uploads/2018/11/ |
22 KB 23 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
7 KB 7 KB |
Font
application/font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v30/ |
15 KB 16 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
g.gif
pixel.wp.com/ |
50 B 93 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
pylos.co/2018/11/18/cozybear-in-from-the-cold/ |
2 KB 1 KB |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
rlt-proxy.js
s0.wp.com/wp-content/js/ Frame D3E3 |
5 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
s0.wp.com/_static/ Frame D3E3 |
81 KB 20 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
public-api.wordpress.com/wp-admin/rest-proxy/ Frame C62E |
8 KB 4 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
rlt-proxy.js
s0.wp.com/wp-content/js/ Frame C62E |
5 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
24 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails object| navigation object| _wpemojiSettings object| related_posts_js_options undefined| $ function| jQuery object| WPCOM_sharing_counts object| addComment object| requestpost object| sharing_js_options object| WPCOMSharing undefined| windowOpen object| _stq function| st_go function| linktracker_init object| wpcom object| twemoji object| wp0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
fonts.googleapis.com
fonts.gstatic.com
pixel.wp.com
public-api.wordpress.com
pylos.co
s0.wp.com
stats.wp.com
widgets.wp.com
162.241.219.164
192.0.76.3
192.0.77.32
192.0.78.22
2a00:1450:4001:828::2003
2a00:1450:4001:82a::200a
029e0a2e809fd6b5dbe76abe8b7a74936be306c9a8c27c814c4d44aa54623300
1153ab7e7066f7c9394c7451ed845b30a0530df734cf8be547bdb9df31cde6ee
240b702419d6c39ecc4896f0132ccfc9bc517e9aef0c782d99580e0c678b47d5
27e8e6cd55a966d38d42835f06bf6e803e5770f0abedd8fd6de8a24a5a688042
2e10d353ff038c2cad3492fc17801af3e6ef2669c9e9713bdb78b1dcb104c4fe
420033f9eaf95478a450e558f93ae6d7a5ad950c3e78f38832b47f9e2164418a
4ebecd8afd2424508ba7ee31ec8cf590613f0f316548badaf2c11d3be79b2d89
4f1e2ab1e239967c7acfcf1e9329e7bd1bae7482954c108b0c7ba042c65380a4
5aad5fbd4238981a9ff5e2772ff1353dfe1a801fb49542fe157418c1438f7782
5cfd3418ebf7c95f8f7a9024ebfa383ff5a267a8568c9a2708c26733824bdf07
6fb1ebf7d05d7235b6cff049056242de93930660c9e79677045fcb13942eb9b0
82d0aae1e7b8cfc0574d6548d1f35096f5e4310321aa964ff3fdb46c4d12e302
955c9994638a653c13afda75fcd1640664c3036243f8aa80bdd6fc606bbb61a7
9acbf11bf79ceb195bb18865b8271664cf01b0890bdf0fe3082b70769d38d87e
a1dbbafdc3544cc1a9eafad30123a7da4f4dc92a9c282efea53821cb648a4aa3
a4759eb9c94c5d6d1cde77ea3a1cb0b09d53e1319c06995125c3755f354edb9e
a501488d7d2fae77e4a6bc3624b38804eff7310e2ca0d51b7f4f67d555e16859
b24220a1cbe811e074f353e3e39612513c31cf3cfdd51cda1d247e55dcf73611
b373def15fab9a8b38cdabdc83342c3c1a9ee0de7d3ae4c7f3eaddfa132d2457
b7908a015a567ec2363011df2475368dbff34360e9da3fdff50604d6395fb646
b958e0f47861dde13a175cc69494bdb54f08e2b5e78cecf6abd16470d2085257
bd4de6a3fc0fb68d6f76ba7b93514b96a92e585c295b5351c31ad92a4b0777ea
c6ebcda16152bea0301203152170aef660be83fd04b4d652583a77f0eea43886
c84ea088d2f1004d223f17bc5c83c3d757a1753d948cff7107b2ab2107b0916f
c8f7c04f8d691138d54380550d91349271ca19cfc0f3f6666c401cfa892a12f8
cdf3f88beb166e98d2656e957b247c886d1702027559a290e74a02d58d950c8c
d17d0bd09eb78265052de6558eb3db4d11cfef6b2f41ac435d99939818d70d7c
d678ab3b4e7dddf5615012cc1a930e50dfbc967181b8fbeb1b98d61549f5ed08
e174a58a503ab84b3d1b9de12fd3895788204485170f1289e445f7b5b98ec789
e44fda2ab2cb50acc2d349f6e29fb5b9096162e014c53c8f7174a1502e73ecd2
eae159662dc6ba4267a91b416b700cbcb63dbd351c5b6fea166b04392190d0a3
f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615
fe66ac5df69c78be7dfcf75943079129dbf24a254e89febc5a7e916d40de43bc