securelist.com Open in urlscan Pro
158.160.164.142 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://securelist.com/hz-rat-attacks-wechat-and-dingtalk/113513/
Submission: On August 28 via api (August 28th 2024, 2:12:25 am UTC) from TR — Scanned from CA

Summary HTTP 77 Redirects Links 100 Behaviour Indicators

Summary

This website contacted 15 IPs in 3 countries across 14 domains to perform 77 HTTP transactions. The main IP is 158.160.164.142, located in Moscow, Russian Federation and belongs to YANDEXCLOUD, RU. The main domain is securelist.com. The Cisco Umbrella rank of the primary domain is 614797.
TLS certificate: Issued by GlobalSign RSA OV SSL CA 2018 on July 9th 2024. Valid for: a year.

This is the only time securelist.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
32	158.160.164.142 158.160.164.142	200350 (YANDEXCLOUD) (YANDEXCLOUD)
18	18.164.96.91 18.164.96.91	16509 (AMAZON-02) (AMAZON-02)
8	2600:9000:21d... 2600:9000:21da:1e00:1b:d000:d280:93a1	16509 (AMAZON-02) (AMAZON-02)
2	2607:f8b0:400... 2607:f8b0:4006:81d::2004	15169 (GOOGLE) (GOOGLE)
1	185.85.15.31 185.85.15.31	200107 (KL-EXT) (KL-EXT)
3	2607:f8b0:400... 2607:f8b0:4006:80c::2008	15169 (GOOGLE) (GOOGLE)
2	23.204.6.193 23.204.6.193	16625 (AKAMAI-AS) (AKAMAI-AS)
2	2a03:2880:f01... 2a03:2880:f012:10c:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
1	2607:f8b0:400... 2607:f8b0:4006:807::200e	15169 (GOOGLE) (GOOGLE)
1	192.28.147.68 192.28.147.68	15224 (OMNITURE) (OMNITURE)
1	2a03:2880:f11... 2a03:2880:f112:182:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
1	52.22.19.177 52.22.19.177	14618 (AMAZON-AES) (AMAZON-AES)
1	3.233.35.165 3.233.35.165	14618 (AMAZON-AES) (AMAZON-AES)
1	63.140.39.150 63.140.39.150	14618 (AMAZON-AES) (AMAZON-AES)
77	15

32 158.160.164.142 (Moscow, Russian Federation)

ASN200350 (YANDEXCLOUD, RU)

securelist.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
kasperskycontenthub.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

18 18.164.96.91 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-164-96-91.jfk50.r.cloudfront.net

assets.kasperskycontenthub.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2600:9000:21da:1e00:1b:d000:d280:93a1 (United States)

ASN16509 (AMAZON-02, US)

media.kasperskycontenthub.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2607:f8b0:4006:81d::2004 (United States)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.85.15.31 (Germany)

ASN200107 (KL-EXT, CH)

media.kaspersky.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2607:f8b0:4006:80c::2008 (United States)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 23.204.6.193 (United States)

ASN16625 (AKAMAI-AS, US)
PTR: a23-204-6-193.deploy.static.akamaitechnologies.com

munchkin.marketo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f012:10c:face:b00c:0:3 (Secaucus, United States)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4006:807::200e (United States)

ASN15169 (GOOGLE, US)

apis.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 192.28.147.68 (United States)

ASN15224 (OMNITURE, US)

802-ijn-240.mktoresp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a03:2880:f112:182:face:b00c:0:25de (Secaucus, United States)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.22.19.177 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-22-19-177.compute-1.amazonaws.com

dpm.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.233.35.165 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-233-35-165.compute-1.amazonaws.com

kaspersky.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 63.140.39.150 (United States)

ASN14618 (AMAZON-AES, US)
PTR: ip-63-140-39-150.data.adobedc.net

kaspersky.d3.sc.omtrdc.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
30	securelist.com securelist.com — Cisco Umbrella Rank: 614797	316 KB
28	kasperskycontenthub.com assets.kasperskycontenthub.com media.kasperskycontenthub.com kasperskycontenthub.com — Cisco Umbrella Rank: 883978	2 MB
3	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 112	383 KB
3	google.com www.google.com — Cisco Umbrella Rank: 10 apis.google.com — Cisco Umbrella Rank: 225	27 KB
2	demdex.net dpm.demdex.net — Cisco Umbrella Rank: 319 kaspersky.demdex.net — Cisco Umbrella Rank: 567055	917 B
2	facebook.net connect.facebook.net — Cisco Umbrella Rank: 236	87 KB
2	marketo.net munchkin.marketo.net — Cisco Umbrella Rank: 8471	6 KB
1	omtrdc.net kaspersky.d3.sc.omtrdc.net	266 B
1	facebook.com www.facebook.com — Cisco Umbrella Rank: 108
1	mktoresp.com 802-ijn-240.mktoresp.com	318 B
1	kaspersky.com media.kaspersky.com — Cisco Umbrella Rank: 291565	50 KB
0	everesttech.net Failed cm.everesttech.net Failed
0	gstatic.com Failed www.gstatic.com Failed
0	kasperskydaily.com Failed media.kasperskydaily.com Failed
77	14

	Domain	Requested by
30	securelist.com	securelist.com
18	assets.kasperskycontenthub.com	securelist.com assets.kasperskycontenthub.com
8	media.kasperskycontenthub.com	securelist.com
3	www.googletagmanager.com	securelist.com www.googletagmanager.com
2	connect.facebook.net	securelist.com connect.facebook.net
2	munchkin.marketo.net	securelist.com munchkin.marketo.net
2	kasperskycontenthub.com	securelist.com
2	www.google.com	securelist.com
1	kaspersky.d3.sc.omtrdc.net	media.kaspersky.com
1	kaspersky.demdex.net	media.kaspersky.com
1	dpm.demdex.net	media.kaspersky.com
1	www.facebook.com	connect.facebook.net
1	802-ijn-240.mktoresp.com	munchkin.marketo.net
1	apis.google.com	securelist.com
1	media.kaspersky.com	securelist.com
0	cm.everesttech.net Failed	securelist.com
0	www.gstatic.com Failed	www.google.com
0	media.kasperskydaily.com Failed	securelist.com
77	18

This site contains links to these domains. Also see Links.

Domain
www.kaspersky.com
companyaccount.kaspersky.com
securelist.ru
securelist.lat
press.kaspersky.com
my.kaspersky.com
support.kaspersky.com
ksos.kaspersky.com
cloud.kaspersky.com
apt.securelist.com
statistics.securelist.com
encyclopedia.kaspersky.com
threats.kaspersky.com
www.kasperskypartners.com
medium.com
media.kasperskycontenthub.com

Subject Issuer	Validity	Valid
securelist.com GlobalSign RSA OV SSL CA 2018	`2024-07-09` - `2025-08-10`	a year	crt.sh
media.kasperskycontenthub.com Amazon RSA 2048 M02	`2023-11-03` - `2024-12-01`	a year	crt.sh
www.google.com WR2	`2024-07-30` - `2024-10-22`	3 months	crt.sh
kasperskycontenthub.com GlobalSign RSA OV SSL CA 2018	`2024-06-25` - `2025-07-27`	a year	crt.sh
media.kaspersky.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-03-15` - `2025-03-14`	a year	crt.sh
*.google-analytics.com WR2	`2024-07-30` - `2024-10-22`	3 months	crt.sh
*.marketo.net DigiCert TLS RSA SHA256 2020 CA1	`2023-12-08` - `2024-12-11`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2024-06-06` - `2024-09-04`	3 months	crt.sh
*.apis.google.com WR2	`2024-07-30` - `2024-10-22`	3 months	crt.sh
*.mktoresp.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-09-07` - `2024-10-07`	a year	crt.sh
*.demdex.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-09-26` - `2024-10-26`	a year	crt.sh
*.d3.sc.omtrdc.net DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-02-07` - `2025-03-09`	a year	crt.sh

This page contains 2 frames:

Primary Page: https://securelist.com/hz-rat-attacks-wechat-and-dingtalk/113513/
Frame ID: 4BBA68FE482518DDACED2CB29AFE0F83
Requests: 76 HTTP requests in this frame

Frame: https://kaspersky.demdex.net/dest5.html?d_nsid=0
Frame ID: 5F7ED1E3A831F9439D3D65B8A7BC4103
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

HZ Rat backdoor for macOS harvests data from WeChat and DingTalk | Securelist

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

<link rel=["']stylesheet["'] [^>]+/wp-(?:content|includes)/
/wp-(?:content|includes)/

Google Sign-in (Social logins) Expand

Overall confidence: 100%
Detected patterns

apis\.google\.com/js/platform\.js

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Google Plus (Widgets) Expand

Overall confidence: 100%
Detected patterns

apis\.google\.com/js/[a-z]*\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js

Marketo (Marketing Automation) Expand

Overall confidence: 100%
Detected patterns

munchkin\.marketo\.\w+/(?:([\d.]+)/)?munchkin\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

reCAPTCHA (Captchas) Expand

Overall confidence: 100%
Detected patterns

/recaptcha/api\.js

Page Statistics

77
Requests

96 %
HTTPS

43 %
IPv6

14
Domains

18
Subdomains

15
IPs

3
Countries

2600 kB
Transfer

7145 kB
Size

4
Cookies

100 Outgoing links

These are links going to different origins than the main page.

URL: https://www.kaspersky.com/home-security?icid=gl_securelisheader_acq_ona_smm__onl_b2c_securelist_prodmen_______
Title: Home Products

Search URL Search Domain Scan URL

URL: https://www.kaspersky.com/small-business-security?icid=gl_securelisheader_acq_ona_smm__onl_b2b__prodmen_______
Title: Small Business 1-50 employees

Search URL Search Domain Scan URL

URL: https://www.kaspersky.com/small-to-medium-business-security?icid=gl_securelisheader_acq_ona_smm__onl_b2b_securelist_prodmen_______
Title: Medium Business 51-999 employees

Search URL Search Domain Scan URL

URL: https://www.kaspersky.com/enterprise-security?icid=gl_securelisheader_acq_ona_smm__onl_b2b_securelist_prodmen_______
Title: Enterprise 1000+ employees

Search URL Search Domain Scan URL

URL: https://companyaccount.kaspersky.com/account/login?icid=gl_securelisheader_acq_ona_smm__onl_b2b_securelist_prodmen_______
Title: CompanyAccount

Search URL Search Domain Scan URL

URL: https://www.kaspersky.com/enterprise-security/contact?icid=gl_securelisheader_acq_ona_smm__onl_b2b_securelist_prodmen_______
Title: Get In Touch

Search URL Search Domain Scan URL

URL: https://securelist.ru/hz-rat-attacks-wechat-and-dingtalk/110294/
Title: Russian

Search URL Search Domain Scan URL

URL: https://securelist.lat/
Title: Spanish

Search URL Search Domain Scan URL

URL: https://www.kaspersky.com/enterprise-security/embedded-security-internet-of-things?icid=gl_securelisheader_acq_ona_smm__onl_b2b_securelist_prodmen_______

Search URL Search Domain Scan URL

URL: https://www.kaspersky.com/enterprise-security/industrial-solution?icid=gl_securelisheader_acq_ona_smm__onl_b2b_securelist_prodmen_______

Search URL Search Domain Scan URL

URL: https://www.kaspersky.com/enterprise-security/fraud-prevention?icid=gl_securelisheader_acq_ona_smm__onl_b2b_securelist_prodmen_______

Search URL Search Domain Scan URL

URL: https://www.kaspersky.com/enterprise-security/kasperskyos?icid=gl_securelisheader_acq_ona_smm__onl_b2b_securelist_prodmen_______
Title: KasperskyOS-based solutions

Search URL Search Domain Scan URL

URL: https://www.kaspersky.com/enterprise-security/security-operations-center-soc?icid=gl_securelisheader_acq_ona_smm__onl_b2b_securelist_prodmen_______
Title: Kaspersky for Security Operations Center

Search URL Search Domain Scan URL

URL: https://www.kaspersky.com/enterprise-security/kaspersky-iot-infrastructure-security?icid=gl_securelisheader_acq_ona_smm__onl_b2b_securelist_prodmen_______
Title: Kaspersky IoT Infrastructure Security

Search URL Search Domain Scan URL

URL: https://www.kaspersky.com/enterprise-security/kaspersky-secure-remote-workspace?icid=gl_securelisheader_acq_ona_smm__onl_b2b_securelist_prodmen_______
Title: Kaspersky Secure Remote Workspace

Search URL Search Domain Scan URL

URL: https://www.kaspersky.com/enterprise-security/industries?icid=gl_securelisheader_acq_ona_smm__onl_b2b_securelist_prodmen_______
Title: Industries

Search URL Search Domain Scan URL

URL: https://www.kaspersky.com/enterprise-security/national-cybersecurity?icid=gl_securelisheader_acq_ona_smm__onl_b2b_securelist_prodmen_______

Search URL Search Domain Scan URL

URL: https://www.kaspersky.com/enterprise-security/industrial?icid=gl_securelisheader_acq_ona_smm__onl_b2b_securelist_prodmen_______

Search URL Search Domain Scan URL

URL: https://www.kaspersky.com/enterprise-security/finance?icid=gl_securelisheader_acq_ona_smm__onl_b2b_securelist_prodmen_______

Search URL Search Domain Scan URL

URL: https://www.kaspersky.com/enterprise-security/healthcare?icid=gl_securelisheader_acq_ona_smm__onl_b2b_securelist_prodmen_______

Search URL Search Domain Scan URL

URL: https://www.kaspersky.com/enterprise-security/transportation-cybersecurity-it-infrastructure?icid=gl_securelisheader_acq_ona_smm__onl_b2b_securelist_prodmen_______

Search URL Search Domain Scan URL

URL: https://www.kaspersky.com/enterprise-security/retail-cybersecurity?icid=gl_securelisheader_acq_ona_smm__onl_b2b_securelist_prodmen_______

Search URL Search Domain Scan URL

URL: https://www.kaspersky.com/enterprise-security/telecom?icid=gl_securelisheader_acq_ona_smm__onl_b2b_securelist_prodmen_______
Title: Telecom Cybersecurity

Search URL Search Domain Scan URL

URL: https://www.kaspersky.com/enterprise-security/products?icid=gl_securelisheader_acq_ona_smm__onl_b2b_securelist_prodmen_______
Title: Products

Search URL Search Domain Scan URL

URL: https://www.kaspersky.com/next?icid=gl_seclistheader_acq_ona_smm__onl_b2b_securelist_prodmen_sm-team___knext___
Title: Kaspersky Next NEW!

Search URL Search Domain Scan URL

URL: https://www.kaspersky.com/enterprise-security/xdr?icid=gl_securelisheader_acq_ona_smm__onl_b2b_securelist_prodmen_______
Title: KasperskyXDR

Search URL Search Domain Scan URL

URL: https://www.kaspersky.com/enterprise-security/endpoint?icid=gl_securelisheader_acq_ona_smm__onl_b2b_securelist_prodmen_______

Search URL Search Domain Scan URL

URL: https://www.kaspersky.com/enterprise-security/endpoint-detection-response-edr

Search URL Search Domain Scan URL

URL: https://www.kaspersky.com/enterprise-security/edr-security-software-solution?icid=gl_securelisheader_acq_ona_smm__onl_b2b_securelist_prodmen_______

Search URL Search Domain Scan URL

URL: https://www.kaspersky.com/enterprise-security/anti-targeted-attack-platform?icid=gl_securelisheader_acq_ona_smm__onl_b2b_securelist_prodmen_______

Search URL Search Domain Scan URL

URL: https://www.kaspersky.com/enterprise-security/cloud-security?icid=gl_securelisheader_acq_ona_smm__onl_b2b_securelist_prodmen_______
Title: KasperskyHybrid Cloud Security

Search URL Search Domain Scan URL

URL: https://www.kaspersky.com/enterprise-security/sd-wan?icid=gl_securelisheader_acq_ona_smm__onl_b2b_securelist_prodmen_______
Title: KasperskySD-WAN

Search URL Search Domain Scan URL

URL: https://www.kaspersky.com/enterprise-security/industrial-cybersecurity?icid=gl_securelisheader_acq_ona_smm__onl_b2b_securelist_prodmen_______

Search URL Search Domain Scan URL

URL: https://www.kaspersky.com/enterprise-security/container-security?icid=gl_securelisheader_acq_ona_smm__onl_b2b_securelist_prodmen_______

Search URL Search Domain Scan URL

URL: https://www.kaspersky.com/enterprise-security/products/internet-gateway?icid=gl_securelisheader_acq_ona_smm__onl_b2b_securelist_prodmen_______
Title: Kaspersky Security for Internet Gateway

Search URL Search Domain Scan URL

URL: https://www.kaspersky.com/enterprise-security/embedded-systems?icid=gl_securelisheader_acq_ona_smm__onl_b2b_securelist_prodmen_______
Title: Kaspersky Embedded Systems Security

Search URL Search Domain Scan URL

URL: https://www.kaspersky.com/enterprise-security/mail-server-security?icid=gl_securelisheader_acq_ona_smm__onl_b2b_securelist_prodmen_______
Title: Kaspersky Security for Mail Server

Search URL Search Domain Scan URL

URL: https://www.kaspersky.com/enterprise-security/services?icid=gl_securelisheader_acq_ona_smm__onl_b2b_securelist_prodmen_______
Title: Services

Search URL Search Domain Scan URL

URL: https://www.kaspersky.com/enterprise-security/cybersecurity-services?icid=gl_securelisheader_acq_ona_smm__onl_b2b_securelist_prodmen_______

Search URL Search Domain Scan URL

URL: https://www.kaspersky.com/enterprise-security/security-awareness?icid=gl_securelisheader_acq_ona_smm__onl_b2b_securelist_prodmen_______
Title: KasperskySecurity Awareness

Search URL Search Domain Scan URL

URL: https://www.kaspersky.com/enterprise-security/premium-support?icid=gl_securelisheader_acq_ona_smm__onl_b2b_securelist_prodmen_______

Search URL Search Domain Scan URL

URL: https://www.kaspersky.com/enterprise-security/threat-intelligence?icid=gl_securelisheader_acq_ona_smm__onl_b2b_securelist_prodmen_______

Search URL Search Domain Scan URL

URL: https://www.kaspersky.com/enterprise-security/managed-detection-and-response?icid=gl_securelisheader_acq_ona_smm__onl_b2b_securelist_prodmen_______

Search URL Search Domain Scan URL

URL: https://www.kaspersky.com/enterprise-security/compromise-assessment?icid=gl_securelisheader_acq_ona_smm__onl_b2b_securelist_prodmen_______

Search URL Search Domain Scan URL

URL: https://www.kaspersky.com/enterprise-security/soc-consulting?icid=gl_securelisheader_acq_ona_smm__onl_b2b_securelist_prodmen_______

Search URL Search Domain Scan URL

URL: https://www.kaspersky.com/enterprise-security/professional-services?icid=gl_securelisheader_acq_ona_smm__onl_b2b_securelist_prodmen_______
Title: Kaspersky Professional Services

Search URL Search Domain Scan URL

URL: https://www.kaspersky.com/enterprise-security/incident-response?icid=gl_securelisheader_acq_ona_smm__onl_b2b_securelist_prodmen_______
Title: Kaspersky Incident Response

Search URL Search Domain Scan URL

URL: https://www.kaspersky.com/enterprise-security/cyber-security-training?icid=gl_securelisheader_acq_ona_smm__onl_b2b_securelist_prodmen_______
Title: Kaspersky Cybersecurity Training

Search URL Search Domain Scan URL

URL: https://www.kaspersky.com/enterprise-security/cyber-incident-response-communication?icid=gl_securelisheader_acq_ona_smm__onl_b2b_securelist_prodmen_______
Title: Kaspersky Incident Communications

Search URL Search Domain Scan URL

URL: https://www.kaspersky.com/enterprise-security/adaptive-online-awareness-training?icid=gl_securelisheader_acq_ona_smm__onl_b2b_securelist_prodmen_______
Title: Kaspersky Adaptive Online Training

Search URL Search Domain Scan URL

URL: https://www.kaspersky.com/enterprise-security/resources?icid=gl_securelisheader_acq_ona_smm__onl_b2b_securelist_prodmen_______
Title: Resource Center

Search URL Search Domain Scan URL

URL: https://www.kaspersky.com/enterprise-security/resources/case-studies?icid=gl_securelisheader_acq_ona_smm__onl_b2b_securelist_prodmen_______
Title: Case Studies

Search URL Search Domain Scan URL

URL: https://www.kaspersky.com/enterprise-security/resources/white-papers?icid=gl_securelisheader_acq_ona_smm__onl_b2b_securelist_prodmen_______
Title: White Papers

Search URL Search Domain Scan URL

URL: https://www.kaspersky.com/enterprise-security/resources/data-sheets?icid=gl_securelisheader_acq_ona_smm__onl_b2b_securelist_prodmen_______
Title: Datasheets

Search URL Search Domain Scan URL

URL: https://www.kaspersky.com/enterprise-security/wiki-section/home?icid=gl_securelisheader_acq_ona_smm__onl_b2b_securelist_prodmen_______
Title: Technologies

Search URL Search Domain Scan URL

URL: https://www.kaspersky.com/MITRE?icid=gl_securelisheader_acq_ona_smm__onl_b2b_securelist_prodmen_______
Title: MITRE ATT&CK

Search URL Search Domain Scan URL

URL: https://www.kaspersky.com/about?icid=gl_securelisheader_acq_ona_smm__onl_b2b_securelist_prodmen_______
Title: About Us

Search URL Search Domain Scan URL

URL: https://www.kaspersky.com/about/transparency
Title: Transparency

Search URL Search Domain Scan URL

URL: https://www.kaspersky.com/about/press-releases
Title: Corporate News

Search URL Search Domain Scan URL

URL: https://press.kaspersky.com/
Title: Press Center

Search URL Search Domain Scan URL

URL: https://www.kaspersky.com/about/careers
Title: Careers

Search URL Search Domain Scan URL

URL: https://www.kaspersky.com/ihub
Title: Innovation Hub

Search URL Search Domain Scan URL

URL: https://www.kaspersky.com/about/sponsorships/
Title: Sponsorship

Search URL Search Domain Scan URL

URL: https://www.kaspersky.com/about/policy-blog
Title: Policy Blog

Search URL Search Domain Scan URL

URL: https://www.kaspersky.com/about/contact
Title: Contacts

Search URL Search Domain Scan URL

URL: https://www.kaspersky.com/gdpr?icid=gl_securelisheader_acq_ona_smm__onl_b2b_securelist_prodmen_______
Title: GDPR

Search URL Search Domain Scan URL

URL: https://my.kaspersky.com/?icid=gl_securelisheader_acq_ona_smm__onl_b2c_securelist_prodmen_______
Title: My Kaspersky

Search URL Search Domain Scan URL

URL: https://www.kaspersky.com/renewal-center/home?icid=gl_securelisheader_acq_ona_smm__onl_b2c_securelist_prodmen_______
Title: Renew your product

Search URL Search Domain Scan URL

URL: https://www.kaspersky.com/downloads?icid=gl_securelisheader_acq_ona_smm__onl_b2c_securelist_prodmen_______#update-product
Title: Update your product

Search URL Search Domain Scan URL

URL: https://support.kaspersky.com/?icid=gl_securelisheader_acq_ona_smm__onl_b2c_securelist_prodmen_______
Title: Customer support

Search URL Search Domain Scan URL

URL: https://ksos.kaspersky.com/?icid=gl_securelisheader_acq_ona_smm__onl_b2b__prodmen_______
Title: KSOS portal

Search URL Search Domain Scan URL

URL: https://cloud.kaspersky.com/?icid=gl_securelisheader_acq_ona_smm__onl_b2b__prodmen_______
Title: Kaspersky Business Hub

Search URL Search Domain Scan URL

URL: https://support.kaspersky.com/?icid=gl_securelisheader_acq_ona_smm__onl_b2b__prodmen_______
Title: Technical Support

Search URL Search Domain Scan URL

URL: https://www.kaspersky.com/small-to-medium-business-security/resources?icid=gl_securelisheader_acq_ona_smm__onl_b2b__prodmen_______
Title: Knowledge Base

Search URL Search Domain Scan URL

URL: https://www.kaspersky.com/renewal-center/vsb?icid=gl_securelisheader_acq_ona_smm__onl_b2b__prodmen_______
Title: Renew License

Search URL Search Domain Scan URL

URL: https://www.kaspersky.com/downloads?icid=gl_securelisheader_acq_ona_smm__onl_b2c_securelist_prodmen_______
Title: Trials&Update

Search URL Search Domain Scan URL

URL: https://www.kaspersky.com/resource-center?icid=gl_securelisheader_acq_ona_smm__onl_b2c_securelist_prodmen_______
Title: Resource Center

Search URL Search Domain Scan URL

URL: https://www.kaspersky.com/small-to-medium-business-security?icid=gl_securelisheader_acq_ona_smm__onl_b2b__prodmen_______
Title: Medium Business (51-999 employees)

Search URL Search Domain Scan URL

URL: https://www.kaspersky.com/enterprise-security?icid=gl_securelisheader_acq_ona_smm__onl_b2b__prodmen_______
Title: Enterprise (1000+ employees)

Search URL Search Domain Scan URL

URL: https://apt.securelist.com/
Title: APT Logbook

Search URL Search Domain Scan URL

URL: https://statistics.securelist.com/
Title: Statistics

Search URL Search Domain Scan URL

URL: https://encyclopedia.kaspersky.com/
Title: Encyclopedia

Search URL Search Domain Scan URL

URL: https://threats.kaspersky.com/
Title: Threats descriptions

Search URL Search Domain Scan URL

URL: https://www.kaspersky.com/about/company?icid=gl_securelisheader_acq_ona_smm__onl_b2b__prodmen_______
Title: Company

Search URL Search Domain Scan URL

URL: https://www.kaspersky.com/transparency?icid=gl_securelisheader_acq_ona_smm__onl_b2b__prodmen_______
Title: Transparency

Search URL Search Domain Scan URL

URL: https://www.kaspersky.com/about/press-releases?icid=gl_securelisheader_acq_ona_smm__onl_b2b__prodmen_______
Title: Corporate News

Search URL Search Domain Scan URL

URL: https://press.kaspersky.com/?icid=gl_securelisheader_acq_ona_smm__onl_b2b__prodmen_______
Title: Press Center

Search URL Search Domain Scan URL

URL: https://www.kaspersky.com/about/careers?icid=gl_securelisheader_acq_ona_smm__onl_b2b__prodmen_______
Title: Careers

Search URL Search Domain Scan URL

URL: https://www.kaspersky.com/about/sponsorships/?icid=gl_securelisheader_acq_ona_smm__onl_b2b__prodmen_______
Title: Sponsorships

Search URL Search Domain Scan URL

URL: https://www.kaspersky.com/about/policy-blog?icid=gl_securelisheader_acq_ona_smm__onl_b2b__prodmen_______
Title: Policy Blog

Search URL Search Domain Scan URL

URL: https://www.kaspersky.com/about/contact?icid=gl_securelisheader_acq_ona_smm__onl_b2b__prodmen_______
Title: Contacts

Search URL Search Domain Scan URL

URL: https://www.kasperskypartners.com/?icid=gl_securelisheader_acq_ona_smm__onl_b2b__prodmen_______
Title: Find a Partner

Search URL Search Domain Scan URL

URL: https://www.kaspersky.com/partners?icid=gl_securelisheader_acq_ona_smm__onl_b2b__prodmen_______
Title: Partner Program

Search URL Search Domain Scan URL

URL: https://medium.com/%40DCSO_CyTec/hz-rat-goes-china-506854c5f2e2
Title: detected by DCSO researchers

Search URL Search Domain Scan URL

URL: https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2024/08/26153517/hz_rat_attacks_wechat_and_dingtalk_01.png

Search URL Search Domain Scan URL

URL: https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2024/08/26153549/hz_rat_attacks_wechat_and_dingtalk_02.png

Search URL Search Domain Scan URL

URL: https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2024/08/26153617/hz_rat_attacks_wechat_and_dingtalk_03.png

Search URL Search Domain Scan URL

URL: https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2024/08/26153649/hz_rat_attacks_wechat_and_dingtalk_04.png

Search URL Search Domain Scan URL

URL: https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2024/08/26153729/hz_rat_attacks_wechat_and_dingtalk_05.png

Search URL Search Domain Scan URL

URL: https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2024/08/26154147/hz_rat_attacks_wechat_and_dingtalk_06.png

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

77 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
securelist.com/hz-rat-attacks-wechat-and-dingtalk/113513/ 198 KB
44 KB 1197ms
376ms Document
text/html 158.160.164.142
YANDEXCLOUD

General

Check archive.org

Show headers Download Go to

Full URL

https://securelist.com/hz-rat-attacks-wechat-and-dingtalk/113513/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

158.160.164.142 Moscow, Russian Federation, ASN200350 (YANDEXCLOUD, RU),

Reverse DNS

Software

ycalb /

Resource Hash

cdb3705fcc82b40d70939dc2bdc99949b46a1e6f9e9c6e9c9f41204cfb0ec495

Security Headers

Name	Value
Content-Security-Policy	connect-src 'self' https://.demdex.net https://.doubleclick.net https://.facebook.com https://.facebook.net https://.google-analytics.com https://.google.com https://.kaspersky.ca https://.kaspersky.co.jp https://.kaspersky.co.uk https://.kaspersky.co.za https://.kaspersky.com https://.kaspersky.com.au https://.kaspersky.com.br https://.kaspersky.com.tr https://.kaspersky.de https://.kaspersky.es https://.kaspersky.fr https://.kaspersky.it https://.kaspersky.nl https://.kaspersky.pt https://.kaspersky.ru https://.kaspersky.se https://.kasperskycontenthub.com https://.mktoresp.com https://.pingdom.net https://.reddit.com https://.securelist.com https://.securelist.lat https://.securelist.ru https://.yandex.com https://.yandex.ru https://.youtube.com https://box.kaspersky.com https://consentcdn.cookiebot.com https://e.infogram.com https://kaspersky.d3.sc.omtrdc.net https://kasperskycontenthub.com https://securelist.com https://tpc.googlesyndication.com https://www.googletagmanager.com; default-src 'self' https://.kasperskycontenthub.com https://.securelist.com https://.securelist.lat https://.securelist.ru https://box.kaspersky.com https://kasperskycontenthub.com https://securelist.com https://tpc.googlesyndication.com; font-src 'self' data: https://.gstatic.com https://.kasperskycontenthub.com https://.securelist.com https://.securelist.lat https://.securelist.ru https://.wp.com https://assets.kasperskycontenthub.com https://assets.threatpost.com https://box.kaspersky.com https://fonts.googleapis.com https://kasperskycontenthub.com https://securelist.com https://tpc.googlesyndication.com; frame-src 'self' http://.slideshare.net https://.doubleclick.net https://.facebook.com https://.google.com https://.googletagservices.com https://.infogram.com https://.instagram.com https://.kasperskycontenthub.com https://.libsyn.com https://.marketo.com https://.securelist.com https://.securelist.lat https://.securelist.ru https://.sharethis.com https://.slideshare.net https://.twitter.com https://.wp.com https://.yandex.com https://.yandex.ru https://.youtube.com https://box.kaspersky.com https://consentcdn.cookiebot.com https://dzen.ru https://go.kaspersky.com https://infogram.com https://kaspersky.demdex.net https://kasperskycontenthub.com https://player.vimeo.com https://securelist.com https://tpc.googlesyndication.com https://vk.com https://www.brighttalk.com; img-src 'self' data: http://.wordpress.com http://.wp.com http://assets.kasperskydaily.com http://d2538mqrb7brka.cloudfront.net http://forum.kasperskyclub.ru http://i0.poll.fm https://.cdninstagram.com https://.doubleclick.net https://.facebook.com https://.google-analytics.com https://.google.com https://.google.ru https://.gravatar.com https://.gstatic.com https://.infogram.com https://.instagram.com https://.kaspersky.ca https://.kaspersky.co.jp https://.kaspersky.co.uk https://.kaspersky.co.za https://.kaspersky.com https://.kaspersky.com.au https://.kaspersky.com.br https://.kaspersky.com.tr https://.kaspersky.de https://.kaspersky.es https://.kaspersky.fr https://.kaspersky.it https://.kaspersky.nl https://.kaspersky.pt https://.kaspersky.ru https://.kaspersky.se https://.kasperskycontenthub.com https://.kasperskydaily.com https://.securelist.com https://.securelist.lat https://.securelist.ru https://.sharethis.com https://.staticflickr.com https://.threatpost.com https://.twimg.com https://.twitter.com https://.vk.com https://.wordpress.com https://.wp.com https://.yandex.com https://.yandex.ru https://.ytimg.com https://assets.kasperskydaily.com https://box.kaspersky.com https://d1srlirzdlmpew.cloudfront.net https://d2538mqrb7brka.cloudfront.net https://kaspersky.d2.sc.omtrdc.net https://kaspersky.d3.sc.omtrdc.net https://kasperskycontenthub.com https://maps.googleapis.com https://player.vimeo.com https://polldaddy.com https://rum-collector.pingdom.net https://s.w.org https://s3-eu-west-1.amazonaws.com https://securelist.com https://securelist.lat https://securelist.ru https://stats.g.doubleclick.net https://t.co https://threatpost.com https://tpc.googlesyndication.com https://vk.com https://www.googletagmanager.com; object-src 'self' https://.kasperskycontenthub.com https://.securelist.com https://.securelist.lat https://.securelist.ru https://box.kaspersky.com https://kasperskycontenthub.com https://player.vimeo.com https://polldaddy.com https://securelist.com https://tpc.googlesyndication.com; script-src 'self' 'unsafe-eval' 'unsafe-inline' https://.cloudfront.net https://.crazyegg.com https://.demdex.net https://.doubleclick.net https://.facebook.com https://.facebook.net https://.flickr.com https://.google-analytics.com https://.google.com https://.googleapis.com https://.googlesyndication.com https://.googletagservices.com https://.gravatar.com https://.gstatic.com https://.instagram.com https://.kaspersky.ca https://.kaspersky.co.jp https://.kaspersky.co.uk https://.kaspersky.co.za https://.kaspersky.com https://.kaspersky.com.au https://.kaspersky.com.br https://.kaspersky.com.tr https://.kaspersky.de https://.kaspersky.es https://.kaspersky.fr https://.kaspersky.it https://.kaspersky.nl https://.kaspersky.pt https://.kaspersky.ru https://.kaspersky.se https://.kasperskycontenthub.com https://.marketo.com https://.marketo.net https://.polldaddy.com https://.securelist.com https://.securelist.lat https://.securelist.ru https://.sharethis.com https://.threatpost.com https://.twimg.com https://.twitter.com https://.woopra.com https://.wp.com https://.yandex.com https://.yandex.ru https://assets.adobedtm.com https://box.kaspersky.com https://cdnjs.cloudflare.com https://connect.mail.ru https://consent.cookiebot.com https://consentcdn.cookiebot.com https://e.infogram.com https://kaspersky.d2.sc.omtrdc.net https://kasperskycontenthub.com https://player.vimeo.com https://polldaddy.com https://rum-static.pingdom.net https://s.ytimg.com https://securelist.com https://tpc.googlesyndication.com https://vk.com https://www.brighttalk.com https://www.googleoptimize.com https://www.googletagmanager.com https://www.googletagservices.com https://www.linkedin.com https://www.youtube.com; style-src 'self' 'unsafe-inline' https://.google.com https://.googleapis.com https://.gravatar.com https://.kaspersky.com https://.kasperskycontenthub.com https://.marketo.com https://.securelist.com https://.securelist.lat https://.securelist.ru https://.sharethis.com https://.threatpost.com https://.twimg.com https://.twitter.com https://.wp.com https://box.kaspersky.com https://kasperskycontenthub.com https://securelist.com https://tpc.googlesyndication.com https://www.googletagmanager.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 14119
content-encoding: gzip
content-length: 39078
content-security-policy: connect-src 'self' https://*.demdex.net https://*.doubleclick.net https://*.facebook.com https://*.facebook.net https://*.google-analytics.com https://*.google.com https://*.kaspersky.ca https://*.kaspersky.co.jp https://*.kaspersky.co.uk https://*.kaspersky.co.za https://*.kaspersky.com https://*.kaspersky.com.au https://*.kaspersky.com.br https://*.kaspersky.com.tr https://*.kaspersky.de https://*.kaspersky.es https://*.kaspersky.fr https://*.kaspersky.it https://*.kaspersky.nl https://*.kaspersky.pt https://*.kaspersky.ru https://*.kaspersky.se https://*.kasperskycontenthub.com https://*.mktoresp.com https://*.pingdom.net https://*.reddit.com https://*.securelist.com https://*.securelist.lat https://*.securelist.ru https://*.yandex.com https://*.yandex.ru https://*.youtube.com https://box.kaspersky.com https://consentcdn.cookiebot.com https://e.infogram.com https://kaspersky.d3.sc.omtrdc.net https://kasperskycontenthub.com https://securelist.com https://tpc.googlesyndication.com https://www.googletagmanager.com; default-src 'self' https://*.kasperskycontenthub.com https://*.securelist.com https://*.securelist.lat https://*.securelist.ru https://box.kaspersky.com https://kasperskycontenthub.com https://securelist.com https://tpc.googlesyndication.com; font-src 'self' data: https://*.gstatic.com https://*.kasperskycontenthub.com https://*.securelist.com https://*.securelist.lat https://*.securelist.ru https://*.wp.com https://assets.kasperskycontenthub.com https://assets.threatpost.com https://box.kaspersky.com https://fonts.googleapis.com https://kasperskycontenthub.com https://securelist.com https://tpc.googlesyndication.com; frame-src 'self' http://*.slideshare.net https://*.doubleclick.net https://*.facebook.com https://*.google.com https://*.googletagservices.com https://*.infogram.com https://*.instagram.com https://*.kasperskycontenthub.com https://*.libsyn.com https://*.marketo.com https://*.securelist.com https://*.securelist.lat https://*.securelist.ru https://*.sharethis.com https://*.slideshare.net https://*.twitter.com https://*.wp.com https://*.yandex.com https://*.yandex.ru https://*.youtube.com https://box.kaspersky.com https://consentcdn.cookiebot.com https://dzen.ru https://go.kaspersky.com https://infogram.com https://kaspersky.demdex.net https://kasperskycontenthub.com https://player.vimeo.com https://securelist.com https://tpc.googlesyndication.com https://vk.com https://www.brighttalk.com; img-src 'self' data: http://*.wordpress.com http://*.wp.com http://assets.kasperskydaily.com http://d2538mqrb7brka.cloudfront.net http://forum.kasperskyclub.ru http://i0.poll.fm https://*.cdninstagram.com https://*.doubleclick.net https://*.facebook.com https://*.google-analytics.com https://*.google.com https://*.google.ru https://*.gravatar.com https://*.gstatic.com https://*.infogram.com https://*.instagram.com https://*.kaspersky.ca https://*.kaspersky.co.jp https://*.kaspersky.co.uk https://*.kaspersky.co.za https://*.kaspersky.com https://*.kaspersky.com.au https://*.kaspersky.com.br https://*.kaspersky.com.tr https://*.kaspersky.de https://*.kaspersky.es https://*.kaspersky.fr https://*.kaspersky.it https://*.kaspersky.nl https://*.kaspersky.pt https://*.kaspersky.ru https://*.kaspersky.se https://*.kasperskycontenthub.com https://*.kasperskydaily.com https://*.securelist.com https://*.securelist.lat https://*.securelist.ru https://*.sharethis.com https://*.staticflickr.com https://*.threatpost.com https://*.twimg.com https://*.twitter.com https://*.vk.com https://*.wordpress.com https://*.wp.com https://*.yandex.com https://*.yandex.ru https://*.ytimg.com https://assets.kasperskydaily.com https://box.kaspersky.com https://d1srlirzdlmpew.cloudfront.net https://d2538mqrb7brka.cloudfront.net https://kaspersky.d2.sc.omtrdc.net https://kaspersky.d3.sc.omtrdc.net https://kasperskycontenthub.com https://maps.googleapis.com https://player.vimeo.com https://polldaddy.com https://rum-collector.pingdom.net https://s.w.org https://s3-eu-west-1.amazonaws.com https://securelist.com https://securelist.lat https://securelist.ru https://stats.g.doubleclick.net https://t.co https://threatpost.com https://tpc.googlesyndication.com https://vk.com https://www.googletagmanager.com; object-src 'self' https://*.kasperskycontenthub.com https://*.securelist.com https://*.securelist.lat https://*.securelist.ru https://box.kaspersky.com https://kasperskycontenthub.com https://player.vimeo.com https://polldaddy.com https://securelist.com https://tpc.googlesyndication.com; script-src 'self' 'unsafe-eval' 'unsafe-inline' https://*.cloudfront.net https://*.crazyegg.com https://*.demdex.net https://*.doubleclick.net https://*.facebook.com https://*.facebook.net https://*.flickr.com https://*.google-analytics.com https://*.google.com https://*.googleapis.com https://*.googlesyndication.com https://*.googletagservices.com https://*.gravatar.com https://*.gstatic.com https://*.instagram.com https://*.kaspersky.ca https://*.kaspersky.co.jp https://*.kaspersky.co.uk https://*.kaspersky.co.za https://*.kaspersky.com https://*.kaspersky.com.au https://*.kaspersky.com.br https://*.kaspersky.com.tr https://*.kaspersky.de https://*.kaspersky.es https://*.kaspersky.fr https://*.kaspersky.it https://*.kaspersky.nl https://*.kaspersky.pt https://*.kaspersky.ru https://*.kaspersky.se https://*.kasperskycontenthub.com https://*.marketo.com https://*.marketo.net https://*.polldaddy.com https://*.securelist.com https://*.securelist.lat https://*.securelist.ru https://*.sharethis.com https://*.threatpost.com https://*.twimg.com https://*.twitter.com https://*.woopra.com https://*.wp.com https://*.yandex.com https://*.yandex.ru https://assets.adobedtm.com https://box.kaspersky.com https://cdnjs.cloudflare.com https://connect.mail.ru https://consent.cookiebot.com https://consentcdn.cookiebot.com https://e.infogram.com https://kaspersky.d2.sc.omtrdc.net https://kasperskycontenthub.com https://player.vimeo.com https://polldaddy.com https://rum-static.pingdom.net https://s.ytimg.com https://securelist.com https://tpc.googlesyndication.com https://vk.com https://www.brighttalk.com https://www.googleoptimize.com https://www.googletagmanager.com https://www.googletagservices.com https://www.linkedin.com https://www.youtube.com; style-src 'self' 'unsafe-inline' https://*.google.com https://*.googleapis.com https://*.gravatar.com https://*.kaspersky.com https://*.kasperskycontenthub.com https://*.marketo.com https://*.securelist.com https://*.securelist.lat https://*.securelist.ru https://*.sharethis.com https://*.threatpost.com https://*.twimg.com https://*.twitter.com https://*.wp.com https://box.kaspersky.com https://kasperskycontenthub.com https://securelist.com https://tpc.googlesyndication.com https://www.googletagmanager.com
content-type: text/html; charset=UTF-8
date: Tue, 27 Aug 2024 22:16:58 GMT
link: <https://securelist.com/wp-json/>; rel="https://api.w.org/" <https://securelist.com/wp-json/wp/v2/posts/113513>; rel="alternate"; type="application/json" <https://securelist.com/?p=113513>; rel=shortlink
server: ycalb
strict-transport-security: max-age=31536000; includeSubDomains
vary: Accept-Encoding
via: 1.1 kch-varnish-kube-httpcache-6bbf48fc9b-q95z9 (Varnish/7.3)
x-backend: varnish
x-cache: HIT
x-cache-hit: BYPASS
x-cache-hits: 278
x-content-type-options: nosniff
x-debug-auth: off
x-frame-options: SAMEORIGIN
x-request-host: securelist.com
x-varnish: 1606734 425991
x-xss-protection: 1; mode=block

GET
H2 200 /
assets.kasperskycontenthub.com/wp-content/plugins/bwp-minify/min/ 3 MB
183 KB 451ms
65ms Stylesheet
text/css 18.164.96.91
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.kasperskycontenthub.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/crayon-syntax-highlighter/css/min/crayon.min.css,wp-content/plugins/crayon-syntax-highlighter/themes/classic/classic.css,wp-content/plugins/crayon-syntax-highlighter/fonts/monaco.css,wp-includes/css/dist/block-library/style.min.css,wp-content/plugins/jquery-collapse-o-matic/css/core_style.css,wp-content/plugins/jquery-collapse-o-matic/css/light_style.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/themes/securelist2020/assets/css/main.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css

Requested by

Host: securelist.com
URL: https://securelist.com/hz-rat-attacks-wechat-and-dingtalk/113513/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.164.96.91 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-164-96-91.jfk50.r.cloudfront.net

Software

ycalb /

Resource Hash

20b03427e659f01c2587779f62d58a3fbb5d0a0ef1c9f39e5fca47bbc1695661

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://securelist.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

x-cache-hits: 1
date: Tue, 27 Aug 2024 07:29:36 GMT
content-encoding: gzip
via: 1.1 kch-varnish-kube-httpcache-578977c959-c84fq (Varnish/7.3), 1.1 6e202b767e6bdee837ba15ada7e3120e.cloudfront.net (CloudFront)
x-backend: varnish
x-amz-cf-pop: JFK50-P5
age: 67362
x-cache: Hit from cloudfront
content-length: 186375
last-modified: Fri, 16 Aug 2024 06:26:01 GMT
server: ycalb
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: text/css; charset=utf-8
x-varnish: 886308 721652
x-cache-hit: BYPASS
cache-control: max-age=86400
x-debug-auth: off
x-request-host: kasperskycontenthub.com
accept-ranges: bytes
x-amz-cf-id: SNTD7swxTN6tiP4wewLpE6LMN_4jXXqmqzmDq8AWti5U9vxMHBdlSA==
expires: Wed, 28 Aug 2024 07:29:36 GMT

GET
H2 200 /
assets.kasperskycontenthub.com/wp-content/plugins/bwp-minify/min/ 387 B
769 B 449ms
64ms Stylesheet
text/css 18.164.96.91
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.kasperskycontenthub.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/taxonomy-images/css/style.css

Requested by

Host: securelist.com
URL: https://securelist.com/hz-rat-attacks-wechat-and-dingtalk/113513/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.164.96.91 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-164-96-91.jfk50.r.cloudfront.net

Software

ycalb /

Resource Hash

484aee1b81286040100dad5243407bd64be9aa7fc389b87ef2acd03451bc6888

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://securelist.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

x-cache-hits: 2
date: Tue, 27 Aug 2024 08:45:47 GMT
content-encoding: gzip
via: 1.1 kch-varnish-kube-httpcache-578977c959-5vxx2 (Varnish/7.3), 1.1 6e202b767e6bdee837ba15ada7e3120e.cloudfront.net (CloudFront)
x-backend: varnish
x-amz-cf-pop: JFK50-P5
age: 62791
x-cache: Hit from cloudfront
content-length: 201
last-modified: Fri, 16 Aug 2024 06:25:59 GMT
server: ycalb
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: text/css; charset=utf-8
x-varnish: 5754 691025
x-cache-hit: BYPASS
cache-control: max-age=86400
x-debug-auth: off
x-request-host: kasperskycontenthub.com
accept-ranges: bytes
x-amz-cf-id: Npctzx-4lRuroQPV1NGuP6TTAGCjM9p1GHUzNRS8XLRvdf-jqVEvTw==
expires: Wed, 28 Aug 2024 08:45:47 GMT

GET
H2 200 jquery-1.12.4-wp.js Show response
securelist.com/wp-content/plugins/kaspersky-enable-jquery-migrate-helper/js/jquery/ 95 KB
95 KB 221ms
220ms Script
application/javascript 158.160.164.142
YANDEXCLOUD

General

Check archive.org

Show headers Download Go to

Full URL: https://securelist.com/wp-content/plugins/kaspersky-enable-jquery-migrate-helper/js/jquery/jquery-1.12.4-wp.js?ver=1.12.4-wp
Requested by: Host: securelist.com
URL: https://securelist.com/hz-rat-attacks-wechat-and-dingtalk/113513/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 158.160.164.142 Moscow, Russian Federation, ASN200350 (YANDEXCLOUD, RU),
Reverse DNS
Software: ycalb /
Resource Hash: 3bb2621a4c0c710f6e78404473aebff8e115a28f8d53f44339b867c63ad93b26

Request headers

Referer: https://securelist.com/hz-rat-attacks-wechat-and-dingtalk/113513/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

expires: Tue, 03 Sep 2024 20:06:05 GMT
date: Tue, 27 Aug 2024 20:06:05 GMT
via: 1.1 kch-varnish-kube-httpcache-6bbf48fc9b-j4vmr (Varnish/7.3)
x-backend: varnish
age: 21972
x-cache: HIT
content-length: 96854
pragma: public
last-modified: Fri, 16 Aug 2024 06:26:01 GMT
server: ycalb
etag: "66bef0f9-17a56"
content-type: application/javascript
x-varnish: 8000830 13369681
cache-control: max-age=604800, public
accept-ranges: bytes
x-cache-hits: 468

GET
H2 200 / Show response
assets.kasperskycontenthub.com/wp-content/plugins/bwp-minify/min/ 21 KB
7 KB 449ms
64ms Script
application/x-javascript 18.164.96.91
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.kasperskycontenthub.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/kaspersky-lazy-load/assets/js/lazyload.js,wp-content/plugins/kaspersky-sso-integration/assets/js/main.js,wp-content/plugins/kspr_twitter_pullquote/js/kaspersky-twitter-pullquote.js,wp-content/plugins/kaspersky-social-sharing/assets/js/social-share.js

Requested by

Host: securelist.com
URL: https://securelist.com/hz-rat-attacks-wechat-and-dingtalk/113513/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.164.96.91 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-164-96-91.jfk50.r.cloudfront.net

Software

ycalb /

Resource Hash

1b2d604efc0b14f3fe050442a97e15547c317c553b2546bd5eba3d81726a8653

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://securelist.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

x-cache-hits: 3
date: Wed, 28 Aug 2024 01:04:56 GMT
content-encoding: gzip
via: 1.1 kch-varnish-kube-httpcache-578977c959-vztj8 (Varnish/7.3), 1.1 6e202b767e6bdee837ba15ada7e3120e.cloudfront.net (CloudFront)
x-backend: varnish
x-amz-cf-pop: JFK50-P5
age: 11545
x-cache: Hit from cloudfront
content-length: 7006
last-modified: Fri, 16 Aug 2024 06:26:01 GMT
server: ycalb
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
x-varnish: 2099763 1836320
x-cache-hit: BYPASS
cache-control: max-age=86400
x-debug-auth: off
x-request-host: kasperskycontenthub.com
accept-ranges: bytes
x-amz-cf-id: TwN0guy14TEld_Bg2BUs8BvbllgUiJ3eUvNtXqdfWfNGRoVnxSuIGw==
expires: Wed, 28 Aug 2024 22:59:52 GMT

GET
H2 200 iot-embed-security.png
securelist.com/wp-content/themes/securelist2020/assets/images/enterprise-menu-icons/ 4 KB
4 KB 304ms
303ms Image
image/png 158.160.164.142
YANDEXCLOUD

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securelist.com/wp-content/themes/securelist2020/assets/images/enterprise-menu-icons/iot-embed-security.png
Requested by: Host: securelist.com
URL: https://securelist.com/hz-rat-attacks-wechat-and-dingtalk/113513/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 158.160.164.142 Moscow, Russian Federation, ASN200350 (YANDEXCLOUD, RU),
Reverse DNS
Software: ycalb /
Resource Hash: ecd5e8012dc2a87ac3ec0707a4d4b2617858985f41333d920645c7c904690462

Request headers

Referer: https://securelist.com/hz-rat-attacks-wechat-and-dingtalk/113513/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

expires: Tue, 03 Sep 2024 20:06:45 GMT
date: Tue, 27 Aug 2024 20:06:45 GMT
via: 1.1 kch-varnish-kube-httpcache-6bbf48fc9b-j4vmr (Varnish/7.3)
x-backend: varnish
age: 21932
x-cache: HIT
content-length: 3978
pragma: public
last-modified: Fri, 16 Aug 2024 06:26:02 GMT
server: ycalb
etag: "66bef0fa-f8a"
content-type: image/png
x-varnish: 8000831 18483344
cache-control: max-age=604800, public
accept-ranges: bytes
x-cache-hits: 290

GET
H2 200 transportation-cybersecurity.png
securelist.com/wp-content/themes/securelist2020/assets/images/enterprise-menu-icons/ 2 KB
2 KB 303ms
303ms Image
image/png 158.160.164.142
YANDEXCLOUD

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securelist.com/wp-content/themes/securelist2020/assets/images/enterprise-menu-icons/transportation-cybersecurity.png
Requested by: Host: securelist.com
URL: https://securelist.com/hz-rat-attacks-wechat-and-dingtalk/113513/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 158.160.164.142 Moscow, Russian Federation, ASN200350 (YANDEXCLOUD, RU),
Reverse DNS
Software: ycalb /
Resource Hash: e4f53b9c893261cf1692f633c38b6b046efbef5b522fb826186f18346569a78e

Request headers

Referer: https://securelist.com/hz-rat-attacks-wechat-and-dingtalk/113513/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

expires: Tue, 03 Sep 2024 22:16:54 GMT
date: Tue, 27 Aug 2024 22:16:54 GMT
via: 1.1 kch-varnish-kube-httpcache-6bbf48fc9b-q95z9 (Varnish/7.3)
x-backend: varnish
age: 14124
x-cache: HIT
content-length: 2276
pragma: public
last-modified: Fri, 16 Aug 2024 06:26:02 GMT
server: ycalb
etag: "66bef0fa-8e4"
content-type: image/png
x-varnish: 2229640 32782
cache-control: max-age=604800, public
accept-ranges: bytes
x-cache-hits: 208

GET
H2 200 fraud-prevention.png
securelist.com/wp-content/themes/securelist2020/assets/images/enterprise-menu-icons/ 1017 B
1 KB 183ms
182ms Image
image/png 158.160.164.142
YANDEXCLOUD

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securelist.com/wp-content/themes/securelist2020/assets/images/enterprise-menu-icons/fraud-prevention.png
Requested by: Host: securelist.com
URL: https://securelist.com/hz-rat-attacks-wechat-and-dingtalk/113513/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 158.160.164.142 Moscow, Russian Federation, ASN200350 (YANDEXCLOUD, RU),
Reverse DNS
Software: ycalb /
Resource Hash: 1c960c480714e7a7e4360e3485b1c121fce15da0714e5fa53fd442ec6e7c8d58

Request headers

Referer: https://securelist.com/hz-rat-attacks-wechat-and-dingtalk/113513/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

expires: Tue, 03 Sep 2024 20:07:24 GMT
date: Tue, 27 Aug 2024 20:07:24 GMT
via: 1.1 kch-varnish-kube-httpcache-6bbf48fc9b-j4vmr (Varnish/7.3)
x-backend: varnish
age: 21894
x-cache: HIT
content-length: 1017
pragma: public
last-modified: Fri, 16 Aug 2024 06:26:02 GMT
server: ycalb
etag: "66bef0fa-3f9"
content-type: image/png
x-varnish: 8000832 9273373
cache-control: max-age=604800, public
accept-ranges: bytes
x-cache-hits: 312

GET
H2 200 national-cybersecurity.png
securelist.com/wp-content/themes/securelist2020/assets/images/enterprise-menu-icons/ 2 KB
2 KB 327ms
326ms Image
image/png 158.160.164.142
YANDEXCLOUD

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securelist.com/wp-content/themes/securelist2020/assets/images/enterprise-menu-icons/national-cybersecurity.png
Requested by: Host: securelist.com
URL: https://securelist.com/hz-rat-attacks-wechat-and-dingtalk/113513/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 158.160.164.142 Moscow, Russian Federation, ASN200350 (YANDEXCLOUD, RU),
Reverse DNS
Software: ycalb /
Resource Hash: 9f7e0e10123ea3e492d4debb89938f3629b518326da0f269a241fd8691ce0a42

Request headers

Referer: https://securelist.com/hz-rat-attacks-wechat-and-dingtalk/113513/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

expires: Tue, 03 Sep 2024 20:07:11 GMT
date: Tue, 27 Aug 2024 20:07:11 GMT
via: 1.1 kch-varnish-kube-httpcache-6bbf48fc9b-j4vmr (Varnish/7.3)
x-backend: varnish
age: 21907
x-cache: HIT
content-length: 1938
pragma: public
last-modified: Fri, 16 Aug 2024 06:26:02 GMT
server: ycalb
etag: "66bef0fa-792"
content-type: image/png
x-varnish: 8000834 18776642
cache-control: max-age=604800, public
accept-ranges: bytes
x-cache-hits: 316

GET
H2 200 industrial-cybersecurity.png
securelist.com/wp-content/themes/securelist2020/assets/images/enterprise-menu-icons/ 5 KB
5 KB 245ms
245ms Image
image/png 158.160.164.142
YANDEXCLOUD

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securelist.com/wp-content/themes/securelist2020/assets/images/enterprise-menu-icons/industrial-cybersecurity.png
Requested by: Host: securelist.com
URL: https://securelist.com/hz-rat-attacks-wechat-and-dingtalk/113513/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 158.160.164.142 Moscow, Russian Federation, ASN200350 (YANDEXCLOUD, RU),
Reverse DNS
Software: ycalb /
Resource Hash: d49dc45ccc495169c52b1a9d0f0fbcc26d3a54023ba219e3fdde91a9121b2ad0

Request headers

Referer: https://securelist.com/hz-rat-attacks-wechat-and-dingtalk/113513/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

expires: Tue, 03 Sep 2024 20:07:12 GMT
date: Tue, 27 Aug 2024 20:07:12 GMT
via: 1.1 kch-varnish-kube-httpcache-6bbf48fc9b-j4vmr (Varnish/7.3)
x-backend: varnish
age: 21906
x-cache: HIT
content-length: 5068
pragma: public
last-modified: Fri, 16 Aug 2024 06:26:02 GMT
server: ycalb
etag: "66bef0fa-13cc"
content-type: image/png
x-varnish: 8000835 13369710
cache-control: max-age=604800, public
accept-ranges: bytes
x-cache-hits: 361

GET
H2 200 financial-cybersecurity.png
securelist.com/wp-content/themes/securelist2020/assets/images/enterprise-menu-icons/ 2 KB
2 KB 215ms
198ms Image
image/png 158.160.164.142
YANDEXCLOUD

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securelist.com/wp-content/themes/securelist2020/assets/images/enterprise-menu-icons/financial-cybersecurity.png
Requested by: Host: securelist.com
URL: https://securelist.com/hz-rat-attacks-wechat-and-dingtalk/113513/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 158.160.164.142 Moscow, Russian Federation, ASN200350 (YANDEXCLOUD, RU),
Reverse DNS
Software: ycalb /
Resource Hash: 98bd3afd3f47082426a89330cbff29e5ed773e6a2b9e5f7f3e25289e8eacad40

Request headers

Referer: https://securelist.com/hz-rat-attacks-wechat-and-dingtalk/113513/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

expires: Tue, 03 Sep 2024 20:06:45 GMT
date: Tue, 27 Aug 2024 20:06:45 GMT
via: 1.1 kch-varnish-kube-httpcache-6bbf48fc9b-j4vmr (Varnish/7.3)
x-backend: varnish
age: 21933
x-cache: HIT
content-length: 1909
pragma: public
last-modified: Fri, 16 Aug 2024 06:26:02 GMT
server: ycalb
etag: "66bef0fa-775"
content-type: image/png
x-varnish: 8000836 18284661
cache-control: max-age=604800, public
accept-ranges: bytes
x-cache-hits: 317

GET
H2 200 healthcare-cybersecurity.png
securelist.com/wp-content/themes/securelist2020/assets/images/enterprise-menu-icons/ 1 KB
1 KB 201ms
185ms Image
image/png 158.160.164.142
YANDEXCLOUD

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securelist.com/wp-content/themes/securelist2020/assets/images/enterprise-menu-icons/healthcare-cybersecurity.png
Requested by: Host: securelist.com
URL: https://securelist.com/hz-rat-attacks-wechat-and-dingtalk/113513/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 158.160.164.142 Moscow, Russian Federation, ASN200350 (YANDEXCLOUD, RU),
Reverse DNS
Software: ycalb /
Resource Hash: ff7e51d6ccb31da2a4099dbc1f3eb62ee3aec7ae5d83fe3d73b664c1b73427e0

Request headers

Referer: https://securelist.com/hz-rat-attacks-wechat-and-dingtalk/113513/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

expires: Tue, 03 Sep 2024 20:06:45 GMT
date: Tue, 27 Aug 2024 20:06:45 GMT
via: 1.1 kch-varnish-kube-httpcache-6bbf48fc9b-j4vmr (Varnish/7.3)
x-backend: varnish
age: 21933
x-cache: HIT
content-length: 1362
pragma: public
last-modified: Fri, 16 Aug 2024 06:26:02 GMT
server: ycalb
etag: "66bef0fa-552"
content-type: image/png
x-varnish: 18092280 18776626
cache-control: max-age=604800, public
accept-ranges: bytes
x-cache-hits: 330

GET
H2 200 retail-cybersecurity.png
securelist.com/wp-content/themes/securelist2020/assets/images/enterprise-menu-icons/ 2 KB
2 KB 189ms
174ms Image
image/png 158.160.164.142
YANDEXCLOUD

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securelist.com/wp-content/themes/securelist2020/assets/images/enterprise-menu-icons/retail-cybersecurity.png
Requested by: Host: securelist.com
URL: https://securelist.com/hz-rat-attacks-wechat-and-dingtalk/113513/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 158.160.164.142 Moscow, Russian Federation, ASN200350 (YANDEXCLOUD, RU),
Reverse DNS
Software: ycalb /
Resource Hash: ff83be5282c14284f873eac8098bd9bad2039604a70eba5aea8b221996535139

Request headers

Referer: https://securelist.com/hz-rat-attacks-wechat-and-dingtalk/113513/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

expires: Tue, 03 Sep 2024 20:06:45 GMT
date: Tue, 27 Aug 2024 20:06:45 GMT
via: 1.1 kch-varnish-kube-httpcache-6bbf48fc9b-j4vmr (Varnish/7.3)
x-backend: varnish
age: 21933
x-cache: HIT
content-length: 1547
pragma: public
last-modified: Fri, 16 Aug 2024 06:26:02 GMT
server: ycalb
etag: "66bef0fa-60b"
content-type: image/png
x-varnish: 18616971 2525012
cache-control: max-age=604800, public
accept-ranges: bytes
x-cache-hits: 343

GET k_Next_RGB_black_icon.png
media.kasperskydaily.com/wp-content/uploads/sites/92/2024/04/10052437/ 0
0

GET
H2 200 endpoint-security_products.png
securelist.com/wp-content/themes/securelist2020/assets/images/enterprise-menu-icons/ 7 KB
7 KB 222ms
207ms Image
image/png 158.160.164.142
YANDEXCLOUD

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securelist.com/wp-content/themes/securelist2020/assets/images/enterprise-menu-icons/endpoint-security_products.png
Requested by: Host: securelist.com
URL: https://securelist.com/hz-rat-attacks-wechat-and-dingtalk/113513/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 158.160.164.142 Moscow, Russian Federation, ASN200350 (YANDEXCLOUD, RU),
Reverse DNS
Software: ycalb /
Resource Hash: 36175c07afaffa0777295d540fe4ee1b82d9c4414228e4551994728a2c88ad7e

Request headers

Referer: https://securelist.com/hz-rat-attacks-wechat-and-dingtalk/113513/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

expires: Tue, 03 Sep 2024 22:16:57 GMT
date: Tue, 27 Aug 2024 22:16:57 GMT
via: 1.1 kch-varnish-kube-httpcache-6bbf48fc9b-q95z9 (Varnish/7.3)
x-backend: varnish
age: 14121
x-cache: HIT
content-length: 7154
pragma: public
last-modified: Fri, 16 Aug 2024 06:26:02 GMT
server: ycalb
etag: "66bef0fa-1bf2"
content-type: image/png
x-varnish: 1606738 131109
cache-control: max-age=604800, public
accept-ranges: bytes
x-cache-hits: 200

GET
H2 200 endpoint-detection-and-response.png
securelist.com/wp-content/themes/securelist2020/assets/images/enterprise-menu-icons/ 3 KB
3 KB 213ms
198ms Image
image/png 158.160.164.142
YANDEXCLOUD

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securelist.com/wp-content/themes/securelist2020/assets/images/enterprise-menu-icons/endpoint-detection-and-response.png
Requested by: Host: securelist.com
URL: https://securelist.com/hz-rat-attacks-wechat-and-dingtalk/113513/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 158.160.164.142 Moscow, Russian Federation, ASN200350 (YANDEXCLOUD, RU),
Reverse DNS
Software: ycalb /
Resource Hash: e98940cfe1288b874d977842ccaeb08cd169caa4173c3b86b8e188927e8578ed

Request headers

Referer: https://securelist.com/hz-rat-attacks-wechat-and-dingtalk/113513/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

expires: Tue, 03 Sep 2024 20:07:13 GMT
date: Tue, 27 Aug 2024 20:07:13 GMT
via: 1.1 kch-varnish-kube-httpcache-6bbf48fc9b-j4vmr (Varnish/7.3)
x-backend: varnish
age: 21905
x-cache: HIT
content-length: 2626
pragma: public
last-modified: Fri, 16 Aug 2024 06:26:02 GMT
server: ycalb
etag: "66bef0fa-a42"
content-type: image/png
x-varnish: 18092281 13369712
cache-control: max-age=604800, public
accept-ranges: bytes
x-cache-hits: 344

GET
H2 200 hybrid-cloud-security_products.png
securelist.com/wp-content/themes/securelist2020/assets/images/enterprise-menu-icons/ 2 KB
2 KB 189ms
175ms Image
image/png 158.160.164.142
YANDEXCLOUD

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securelist.com/wp-content/themes/securelist2020/assets/images/enterprise-menu-icons/hybrid-cloud-security_products.png
Requested by: Host: securelist.com
URL: https://securelist.com/hz-rat-attacks-wechat-and-dingtalk/113513/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 158.160.164.142 Moscow, Russian Federation, ASN200350 (YANDEXCLOUD, RU),
Reverse DNS
Software: ycalb /
Resource Hash: b378d22c726917d39df915cf46f85c2a88776f5463ad0b2f2bf4107e208c5fc6

Request headers

Referer: https://securelist.com/hz-rat-attacks-wechat-and-dingtalk/113513/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

expires: Tue, 03 Sep 2024 21:46:46 GMT
date: Tue, 27 Aug 2024 21:46:46 GMT
via: 1.1 kch-varnish-kube-httpcache-6bbf48fc9b-kb4mz (Varnish/7.3)
x-backend: varnish
age: 15932
x-cache: HIT
content-length: 2028
pragma: public
last-modified: Fri, 16 Aug 2024 06:26:02 GMT
server: ycalb
etag: "66bef0fa-7ec"
content-type: image/png
x-varnish: 135208 163899
cache-control: max-age=604800, public
accept-ranges: bytes
x-cache-hits: 225

GET
H2 200 anti-targeted-attack-platform.png
securelist.com/wp-content/themes/securelist2020/assets/images/enterprise-menu-icons/ 2 KB
2 KB 223ms
209ms Image
image/png 158.160.164.142
YANDEXCLOUD

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securelist.com/wp-content/themes/securelist2020/assets/images/enterprise-menu-icons/anti-targeted-attack-platform.png
Requested by: Host: securelist.com
URL: https://securelist.com/hz-rat-attacks-wechat-and-dingtalk/113513/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 158.160.164.142 Moscow, Russian Federation, ASN200350 (YANDEXCLOUD, RU),
Reverse DNS
Software: ycalb /
Resource Hash: 3ef18948ff01c7b94a3ba7a291c1f632faa83da95570b77d0dd003a53a2a0855

Request headers

Referer: https://securelist.com/hz-rat-attacks-wechat-and-dingtalk/113513/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

expires: Tue, 03 Sep 2024 22:23:18 GMT
date: Tue, 27 Aug 2024 22:23:18 GMT
via: 1.1 kch-varnish-kube-httpcache-6bbf48fc9b-q95z9 (Varnish/7.3)
x-backend: varnish
age: 13740
x-cache: HIT
content-length: 1693
pragma: public
last-modified: Fri, 16 Aug 2024 06:26:01 GMT
server: ycalb
etag: "66bef0f9-69d"
content-type: image/png
x-varnish: 3180158 753785
cache-control: max-age=604800, public
accept-ranges: bytes
x-cache-hits: 182

GET
H2 200 private-security-network.png
securelist.com/wp-content/themes/securelist2020/assets/images/enterprise-menu-icons/ 2 KB
2 KB 215ms
201ms Image
image/png 158.160.164.142
YANDEXCLOUD

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securelist.com/wp-content/themes/securelist2020/assets/images/enterprise-menu-icons/private-security-network.png
Requested by: Host: securelist.com
URL: https://securelist.com/hz-rat-attacks-wechat-and-dingtalk/113513/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 158.160.164.142 Moscow, Russian Federation, ASN200350 (YANDEXCLOUD, RU),
Reverse DNS
Software: ycalb /
Resource Hash: 211b1eb870f412eeb313da14d50d29c1702ed1ba5fd360d0a30b179d4008e520

Request headers

Referer: https://securelist.com/hz-rat-attacks-wechat-and-dingtalk/113513/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

expires: Tue, 03 Sep 2024 21:45:12 GMT
date: Tue, 27 Aug 2024 21:45:12 GMT
via: 1.1 kch-varnish-kube-httpcache-6bbf48fc9b-kb4mz (Varnish/7.3)
x-backend: varnish
age: 16027
x-cache: HIT
content-length: 1596
pragma: public
last-modified: Fri, 16 Aug 2024 06:26:02 GMT
server: ycalb
etag: "66bef0fa-63c"
content-type: image/png
x-varnish: 1377527 327685
cache-control: max-age=604800, public
accept-ranges: bytes
x-cache-hits: 233

GET
H2 200 embedded-systems-security.png
securelist.com/wp-content/themes/securelist2020/assets/images/enterprise-menu-icons/ 4 KB
4 KB 189ms
176ms Image
image/png 158.160.164.142
YANDEXCLOUD

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securelist.com/wp-content/themes/securelist2020/assets/images/enterprise-menu-icons/embedded-systems-security.png
Requested by: Host: securelist.com
URL: https://securelist.com/hz-rat-attacks-wechat-and-dingtalk/113513/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 158.160.164.142 Moscow, Russian Federation, ASN200350 (YANDEXCLOUD, RU),
Reverse DNS
Software: ycalb /
Resource Hash: 00e2a621d21f27807c82af5d0ae72ba394d49cadb66eabdbeda8df15035dd00c

Request headers

Referer: https://securelist.com/hz-rat-attacks-wechat-and-dingtalk/113513/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

expires: Tue, 03 Sep 2024 21:46:31 GMT
date: Tue, 27 Aug 2024 21:46:31 GMT
via: 1.1 kch-varnish-kube-httpcache-6bbf48fc9b-kb4mz (Varnish/7.3)
x-backend: varnish
age: 15947
x-cache: HIT
content-length: 4146
pragma: public
last-modified: Fri, 16 Aug 2024 06:26:02 GMT
server: ycalb
etag: "66bef0fa-1032"
content-type: image/png
x-varnish: 2166088 262198
cache-control: max-age=604800, public
accept-ranges: bytes
x-cache-hits: 239

GET
H2 200 cybersecurity-services.png
securelist.com/wp-content/themes/securelist2020/assets/images/enterprise-menu-icons/ 2 KB
2 KB 224ms
210ms Image
image/png 158.160.164.142
YANDEXCLOUD

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securelist.com/wp-content/themes/securelist2020/assets/images/enterprise-menu-icons/cybersecurity-services.png
Requested by: Host: securelist.com
URL: https://securelist.com/hz-rat-attacks-wechat-and-dingtalk/113513/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 158.160.164.142 Moscow, Russian Federation, ASN200350 (YANDEXCLOUD, RU),
Reverse DNS
Software: ycalb /
Resource Hash: 3511b363a05be1ba4471c10307c80144f57110e642deb01da0e4f561886a13d7

Request headers

Referer: https://securelist.com/hz-rat-attacks-wechat-and-dingtalk/113513/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

expires: Tue, 03 Sep 2024 22:16:58 GMT
date: Tue, 27 Aug 2024 22:16:58 GMT
via: 1.1 kch-varnish-kube-httpcache-6bbf48fc9b-q95z9 (Varnish/7.3)
x-backend: varnish
age: 14121
x-cache: HIT
content-length: 2191
pragma: public
last-modified: Fri, 16 Aug 2024 06:26:02 GMT
server: ycalb
etag: "66bef0fa-88f"
content-type: image/png
x-varnish: 2524838 131116
cache-control: max-age=604800, public
accept-ranges: bytes
x-cache-hits: 179

GET
H2 200 premium-support.png
securelist.com/wp-content/themes/securelist2020/assets/images/enterprise-menu-icons/ 2 KB
2 KB 215ms
201ms Image
image/png 158.160.164.142
YANDEXCLOUD

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securelist.com/wp-content/themes/securelist2020/assets/images/enterprise-menu-icons/premium-support.png
Requested by: Host: securelist.com
URL: https://securelist.com/hz-rat-attacks-wechat-and-dingtalk/113513/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 158.160.164.142 Moscow, Russian Federation, ASN200350 (YANDEXCLOUD, RU),
Reverse DNS
Software: ycalb /
Resource Hash: a5a74efd53eb2a7c097f816021c53f567e766cc3d3346bc9c322c247ef4f7c08

Request headers

Referer: https://securelist.com/hz-rat-attacks-wechat-and-dingtalk/113513/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

expires: Tue, 03 Sep 2024 21:46:31 GMT
date: Tue, 27 Aug 2024 21:46:31 GMT
via: 1.1 kch-varnish-kube-httpcache-6bbf48fc9b-kb4mz (Varnish/7.3)
x-backend: varnish
age: 15947
x-cache: HIT
content-length: 2151
pragma: public
last-modified: Fri, 16 Aug 2024 06:26:02 GMT
server: ycalb
etag: "66bef0fa-867"
content-type: image/png
x-varnish: 1082439 262200
cache-control: max-age=604800, public
accept-ranges: bytes
x-cache-hits: 248

GET
H2 200 threat-intelligence.png
securelist.com/wp-content/themes/securelist2020/assets/images/enterprise-menu-icons/ 3 KB
3 KB 187ms
174ms Image
image/png 158.160.164.142
YANDEXCLOUD

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securelist.com/wp-content/themes/securelist2020/assets/images/enterprise-menu-icons/threat-intelligence.png
Requested by: Host: securelist.com
URL: https://securelist.com/hz-rat-attacks-wechat-and-dingtalk/113513/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 158.160.164.142 Moscow, Russian Federation, ASN200350 (YANDEXCLOUD, RU),
Reverse DNS
Software: ycalb /
Resource Hash: 2c24b916160dc4962ba77c6f85b04c5f4831e2d71b549c0695d61154b1f32d49

Request headers

Referer: https://securelist.com/hz-rat-attacks-wechat-and-dingtalk/113513/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

expires: Tue, 03 Sep 2024 21:46:46 GMT
date: Tue, 27 Aug 2024 21:46:46 GMT
via: 1.1 kch-varnish-kube-httpcache-6bbf48fc9b-kb4mz (Varnish/7.3)
x-backend: varnish
age: 15932
x-cache: HIT
content-length: 3134
pragma: public
last-modified: Fri, 16 Aug 2024 06:26:02 GMT
server: ycalb
etag: "66bef0fa-c3e"
content-type: image/png
x-varnish: 2720914 557075
cache-control: max-age=604800, public
accept-ranges: bytes
x-cache-hits: 228

GET
H2 200 incident-response.png
securelist.com/wp-content/themes/securelist2020/assets/images/enterprise-menu-icons/ 3 KB
3 KB 224ms
212ms Image
image/png 158.160.164.142
YANDEXCLOUD

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securelist.com/wp-content/themes/securelist2020/assets/images/enterprise-menu-icons/incident-response.png
Requested by: Host: securelist.com
URL: https://securelist.com/hz-rat-attacks-wechat-and-dingtalk/113513/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 158.160.164.142 Moscow, Russian Federation, ASN200350 (YANDEXCLOUD, RU),
Reverse DNS
Software: ycalb /
Resource Hash: c771fce0ba519a6fa28085f4ab1172fa52b71b26ec71bfd11955e2a743825dea

Request headers

Referer: https://securelist.com/hz-rat-attacks-wechat-and-dingtalk/113513/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

expires: Tue, 03 Sep 2024 20:08:22 GMT
date: Tue, 27 Aug 2024 20:08:22 GMT
via: 1.1 kch-varnish-kube-httpcache-6bbf48fc9b-j4vmr (Varnish/7.3)
x-backend: varnish
age: 21836
x-cache: HIT
content-length: 2803
pragma: public
last-modified: Fri, 16 Aug 2024 06:26:02 GMT
server: ycalb
etag: "66bef0fa-af3"
content-type: image/png
x-varnish: 8000837 9273431
cache-control: max-age=604800, public
accept-ranges: bytes
x-cache-hits: 341

GET
H2 200 threat-hunting.png
securelist.com/wp-content/themes/securelist2020/assets/images/enterprise-menu-icons/ 3 KB
3 KB 221ms
209ms Image
image/png 158.160.164.142
YANDEXCLOUD

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securelist.com/wp-content/themes/securelist2020/assets/images/enterprise-menu-icons/threat-hunting.png
Requested by: Host: securelist.com
URL: https://securelist.com/hz-rat-attacks-wechat-and-dingtalk/113513/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 158.160.164.142 Moscow, Russian Federation, ASN200350 (YANDEXCLOUD, RU),
Reverse DNS
Software: ycalb /
Resource Hash: 528bbd11d6966cc5106f4ecf60da4f7096cd0b3c951f79a2d12c1f0bad33faa8

Request headers

Referer: https://securelist.com/hz-rat-attacks-wechat-and-dingtalk/113513/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

expires: Tue, 03 Sep 2024 21:45:12 GMT
date: Tue, 27 Aug 2024 21:45:12 GMT
via: 1.1 kch-varnish-kube-httpcache-6bbf48fc9b-kb4mz (Varnish/7.3)
x-backend: varnish
age: 16027
x-cache: HIT
content-length: 2693
pragma: public
last-modified: Fri, 16 Aug 2024 06:26:02 GMT
server: ycalb
etag: "66bef0fa-a85"
content-type: image/png
x-varnish: 1213793 65556
cache-control: max-age=604800, public
accept-ranges: bytes
x-cache-hits: 226

GET
H2 200 hzrat-featured-800x450.jpg
media.kasperskycontenthub.com/wp-content/uploads/sites/43/2024/08/27085625/ 57 KB
58 KB 943ms
79ms Image
image/jpeg 2600:9000:21da:1e00:1b:d000:d280:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2024/08/27085625/hzrat-featured-800x450.jpg
Requested by: Host: securelist.com
URL: https://securelist.com/hz-rat-attacks-wechat-and-dingtalk/113513/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:21da:1e00:1b:d000:d280:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 41c7b7e643cb09d14fc9c22e3a8025ea422230e94c82c27bc2437f639dcf8975

Request headers

Referer: https://securelist.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 27 Aug 2024 10:02:38 GMT
via: 1.1 17a79dcb426270de1bedb2a8dbcb8f72.cloudfront.net (CloudFront)
last-modified: Tue, 27 Aug 2024 08:56:27 GMT
server: AmazonS3
x-amz-cf-pop: EWR53-C1
age: 58182
etag: "f31f2134794c9d800ad363cfe80ac151"
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-type: image/jpeg
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 58833
x-amz-cf-id: 6oqZu04E6u_JpCkIp-FpNK_9EJLxBmwlC4U_B9izuzuyb-N9InTD7g==

GET
H2 200 icon-categories.svg
securelist.com/wp-content/themes/securelist2020/assets/images/icon/ 1 KB
1 KB 207ms
196ms Image
image/svg+xml 158.160.164.142
YANDEXCLOUD

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securelist.com/wp-content/themes/securelist2020/assets/images/icon/icon-categories.svg
Requested by: Host: securelist.com
URL: https://securelist.com/hz-rat-attacks-wechat-and-dingtalk/113513/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 158.160.164.142 Moscow, Russian Federation, ASN200350 (YANDEXCLOUD, RU),
Reverse DNS
Software: ycalb /
Resource Hash: 8f799a34a68e6a09ed2f0afe3d9ef2bd456680fbc778766ab515feeed4b9cc81

Request headers

Referer: https://securelist.com/hz-rat-attacks-wechat-and-dingtalk/113513/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 27 Aug 2024 20:07:24 GMT
via: 1.1 kch-varnish-kube-httpcache-6bbf48fc9b-j4vmr (Varnish/7.3)
last-modified: Fri, 16 Aug 2024 06:26:02 GMT
server: ycalb
x-backend: varnish
age: 21894
etag: "66bef0fa-476"
x-cache: HIT
content-type: image/svg+xml
access-control-allow-origin: *
x-varnish: 18616972 9273379
accept-ranges: bytes
content-length: 1142
x-cache-hits: 299

GET
H2 200 icon-categories--invert.svg
securelist.com/wp-content/themes/securelist2020/assets/images/icon/ 1 KB
1 KB 347ms
337ms Image
image/svg+xml 158.160.164.142
YANDEXCLOUD

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securelist.com/wp-content/themes/securelist2020/assets/images/icon/icon-categories--invert.svg
Requested by: Host: securelist.com
URL: https://securelist.com/hz-rat-attacks-wechat-and-dingtalk/113513/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 158.160.164.142 Moscow, Russian Federation, ASN200350 (YANDEXCLOUD, RU),
Reverse DNS
Software: ycalb /
Resource Hash: e6bb226afa82eb9fcf6dc25592c6a7cd979ba4d795dfe6e0a31720de6ecd0af2

Request headers

Referer: https://securelist.com/hz-rat-attacks-wechat-and-dingtalk/113513/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 27 Aug 2024 20:07:12 GMT
via: 1.1 kch-varnish-kube-httpcache-6bbf48fc9b-j4vmr (Varnish/7.3)
last-modified: Fri, 16 Aug 2024 06:26:02 GMT
server: ycalb
x-backend: varnish
age: 21906
etag: "66bef0fa-45b"
x-cache: HIT
content-type: image/svg+xml
access-control-allow-origin: *
x-varnish: 11502861 18776649
accept-ranges: bytes
content-length: 1115
x-cache-hits: 299

GET
H2 200 avatar_default_1.png
securelist.com/wp-content/themes/securelist2020/assets/images/avatar-default/ 1 KB
1 KB 222ms
211ms Image
image/png 158.160.164.142
YANDEXCLOUD

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securelist.com/wp-content/themes/securelist2020/assets/images/avatar-default/avatar_default_1.png
Requested by: Host: securelist.com
URL: https://securelist.com/hz-rat-attacks-wechat-and-dingtalk/113513/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 158.160.164.142 Moscow, Russian Federation, ASN200350 (YANDEXCLOUD, RU),
Reverse DNS
Software: ycalb /
Resource Hash: ce543d7ee7edde197562d34ff6ef482dcf1529869f30b068c3a6d3eb8a2bf007

Request headers

Referer: https://securelist.com/hz-rat-attacks-wechat-and-dingtalk/113513/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

expires: Tue, 03 Sep 2024 22:24:45 GMT
date: Tue, 27 Aug 2024 22:24:45 GMT
via: 1.1 kch-varnish-kube-httpcache-6bbf48fc9b-q95z9 (Varnish/7.3)
x-backend: varnish
age: 13654
x-cache: HIT
content-length: 1065
pragma: public
last-modified: Fri, 16 Aug 2024 06:26:02 GMT
server: ycalb
etag: "66bef0fa-429"
content-type: image/png
x-varnish: 2262053 33059
cache-control: max-age=604800, public
accept-ranges: bytes
x-cache-hits: 124

GET
H2 200 api.js Show response
www.google.com/recaptcha/ 1 KB
1 KB 94ms
84ms Script
text/javascript 2607:f8b0:4006:81d::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api.js?hl=en&render=explicit

Requested by

Host: securelist.com
URL: https://securelist.com/hz-rat-attacks-wechat-and-dingtalk/113513/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81d::2004 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

2bed92c66db2de6cf2e66eb746378554ee040722c038c5aa899aec292f37a052

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://securelist.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Wed, 28 Aug 2024 02:12:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy: frame-ancestors 'self'
server: GSE
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=utf-8
cache-control: private, max-age=300
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 1; mode=block
expires: Wed, 28 Aug 2024 02:12:19 GMT

GET
H2 200 NEXT_310x420_EN_1.jpg
media.kasperskycontenthub.com/wp-content/uploads/sites/43/2024/04/10092503/ 42 KB
42 KB 77ms
67ms Image
image/jpeg 2600:9000:21da:1e00:1b:d000:d280:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2024/04/10092503/NEXT_310x420_EN_1.jpg
Requested by: Host: securelist.com
URL: https://securelist.com/hz-rat-attacks-wechat-and-dingtalk/113513/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:21da:1e00:1b:d000:d280:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 302eb6358c289fc940f4fae176ac6a6cee8172c433a7aecb92fe9db697859bb3

Request headers

Referer: https://securelist.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 27 Aug 2024 08:21:51 GMT
via: 1.1 17a79dcb426270de1bedb2a8dbcb8f72.cloudfront.net (CloudFront)
last-modified: Wed, 10 Apr 2024 09:25:07 GMT
server: AmazonS3
x-amz-cf-pop: EWR53-C1
age: 65167
x-amz-server-side-encryption: AES256
etag: "25aeeb6393599b99118403f4c57d35dd"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/jpeg
accept-ranges: bytes
content-length: 42649
x-amz-cf-id: 6XuHwvm7KUMMZvv23Ic92X_SwsBDWEJ4XaZhOw0qfFgaW9Dxy7rkYQ==

GET
H2 200 370x500-1.png
media.kasperskycontenthub.com/wp-content/uploads/sites/43/2020/12/23093819/ 70 KB
70 KB 77ms
67ms Image
image/png 2600:9000:21da:1e00:1b:d000:d280:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2020/12/23093819/370x500-1.png
Requested by: Host: securelist.com
URL: https://securelist.com/hz-rat-attacks-wechat-and-dingtalk/113513/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:21da:1e00:1b:d000:d280:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 8a3f22d1b41eca1d79771fad2e6be3f4cd45f7843ecacb8e9340268f6dd7c2b6

Request headers

Referer: https://securelist.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 27 Aug 2024 09:57:07 GMT
via: 1.1 17a79dcb426270de1bedb2a8dbcb8f72.cloudfront.net (CloudFront)
last-modified: Fri, 23 Aug 2024 09:38:23 GMT
server: AmazonS3
x-amz-cf-pop: EWR53-C1
age: 61608
x-amz-server-side-encryption: AES256
etag: "f1a4801b6d5f7b8866e5c0540f476440"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/png
accept-ranges: bytes
content-length: 71742
x-amz-cf-id: us2iQLHg0Z4KanWfHOQMgJXBfuDcdto-WYCmNDh382Or1uBZ9GN0-w==

GET
H2 200 1080x1080-3-740x740.png
media.kasperskycontenthub.com/wp-content/uploads/sites/43/2020/12/23093838/ 678 KB
679 KB 76ms
67ms Image
image/png 2600:9000:21da:1e00:1b:d000:d280:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2020/12/23093838/1080x1080-3-740x740.png
Requested by: Host: securelist.com
URL: https://securelist.com/hz-rat-attacks-wechat-and-dingtalk/113513/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:21da:1e00:1b:d000:d280:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 9c3d551dd7ea51cf5d3128d6dba3f37eec73cde5bc24f901a8b32323709013e1

Request headers

Referer: https://securelist.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Fri, 23 Aug 2024 09:55:16 GMT
via: 1.1 17a79dcb426270de1bedb2a8dbcb8f72.cloudfront.net (CloudFront)
last-modified: Fri, 23 Aug 2024 09:38:43 GMT
server: AmazonS3
x-amz-cf-pop: EWR53-C1
age: 404224
etag: "c02d4f5eb81b3d4d3d8fc0b2c41fd854"
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-type: image/png
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 694180
x-amz-cf-id: REhAhyJV1G04a3SwZn3e9xDg2eEJ6GBei_PXe0nCZtXnNblfOzWi8A==

GET
H2 200 scripts.js Show response
kasperskycontenthub.com/securelist/wp-content/plugins/kaspersky-embeds/js/ 2 KB
2 KB 778ms
345ms Script
application/javascript 158.160.164.142
YANDEXCLOUD

General

Check archive.org

Show headers Download Go to

Full URL: https://kasperskycontenthub.com/securelist/wp-content/plugins/kaspersky-embeds/js/scripts.js?ver=1.0
Requested by: Host: securelist.com
URL: https://securelist.com/hz-rat-attacks-wechat-and-dingtalk/113513/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 158.160.164.142 Moscow, Russian Federation, ASN200350 (YANDEXCLOUD, RU),
Reverse DNS
Software: ycalb /
Resource Hash: b1f863d13dbad7d5240f577a73b47b06227d218909259042da95301e2eb8be55

Request headers

Referer: https://securelist.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

expires: Tue, 03 Sep 2024 21:45:11 GMT
date: Tue, 27 Aug 2024 21:45:11 GMT
via: 1.1 kch-varnish-kube-httpcache-6bbf48fc9b-kb4mz (Varnish/7.3)
x-backend: varnish
age: 16028
x-cache: HIT
content-length: 2088
pragma: public
last-modified: Fri, 16 Aug 2024 06:26:01 GMT
server: ycalb
etag: "66bef0f9-828"
content-type: application/javascript
x-varnish: 5728 196652
cache-control: max-age=604800, public
accept-ranges: bytes
x-cache-hits: 325

GET
H2 200 api.js Show response
www.google.com/recaptcha/ 1 KB
1011 B 285ms
85ms Script
text/javascript 2607:f8b0:4006:81d::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api.js?render=explicit&ver=202124050927

Requested by

Host: securelist.com
URL: https://securelist.com/hz-rat-attacks-wechat-and-dingtalk/113513/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81d::2004 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

2bed92c66db2de6cf2e66eb746378554ee040722c038c5aa899aec292f37a052

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://securelist.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Wed, 28 Aug 2024 02:12:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy: frame-ancestors 'self'
server: GSE
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=utf-8
cache-control: private, max-age=300
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 1; mode=block
expires: Wed, 28 Aug 2024 02:12:19 GMT

GET
H2 200 s_code_single_suite.js Show response
media.kaspersky.com/tracking/omniture/ 208 KB
50 KB 735ms
286ms Script
application/javascript 185.85.15.31
KL-EXT

General

Check archive.org

Show headers Download Go to

Full URL

https://media.kaspersky.com/tracking/omniture/s_code_single_suite.js?ver=6.5.5

Requested by

Host: securelist.com
URL: https://securelist.com/hz-rat-attacks-wechat-and-dingtalk/113513/

Protocol

Security

TLS 1.3, , CHACHA20_POLY1305

Server

185.85.15.31 , Germany, ASN200107 (KL-EXT, CH),

Reverse DNS

Software

/ Kaspersky Labs, Kaspersky Labs

Resource Hash

2a0bee86cb7897007c66d44b3008c3f91ff9e1f9a289c97eeff0a0d19c6275a7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://securelist.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: br
x-content-type-options: nosniff
date: Wed, 28 Aug 2024 02:12:19 GMT
x-powered-by: Kaspersky Labs, Kaspersky Labs
alt-svc: h3=":443"; ma=86400; persist=1
content-length: 51027
x-xss-protection: 1; mode=block
last-modified: Mon, 19 Aug 2024 11:42:17 GMT
server
etag: "80f291d72cf2da1:0"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
cache-control: max-age=3600
x-server: fr2/FRA4
accept-ranges: bytes

GET
H2 200 / Show response
assets.kasperskycontenthub.com/wp-content/plugins/bwp-minify/min/ 243 KB
78 KB 62ms
45ms Script
application/x-javascript 18.164.96.91
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.kasperskycontenthub.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/crayon-syntax-highlighter/js/min/crayon.min.js,wp-content/plugins/kaspersky-gravity-forms-dynamic-recaptcha/assets/js/main.js,wp-content/plugins/kaspersky-lazy-load/assets/js/main.js,wp-content/plugins/kaspersky-wp-autosearch/assert/js/migrate.js,wp-content/plugins/kaspersky-wp-autosearch/assert/js/autocomplete.js,wp-content/plugins/kaspersky-wp-autosearch/assert/js/ajax-script.js,wp-content/plugins/wds-no-login-autocomplete/js/script.js,wp-content/themes/securelist2020/assets/js/main.js,wp-includes/js/comment-reply.min.js,wp-content/plugins/akismet/_inc/akismet-frontend.js

Requested by

Host: securelist.com
URL: https://securelist.com/hz-rat-attacks-wechat-and-dingtalk/113513/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.164.96.91 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-164-96-91.jfk50.r.cloudfront.net

Software

ycalb /

Resource Hash

b1510bbf567967e8a99f52c614b1c9d5a08e9565cec6f1ef2f3a9aaa2dc6a7b4

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://securelist.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

x-cache-hits: 3
date: Wed, 28 Aug 2024 00:16:48 GMT
content-encoding: gzip
via: 1.1 kch-varnish-kube-httpcache-578977c959-d8jw2 (Varnish/7.3), 1.1 6e202b767e6bdee837ba15ada7e3120e.cloudfront.net (CloudFront)
x-backend: varnish
x-amz-cf-pop: JFK50-P5
age: 6930
x-cache: Hit from cloudfront
content-length: 79500
last-modified: Fri, 16 Aug 2024 06:26:01 GMT
server: ycalb
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
x-varnish: 28872765 827120
x-cache-hit: BYPASS
cache-control: max-age=86400
x-debug-auth: off
x-request-host: kasperskycontenthub.com
accept-ranges: bytes
x-amz-cf-id: 6hexYzaWdOVvda7G3qYh29Gxq6IRmV8wKDUAOqL4TatDXt25rQ0Zsg==
expires: Thu, 29 Aug 2024 00:16:48 GMT

GET
H2 200 / Show response
assets.kasperskycontenthub.com/wp-content/plugins/bwp-minify/min/ 68 KB
24 KB 82ms
66ms Script
application/x-javascript 18.164.96.91
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.kasperskycontenthub.com/wp-content/plugins/bwp-minify/min/?f=wp-includes/js/dist/vendor/wp-polyfill-inert.min.js,wp-includes/js/dist/vendor/regenerator-runtime.min.js,wp-includes/js/dist/vendor/wp-polyfill.min.js,wp-includes/js/dist/dom-ready.min.js,wp-includes/js/dist/hooks.min.js,wp-includes/js/dist/i18n.min.js,wp-includes/js/dist/a11y.min.js

Requested by

Host: securelist.com
URL: https://securelist.com/hz-rat-attacks-wechat-and-dingtalk/113513/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.164.96.91 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-164-96-91.jfk50.r.cloudfront.net

Software

ycalb /

Resource Hash

f230b4cd29d2e4719ad307d8b1176a5c1787c7399b12676f3c4fe31bde54c0ab

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://securelist.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

x-cache-hits: 2
date: Tue, 27 Aug 2024 06:21:32 GMT
content-encoding: gzip
via: 1.1 kch-varnish-kube-httpcache-578977c959-5vxx2 (Varnish/7.3), 1.1 6e202b767e6bdee837ba15ada7e3120e.cloudfront.net (CloudFront)
x-backend: varnish
x-amz-cf-pop: JFK50-P5
age: 71447
x-cache: Hit from cloudfront
content-length: 23556
last-modified: Fri, 16 Aug 2024 06:25:59 GMT
server: ycalb
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
x-varnish: 2362704 656921
x-cache-hit: BYPASS
cache-control: max-age=86400
x-debug-auth: off
x-request-host: kasperskycontenthub.com
accept-ranges: bytes
x-amz-cf-id: oBMEcTROEFeSm4DNYA0NOwro-w2iwEjH5KrHpuSOICpdZV8jNmHn1w==
expires: Wed, 28 Aug 2024 06:21:32 GMT

GET
H2 200 jquery.json.min.js Show response
securelist.com/wp-content/plugins/gravityforms/js/ 2 KB
2 KB 190ms
181ms Script
application/javascript 158.160.164.142
YANDEXCLOUD

General

Check archive.org

Show headers Download Go to

Full URL: https://securelist.com/wp-content/plugins/gravityforms/js/jquery.json.min.js?ver=2.5.16.3
Requested by: Host: securelist.com
URL: https://securelist.com/hz-rat-attacks-wechat-and-dingtalk/113513/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 158.160.164.142 Moscow, Russian Federation, ASN200350 (YANDEXCLOUD, RU),
Reverse DNS
Software: ycalb /
Resource Hash: 693c8b61667ac94847264924178702a190c5113b41b82085dad0641f89e3f864

Request headers

Referer: https://securelist.com/hz-rat-attacks-wechat-and-dingtalk/113513/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

expires: Tue, 03 Sep 2024 21:47:14 GMT
date: Tue, 27 Aug 2024 21:47:14 GMT
via: 1.1 kch-varnish-kube-httpcache-6bbf48fc9b-kb4mz (Varnish/7.3)
x-backend: varnish
age: 15904
x-cache: HIT
content-length: 1840
pragma: public
last-modified: Fri, 16 Aug 2024 06:26:01 GMT
server: ycalb
etag: "66bef0f9-730"
content-type: application/javascript
x-varnish: 2720915 426088
cache-control: max-age=604800, public
accept-ranges: bytes
x-cache-hits: 315

GET
H2 200 gravityforms.min.js Show response
securelist.com/wp-content/plugins/gravityforms/js/ 43 KB
43 KB 344ms
336ms Script
application/javascript 158.160.164.142
YANDEXCLOUD

General

Check archive.org

Show headers Download Go to

Full URL: https://securelist.com/wp-content/plugins/gravityforms/js/gravityforms.min.js?ver=2.5.16.3
Requested by: Host: securelist.com
URL: https://securelist.com/hz-rat-attacks-wechat-and-dingtalk/113513/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 158.160.164.142 Moscow, Russian Federation, ASN200350 (YANDEXCLOUD, RU),
Reverse DNS
Software: ycalb /
Resource Hash: 69f0ade8cca67112ef495f707fb73c68fd5099a6cd9c51d9ba9ceda8dcca16f7

Request headers

Referer: https://securelist.com/hz-rat-attacks-wechat-and-dingtalk/113513/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

expires: Tue, 03 Sep 2024 22:18:46 GMT
date: Tue, 27 Aug 2024 22:18:46 GMT
via: 1.1 kch-varnish-kube-httpcache-6bbf48fc9b-q95z9 (Varnish/7.3)
x-backend: varnish
age: 14013
x-cache: HIT
content-length: 44000
pragma: public
last-modified: Fri, 16 Aug 2024 06:26:01 GMT
server: ycalb
etag: "66bef0f9-abe0"
content-type: application/javascript
x-varnish: 1606739 819203
cache-control: max-age=604800, public
accept-ranges: bytes
x-cache-hits: 264

GET
H2 200 placeholders.jquery.min.js Show response
securelist.com/wp-content/plugins/gravityforms/js/ 5 KB
5 KB 209ms
200ms Script
application/javascript 158.160.164.142
YANDEXCLOUD

General

Check archive.org

Show headers Download Go to

Full URL: https://securelist.com/wp-content/plugins/gravityforms/js/placeholders.jquery.min.js?ver=2.5.16.3
Requested by: Host: securelist.com
URL: https://securelist.com/hz-rat-attacks-wechat-and-dingtalk/113513/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 158.160.164.142 Moscow, Russian Federation, ASN200350 (YANDEXCLOUD, RU),
Reverse DNS
Software: ycalb /
Resource Hash: d62a7b7ec5313469ebff5c006b9068dc44d6d1c122cf787ffa29a10113b34060

Request headers

Referer: https://securelist.com/hz-rat-attacks-wechat-and-dingtalk/113513/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

expires: Tue, 03 Sep 2024 20:06:05 GMT
date: Tue, 27 Aug 2024 20:06:05 GMT
via: 1.1 kch-varnish-kube-httpcache-6bbf48fc9b-j4vmr (Varnish/7.3)
x-backend: varnish
age: 21973
x-cache: HIT
content-length: 4639
pragma: public
last-modified: Fri, 16 Aug 2024 06:26:01 GMT
server: ycalb
etag: "66bef0f9-121f"
content-type: application/javascript
x-varnish: 18092282 13369683
cache-control: max-age=604800, public
accept-ranges: bytes
x-cache-hits: 390

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 270 KB
88 KB 357ms
119ms Script
application/javascript 2607:f8b0:4006:80c::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-5CGZ3HG

Requested by

Host: securelist.com
URL: https://securelist.com/hz-rat-attacks-wechat-and-dingtalk/113513/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80c::2008 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

f6288a59b12995368e81d47f45d3b331c049afebfc135f5394af5d1fc2c9c6ca

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://securelist.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Wed, 28 Aug 2024 02:12:19 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 89427
x-xss-protection: 0
last-modified: Wed, 28 Aug 2024 00:52:49 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Wed, 28 Aug 2024 02:12:19 GMT

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 552 KB
135 KB 387ms
150ms Script
application/javascript 2607:f8b0:4006:80c::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-WZ7LJ3

Requested by

Host: securelist.com
URL: https://securelist.com/hz-rat-attacks-wechat-and-dingtalk/113513/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80c::2008 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

18049e681169e22145e19046fb8b15eaf7a08f1e36cb78b00e40c0fb102970a1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://securelist.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Wed, 28 Aug 2024 02:12:19 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 137842
x-xss-protection: 0
last-modified: Wed, 28 Aug 2024 00:52:49 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Wed, 28 Aug 2024 02:12:19 GMT

GET
H2 200 / Show response
kasperskycontenthub.com/ 0
280 B 463ms
377ms Script
application/javascript 158.160.164.142
YANDEXCLOUD

General

Check archive.org

Show headers Download Go to

Full URL

https://kasperskycontenthub.com/?dm=ed1f9e435dc885292eab65620c51f3fb&action=load&blogid=43&siteid=1&t=774940607&back=https%3A%2F%2Fsecurelist.com%2Fhz-rat-attacks-wechat-and-dingtalk%2F113513%2F

Requested by

Host: securelist.com
URL: https://securelist.com/hz-rat-attacks-wechat-and-dingtalk/113513/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

158.160.164.142 Moscow, Russian Federation, ASN200350 (YANDEXCLOUD, RU),

Reverse DNS

Software

ycalb /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://securelist.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 27 Aug 2024 23:01:36 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
via: 1.1 kch-varnish-kube-httpcache-6bbf48fc9b-j4vmr (Varnish/7.3)
x-backend: varnish
age: 11443
x-cache: HIT
content-length: 0
x-xss-protection: 1; mode=block
server: ycalb
x-frame-options: SAMEORIGIN
content-type: application/javascript
x-varnish: 8553656 19270824
x-cache-hit: BYPASS
x-debug-auth: off
x-request-host: kasperskycontenthub.com
accept-ranges: bytes
x-cache-hits: 35

GET
H/1.1 200
OK munchkin.js Show response
munchkin.marketo.net/ 1 KB
1 KB 334ms
120ms Script
application/x-javascript 23.204.6.193
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://munchkin.marketo.net/munchkin.js
Requested by: Host: securelist.com
URL: https://securelist.com/hz-rat-attacks-wechat-and-dingtalk/113513/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.204.6.193 , United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-204-6-193.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 5206536707c84baa892d3c3231b351985ee828cb8b9c0bd8db42cd3363995fc4

Request headers

Referer: https://securelist.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

Date: Wed, 28 Aug 2024 02:12:19 GMT
Content-Encoding: gzip
Last-Modified: Fri, 17 Mar 2023 01:24:48 GMT
Server: AkamaiNetStorage
ETag: "cb731cc5c2bd9f31d6bfeb19f3c8b1ff:1679016288.730763"
Vary: Accept-Encoding
P3P: policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Content-Type: application/x-javascript
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 729

GET
H/1.1 200
OK munchkin.js Show response
munchkin.marketo.net/163/ 11 KB
5 KB 54ms
49ms Script
application/x-javascript 23.204.6.193
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://munchkin.marketo.net/163/munchkin.js
Requested by: Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/munchkin.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.204.6.193 , United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-204-6-193.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 68cc280ce370c6f1f51a4fc5950103fc38df80a429552c549add04ebd8bd3a23

Request headers

Referer: https://securelist.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date: Wed, 28 Aug 2024 02:12:19 GMT
Content-Encoding: gzip
Last-Modified: Fri, 06 Jan 2023 02:26:40 GMT
Server: AkamaiNetStorage
ETag: "ea7826f34518d7c2295738f39c7640fa:1672972000.238769"
Vary: Accept-Encoding
P3P: policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Content-Type: application/x-javascript
Cache-Control: max-age=8640000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 4741
Expires: Fri, 06 Dec 2024 02:12:19 GMT

GET
H3 200 all.js Show response
connect.facebook.net/en_US/ 3 KB
2 KB 282ms
109ms Script
application/x-javascript 2a03:2880:f012:10c:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/all.js

Requested by

Host: securelist.com
URL: https://securelist.com/hz-rat-attacks-wechat-and-dingtalk/113513/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f012:10c:face:b00c:0:3 Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

c8de5761cdf4b1c78246708cf2bb10be840030554dcf908d56824d4d00cf06a9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://securelist.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
date: Wed, 28 Aug 2024 02:12:19 GMT
content-md5: 2hyXWG5TupmYiTnuIKQ4aw==
document-policy: force-load-at-top
x-fb-server-load: 30
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 1687
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
x-fb-connection-quality: GOOD; q=0.7, rtt=60, rtx=0, c=23, mss=1232, tbw=5550, tp=10, tpl=0, uplat=1, ullat=-1
x-fb-debug: p/hhQLOjs4zuK9Q0WusAhHMNwuKV0wU5sCNELRLRvyYKWl3WkZa/Gy4i9MvimuADGqaHZZIE+cZv74TFtcFukw==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
x-fb-content-md5: 25c218646df0cfe0c1355041294fe4e2
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
etag: "0ee1baaf2643e303e57399536cebb91f"
vary: Accept-Encoding
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
origin-agent-cluster: ?0
access-control-expose-headers: X-FB-Content-MD5
cache-control: public,max-age=1200,stale-while-revalidate=3600
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
x-frame-options: DENY
timing-allow-origin: *
priority: u=3,i
expires: Wed, 28 Aug 2024 02:17:29 GMT

GET
H2 200 platform.js Show response
apis.google.com/js/ 64 KB
25 KB 336ms
95ms Script
text/javascript 2607:f8b0:4006:807::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://apis.google.com/js/platform.js

Requested by

Host: securelist.com
URL: https://securelist.com/hz-rat-attacks-wechat-and-dingtalk/113513/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:807::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fd147b07bdeee3792d9bf29d77d72396488b3bef3c1ef3a185f343192db704fa

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/gapi-team
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://securelist.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

content-security-policy: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/gapi-team
content-encoding: gzip
x-content-type-options: nosniff
date: Wed, 28 Aug 2024 02:12:19 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 24573
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="gapi-team"
etag: "155b010c76c0be57"
vary: Accept-Encoding
report-to: {"group":"gapi-team","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gapi-team"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: private, max-age=1800, stale-while-revalidate=1800
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 28 Aug 2024 02:12:19 GMT

GET
H2 200 icons.svg
securelist.com/wp-content/themes/securelist2020/assets/sprite/ 16 KB
16 KB 186ms
181ms Other
image/svg+xml 158.160.164.142
YANDEXCLOUD

General

Check archive.org

Show headers Download Go to

Full URL: https://securelist.com/wp-content/themes/securelist2020/assets/sprite/icons.svg
Requested by: Host: securelist.com
URL: https://securelist.com/hz-rat-attacks-wechat-and-dingtalk/113513/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 158.160.164.142 Moscow, Russian Federation, ASN200350 (YANDEXCLOUD, RU),
Reverse DNS
Software: ycalb /
Resource Hash: b0e0f16e7a10a53e2976ccf09a91ff8b0fd73b9e4188e70e4f91f14c10c4e574

Request headers

Referer: https://securelist.com/hz-rat-attacks-wechat-and-dingtalk/113513/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 27 Aug 2024 21:44:44 GMT
via: 1.1 kch-varnish-kube-httpcache-6bbf48fc9b-kb4mz (Varnish/7.3)
last-modified: Fri, 16 Aug 2024 06:26:01 GMT
server: ycalb
x-backend: varnish
age: 16054
etag: "66bef0f9-3e36"
x-cache: HIT
content-type: image/svg+xml
access-control-allow-origin: *
x-varnish: 2166089 32780
accept-ranges: bytes
content-length: 15926
x-cache-hits: 328

GET
H2 200 logo-basic.svg
assets.kasperskycontenthub.com/wp-content/themes/securelist2020/assets/images/logo/ 2 KB
1 KB 57ms
57ms Image
image/svg+xml 18.164.96.91
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.kasperskycontenthub.com/wp-content/themes/securelist2020/assets/images/logo/logo-basic.svg
Requested by: Host: assets.kasperskycontenthub.com
URL: https://assets.kasperskycontenthub.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/crayon-syntax-highlighter/css/min/crayon.min.css,wp-content/plugins/crayon-syntax-highlighter/themes/classic/classic.css,wp-content/plugins/crayon-syntax-highlighter/fonts/monaco.css,wp-includes/css/dist/block-library/style.min.css,wp-content/plugins/jquery-collapse-o-matic/css/core_style.css,wp-content/plugins/jquery-collapse-o-matic/css/light_style.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/themes/securelist2020/assets/css/main.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.164.96.91 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-164-96-91.jfk50.r.cloudfront.net
Software: ycalb /
Resource Hash: e381e76e2f8e13a602958f16754d80474a07c1019eb3c7770bf34bdf51c40b5d

Request headers

Referer: https://assets.kasperskycontenthub.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/crayon-syntax-highlighter/css/min/crayon.min.css,wp-content/plugins/crayon-syntax-highlighter/themes/classic/classic.css,wp-content/plugins/crayon-syntax-highlighter/fonts/monaco.css,wp-includes/css/dist/block-library/style.min.css,wp-content/plugins/jquery-collapse-o-matic/css/core_style.css,wp-content/plugins/jquery-collapse-o-matic/css/light_style.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/themes/securelist2020/assets/css/main.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 27 Aug 2024 01:57:44 GMT
via: 1.1 kch-varnish-kube-httpcache-578977c959-zvnfb (Varnish/7.3), 1.1 6e202b767e6bdee837ba15ada7e3120e.cloudfront.net (CloudFront)
content-encoding: gzip
x-backend: varnish
x-amz-cf-pop: JFK50-P5
age: 87275
x-cache: Hit from cloudfront
last-modified: Fri, 16 Aug 2024 06:26:01 GMT
server: ycalb
etag: W/"66bef0f9-9e5"
vary: Accept-Encoding
x-varnish: 557866
access-control-allow-origin: *
content-type: image/svg+xml
x-amz-cf-id: 6oceUPk8NXFXOgoNy_TP08opEVmz4082szwGtrMr-_DlK3ksnSrrIg==
x-cache-hits: 0

GET
H2 200 bg-gradient-01.jpg
securelist.com/wp-content/themes/securelist2020/assets/images/content/ 19 KB
19 KB 336ms
334ms Image
image/jpeg 158.160.164.142
YANDEXCLOUD

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securelist.com/wp-content/themes/securelist2020/assets/images/content/bg-gradient-01.jpg
Requested by: Host: securelist.com
URL: https://securelist.com/hz-rat-attacks-wechat-and-dingtalk/113513/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 158.160.164.142 Moscow, Russian Federation, ASN200350 (YANDEXCLOUD, RU),
Reverse DNS
Software: ycalb /
Resource Hash: 6f4abed507ae5e7cea30cf0420b7a937e954423ff85ff0111c9cc6140d472d56

Request headers

Referer: https://securelist.com/hz-rat-attacks-wechat-and-dingtalk/113513/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

expires: Tue, 03 Sep 2024 22:16:54 GMT
date: Tue, 27 Aug 2024 22:16:54 GMT
via: 1.1 kch-varnish-kube-httpcache-6bbf48fc9b-q95z9 (Varnish/7.3)
x-backend: varnish
age: 14124
x-cache: HIT
content-length: 19515
pragma: public
last-modified: Fri, 16 Aug 2024 06:26:02 GMT
server: ycalb
etag: "66bef0fa-4c3b"
content-type: image/jpeg
x-varnish: 1606740 98338
cache-control: max-age=604800, public
accept-ranges: bytes
x-cache-hits: 212

GET
H2 200 logo-basic--invert.svg
assets.kasperskycontenthub.com/wp-content/themes/securelist2020/assets/images/logo/ 2 KB
1 KB 58ms
57ms Image
image/svg+xml 18.164.96.91
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.kasperskycontenthub.com/wp-content/themes/securelist2020/assets/images/logo/logo-basic--invert.svg
Requested by: Host: assets.kasperskycontenthub.com
URL: https://assets.kasperskycontenthub.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/crayon-syntax-highlighter/css/min/crayon.min.css,wp-content/plugins/crayon-syntax-highlighter/themes/classic/classic.css,wp-content/plugins/crayon-syntax-highlighter/fonts/monaco.css,wp-includes/css/dist/block-library/style.min.css,wp-content/plugins/jquery-collapse-o-matic/css/core_style.css,wp-content/plugins/jquery-collapse-o-matic/css/light_style.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/themes/securelist2020/assets/css/main.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.164.96.91 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-164-96-91.jfk50.r.cloudfront.net
Software: ycalb /
Resource Hash: 836563ad7be90ef74eac8862468b675138192f8691a870462d25bacb8c7069af

Request headers

Referer: https://assets.kasperskycontenthub.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/crayon-syntax-highlighter/css/min/crayon.min.css,wp-content/plugins/crayon-syntax-highlighter/themes/classic/classic.css,wp-content/plugins/crayon-syntax-highlighter/fonts/monaco.css,wp-includes/css/dist/block-library/style.min.css,wp-content/plugins/jquery-collapse-o-matic/css/core_style.css,wp-content/plugins/jquery-collapse-o-matic/css/light_style.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/themes/securelist2020/assets/css/main.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 27 Aug 2024 12:33:32 GMT
via: 1.1 kch-varnish-kube-httpcache-6bbf48fc9b-nqd88 (Varnish/7.3), 1.1 6e202b767e6bdee837ba15ada7e3120e.cloudfront.net (CloudFront)
content-encoding: gzip
x-backend: varnish
x-amz-cf-pop: JFK50-P5
age: 49126
x-cache: Hit from cloudfront
last-modified: Fri, 16 Aug 2024 06:26:02 GMT
server: ycalb
etag: W/"66bef0fa-9d9"
vary: Accept-Encoding
x-varnish: 229918
access-control-allow-origin: *
content-type: image/svg+xml
x-amz-cf-id: flwZcKS0dwu-E1YSBfpchwp9F8oQ0x4dswmwTOlLVJI_et9QQe-RAw==
x-cache-hits: 0

GET
H2 200 buttons.png
assets.kasperskycontenthub.com/wp-content/plugins/crayon-syntax-highlighter/css/images/toolbar/ 2 KB
3 KB 55ms
55ms Image
image/png 18.164.96.91
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.kasperskycontenthub.com/wp-content/plugins/crayon-syntax-highlighter/css/images/toolbar/buttons.png
Requested by: Host: assets.kasperskycontenthub.com
URL: https://assets.kasperskycontenthub.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/crayon-syntax-highlighter/css/min/crayon.min.css,wp-content/plugins/crayon-syntax-highlighter/themes/classic/classic.css,wp-content/plugins/crayon-syntax-highlighter/fonts/monaco.css,wp-includes/css/dist/block-library/style.min.css,wp-content/plugins/jquery-collapse-o-matic/css/core_style.css,wp-content/plugins/jquery-collapse-o-matic/css/light_style.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/themes/securelist2020/assets/css/main.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.164.96.91 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-164-96-91.jfk50.r.cloudfront.net
Software: ycalb /
Resource Hash: 630d0a3cc8f4c4aa7bf49b40ae6f59f3a137707e0d7bba46ba44e2e5f2c53aab

Request headers

Referer: https://assets.kasperskycontenthub.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/crayon-syntax-highlighter/css/min/crayon.min.css,wp-content/plugins/crayon-syntax-highlighter/themes/classic/classic.css,wp-content/plugins/crayon-syntax-highlighter/fonts/monaco.css,wp-includes/css/dist/block-library/style.min.css,wp-content/plugins/jquery-collapse-o-matic/css/core_style.css,wp-content/plugins/jquery-collapse-o-matic/css/light_style.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/themes/securelist2020/assets/css/main.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

expires: Mon, 02 Sep 2024 17:44:16 GMT
date: Mon, 26 Aug 2024 17:44:16 GMT
via: 1.1 kch-varnish-kube-httpcache-6bbf48fc9b-gkl4l (Varnish/7.3), 1.1 6e202b767e6bdee837ba15ada7e3120e.cloudfront.net (CloudFront)
x-backend: varnish
x-amz-cf-pop: JFK50-P5
age: 116883
x-cache: Hit from cloudfront
content-length: 2236
pragma: public
last-modified: Fri, 16 Aug 2024 06:26:01 GMT
server: ycalb
etag: "66bef0f9-8bc"
content-type: image/png
x-varnish: 657937
cache-control: max-age=604800, public
accept-ranges: bytes
x-amz-cf-id: -u-jrPevJ7jwW1qx8NnsM94oKL7NT7wuweLGCL3NADGsCQboZlthZQ==
x-cache-hits: 0

GET
H2 200 form-dropdown.svg
assets.kasperskycontenthub.com/wp-content/themes/securelist2020/assets/images/icon/ 370 B
791 B 53ms
49ms Image
image/svg+xml 18.164.96.91
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.kasperskycontenthub.com/wp-content/themes/securelist2020/assets/images/icon/form-dropdown.svg
Requested by: Host: assets.kasperskycontenthub.com
URL: https://assets.kasperskycontenthub.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/crayon-syntax-highlighter/css/min/crayon.min.css,wp-content/plugins/crayon-syntax-highlighter/themes/classic/classic.css,wp-content/plugins/crayon-syntax-highlighter/fonts/monaco.css,wp-includes/css/dist/block-library/style.min.css,wp-content/plugins/jquery-collapse-o-matic/css/core_style.css,wp-content/plugins/jquery-collapse-o-matic/css/light_style.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/themes/securelist2020/assets/css/main.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.164.96.91 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-164-96-91.jfk50.r.cloudfront.net
Software: ycalb /
Resource Hash: 73a6db7aaf149ec53d69ffea02bf070734217ea7e55c8f8b2b47a5ec4e656b54

Request headers

Referer: https://assets.kasperskycontenthub.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/crayon-syntax-highlighter/css/min/crayon.min.css,wp-content/plugins/crayon-syntax-highlighter/themes/classic/classic.css,wp-content/plugins/crayon-syntax-highlighter/fonts/monaco.css,wp-includes/css/dist/block-library/style.min.css,wp-content/plugins/jquery-collapse-o-matic/css/core_style.css,wp-content/plugins/jquery-collapse-o-matic/css/light_style.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/themes/securelist2020/assets/css/main.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 27 Aug 2024 07:15:34 GMT
via: 1.1 kch-varnish-kube-httpcache-6bbf48fc9b-9jgmh (Varnish/7.3), 1.1 6e202b767e6bdee837ba15ada7e3120e.cloudfront.net (CloudFront)
x-backend: varnish
x-amz-cf-pop: JFK50-P5
age: 68205
x-cache: Hit from cloudfront
content-length: 370
last-modified: Fri, 16 Aug 2024 06:26:02 GMT
server: ycalb
etag: "66bef0fa-172"
content-type: image/svg+xml
access-control-allow-origin: *
x-varnish: 9308287 98414
accept-ranges: bytes
x-amz-cf-id: 7sBX1t-wKZf393f2qL6TwhrryhAESA4ZECpmMErYaWwT9jxi_9lfYw==
x-cache-hits: 2

GET
H2 200 KasperskySans-Light.woff2
assets.kasperskycontenthub.com/wp-content/themes/securelist2020/assets/fonts/kasperskysans/ 36 KB
37 KB 307ms
69ms Font
font/woff2 18.164.96.91
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.kasperskycontenthub.com/wp-content/themes/securelist2020/assets/fonts/kasperskysans/KasperskySans-Light.woff2
Requested by: Host: assets.kasperskycontenthub.com
URL: https://assets.kasperskycontenthub.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/crayon-syntax-highlighter/css/min/crayon.min.css,wp-content/plugins/crayon-syntax-highlighter/themes/classic/classic.css,wp-content/plugins/crayon-syntax-highlighter/fonts/monaco.css,wp-includes/css/dist/block-library/style.min.css,wp-content/plugins/jquery-collapse-o-matic/css/core_style.css,wp-content/plugins/jquery-collapse-o-matic/css/light_style.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/themes/securelist2020/assets/css/main.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.164.96.91 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-164-96-91.jfk50.r.cloudfront.net
Software: ycalb /
Resource Hash: f49616f5799065ebf4fcc95c80d526d53a486c33aa0213d32b5b124aab582c6b

Request headers

Referer: https://assets.kasperskycontenthub.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/crayon-syntax-highlighter/css/min/crayon.min.css,wp-content/plugins/crayon-syntax-highlighter/themes/classic/classic.css,wp-content/plugins/crayon-syntax-highlighter/fonts/monaco.css,wp-includes/css/dist/block-library/style.min.css,wp-content/plugins/jquery-collapse-o-matic/css/core_style.css,wp-content/plugins/jquery-collapse-o-matic/css/light_style.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/themes/securelist2020/assets/css/main.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css
Origin: https://securelist.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Mon, 26 Aug 2024 18:08:55 GMT
via: 1.1 kch-varnish-kube-httpcache-578977c959-hr8vn (Varnish/7.3), 1.1 6e202b767e6bdee837ba15ada7e3120e.cloudfront.net (CloudFront)
x-backend: varnish
x-amz-cf-pop: JFK50-P5
age: 115402
x-cache: Hit from cloudfront
content-length: 37156
last-modified: Fri, 16 Aug 2024 06:26:02 GMT
server: ycalb
etag: "66bef0fa-9124"
vary: Accept-Encoding
x-varnish: 825752 761134
access-control-allow-origin: *
content-type: font/woff2
accept-ranges: bytes
x-amz-cf-id: erW3sMwPDa1-8fhaNFBbCwZxjizgK5LQf4pbKN46mSittiqbw1avWA==
x-cache-hits: 7

GET
H2 200 font-icons.ttf
assets.kasperskycontenthub.com/wp-content/themes/securelist2020/assets/fonts/font-icons/ 34 KB
35 KB 409ms
171ms Font
application/octet-stream 18.164.96.91
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.kasperskycontenthub.com/wp-content/themes/securelist2020/assets/fonts/font-icons/font-icons.ttf?p2bytm
Requested by: Host: assets.kasperskycontenthub.com
URL: https://assets.kasperskycontenthub.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/crayon-syntax-highlighter/css/min/crayon.min.css,wp-content/plugins/crayon-syntax-highlighter/themes/classic/classic.css,wp-content/plugins/crayon-syntax-highlighter/fonts/monaco.css,wp-includes/css/dist/block-library/style.min.css,wp-content/plugins/jquery-collapse-o-matic/css/core_style.css,wp-content/plugins/jquery-collapse-o-matic/css/light_style.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/themes/securelist2020/assets/css/main.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.164.96.91 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-164-96-91.jfk50.r.cloudfront.net
Software: ycalb /
Resource Hash: 0b5e58a4f0210f08715d04b464d51ee735c5952a86ecb59988f5aab3ad166096

Request headers

Referer: https://assets.kasperskycontenthub.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/crayon-syntax-highlighter/css/min/crayon.min.css,wp-content/plugins/crayon-syntax-highlighter/themes/classic/classic.css,wp-content/plugins/crayon-syntax-highlighter/fonts/monaco.css,wp-includes/css/dist/block-library/style.min.css,wp-content/plugins/jquery-collapse-o-matic/css/core_style.css,wp-content/plugins/jquery-collapse-o-matic/css/light_style.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/themes/securelist2020/assets/css/main.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css
Origin: https://securelist.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 27 Aug 2024 12:33:33 GMT
via: 1.1 kch-varnish-kube-httpcache-6bbf48fc9b-nqd88 (Varnish/7.3), 1.1 6e202b767e6bdee837ba15ada7e3120e.cloudfront.net (CloudFront)
x-backend: varnish
x-amz-cf-pop: JFK50-P5
age: 49126
x-cache: Hit from cloudfront
content-length: 35196
last-modified: Fri, 16 Aug 2024 06:26:02 GMT
server: ycalb
etag: "66bef0fa-897c"
content-type: application/octet-stream
access-control-allow-origin: *
x-varnish: 787091
accept-ranges: bytes
x-amz-cf-id: 5iT9tZvQBfElX7Y7KfehbxGDbLnx9OtWXmdbRo1EvxbuXFoi-io65A==
x-cache-hits: 0

GET
H2 200 KasperskySans-Regular.woff2
assets.kasperskycontenthub.com/wp-content/themes/securelist2020/assets/fonts/kasperskysans/ 36 KB
37 KB 373ms
135ms Font
font/woff2 18.164.96.91
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.kasperskycontenthub.com/wp-content/themes/securelist2020/assets/fonts/kasperskysans/KasperskySans-Regular.woff2
Requested by: Host: assets.kasperskycontenthub.com
URL: https://assets.kasperskycontenthub.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/crayon-syntax-highlighter/css/min/crayon.min.css,wp-content/plugins/crayon-syntax-highlighter/themes/classic/classic.css,wp-content/plugins/crayon-syntax-highlighter/fonts/monaco.css,wp-includes/css/dist/block-library/style.min.css,wp-content/plugins/jquery-collapse-o-matic/css/core_style.css,wp-content/plugins/jquery-collapse-o-matic/css/light_style.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/themes/securelist2020/assets/css/main.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.164.96.91 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-164-96-91.jfk50.r.cloudfront.net
Software: ycalb /
Resource Hash: 9d267660007f1f410756135374db1ee6baea0115d81e2c2a0821507c7111209f

Request headers

Referer: https://assets.kasperskycontenthub.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/crayon-syntax-highlighter/css/min/crayon.min.css,wp-content/plugins/crayon-syntax-highlighter/themes/classic/classic.css,wp-content/plugins/crayon-syntax-highlighter/fonts/monaco.css,wp-includes/css/dist/block-library/style.min.css,wp-content/plugins/jquery-collapse-o-matic/css/core_style.css,wp-content/plugins/jquery-collapse-o-matic/css/light_style.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/themes/securelist2020/assets/css/main.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css
Origin: https://securelist.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 27 Aug 2024 13:06:23 GMT
via: 1.1 kch-varnish-kube-httpcache-578977c959-dgdbw (Varnish/7.3), 1.1 6e202b767e6bdee837ba15ada7e3120e.cloudfront.net (CloudFront)
x-backend: varnish
x-amz-cf-pop: JFK50-P5
age: 87716
x-cache: Hit from cloudfront
content-length: 37372
last-modified: Fri, 16 Aug 2024 06:26:02 GMT
server: ycalb
etag: "66bef0fa-91fc"
vary: Accept-Encoding
x-varnish: 25370404 17989970
access-control-allow-origin: *
content-type: font/woff2
accept-ranges: bytes
x-amz-cf-id: W3SK96YBzFRO4ilHgyq3bGltxvX7K8mSE7dlmC2QNjdBwLVps8WLLw==
x-cache-hits: 5

GET
H2 200 AnonymousPro-Bold.woff2
assets.kasperskycontenthub.com/wp-content/themes/securelist2020/assets/fonts/anonymouspro/ 34 KB
35 KB 372ms
134ms Font
font/woff2 18.164.96.91
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.kasperskycontenthub.com/wp-content/themes/securelist2020/assets/fonts/anonymouspro/AnonymousPro-Bold.woff2
Requested by: Host: assets.kasperskycontenthub.com
URL: https://assets.kasperskycontenthub.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/crayon-syntax-highlighter/css/min/crayon.min.css,wp-content/plugins/crayon-syntax-highlighter/themes/classic/classic.css,wp-content/plugins/crayon-syntax-highlighter/fonts/monaco.css,wp-includes/css/dist/block-library/style.min.css,wp-content/plugins/jquery-collapse-o-matic/css/core_style.css,wp-content/plugins/jquery-collapse-o-matic/css/light_style.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/themes/securelist2020/assets/css/main.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.164.96.91 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-164-96-91.jfk50.r.cloudfront.net
Software: ycalb /
Resource Hash: 47db3eedf6793ff55d3d71a6ea5fa2cc86317453f3910e181d22198cee291389

Request headers

Referer: https://assets.kasperskycontenthub.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/crayon-syntax-highlighter/css/min/crayon.min.css,wp-content/plugins/crayon-syntax-highlighter/themes/classic/classic.css,wp-content/plugins/crayon-syntax-highlighter/fonts/monaco.css,wp-includes/css/dist/block-library/style.min.css,wp-content/plugins/jquery-collapse-o-matic/css/core_style.css,wp-content/plugins/jquery-collapse-o-matic/css/light_style.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/themes/securelist2020/assets/css/main.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css
Origin: https://securelist.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 27 Aug 2024 12:33:13 GMT
via: 1.1 kch-varnish-kube-httpcache-578977c959-vztj8 (Varnish/7.3), 1.1 6e202b767e6bdee837ba15ada7e3120e.cloudfront.net (CloudFront)
x-backend: varnish
x-amz-cf-pop: JFK50-P5
age: 89491
x-cache: Hit from cloudfront
content-length: 35064
last-modified: Fri, 16 Aug 2024 06:26:02 GMT
server: ycalb
etag: "66bef0fa-88f8"
vary: Accept-Encoding
x-varnish: 13664370 1901096
access-control-allow-origin: *
content-type: font/woff2
accept-ranges: bytes
x-amz-cf-id: mp9_4Q33_OMzOrt33xC2Gyibsw9xOzsq9ATbw6yO5JKPAWcupMRJAg==
x-cache-hits: 1

GET
H2 200 KasperskySans-Bold.woff2
assets.kasperskycontenthub.com/wp-content/themes/securelist2020/assets/fonts/kasperskysans/ 36 KB
37 KB 372ms
136ms Font
font/woff2 18.164.96.91
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.kasperskycontenthub.com/wp-content/themes/securelist2020/assets/fonts/kasperskysans/KasperskySans-Bold.woff2
Requested by: Host: assets.kasperskycontenthub.com
URL: https://assets.kasperskycontenthub.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/crayon-syntax-highlighter/css/min/crayon.min.css,wp-content/plugins/crayon-syntax-highlighter/themes/classic/classic.css,wp-content/plugins/crayon-syntax-highlighter/fonts/monaco.css,wp-includes/css/dist/block-library/style.min.css,wp-content/plugins/jquery-collapse-o-matic/css/core_style.css,wp-content/plugins/jquery-collapse-o-matic/css/light_style.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/themes/securelist2020/assets/css/main.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.164.96.91 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-164-96-91.jfk50.r.cloudfront.net
Software: ycalb /
Resource Hash: 799706f10a0d4045e0be9f81f89a830a6b303283f8d363d12aa984e79e108713

Request headers

Referer: https://assets.kasperskycontenthub.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/crayon-syntax-highlighter/css/min/crayon.min.css,wp-content/plugins/crayon-syntax-highlighter/themes/classic/classic.css,wp-content/plugins/crayon-syntax-highlighter/fonts/monaco.css,wp-includes/css/dist/block-library/style.min.css,wp-content/plugins/jquery-collapse-o-matic/css/core_style.css,wp-content/plugins/jquery-collapse-o-matic/css/light_style.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/themes/securelist2020/assets/css/main.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css
Origin: https://securelist.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 27 Aug 2024 12:33:13 GMT
via: 1.1 kch-varnish-kube-httpcache-578977c959-vztj8 (Varnish/7.3), 1.1 6e202b767e6bdee837ba15ada7e3120e.cloudfront.net (CloudFront)
x-backend: varnish
x-amz-cf-pop: JFK50-P5
age: 49982
x-cache: Hit from cloudfront
content-length: 37056
last-modified: Fri, 16 Aug 2024 06:26:02 GMT
server: ycalb
etag: "66bef0fa-90c0"
vary: Accept-Encoding
x-varnish: 1606019 1803217
access-control-allow-origin: *
content-type: font/woff2
accept-ranges: bytes
x-amz-cf-id: kdYBIe9m9I6TARRXoovO6MqBlJbN81M82mLIFD_NmCNKJj6mUw6Nlw==
x-cache-hits: 2

GET
H2 200 Oswald-Bold.woff2
assets.kasperskycontenthub.com/wp-content/themes/securelist2020/assets/fonts/oswald/ 30 KB
30 KB 373ms
136ms Font
font/woff2 18.164.96.91
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.kasperskycontenthub.com/wp-content/themes/securelist2020/assets/fonts/oswald/Oswald-Bold.woff2
Requested by: Host: assets.kasperskycontenthub.com
URL: https://assets.kasperskycontenthub.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/crayon-syntax-highlighter/css/min/crayon.min.css,wp-content/plugins/crayon-syntax-highlighter/themes/classic/classic.css,wp-content/plugins/crayon-syntax-highlighter/fonts/monaco.css,wp-includes/css/dist/block-library/style.min.css,wp-content/plugins/jquery-collapse-o-matic/css/core_style.css,wp-content/plugins/jquery-collapse-o-matic/css/light_style.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/themes/securelist2020/assets/css/main.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.164.96.91 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-164-96-91.jfk50.r.cloudfront.net
Software: ycalb /
Resource Hash: 08e5c51e367f5f721ad103f5463f457f4ea5d9586583030cd1b766f4514e1bac

Request headers

Referer: https://assets.kasperskycontenthub.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/crayon-syntax-highlighter/css/min/crayon.min.css,wp-content/plugins/crayon-syntax-highlighter/themes/classic/classic.css,wp-content/plugins/crayon-syntax-highlighter/fonts/monaco.css,wp-includes/css/dist/block-library/style.min.css,wp-content/plugins/jquery-collapse-o-matic/css/core_style.css,wp-content/plugins/jquery-collapse-o-matic/css/light_style.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/themes/securelist2020/assets/css/main.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css
Origin: https://securelist.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 27 Aug 2024 09:16:47 GMT
via: 1.1 kch-varnish-kube-httpcache-578977c959-l8vph (Varnish/7.3), 1.1 6e202b767e6bdee837ba15ada7e3120e.cloudfront.net (CloudFront)
x-backend: varnish
x-amz-cf-pop: JFK50-P5
age: 65290
x-cache: Hit from cloudfront
content-length: 30624
last-modified: Fri, 16 Aug 2024 06:26:02 GMT
server: ycalb
etag: "66bef0fa-77a0"
vary: Accept-Encoding
x-varnish: 1934784 623207
access-control-allow-origin: *
content-type: font/woff2
accept-ranges: bytes
x-amz-cf-id: Bf3uGGNA9iBUHIJRsqKCid1TgbJgWF9_cMJKC8wngbbWH3lEtOs_4A==
x-cache-hits: 1

GET
H2 200 monaco-webfont.woff
assets.kasperskycontenthub.com/wp-content/plugins/crayon-syntax-highlighter/fonts/monaco/ 21 KB
21 KB 348ms
112ms Font
font/woff 18.164.96.91
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.kasperskycontenthub.com/wp-content/plugins/crayon-syntax-highlighter/fonts/monaco/monaco-webfont.woff
Requested by: Host: assets.kasperskycontenthub.com
URL: https://assets.kasperskycontenthub.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/crayon-syntax-highlighter/css/min/crayon.min.css,wp-content/plugins/crayon-syntax-highlighter/themes/classic/classic.css,wp-content/plugins/crayon-syntax-highlighter/fonts/monaco.css,wp-includes/css/dist/block-library/style.min.css,wp-content/plugins/jquery-collapse-o-matic/css/core_style.css,wp-content/plugins/jquery-collapse-o-matic/css/light_style.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/themes/securelist2020/assets/css/main.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.164.96.91 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-164-96-91.jfk50.r.cloudfront.net
Software: ycalb /
Resource Hash: 9c2e1d2864f53c224d6542bed9a1ab1de620dae21a2146eb4ff982dd8fcd4567

Request headers

Referer: https://assets.kasperskycontenthub.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/crayon-syntax-highlighter/css/min/crayon.min.css,wp-content/plugins/crayon-syntax-highlighter/themes/classic/classic.css,wp-content/plugins/crayon-syntax-highlighter/fonts/monaco.css,wp-includes/css/dist/block-library/style.min.css,wp-content/plugins/jquery-collapse-o-matic/css/core_style.css,wp-content/plugins/jquery-collapse-o-matic/css/light_style.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/themes/securelist2020/assets/css/main.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css
Origin: https://securelist.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 27 Aug 2024 10:42:37 GMT
via: 1.1 kch-varnish-kube-httpcache-578977c959-2rvm6 (Varnish/7.3), 1.1 6e202b767e6bdee837ba15ada7e3120e.cloudfront.net (CloudFront)
x-backend: varnish
x-amz-cf-pop: JFK50-P5
age: 55782
x-cache: Hit from cloudfront
content-length: 21372
last-modified: Fri, 16 Aug 2024 06:26:01 GMT
server: ycalb
etag: "66bef0f9-537c"
vary: Accept-Encoding
x-varnish: 74535
access-control-allow-origin: *
content-type: font/woff
accept-ranges: bytes
x-amz-cf-id: eDejPoVSY7HfPiNxsj3TWXywyldDe3_11u9SqoUEuwSFL9RTgV5liw==
x-cache-hits: 0

GET
H2 200 hzrat-featured-1200x600.jpg
media.kasperskycontenthub.com/wp-content/uploads/sites/43/2024/08/27085625/ 102 KB
102 KB 209ms
199ms Image
image/jpeg 2600:9000:21da:1e00:1b:d000:d280:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2024/08/27085625/hzrat-featured-1200x600.jpg
Requested by: Host: securelist.com
URL: https://securelist.com/hz-rat-attacks-wechat-and-dingtalk/113513/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:21da:1e00:1b:d000:d280:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 49d185466cd7f5e8547ce91fb785a1bdf3bc330ac02d8cb65d9f49b94b1185fe

Request headers

Referer: https://securelist.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 27 Aug 2024 10:02:52 GMT
via: 1.1 17a79dcb426270de1bedb2a8dbcb8f72.cloudfront.net (CloudFront)
last-modified: Tue, 27 Aug 2024 08:56:28 GMT
server: AmazonS3
x-amz-cf-pop: EWR53-C1
age: 58168
etag: "3545a66f35ce14f66fb27ee264e220df"
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-type: image/jpeg
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 104319
x-amz-cf-id: AtfzocgxU-hGTj8ifzjqoNnZLKZIpbjw6q7k6axxVwp81UdxFgTt4Q==

GET
H2 200 hz_rat_attacks_wechat_and_dingtalk_01-1024x552.png
media.kasperskycontenthub.com/wp-content/uploads/sites/43/2024/08/26153517/ 167 KB
168 KB 186ms
177ms Image
image/png 2600:9000:21da:1e00:1b:d000:d280:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2024/08/26153517/hz_rat_attacks_wechat_and_dingtalk_01-1024x552.png
Requested by: Host: securelist.com
URL: https://securelist.com/hz-rat-attacks-wechat-and-dingtalk/113513/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:21da:1e00:1b:d000:d280:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: b5423efa22f4f7cf48ec28a428eba513bbe67a337975edc86a7de0ba6a5dca46

Request headers

Referer: https://securelist.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 27 Aug 2024 10:02:52 GMT
via: 1.1 17a79dcb426270de1bedb2a8dbcb8f72.cloudfront.net (CloudFront)
last-modified: Mon, 26 Aug 2024 15:35:19 GMT
server: AmazonS3
x-amz-cf-pop: EWR53-C1
age: 58168
etag: "1c51e5b2cb54cfd130ab057779164f22"
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-type: image/png
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 171351
x-amz-cf-id: 17yRHjuUIEp73u-T-0KUAvQDTld0in2JSk0y8-6GjIZA7pN2SRqEhA==

GET
H2 200 hz_rat_attacks_wechat_and_dingtalk_02.png
media.kasperskycontenthub.com/wp-content/uploads/sites/43/2024/08/26153549/ 24 KB
24 KB 187ms
178ms Image
image/png 2600:9000:21da:1e00:1b:d000:d280:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2024/08/26153549/hz_rat_attacks_wechat_and_dingtalk_02.png
Requested by: Host: securelist.com
URL: https://securelist.com/hz-rat-attacks-wechat-and-dingtalk/113513/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:21da:1e00:1b:d000:d280:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 0ea1b10645a680dbd031885ce8fb9ea93348eff8869acf850fc92d3d55fd9f69

Request headers

Referer: https://securelist.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 27 Aug 2024 10:02:53 GMT
via: 1.1 17a79dcb426270de1bedb2a8dbcb8f72.cloudfront.net (CloudFront)
last-modified: Mon, 26 Aug 2024 15:35:52 GMT
server: AmazonS3
x-amz-cf-pop: EWR53-C1
age: 58167
etag: "2ef44cde5cb7041f33d37c713ba86652"
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-type: image/png
accept-ranges: bytes
content-length: 24116
x-amz-cf-id: 0FqGAReYUVji3vbAIA7--QjgKInHSSBkgxapMgEn18-z28D4h4vSzg==

GET
H2 200 hz_rat_attacks_wechat_and_dingtalk_03.png
media.kasperskycontenthub.com/wp-content/uploads/sites/43/2024/08/26153617/ 5 KB
5 KB 206ms
198ms Image
image/png 2600:9000:21da:1e00:1b:d000:d280:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2024/08/26153617/hz_rat_attacks_wechat_and_dingtalk_03.png
Requested by: Host: securelist.com
URL: https://securelist.com/hz-rat-attacks-wechat-and-dingtalk/113513/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:21da:1e00:1b:d000:d280:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: a35e957c5100afe587a873f70790be71909338de74de8dbcd08e053557b5abdc

Request headers

Referer: https://securelist.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 27 Aug 2024 10:02:53 GMT
via: 1.1 17a79dcb426270de1bedb2a8dbcb8f72.cloudfront.net (CloudFront)
last-modified: Mon, 26 Aug 2024 15:36:20 GMT
server: AmazonS3
x-amz-cf-pop: EWR53-C1
age: 58167
etag: "85ce13cc546af83d1fd1581707264523"
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-type: image/png
accept-ranges: bytes
content-length: 4917
x-amz-cf-id: lF1EcckpjMMyhnaIjIoTZN54S318ai1V1JEaKnTjG0j-HAG2a9bEWg==

GET
H2 200 bg-gradient-03.jpg
assets.kasperskycontenthub.com/wp-content/themes/securelist2020/assets/images/content/ 44 KB
44 KB 86ms
85ms Image
image/jpeg 18.164.96.91
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.kasperskycontenthub.com/wp-content/themes/securelist2020/assets/images/content/bg-gradient-03.jpg
Requested by: Host: assets.kasperskycontenthub.com
URL: https://assets.kasperskycontenthub.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/crayon-syntax-highlighter/css/min/crayon.min.css,wp-content/plugins/crayon-syntax-highlighter/themes/classic/classic.css,wp-content/plugins/crayon-syntax-highlighter/fonts/monaco.css,wp-includes/css/dist/block-library/style.min.css,wp-content/plugins/jquery-collapse-o-matic/css/core_style.css,wp-content/plugins/jquery-collapse-o-matic/css/light_style.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/themes/securelist2020/assets/css/main.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.164.96.91 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-164-96-91.jfk50.r.cloudfront.net
Software: ycalb /
Resource Hash: 53dbe2ed80b498f4a0c0e811dc9c4f6a8c1d62c7a5c19e3e3d9b9aab8a070bc2

Request headers

Referer: https://assets.kasperskycontenthub.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/crayon-syntax-highlighter/css/min/crayon.min.css,wp-content/plugins/crayon-syntax-highlighter/themes/classic/classic.css,wp-content/plugins/crayon-syntax-highlighter/fonts/monaco.css,wp-includes/css/dist/block-library/style.min.css,wp-content/plugins/jquery-collapse-o-matic/css/core_style.css,wp-content/plugins/jquery-collapse-o-matic/css/light_style.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/themes/securelist2020/assets/css/main.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

expires: Sat, 31 Aug 2024 09:15:24 GMT
date: Sat, 24 Aug 2024 09:15:24 GMT
via: 1.1 kch-varnish-kube-httpcache-578977c959-ftwwt (Varnish/7.3), 1.1 6e202b767e6bdee837ba15ada7e3120e.cloudfront.net (CloudFront)
x-backend: varnish
x-amz-cf-pop: JFK50-P5
age: 320215
x-cache: Hit from cloudfront
content-length: 44956
pragma: public
last-modified: Fri, 16 Aug 2024 06:26:02 GMT
server: ycalb
etag: "66bef0fa-af9c"
content-type: image/jpeg
x-varnish: 4653292
cache-control: max-age=604800, public
accept-ranges: bytes
x-amz-cf-id: tuUaYWLekm91E2CQqcWxEgcvWLKgJy0u_3vGiB_ympjluhLsi7qn8A==
x-cache-hits: 0

POST
H/1.1 200
OK visitWebPage
802-ijn-240.mktoresp.com/webevents/ 2 B
318 B 672ms
164ms Ping
text/plain 192.28.147.68
OMNITURE

General

Check archive.org

Show headers Download Go to

Full URL: https://802-ijn-240.mktoresp.com/webevents/visitWebPage?_mchNc=1724811139421&_mchCn=&_mchId=802-IJN-240&_mchTk=_mch-securelist.com-1724811139419-36967&_mchHo=securelist.com&_mchPo=&_mchRu=%2Fhz-rat-attacks-wechat-and-dingtalk%2F113513%2F&_mchPc=https%3A&_mchVr=163&_mchEcid=&_mchHa=&_mchRe=&_mchQp=
Requested by: Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/163/munchkin.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 192.28.147.68 , United States, ASN15224 (OMNITURE, US),
Reverse DNS
Software: nginx/1.20.1 /
Resource Hash: 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

Referer: https://securelist.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date: Wed, 28 Aug 2024 02:12:19 GMT
Content-Encoding: gzip
Server: nginx/1.20.1
Transfer-Encoding: chunked
Content-Type: text/plain; charset=UTF-8
Access-Control-Allow-Origin: *
Connection: keep-alive
X-Request-Id: 279e71ad-312b-41bc-9c23-1380f25656e3

GET recaptcha__en.js
www.gstatic.com/recaptcha/releases/i7X0JrnYWy9Y_5EYdoFM79kV/ 0
0

GET
H2 200 bg-gradient-02.jpg
securelist.com/wp-content/themes/securelist2020/assets/images/content/ 37 KB
37 KB 290ms
289ms Image
image/jpeg 158.160.164.142
YANDEXCLOUD

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securelist.com/wp-content/themes/securelist2020/assets/images/content/bg-gradient-02.jpg
Requested by: Host: securelist.com
URL: https://securelist.com/hz-rat-attacks-wechat-and-dingtalk/113513/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 158.160.164.142 Moscow, Russian Federation, ASN200350 (YANDEXCLOUD, RU),
Reverse DNS
Software: ycalb /
Resource Hash: 946b9f30a2864e61c74a65da0fc9dacce9a001b5c361c29b710fd2e34dd2f89b

Request headers

Referer: https://securelist.com/hz-rat-attacks-wechat-and-dingtalk/113513/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

expires: Tue, 03 Sep 2024 22:17:25 GMT
date: Tue, 27 Aug 2024 22:17:25 GMT
via: 1.1 kch-varnish-kube-httpcache-6bbf48fc9b-q95z9 (Varnish/7.3)
x-backend: varnish
age: 14093
x-cache: HIT
content-length: 37960
pragma: public
last-modified: Fri, 16 Aug 2024 06:26:02 GMT
server: ycalb
etag: "66bef0fa-9448"
content-type: image/jpeg
x-varnish: 1606741 65604
cache-control: max-age=604800, public
accept-ranges: bytes
x-cache-hits: 241

GET
H2 200 logo-kaspersky--invert.svg
assets.kasperskycontenthub.com/wp-content/themes/securelist2020/assets/images/logo/ 3 KB
2 KB 95ms
93ms Image
image/svg+xml 18.164.96.91
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.kasperskycontenthub.com/wp-content/themes/securelist2020/assets/images/logo/logo-kaspersky--invert.svg
Requested by: Host: assets.kasperskycontenthub.com
URL: https://assets.kasperskycontenthub.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/crayon-syntax-highlighter/css/min/crayon.min.css,wp-content/plugins/crayon-syntax-highlighter/themes/classic/classic.css,wp-content/plugins/crayon-syntax-highlighter/fonts/monaco.css,wp-includes/css/dist/block-library/style.min.css,wp-content/plugins/jquery-collapse-o-matic/css/core_style.css,wp-content/plugins/jquery-collapse-o-matic/css/light_style.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/themes/securelist2020/assets/css/main.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.164.96.91 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-164-96-91.jfk50.r.cloudfront.net
Software: ycalb /
Resource Hash: 6670587c6c6f7eaea610366096842e6256d42aa527149b0627416005f81f3390

Request headers

Referer: https://assets.kasperskycontenthub.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/crayon-syntax-highlighter/css/min/crayon.min.css,wp-content/plugins/crayon-syntax-highlighter/themes/classic/classic.css,wp-content/plugins/crayon-syntax-highlighter/fonts/monaco.css,wp-includes/css/dist/block-library/style.min.css,wp-content/plugins/jquery-collapse-o-matic/css/core_style.css,wp-content/plugins/jquery-collapse-o-matic/css/light_style.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/themes/securelist2020/assets/css/main.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 27 Aug 2024 08:27:55 GMT
via: 1.1 kch-varnish-kube-httpcache-578977c959-ftwwt (Varnish/7.3), 1.1 6e202b767e6bdee837ba15ada7e3120e.cloudfront.net (CloudFront)
content-encoding: gzip
x-backend: varnish
x-amz-cf-pop: JFK50-P5
age: 63863
x-cache: Hit from cloudfront
last-modified: Fri, 16 Aug 2024 06:26:02 GMT
server: ycalb
etag: W/"66bef0fa-d79"
vary: Accept-Encoding
x-varnish: 1316352 131127
access-control-allow-origin: *
content-type: image/svg+xml
x-amz-cf-id: tegXYdlv6kEuIBqZXrH9pgDpUhjUvpcDNMYM8cJSVttqEZQCLkbj1g==
x-cache-hits: 2

GET
H3 200 all.js Show response
connect.facebook.net/en_US/ 301 KB
85 KB 249ms
62ms Script
application/x-javascript 2a03:2880:f012:10c:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/all.js?hash=2059740aeef11e341c33648d77f06545

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/all.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f012:10c:face:b00c:0:3 Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

7fd67f7e5ed7e6e91b038162284314b32c6176274cb8c559096c179747c84524

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://securelist.com/
Origin: https://securelist.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
date: Wed, 28 Aug 2024 02:12:19 GMT
content-md5: zam792yo+J+UkyErZLJs8g==
document-policy: force-load-at-top
x-fb-server-load: 48
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 87220
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
x-fb-connection-quality: GOOD; q=0.7, rtt=76, rtx=0, c=23, mss=1232, tbw=5580, tp=10, tpl=0, uplat=1, ullat=-1
x-fb-debug: CMARCZAG5dRACO55PfvDyicRLV9t57UfRpw6PSy89CwDEomHNdO9JEugHlzq2Ok5X+hX9IRRkmLXBtqwllP/2Q==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
x-fb-content-md5: e10215f05225b02b6eaa0d8f0c35299e
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
etag: "3bc746f673673a6cf9c2973d869ccc27"
vary: Accept-Encoding
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
origin-agent-cluster: ?0
access-control-expose-headers: X-FB-Content-MD5
cache-control: public,max-age=31536000,stale-while-revalidate=3600,immutable
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
x-frame-options: DENY
timing-allow-origin: *
priority: u=3,i
expires: Wed, 27 Aug 2025 22:51:48 GMT

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 633 KB
161 KB 134ms
133ms Script
application/javascript 2607:f8b0:4006:80c::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-T45JW6B&l=dataLayer

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WZ7LJ3

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80c::2008 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

daaf5bbd1b27e54d87f7fc8b2ac8e797272bdaa64542f65e2c4ea0623e46c7c1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://securelist.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Wed, 28 Aug 2024 02:12:19 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 164368
x-xss-protection: 0
last-modified: Wed, 28 Aug 2024 00:52:49 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Wed, 28 Aug 2024 02:12:19 GMT

GET
H2 200 status
www.facebook.com/x/oauth/ 0
0 479ms
179ms Fetch
text/plain 2a03:2880:f112:182:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/x/oauth/status?client_id=160639043985664&input_token&origin=1&redirect_uri=https%3A%2F%2Fsecurelist.com%2Fhz-rat-attacks-wechat-and-dingtalk%2F113513%2F&sdk=joey&wants_cookie_data=false

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/all.js?hash=2059740aeef11e341c33648d77f06545

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f112:182:face:b00c:0:25de Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://securelist.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

strict-transport-security: max-age=15552000; preload
date: Wed, 28 Aug 2024 02:12:20 GMT
x-content-type-options: nosniff
document-policy: force-load-at-top
x-fb-server-load: 21
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0
reporting-endpoints: default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown&brsid=7408007439110063476", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=16, rtx=0, c=10, mss=1392, tbw=2765, tp=-1, tpl=-1, uplat=15, ullat=0
pragma: no-cache
x-fb-debug: sPTAJRxHAyp6pQLJjQERjJ7s1JngH9VfdJ00gKxbm3/ZfLn4Qo+wsB44/FyTqxjQJhiJzhEXitqM8I4KNYsipg==
fb-s: unknown
report-to: {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown&brsid=7408007439110063476"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://securelist.com
origin-agent-cluster: ?0
access-control-expose-headers: fb-s
cache-control: private, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), browsing-topics=(self), camera=(self), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(self), clipboard-write=(self), compute-pressure=(), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(self), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(self), midi=(), otp-credentials=(), payment=(), picture-in-picture=(self), private-state-token-issuance=(), publickey-credentials-get=(self), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=(self);report-to="permissions_policy"
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 id Show response
dpm.demdex.net/ 368 B
917 B 384ms
76ms XHR
application/json 52.22.19.177
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://dpm.demdex.net/id?d_visid_ver=4.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_orgid=983502BE532960BE0A490D4C%40AdobeOrg&d_nsid=0&ts=1724811140228

Requested by

Host: media.kaspersky.com
URL: https://media.kaspersky.com/tracking/omniture/s_code_single_suite.js?ver=6.5.5

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.22.19.177 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-22-19-177.compute-1.amazonaws.com

Software

Resource Hash

6956c5691406ff1b2fec56ba630b81bffbb236c2307426d6dd7127afed13b74f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://securelist.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

dcs: dcs-prod-va6-2-v064-0826c50b7.edge-va6.demdex.com 5 ms
pragma: no-cache
date: Wed, 28 Aug 2024 02:12:20 GMT
strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
x-tid: wJCT0mCDTho=
vary: Origin
content-type: application/json;charset=utf-8
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
access-control-allow-origin: https://securelist.com
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
access-control-allow-credentials: true
content-length: 315
expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H2 200 dest5.html
kaspersky.demdex.net/ Frame 5F7E 0
0 245ms
68ms Document
text/html 3.233.35.165
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://kaspersky.demdex.net/dest5.html?d_nsid=0

Requested by

Host: media.kaspersky.com
URL: https://media.kaspersky.com/tracking/omniture/s_code_single_suite.js?ver=6.5.5

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.233.35.165 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-233-35-165.compute-1.amazonaws.com

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://securelist.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
content-encoding: gzip
content-type: text/html;charset=UTF-8
date: Wed, 28 Aug 2024 02:12:20 GMT
dcs: dcs-prod-va6-2-v064-0cb2f2933.edge-va6.demdex.com 0 ms
expires: Thu, 01 Jan 1970 00:00:00 UTC
last-modified: Mon, 19 Aug 2024 12:40:29 GMT
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
pragma: no-cache
strict-transport-security: max-age=31536000; includeSubDomains
vary: accept-encoding
x-tid: QXX1rPYsRe8=

GET
H2 200 id Show response
kaspersky.d3.sc.omtrdc.net/ 2 B
266 B 313ms
133ms XHR
application/x-javascript 63.140.39.150
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://kaspersky.d3.sc.omtrdc.net/id?d_visid_ver=4.4.0&d_fieldgroup=A&mcorgid=983502BE532960BE0A490D4C%40AdobeOrg&mid=44221625566092903700010860833699971769&ts=1724811140621

Requested by

Host: media.kaspersky.com
URL: https://media.kaspersky.com/tracking/omniture/s_code_single_suite.js?ver=6.5.5

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

63.140.39.150 , United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ip-63-140-39-150.data.adobedc.net

Software

jag /

Resource Hash

44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://securelist.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Wed, 28 Aug 2024 02:12:20 GMT
x-content-type-options: nosniff
server: jag
vary: Origin
content-type: application/x-javascript;charset=utf-8
access-control-allow-origin: https://securelist.com
p3p: CP="This is not a P3P policy"
cache-control: no-cache, no-store, max-age=0, no-transform, private
access-control-allow-credentials: true
content-length: 2
x-xss-protection: 1; mode=block

GET dd
cm.everesttech.net/cm/ 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: media.kasperskydaily.com
URL: https://media.kasperskydaily.com/wp-content/uploads/sites/92/2024/04/10052437/k_Next_RGB_black_icon.png

Domain: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/i7X0JrnYWy9Y_5EYdoFM79kV/recaptcha__en.js

Domain: cm.everesttech.net
URL: https://cm.everesttech.net/cm/dd?d_uuid=36761432035551679601043832843140295907

Verdicts & Comments Add Verdict or Comment

211 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

4 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.securelist.com/	1970-01-21 08:42:51	Name: _mkto_trk Value: id:802-IJN-240&token:_mch-securelist.com-1724811139419-36967
.demdex.net/	1970-01-21 03:26:03	Name: demdex Value: 36761432035551679601043832843140295907
.securelist.com/	1969-12-31 23:59:59	Name: AMCVS_983502BE532960BE0A490D4C%40AdobeOrg Value: 1
.securelist.com/	1970-01-21 08:42:51	Name: AMCV_983502BE532960BE0A490D4C%40AdobeOrg Value: 1585540135%7CMCIDTS%7C19964%7CMCMID%7C44221625566092903700010860833699971769%7CMCAAMLH-1725415940%7C7%7CMCAAMB-1725415940%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1724818340s%7CNONE%7CMCAID%7CNONE%7CvVersion%7C4.4.0

3 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	warning	URL: https://securelist.com/hz-rat-attacks-wechat-and-dingtalk/113513/(Line 99) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://munchkin.marketo.net/munchkin.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://securelist.com/hz-rat-attacks-wechat-and-dingtalk/113513/(Line 99) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://munchkin.marketo.net/munchkin.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
security	error	URL: https://securelist.com/hz-rat-attacks-wechat-and-dingtalk/113513/ Message: Refused to load the image 'https://cm.everesttech.net/cm/dd?d_uuid=36761432035551679601043832843140295907' because it violates the following Content Security Policy directive: "img-src 'self' data: http://.wordpress.com http://.wp.com http://assets.kasperskydaily.com http://d2538mqrb7brka.cloudfront.net http://forum.kasperskyclub.ru http://i0.poll.fm https://.cdninstagram.com https://.doubleclick.net https://.facebook.com https://.google-analytics.com https://.google.com https://.google.ru https://.gravatar.com https://.gstatic.com https://.infogram.com https://.instagram.com https://.kaspersky.ca https://.kaspersky.co.jp https://.kaspersky.co.uk https://.kaspersky.co.za https://.kaspersky.com https://.kaspersky.com.au https://.kaspersky.com.br https://.kaspersky.com.tr https://.kaspersky.de https://.kaspersky.es https://.kaspersky.fr https://.kaspersky.it https://.kaspersky.nl https://.kaspersky.pt https://.kaspersky.ru https://.kaspersky.se https://.kasperskycontenthub.com https://.kasperskydaily.com https://.securelist.com https://.securelist.lat https://.securelist.ru https://.sharethis.com https://.staticflickr.com https://.threatpost.com https://.twimg.com https://.twitter.com https://.vk.com https://.wordpress.com https://.wp.com https://.yandex.com https://.yandex.ru https://.ytimg.com https://assets.kasperskydaily.com https://box.kaspersky.com https://d1srlirzdlmpew.cloudfront.net https://d2538mqrb7brka.cloudfront.net https://kaspersky.d2.sc.omtrdc.net https://kaspersky.d3.sc.omtrdc.net https://kasperskycontenthub.com https://maps.googleapis.com https://player.vimeo.com https://polldaddy.com https://rum-collector.pingdom.net https://s.w.org https://s3-eu-west-1.amazonaws.com https://securelist.com https://securelist.lat https://securelist.ru https://stats.g.doubleclick.net https://t.co https://threatpost.com https://tpc.googlesyndication.com https://vk.com https://www.googletagmanager.com".

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	connect-src 'self' https://.demdex.net https://.doubleclick.net https://.facebook.com https://.facebook.net https://.google-analytics.com https://.google.com https://.kaspersky.ca https://.kaspersky.co.jp https://.kaspersky.co.uk https://.kaspersky.co.za https://.kaspersky.com https://.kaspersky.com.au https://.kaspersky.com.br https://.kaspersky.com.tr https://.kaspersky.de https://.kaspersky.es https://.kaspersky.fr https://.kaspersky.it https://.kaspersky.nl https://.kaspersky.pt https://.kaspersky.ru https://.kaspersky.se https://.kasperskycontenthub.com https://.mktoresp.com https://.pingdom.net https://.reddit.com https://.securelist.com https://.securelist.lat https://.securelist.ru https://.yandex.com https://.yandex.ru https://.youtube.com https://box.kaspersky.com https://consentcdn.cookiebot.com https://e.infogram.com https://kaspersky.d3.sc.omtrdc.net https://kasperskycontenthub.com https://securelist.com https://tpc.googlesyndication.com https://www.googletagmanager.com; default-src 'self' https://.kasperskycontenthub.com https://.securelist.com https://.securelist.lat https://.securelist.ru https://box.kaspersky.com https://kasperskycontenthub.com https://securelist.com https://tpc.googlesyndication.com; font-src 'self' data: https://.gstatic.com https://.kasperskycontenthub.com https://.securelist.com https://.securelist.lat https://.securelist.ru https://.wp.com https://assets.kasperskycontenthub.com https://assets.threatpost.com https://box.kaspersky.com https://fonts.googleapis.com https://kasperskycontenthub.com https://securelist.com https://tpc.googlesyndication.com; frame-src 'self' http://.slideshare.net https://.doubleclick.net https://.facebook.com https://.google.com https://.googletagservices.com https://.infogram.com https://.instagram.com https://.kasperskycontenthub.com https://.libsyn.com https://.marketo.com https://.securelist.com https://.securelist.lat https://.securelist.ru https://.sharethis.com https://.slideshare.net https://.twitter.com https://.wp.com https://.yandex.com https://.yandex.ru https://.youtube.com https://box.kaspersky.com https://consentcdn.cookiebot.com https://dzen.ru https://go.kaspersky.com https://infogram.com https://kaspersky.demdex.net https://kasperskycontenthub.com https://player.vimeo.com https://securelist.com https://tpc.googlesyndication.com https://vk.com https://www.brighttalk.com; img-src 'self' data: http://.wordpress.com http://.wp.com http://assets.kasperskydaily.com http://d2538mqrb7brka.cloudfront.net http://forum.kasperskyclub.ru http://i0.poll.fm https://.cdninstagram.com https://.doubleclick.net https://.facebook.com https://.google-analytics.com https://.google.com https://.google.ru https://.gravatar.com https://.gstatic.com https://.infogram.com https://.instagram.com https://.kaspersky.ca https://.kaspersky.co.jp https://.kaspersky.co.uk https://.kaspersky.co.za https://.kaspersky.com https://.kaspersky.com.au https://.kaspersky.com.br https://.kaspersky.com.tr https://.kaspersky.de https://.kaspersky.es https://.kaspersky.fr https://.kaspersky.it https://.kaspersky.nl https://.kaspersky.pt https://.kaspersky.ru https://.kaspersky.se https://.kasperskycontenthub.com https://.kasperskydaily.com https://.securelist.com https://.securelist.lat https://.securelist.ru https://.sharethis.com https://.staticflickr.com https://.threatpost.com https://.twimg.com https://.twitter.com https://.vk.com https://.wordpress.com https://.wp.com https://.yandex.com https://.yandex.ru https://.ytimg.com https://assets.kasperskydaily.com https://box.kaspersky.com https://d1srlirzdlmpew.cloudfront.net https://d2538mqrb7brka.cloudfront.net https://kaspersky.d2.sc.omtrdc.net https://kaspersky.d3.sc.omtrdc.net https://kasperskycontenthub.com https://maps.googleapis.com https://player.vimeo.com https://polldaddy.com https://rum-collector.pingdom.net https://s.w.org https://s3-eu-west-1.amazonaws.com https://securelist.com https://securelist.lat https://securelist.ru https://stats.g.doubleclick.net https://t.co https://threatpost.com https://tpc.googlesyndication.com https://vk.com https://www.googletagmanager.com; object-src 'self' https://.kasperskycontenthub.com https://.securelist.com https://.securelist.lat https://.securelist.ru https://box.kaspersky.com https://kasperskycontenthub.com https://player.vimeo.com https://polldaddy.com https://securelist.com https://tpc.googlesyndication.com; script-src 'self' 'unsafe-eval' 'unsafe-inline' https://.cloudfront.net https://.crazyegg.com https://.demdex.net https://.doubleclick.net https://.facebook.com https://.facebook.net https://.flickr.com https://.google-analytics.com https://.google.com https://.googleapis.com https://.googlesyndication.com https://.googletagservices.com https://.gravatar.com https://.gstatic.com https://.instagram.com https://.kaspersky.ca https://.kaspersky.co.jp https://.kaspersky.co.uk https://.kaspersky.co.za https://.kaspersky.com https://.kaspersky.com.au https://.kaspersky.com.br https://.kaspersky.com.tr https://.kaspersky.de https://.kaspersky.es https://.kaspersky.fr https://.kaspersky.it https://.kaspersky.nl https://.kaspersky.pt https://.kaspersky.ru https://.kaspersky.se https://.kasperskycontenthub.com https://.marketo.com https://.marketo.net https://.polldaddy.com https://.securelist.com https://.securelist.lat https://.securelist.ru https://.sharethis.com https://.threatpost.com https://.twimg.com https://.twitter.com https://.woopra.com https://.wp.com https://.yandex.com https://.yandex.ru https://assets.adobedtm.com https://box.kaspersky.com https://cdnjs.cloudflare.com https://connect.mail.ru https://consent.cookiebot.com https://consentcdn.cookiebot.com https://e.infogram.com https://kaspersky.d2.sc.omtrdc.net https://kasperskycontenthub.com https://player.vimeo.com https://polldaddy.com https://rum-static.pingdom.net https://s.ytimg.com https://securelist.com https://tpc.googlesyndication.com https://vk.com https://www.brighttalk.com https://www.googleoptimize.com https://www.googletagmanager.com https://www.googletagservices.com https://www.linkedin.com https://www.youtube.com; style-src 'self' 'unsafe-inline' https://.google.com https://.googleapis.com https://.gravatar.com https://.kaspersky.com https://.kasperskycontenthub.com https://.marketo.com https://.securelist.com https://.securelist.lat https://.securelist.ru https://.sharethis.com https://.threatpost.com https://.twimg.com https://.twitter.com https://.wp.com https://box.kaspersky.com https://kasperskycontenthub.com https://securelist.com https://tpc.googlesyndication.com https://www.googletagmanager.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

802-ijn-240.mktoresp.com
apis.google.com
assets.kasperskycontenthub.com
cm.everesttech.net
connect.facebook.net
dpm.demdex.net
kaspersky.d3.sc.omtrdc.net
kaspersky.demdex.net
kasperskycontenthub.com
media.kaspersky.com
media.kasperskycontenthub.com
media.kasperskydaily.com
munchkin.marketo.net
securelist.com
www.facebook.com
www.google.com
www.googletagmanager.com
www.gstatic.com
cm.everesttech.net
media.kasperskydaily.com
www.gstatic.com
158.160.164.142
18.164.96.91
185.85.15.31
192.28.147.68
23.204.6.193
2600:9000:21da:1e00:1b:d000:d280:93a1
2607:f8b0:4006:807::200e
2607:f8b0:4006:80c::2008
2607:f8b0:4006:81d::2004
2a03:2880:f012:10c:face:b00c:0:3
2a03:2880:f112:182:face:b00c:0:25de
3.233.35.165
52.22.19.177
63.140.39.150
00e2a621d21f27807c82af5d0ae72ba394d49cadb66eabdbeda8df15035dd00c
08e5c51e367f5f721ad103f5463f457f4ea5d9586583030cd1b766f4514e1bac
0b5e58a4f0210f08715d04b464d51ee735c5952a86ecb59988f5aab3ad166096
0ea1b10645a680dbd031885ce8fb9ea93348eff8869acf850fc92d3d55fd9f69
18049e681169e22145e19046fb8b15eaf7a08f1e36cb78b00e40c0fb102970a1
1b2d604efc0b14f3fe050442a97e15547c317c553b2546bd5eba3d81726a8653
1c960c480714e7a7e4360e3485b1c121fce15da0714e5fa53fd442ec6e7c8d58
20b03427e659f01c2587779f62d58a3fbb5d0a0ef1c9f39e5fca47bbc1695661
211b1eb870f412eeb313da14d50d29c1702ed1ba5fd360d0a30b179d4008e520
2a0bee86cb7897007c66d44b3008c3f91ff9e1f9a289c97eeff0a0d19c6275a7
2bed92c66db2de6cf2e66eb746378554ee040722c038c5aa899aec292f37a052
2c24b916160dc4962ba77c6f85b04c5f4831e2d71b549c0695d61154b1f32d49
302eb6358c289fc940f4fae176ac6a6cee8172c433a7aecb92fe9db697859bb3
3511b363a05be1ba4471c10307c80144f57110e642deb01da0e4f561886a13d7
36175c07afaffa0777295d540fe4ee1b82d9c4414228e4551994728a2c88ad7e
3bb2621a4c0c710f6e78404473aebff8e115a28f8d53f44339b867c63ad93b26
3ef18948ff01c7b94a3ba7a291c1f632faa83da95570b77d0dd003a53a2a0855
41c7b7e643cb09d14fc9c22e3a8025ea422230e94c82c27bc2437f639dcf8975
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
47db3eedf6793ff55d3d71a6ea5fa2cc86317453f3910e181d22198cee291389
484aee1b81286040100dad5243407bd64be9aa7fc389b87ef2acd03451bc6888
49d185466cd7f5e8547ce91fb785a1bdf3bc330ac02d8cb65d9f49b94b1185fe
5206536707c84baa892d3c3231b351985ee828cb8b9c0bd8db42cd3363995fc4
528bbd11d6966cc5106f4ecf60da4f7096cd0b3c951f79a2d12c1f0bad33faa8
53dbe2ed80b498f4a0c0e811dc9c4f6a8c1d62c7a5c19e3e3d9b9aab8a070bc2
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
630d0a3cc8f4c4aa7bf49b40ae6f59f3a137707e0d7bba46ba44e2e5f2c53aab
6670587c6c6f7eaea610366096842e6256d42aa527149b0627416005f81f3390
68cc280ce370c6f1f51a4fc5950103fc38df80a429552c549add04ebd8bd3a23
693c8b61667ac94847264924178702a190c5113b41b82085dad0641f89e3f864
6956c5691406ff1b2fec56ba630b81bffbb236c2307426d6dd7127afed13b74f
69f0ade8cca67112ef495f707fb73c68fd5099a6cd9c51d9ba9ceda8dcca16f7
6f4abed507ae5e7cea30cf0420b7a937e954423ff85ff0111c9cc6140d472d56
73a6db7aaf149ec53d69ffea02bf070734217ea7e55c8f8b2b47a5ec4e656b54
799706f10a0d4045e0be9f81f89a830a6b303283f8d363d12aa984e79e108713
7fd67f7e5ed7e6e91b038162284314b32c6176274cb8c559096c179747c84524
836563ad7be90ef74eac8862468b675138192f8691a870462d25bacb8c7069af
8a3f22d1b41eca1d79771fad2e6be3f4cd45f7843ecacb8e9340268f6dd7c2b6
8f799a34a68e6a09ed2f0afe3d9ef2bd456680fbc778766ab515feeed4b9cc81
946b9f30a2864e61c74a65da0fc9dacce9a001b5c361c29b710fd2e34dd2f89b
98bd3afd3f47082426a89330cbff29e5ed773e6a2b9e5f7f3e25289e8eacad40
9c2e1d2864f53c224d6542bed9a1ab1de620dae21a2146eb4ff982dd8fcd4567
9c3d551dd7ea51cf5d3128d6dba3f37eec73cde5bc24f901a8b32323709013e1
9d267660007f1f410756135374db1ee6baea0115d81e2c2a0821507c7111209f
9f7e0e10123ea3e492d4debb89938f3629b518326da0f269a241fd8691ce0a42
a35e957c5100afe587a873f70790be71909338de74de8dbcd08e053557b5abdc
a5a74efd53eb2a7c097f816021c53f567e766cc3d3346bc9c322c247ef4f7c08
b0e0f16e7a10a53e2976ccf09a91ff8b0fd73b9e4188e70e4f91f14c10c4e574
b1510bbf567967e8a99f52c614b1c9d5a08e9565cec6f1ef2f3a9aaa2dc6a7b4
b1f863d13dbad7d5240f577a73b47b06227d218909259042da95301e2eb8be55
b378d22c726917d39df915cf46f85c2a88776f5463ad0b2f2bf4107e208c5fc6
b5423efa22f4f7cf48ec28a428eba513bbe67a337975edc86a7de0ba6a5dca46
c771fce0ba519a6fa28085f4ab1172fa52b71b26ec71bfd11955e2a743825dea
c8de5761cdf4b1c78246708cf2bb10be840030554dcf908d56824d4d00cf06a9
cdb3705fcc82b40d70939dc2bdc99949b46a1e6f9e9c6e9c9f41204cfb0ec495
ce543d7ee7edde197562d34ff6ef482dcf1529869f30b068c3a6d3eb8a2bf007
d49dc45ccc495169c52b1a9d0f0fbcc26d3a54023ba219e3fdde91a9121b2ad0
d62a7b7ec5313469ebff5c006b9068dc44d6d1c122cf787ffa29a10113b34060
daaf5bbd1b27e54d87f7fc8b2ac8e797272bdaa64542f65e2c4ea0623e46c7c1
e381e76e2f8e13a602958f16754d80474a07c1019eb3c7770bf34bdf51c40b5d
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e4f53b9c893261cf1692f633c38b6b046efbef5b522fb826186f18346569a78e
e6bb226afa82eb9fcf6dc25592c6a7cd979ba4d795dfe6e0a31720de6ecd0af2
e98940cfe1288b874d977842ccaeb08cd169caa4173c3b86b8e188927e8578ed
ecd5e8012dc2a87ac3ec0707a4d4b2617858985f41333d920645c7c904690462
f230b4cd29d2e4719ad307d8b1176a5c1787c7399b12676f3c4fe31bde54c0ab
f49616f5799065ebf4fcc95c80d526d53a486c33aa0213d32b5b124aab582c6b
f6288a59b12995368e81d47f45d3b331c049afebfc135f5394af5d1fc2c9c6ca
fd147b07bdeee3792d9bf29d77d72396488b3bef3c1ef3a185f343192db704fa
ff7e51d6ccb31da2a4099dbc1f3eb62ee3aec7ae5d83fe3d73b664c1b73427e0
ff83be5282c14284f873eac8098bd9bad2039604a70eba5aea8b221996535139

securelist.com Open in urlscan Pro 158.160.164.142 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

77 Requests

96 %HTTPS

43 %IPv6

14 Domains

18 Subdomains

15 IPs

3 Countries

2600 kBTransfer

7145 kBSize

4 Cookies

100 Outgoing links

Redirected requests

77 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

securelist.com Open in urlscan Pro
158.160.164.142 Public Scan

Screenshot
Live screenshot

Full Image

77
Requests

96 %
HTTPS

43 %
IPv6

14
Domains

18
Subdomains

15
IPs

3
Countries

2600 kB
Transfer

7145 kB
Size

4
Cookies

77 HTTP transactions
0 data transactions