![](/screenshots/ab12f00d-081b-4b7c-a351-2e69d99662a3.png)
www.welivesecurity.com
Open in
urlscan Pro
2a02:26f0:480:f::213:7ec8
Public Scan
Submission: On July 26 via api from DE — Scanned from GB
Summary
TLS certificate: Issued by Thawte TLS RSA CA G1 on January 19th 2024. Valid for: a year.
This is the only time www.welivesecurity.com was scanned on urlscan.io!
urlscan.io Verdict: No classification
Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
17 | 2a02:26f0:480... 2a02:26f0:480:f::213:7ec8 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
5 | 2606:2800:233... 2606:2800:233:1cb7:261b:1f9c:2074:3c | 15133 (EDGECAST) (EDGECAST) | |
47 | 3 |
ASN20940 (AKAMAI-ASN1, NL)
www.welivesecurity.com |
ASN15133 (EDGECAST, US)
web-assets.esetstatic.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
17 |
welivesecurity.com
www.welivesecurity.com — Cisco Umbrella Rank: 380578 |
84 KB |
5 |
esetstatic.com
web-assets.esetstatic.com |
8 KB |
0 |
disqus.com
Failed
welivesecurity.disqus.com Failed |
|
0 |
go-mpulse.net
Failed
s.go-mpulse.net Failed |
|
47 | 4 |
Domain | Requested by | |
---|---|---|
17 | www.welivesecurity.com |
www.welivesecurity.com
|
5 | web-assets.esetstatic.com |
www.welivesecurity.com
|
0 | welivesecurity.disqus.com Failed |
www.welivesecurity.com
|
0 | s.go-mpulse.net Failed |
www.welivesecurity.com
|
47 | 4 |
This site contains links to these domains. Also see Links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
www.welivesecurity.com Thawte TLS RSA CA G1 |
2024-01-19 - 2025-01-18 |
a year | crt.sh |
web-assets.esetstatic.com Thawte TLS RSA CA G1 |
2024-05-22 - 2025-05-21 |
a year | crt.sh |
This page contains 2 frames:
Primary Page:
https://www.welivesecurity.com/en/eset-research/hotpage-story-signed-vulnerable-ad-injecting-driver/
Frame ID: 5F8E583DFC5B97E1ABEBB5D67E9DC228
Requests: 47 HTTP requests in this frame
Frame:
https://s.go-mpulse.net/boomerang/7R9SM-QGSYF-QDLJK-UETXR-SPM6B
Frame ID: 7D6F8C0392F3FB51AD764BAC3DA33969
Requests: 1 HTTP requests in this frame
Screenshot
![](/screenshots/ab12f00d-081b-4b7c-a351-2e69d99662a3.png)
Page Title
HotPage: Story of a signed, vulnerable, ad-injecting driverDetected technologies
![](/vendor/wappa/icons/Google Tag Manager.png)
Detected patterns
- googletagmanager\.com/ns\.html[^>]+></iframe>
- <!-- (?:End )?Google Tag Manager -->
Page Statistics
60 Outgoing links
These are links going to different origins than the main page.
Title: Mandiant Intelligence
Search URL Search Domain Scan URL
Title: SentinelLabs
Search URL Search Domain Scan URL
Title: G DATA
Search URL Search Domain Scan URL
Title: Microsoft’s driver code-signing requirements
Search URL Search Domain Scan URL
Title: SpcSpOpusInfo
Search URL Search Domain Scan URL
Title: LIEF binary parser
Search URL Search Domain Scan URL
Title: Windows Server Catalog
Search URL Search Domain Scan URL
Title: netfilter
Search URL Search Domain Scan URL
Title: dingtalk
Search URL Search Domain Scan URL
Title: web crawler
Search URL Search Domain Scan URL
Title: Hypervisor Discovery
Search URL Search Domain Scan URL
Title: BCryptGenerateSymmetricKey
Search URL Search Domain Scan URL
Title: Blackbone
Search URL Search Domain Scan URL
Title: process creation
Search URL Search Domain Scan URL
Title: image loading
Search URL Search Domain Scan URL
Title: IRP_MJ_DEVICE_CONTROL
Search URL Search Domain Scan URL
Title: KeStackAttachProcess
Search URL Search Domain Scan URL
Title: ZwCreateThreadEx
Search URL Search Domain Scan URL
Title: CreateProcessW
Search URL Search Domain Scan URL
Title: APC routine
Search URL Search Domain Scan URL
Title: IoQueueWorkItemEx
Search URL Search Domain Scan URL
Title: Microsoft Detours hooking library
Search URL Search Domain Scan URL
Title: SetProcessMitigationPolicy
Search URL Search Domain Scan URL
Title: getaddrinfo
Search URL Search Domain Scan URL
Title: SSL_read
Search URL Search Domain Scan URL
Title: SSL_write
Search URL Search Domain Scan URL
Title: DoPayloadWrite
Search URL Search Domain Scan URL
Title: NtDeviceIoControlFile
Search URL Search Domain Scan URL
Title: HTTP code 302
Search URL Search Domain Scan URL
Title: iframe
Search URL Search Domain Scan URL
Title: replace
Search URL Search Domain Scan URL
Title: ACLs
Search URL Search Domain Scan URL
Title: protected processes
Search URL Search Domain Scan URL
Title: ESET Threat Intelligence
Search URL Search Domain Scan URL
Title: GitHub repository
Search URL Search Domain Scan URL
Title: version 15
Search URL Search Domain Scan URL
Title: T1588.003
Search URL Search Domain Scan URL
Title: T1204.002
Search URL Search Domain Scan URL
Title: T1569.002
Search URL Search Domain Scan URL
Title: T1574.013
Search URL Search Domain Scan URL
Title: T1055.004
Search URL Search Domain Scan URL
Title: T1553.002
Search URL Search Domain Scan URL
Title: T1140
Search URL Search Domain Scan URL
Title: T1055.001
Search URL Search Domain Scan URL
Title: T1027.009
Search URL Search Domain Scan URL
Title: T1070.004
Search URL Search Domain Scan URL
Title: T1027.002
Search URL Search Domain Scan URL
Title: T1033
Search URL Search Domain Scan URL
Title: T1185
Search URL Search Domain Scan URL
Title: T1071.001
Search URL Search Domain Scan URL
Title: T1573.001
Search URL Search Domain Scan URL
Title: T1565.002
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Title: ESET
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
47 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
www.welivesecurity.com/en/eset-research/hotpage-story-signed-vulnerable-ad-injecting-driver/ |
143 KB 40 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
FedraSansAltPro-BookLF-405f3258.woff
www.welivesecurity.com/build/assets/ |
46 KB 0 |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
FedraSansAltPro-BoldLF-31f4bc72.woff
www.welivesecurity.com/build/assets/ |
40 KB 0 |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
FedraSansAltPro-DemiLF-8885b886.woff
www.welivesecurity.com/build/assets/ |
34 KB 0 |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
hotpage-ad-injecting-driver.jpeg
web-assets.esetstatic.com/tn/-x425/wls/2024/7-2024/hotpage/ |
3 KB 0 |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
article-header-995fa639.js
www.welivesecurity.com/build/assets/ |
442 B 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
app-6317871c.css
www.welivesecurity.com/build/assets/ |
298 KB 36 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
romain-dumont.jpeg
web-assets.esetstatic.com/tn/-x45/wls/ |
1 KB 2 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
hotpage-ad-injecting-driver.jpeg
web-assets.esetstatic.com/tn/-x700/wls/2024/7-2024/hotpage/ |
29 KB 0 |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
figure-1-owner-of-hotpage-driver-s-digital-signature.png
web-assets.esetstatic.com/wls/2024/7-2024/hotpage/ |
6 KB 6 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
figure-2-hotpage-driver-s-certificate-extended-verification-and-code-signing-attributes.png
web-assets.esetstatic.com/wls/2024/7-2024/hotpage/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
figure-3-hotpage-driver-s-certificate-spcspopusinfo-attribute.png
web-assets.esetstatic.com/wls/2024/7-2024/hotpage/ |
3 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
figure-4-extraction-of-the-company-name-from-the-hotpage-driver-s-certificate.png
web-assets.esetstatic.com/wls/2024/7-2024/hotpage/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
figure-5-the-chinese-company-s-certified-products-listed-in-the-windows-server-catalog.png
web-assets.esetstatic.com/wls/2024/7-2024/hotpage/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
figure-6-translated-executive-and-shareholder-information-about-the-company.png
web-assets.esetstatic.com/wls/2024/7-2024/hotpage/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
figure-7-screenshot-of-the-dwadsafe-com-webpage-made-by-zhizhuyinqing-com.png
web-assets.esetstatic.com/wls/2024/7-2024/hotpage/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
figure-8-mention-of-dwadsafe-com-in-a-forum-dedicated-to-internet-cafe-maintenance.png
web-assets.esetstatic.com/wls/2024/7-2024/hotpage/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
figure-9-overview-of-the-installer-s-workflow.png
web-assets.esetstatic.com/wls/2024/7-2024/hotpage/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
figure-10-newtalbe-configuration.png
web-assets.esetstatic.com/wls/2024/7-2024/hotpage/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
figure-11-simplified-driver-logic.png
web-assets.esetstatic.com/wls/2024/7-2024/hotpage/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
figure-12-the-hotpage-configuration.png
web-assets.esetstatic.com/wls/2024/7-2024/hotpage/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
figure-13-legitimate-main-page-of-the-web-directory-2345-com.png
web-assets.esetstatic.com/wls/2024/7-2024/hotpage/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
figure-14-ad-riddled-page-mimicking-the-homepage-of-2345-com.png
web-assets.esetstatic.com/wls/2024/7-2024/hotpage/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
figure-15-function-that-finds-the-command-line-buffer-left-and-disassembly-of-the-getcommandlinea.png
web-assets.esetstatic.com/wls/2024/7-2024/hotpage/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
figure-16-patterns-used-to-find-the-dopayloadwrite-function.png
web-assets.esetstatic.com/wls/2024/7-2024/hotpage/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
figure-17-finding-the-pointer-to-the-ssl-write-function.png
web-assets.esetstatic.com/wls/2024/7-2024/hotpage/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
figure-18-hook-routine-for-ntdeviceiocontrolfile-api-function.png
web-assets.esetstatic.com/wls/2024/7-2024/hotpage/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
figure-19-redirection-method-0.png
web-assets.esetstatic.com/wls/2024/7-2024/hotpage/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
figure-20-log-file-of-our-injected-library.png
web-assets.esetstatic.com/wls/2024/7-2024/hotpage/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
welivesecurity-eset-threat-intelligence.jpeg
web-assets.esetstatic.com/wls/2023/2023-12/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
signed-kernel-drivers-windows-vulnerabilities-1.jpg
web-assets.esetstatic.com/tn/-x82/wls/2022/01/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
DLink_Malware-1.jpg
web-assets.esetstatic.com/tn/-x82/wls/2018/06/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
Untitled-design-2-1.jpg
web-assets.esetstatic.com/tn/-x82/wls/2019/06/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
apt-activity-report-4523d00f.webp
www.welivesecurity.com/build/assets/ |
0 0 |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
app-7a4ecde0.js
www.welivesecurity.com/build/assets/ |
7 KB 0 |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
search-7d9f58b7.js
www.welivesecurity.com/build/assets/ |
3 KB 0 |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
_commonjsHelpers-042e6b4d.js
www.welivesecurity.com/build/assets/ |
725 B 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
prism-40494b65.css
www.welivesecurity.com/build/assets/ |
0 0 |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
prism-40d1b0a4.js
www.welivesecurity.com/build/assets/ |
6 KB 0 |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
article-e3625c4c.css
www.welivesecurity.com/build/assets/ |
0 0 |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
article-fd027339.js
www.welivesecurity.com/build/assets/ |
4 KB 0 |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
7R9SM-QGSYF-QDLJK-UETXR-SPM6B
s.go-mpulse.net/boomerang/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
7R9SM-QGSYF-QDLJK-UETXR-SPM6B
s.go-mpulse.net/boomerang/ Frame 7D6F |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
embed.js
welivesecurity.disqus.com/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
671 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
FedraSansAltPro-MediumLF-261e3ac5.woff
www.welivesecurity.com/build/assets/ |
0 0 |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
FedraSansAltPro-BookItalicLF-4cad214a.woff
www.welivesecurity.com/build/assets/ |
0 0 |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
FedraSansAltPro-LightLF-ec800a5b.woff
www.welivesecurity.com/build/assets/ |
0 0 |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- web-assets.esetstatic.com
- URL
- https://web-assets.esetstatic.com/wls/2024/7-2024/hotpage/figure-2-hotpage-driver-s-certificate-extended-verification-and-code-signing-attributes.png
- Domain
- web-assets.esetstatic.com
- URL
- https://web-assets.esetstatic.com/wls/2024/7-2024/hotpage/figure-4-extraction-of-the-company-name-from-the-hotpage-driver-s-certificate.png
- Domain
- web-assets.esetstatic.com
- URL
- https://web-assets.esetstatic.com/wls/2024/7-2024/hotpage/figure-5-the-chinese-company-s-certified-products-listed-in-the-windows-server-catalog.png
- Domain
- web-assets.esetstatic.com
- URL
- https://web-assets.esetstatic.com/wls/2024/7-2024/hotpage/figure-6-translated-executive-and-shareholder-information-about-the-company.png
- Domain
- web-assets.esetstatic.com
- URL
- https://web-assets.esetstatic.com/wls/2024/7-2024/hotpage/figure-7-screenshot-of-the-dwadsafe-com-webpage-made-by-zhizhuyinqing-com.png
- Domain
- web-assets.esetstatic.com
- URL
- https://web-assets.esetstatic.com/wls/2024/7-2024/hotpage/figure-8-mention-of-dwadsafe-com-in-a-forum-dedicated-to-internet-cafe-maintenance.png
- Domain
- web-assets.esetstatic.com
- URL
- https://web-assets.esetstatic.com/wls/2024/7-2024/hotpage/figure-9-overview-of-the-installer-s-workflow.png
- Domain
- web-assets.esetstatic.com
- URL
- https://web-assets.esetstatic.com/wls/2024/7-2024/hotpage/figure-10-newtalbe-configuration.png
- Domain
- web-assets.esetstatic.com
- URL
- https://web-assets.esetstatic.com/wls/2024/7-2024/hotpage/figure-11-simplified-driver-logic.png
- Domain
- web-assets.esetstatic.com
- URL
- https://web-assets.esetstatic.com/wls/2024/7-2024/hotpage/figure-12-the-hotpage-configuration.png
- Domain
- web-assets.esetstatic.com
- URL
- https://web-assets.esetstatic.com/wls/2024/7-2024/hotpage/figure-13-legitimate-main-page-of-the-web-directory-2345-com.png
- Domain
- web-assets.esetstatic.com
- URL
- https://web-assets.esetstatic.com/wls/2024/7-2024/hotpage/figure-14-ad-riddled-page-mimicking-the-homepage-of-2345-com.png
- Domain
- web-assets.esetstatic.com
- URL
- https://web-assets.esetstatic.com/wls/2024/7-2024/hotpage/figure-15-function-that-finds-the-command-line-buffer-left-and-disassembly-of-the-getcommandlinea.png
- Domain
- web-assets.esetstatic.com
- URL
- https://web-assets.esetstatic.com/wls/2024/7-2024/hotpage/figure-16-patterns-used-to-find-the-dopayloadwrite-function.png
- Domain
- web-assets.esetstatic.com
- URL
- https://web-assets.esetstatic.com/wls/2024/7-2024/hotpage/figure-17-finding-the-pointer-to-the-ssl-write-function.png
- Domain
- web-assets.esetstatic.com
- URL
- https://web-assets.esetstatic.com/wls/2024/7-2024/hotpage/figure-18-hook-routine-for-ntdeviceiocontrolfile-api-function.png
- Domain
- web-assets.esetstatic.com
- URL
- https://web-assets.esetstatic.com/wls/2024/7-2024/hotpage/figure-19-redirection-method-0.png
- Domain
- web-assets.esetstatic.com
- URL
- https://web-assets.esetstatic.com/wls/2024/7-2024/hotpage/figure-20-log-file-of-our-injected-library.png
- Domain
- web-assets.esetstatic.com
- URL
- https://web-assets.esetstatic.com/wls/2023/2023-12/welivesecurity-eset-threat-intelligence.jpeg
- Domain
- web-assets.esetstatic.com
- URL
- https://web-assets.esetstatic.com/tn/-x82/wls/2022/01/signed-kernel-drivers-windows-vulnerabilities-1.jpg
- Domain
- web-assets.esetstatic.com
- URL
- https://web-assets.esetstatic.com/tn/-x82/wls/2018/06/DLink_Malware-1.jpg
- Domain
- web-assets.esetstatic.com
- URL
- https://web-assets.esetstatic.com/tn/-x82/wls/2019/06/Untitled-design-2-1.jpg
- Domain
- s.go-mpulse.net
- URL
- https://s.go-mpulse.net/boomerang/7R9SM-QGSYF-QDLJK-UETXR-SPM6B
- Domain
- s.go-mpulse.net
- URL
- https://s.go-mpulse.net/boomerang/7R9SM-QGSYF-QDLJK-UETXR-SPM6B
- Domain
- welivesecurity.disqus.com
- URL
- https://welivesecurity.disqus.com/embed.js
Verdicts & Comments Add Verdict or Comment
7 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| $current_language object| BOOMR_mq string| BOOMR_API_key object| BOOMR number| BOOMR_lstart function| disqus_config1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.welivesecurity.com/ | Name: AKA_A2 Value: A |
5 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Content-Security-Policy | default-src 'none'; child-src https://disqus.com https://vars.hotjar.com; connect-src 'self' http://ad.doubleclick.net https://*.akamaihd.net https://*.akstat.io https://*.eset.com https://*.hotjar.com https://*.hotjar.io https://adservice.google.com https://captcha.eset.com https://captcha.welivesecurity.com https://cc.welivesecurity.com https://cdn.esetstatic.com https://cdn.linkedin.oribi.io https://in.hotjar.com https://px.ads.linkedin.com https://region1.google-analytics.com https://stats.g.doubleclick.net https://trial-eum-clientnsv4-s.akamaihd.net https://trial-eum-clienttons-s.akamaihd.net https://vc.hotjar.io https://ws22.hotjar.com https://ws32.hotjar.com https://www.facebook.com https://www.google-analytics.com https://www.google.com https://www.googletagmanager.com https://www.opinionstage.com wss://*.hotjar.com wss://ws1.hotjar.com; font-src 'self' data: https://script.hotjar.com; form-action 'self'; frame-ancestors 'self'; frame-src 'self' https://*.slideshare.net https://bid.g.doubleclick.net https://c.disquscdn.com https://disqus.com https://m.facebook.com https://open.spotify.com/ https://platform.twitter.com https://player.vimeo.com https://share.transistor.fm https://tpc.googlesyndication.com https://vars.hotjar.com https://www.facebook.com https://www.googletagmanager.com https://www.instagram.com https://www.opinionstage.com https://www.podbean.com https://www.screencast.com https://www.slideshare.net https://www.youtube-nocookie.com https://www.youtube.com; img-src 'self' data: https://*.ads.linkedin.com https://*.esetstatic.com https://adservice.google.com https://analytics.twitter.com https://c.disquscdn.com https://captcha.welivesecurity.com https://connect.facebook.net https://googleads.g.doubleclick.net https://px.ads.linkedin.com https://referrer.disqus.com https://region1.google-analytics.com https://script.hotjar.com https://secure.eset.com https://syndication.twitter.com https://t.co https://twitter.com https://www.facebook.com https://www.google-analytics.com https://www.google.al https://www.google.ba https://www.google.bf https://www.google.bg https://www.google.by https://www.google.ca https://www.google.cd https://www.google.ch https://www.google.co.ao https://www.google.co.il https://www.google.co.in https://www.google.co.jp https://www.google.co.ke https://www.google.co.ls https://www.google.co.ma https://www.google.co.tz https://www.google.co.za https://www.google.com.af https://www.google.com.au https://www.google.com.bd https://www.google.com.bh https://www.google.com.br https://www.google.com.co https://www.google.com.do https://www.google.com.eg https://www.google.com.gi https://www.google.com.gt https://www.google.com.hk https://www.google.com.kw https://www.google.com.ly https://www.google.com.mx https://www.google.com.ni https://www.google.com.pe https://www.google.com.ph https://www.google.com.pk https://www.google.com.sa https://www.google.com.sl https://www.google.com.tr https://www.google.com.tw https://www.google.com.vn https://www.google.cv https://www.google.cz https://www.google.es https://www.google.fi https://www.google.ge https://www.google.gm https://www.google.gy https://www.google.hn https://www.google.hr https://www.google.ie https://www.google.it https://www.google.je https://www.google.jo https://www.google.kg https://www.google.lt https://www.google.lu https://www.google.lv https://www.google.md https://www.google.mw https://www.google.no https://www.google.ps https://www.google.rs https://www.google.sk https://www.google.tg https://www.google.tn https://www.googletagmanager.com https://www.hotjar.com https://www.linkedin.com https://www.youtube.com; manifest-src 'self'; media-src 'self' https://web-assets.esetstatic.com; object-src 'self' https://content.screencast.com; prefetch-src https://c.disquscdn.com https://disqus.com; script-src 'self' 'unsafe-eval' 'unsafe-inline' https://a.disquscdn.com https://assets.esetstatic.com https://cdn.esetstatic.com https://connect.facebook.net https://googleads.g.doubleclick.net https://platform.twitter.com https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tpc.googlesyndication.com https://welivesecurity.disqus.com https://www.google-analytics.com https://www.google.ie https://www.google.nl https://www.googleadservices.com https://www.googletagmanager.com https://www.instagram.com https://www.opinionstage.com https://www.youtube.com; style-src 'self' 'unsafe-inline' https://assets.esetstatic.com https://c.disquscdn.com https://cdn.esetstatic.com; worker-src 'self'; report-uri https://www-welivesecurity-com.api.cspconsole.com/v1/csp/report; report-to default; |
Strict-Transport-Security | max-age=15724800 |
X-Content-Type-Options | nosniff |
X-Xss-Protection | 1; mode=block |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
s.go-mpulse.net
web-assets.esetstatic.com
welivesecurity.disqus.com
www.welivesecurity.com
s.go-mpulse.net
web-assets.esetstatic.com
welivesecurity.disqus.com
2606:2800:233:1cb7:261b:1f9c:2074:3c
2a02:26f0:480:f::213:7ec8
606ea62b1a8a1e2b24b9e0eafef0757cea22f73f3956d6548611f7c26c4551b5
6317871c5ca7b272b4fd676ec207449ca4e75847b4af2c95f4682e15fde4af95
644fbb688b94c602990a4988d379d439a5151ea782e06496cb6347cbbb64e49d
7583504bff4b63512acd5e13c8e60b4bc9955ce1859ff183cfa6f0b6c9b809c8
b1ad05543f9a18e124fd92c9c7423f38cfff29475b12deb9a989ea1d27158137
e1dff8ed16093991fa6c2b2bb97094a50e8ab172eda52cf1a1bfd250f6f27ba7
ed915d2176566b841f0e01e7632ce7a20b023cbcb4f5976a6015284fccd8a865