urlscan.io logo urlscan.io
SecurityTrails logo

www.welivesecurity.com Open in urlscan Pro
2600:141b:13::17d7:823a  Public Scan

Go To Rescan Add Verdict Report
URL: https://www.welivesecurity.com/2022/03/01/isaacwiper-hermeticwizard-wiper-worm-targeting-ukraine/'
Submission: On May 05 via api from CA — Scanned from CA
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 1 countries across 2 domains to perform 6 HTTP transactions. The main IP is 2600:141b:13::17d7:823a, located in New York, United States and belongs to AKAMAI-ASN1, NL. The main domain is www.welivesecurity.com. The Cisco Umbrella rank of the primary domain is 484032.
TLS certificate: Issued by Thawte RSA CA 2018 on November 8th 2021. Valid for: a year.
This is the only time www.welivesecurity.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
5 2600:141b:13:... 20940 (AKAMAI-ASN1)
1 2607:f8b0:400... 15169 (GOOGLE)
6 2
Apex Domain
Subdomains		 Transfer
5 welivesecurity.com
www.welivesecurity.com — Cisco Umbrella Rank: 484032
142 KB
1 google-analytics.com
www.google-analytics.com — Cisco Umbrella Rank: 101
6 2
Domain Requested by
5 www.welivesecurity.com
1 www.google-analytics.com www.welivesecurity.com
6 2

This site contains no links.

Subject Issuer Validity Valid
www.welivesecurity.com
Thawte RSA CA 2018		 2021-11-08 -
2022-11-08		 a year crt.sh
*.google-analytics.com
GTS CA 1C3		 2022-04-18 -
2022-07-11		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://www.welivesecurity.com/2022/03/01/isaacwiper-hermeticwizard-wiper-worm-targeting-ukraine/'
Frame ID: D297CAC457320B28CFFC296BF3B983A5
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

403 Error | ESET

Detected technologies

Overall confidence: 100%
Detected patterns
  • /wp-(?:content|includes)/
Overall confidence: 100%
Detected patterns
  • googletagmanager\.com/ns\.html[^>]+></iframe>
  • <!-- (?:End )?Google Tag Manager -->

Page Statistics

6
Requests

100 %
HTTPS

100 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

142 kB
Transfer

141 kB
Size

1
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request '
www.welivesecurity.com/2022/03/01/isaacwiper-hermeticwizard-wiper-worm-targeting-ukraine/ 		18 KB
19 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.welivesecurity.com/2022/03/01/isaacwiper-hermeticwizard-wiper-worm-targeting-ukraine/'
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2600:141b:13::17d7:823a New York, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
f0bf93b02839085472e0c1249f2a6ac5c6c9a4a8a998557ca50b0e16ec45c8f8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

cache-control
no-cache, no-store, must-revalidate
content-length
18271
content-type
text/html; charset=utf-8
date
Thu, 05 May 2022 20:41:01 GMT
expires
0
link
<https://www.welivesecurity.com/wp-content/themes/eset-wls-2018/assets/fonts/Fedra-Sans-Alt-Book.woff?c156eca4ec460dcfa741dfda69fb16d5>;rel="preload";as="font";type="font/woff";crossorigin,<https://www.welivesecurity.com/wp-content/themes/eset-wls-2018/assets/fonts/Fedra-Sans-Alt-Bold.woff?0050bbd300d61bbb50d2fff0bb6cd926>;rel="preload";as="font";type="font/woff";crossorigin,<https://www.welivesecurity.com/wp-content/themes/eset-wls-2018/assets/fonts/Fedra-Sans-Alt-Book-Italic.woff?f299cc2feeecf266ff50b5ea8b3a3deb>;rel="preload";as="font";type="font/woff";crossorigin,<https://www.welivesecurity.com/wp-content/themes/eset-wls-2018/assets/fonts/icomoon.ttf?45b4319f2445b74719611d0ab85cf93a>;rel="preload";as="font";type="font/ttf";crossorigin
pragma
no-cache
server-timing
cdn-cache; desc=MISS edge; dur=29 origin; dur=40
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN
x-xss-protection
1; mode=block
Fedra-Sans-Alt-Book.woff
www.welivesecurity.com/wp-content/themes/eset-wls-2018/assets/fonts/ 		40 KB
40 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://www.welivesecurity.com/wp-content/themes/eset-wls-2018/assets/fonts/Fedra-Sans-Alt-Book.woff?c156eca4ec460dcfa741dfda69fb16d5
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2600:141b:13::17d7:823a New York, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
1ba0ff3994900740a94dc37300b7415b25d642f6ef495afc5ae4e16ae1128e66
Security Headers
Name Value
Strict-Transport-Security max-age=15724800
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.welivesecurity.com/2022/03/01/isaacwiper-hermeticwizard-wiper-worm-targeting-ukraine/'
Origin
https://www.welivesecurity.com
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

strict-transport-security
max-age=15724800
referrer-policy
no-referrer-when-downgrade
last-modified
Wed, 27 Apr 2022 11:33:12 GMT
etag
"626929f8-9ff1"
content-type
font/woff
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=31536000, public
date
Thu, 05 May 2022 20:41:02 GMT
server-timing
cdn-cache; desc=HIT, edge; dur=3
accept-ranges
bytes
content-length
40945
x-content-type-options
nosniff
expires
Sun, 30 Apr 2023 16:44:41 GMT
Fedra-Sans-Alt-Bold.woff
www.welivesecurity.com/wp-content/themes/eset-wls-2018/assets/fonts/ 		40 KB
40 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://www.welivesecurity.com/wp-content/themes/eset-wls-2018/assets/fonts/Fedra-Sans-Alt-Bold.woff?0050bbd300d61bbb50d2fff0bb6cd926
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2600:141b:13::17d7:823a New York, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
12f37c0a70377ac636345742e2eb0d2acb70d411612020ae1608193330a5b15d
Security Headers
Name Value
Strict-Transport-Security max-age=15724800
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.welivesecurity.com/2022/03/01/isaacwiper-hermeticwizard-wiper-worm-targeting-ukraine/'
Origin
https://www.welivesecurity.com
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

strict-transport-security
max-age=15724800
referrer-policy
no-referrer-when-downgrade
last-modified
Sun, 13 Feb 2022 05:54:20 GMT
etag
"62089d0c-9e73"
content-type
font/woff
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=31536000, public
date
Thu, 05 May 2022 20:41:02 GMT
server-timing
cdn-cache; desc=HIT, edge; dur=6
accept-ranges
bytes
content-length
40563
x-content-type-options
nosniff
expires
Tue, 28 Feb 2023 15:46:39 GMT
Fedra-Sans-Alt-Book-Italic.woff
www.welivesecurity.com/wp-content/themes/eset-wls-2018/assets/fonts/ 		40 KB
40 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://www.welivesecurity.com/wp-content/themes/eset-wls-2018/assets/fonts/Fedra-Sans-Alt-Book-Italic.woff?f299cc2feeecf266ff50b5ea8b3a3deb
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2600:141b:13::17d7:823a New York, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
63a41173db39c92635a87b39eedb581e8a1c3142372ebced441ce927fef343a1
Security Headers
Name Value
Strict-Transport-Security max-age=15724800
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.welivesecurity.com/2022/03/01/isaacwiper-hermeticwizard-wiper-worm-targeting-ukraine/'
Origin
https://www.welivesecurity.com
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

strict-transport-security
max-age=15724800
referrer-policy
no-referrer-when-downgrade
last-modified
Tue, 19 Apr 2022 14:42:38 GMT
etag
"625eca5e-9ec0"
content-type
font/woff
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=31536000, public
date
Thu, 05 May 2022 20:41:02 GMT
server-timing
cdn-cache; desc=HIT, edge; dur=4
accept-ranges
bytes
content-length
40640
x-content-type-options
nosniff
expires
Thu, 20 Apr 2023 15:09:12 GMT
icomoon.ttf
www.welivesecurity.com/wp-content/themes/eset-wls-2018/assets/fonts/ 		4 KB
2 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://www.welivesecurity.com/wp-content/themes/eset-wls-2018/assets/fonts/icomoon.ttf?45b4319f2445b74719611d0ab85cf93a
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2600:141b:13::17d7:823a New York, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
8d8ba4c94f3b33965aa63ce307972277b1263dc40705b292af8f835f4eebd042
Security Headers
Name Value
Strict-Transport-Security max-age=15724800
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.welivesecurity.com/2022/03/01/isaacwiper-hermeticwizard-wiper-worm-targeting-ukraine/'
Origin
https://www.welivesecurity.com
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

strict-transport-security
max-age=15724800
content-encoding
gzip
referrer-policy
no-referrer-when-downgrade
last-modified
Wed, 04 May 2022 01:30:04 GMT
etag
W/"6271d71c-f94"
vary
Accept-Encoding
content-type
text/plain; charset=UTF-8
access-control-allow-origin
*
cache-control
max-age=86400, public
date
Thu, 05 May 2022 20:41:02 GMT
x-content-type-options
nosniff
server-timing
cdn-cache; desc=HIT, edge; dur=1
content-length
2195
x-xss-protection
1; mode=block
expires
Fri, 06 May 2022 04:16:13 GMT
collect
www.google-analytics.com/ 		35 B
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/collect?v=1&tid=UA-160836-57&cid=e5924ac0-49a7-435a-b995-23958a726b76&t=event&ec=server+error&ea=403+%7C+Access+Denied&el=The+requested+resource+requires+an+authentication.&dl=https%3A%2F%2Fwww.welivesecurity.com%2F2022%2F03%2F01%2Fisaacwiper-hermeticwizard-wiper-worm-targeting-ukraine%2F%27
Requested by
Host: www.welivesecurity.com
URL: https://www.welivesecurity.com/2022/03/01/isaacwiper-hermeticwizard-wiper-worm-targeting-ukraine/'
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:809::200e Staten Island, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.welivesecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 05 May 2022 11:06:11 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
34491
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT

Verdicts & Comments Add Verdict or Comment

10 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontextlost object| oncontextrestored function| structuredClone function| getScreenDetails number| errorCode string| errorMsg string| errorDsc object| params function| uuidv4 object| url

1 Cookies

Domain/Path Name / Value
.welivesecurity.com/ Name: AKA_A2
Value: A

5 Console Messages

Source Level URL
Text
network error URL: https://www.welivesecurity.com/2022/03/01/isaacwiper-hermeticwizard-wiper-worm-targeting-ukraine/'
Message:
Failed to load resource: the server responded with a status of 403 ()
javascript warning URL: https://www.welivesecurity.com/2022/03/01/isaacwiper-hermeticwizard-wiper-worm-targeting-ukraine/'
Message:
The resource https://www.welivesecurity.com/wp-content/themes/eset-wls-2018/assets/fonts/Fedra-Sans-Alt-Bold.woff?0050bbd300d61bbb50d2fff0bb6cd926 was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.
javascript warning URL: https://www.welivesecurity.com/2022/03/01/isaacwiper-hermeticwizard-wiper-worm-targeting-ukraine/'
Message:
The resource https://www.welivesecurity.com/wp-content/themes/eset-wls-2018/assets/fonts/icomoon.ttf?45b4319f2445b74719611d0ab85cf93a was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.
javascript warning URL: https://www.welivesecurity.com/2022/03/01/isaacwiper-hermeticwizard-wiper-worm-targeting-ukraine/'
Message:
The resource https://www.welivesecurity.com/wp-content/themes/eset-wls-2018/assets/fonts/Fedra-Sans-Alt-Book.woff?c156eca4ec460dcfa741dfda69fb16d5 was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.
javascript warning URL: https://www.welivesecurity.com/2022/03/01/isaacwiper-hermeticwizard-wiper-worm-targeting-ukraine/'
Message:
The resource https://www.welivesecurity.com/wp-content/themes/eset-wls-2018/assets/fonts/Fedra-Sans-Alt-Book-Italic.woff?f299cc2feeecf266ff50b5ea8b3a3deb was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block