urlscan.io logo urlscan.io
SecurityTrails logo

www.welivesecurity.com Open in urlscan Pro
2606:2800:233:1cb7:261b:1f9c:2074:3c  Public Scan

Go To Rescan Add Verdict Report
URL: https://www.welivesecurity.com/2021/04/08/are-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor/
Submission: On April 13 via api from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 18 IPs in 6 countries across 19 domains to perform 86 HTTP transactions. The main IP is 2606:2800:233:1cb7:261b:1f9c:2074:3c, located in United States and belongs to EDGECAST, US. The main domain is www.welivesecurity.com.
TLS certificate: Issued by Thawte RSA CA 2018 on January 26th 2021. Valid for: a year.
This is the only time www.welivesecurity.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
28 2606:2800:233... 15133 (EDGECAST)
2 2620:1ec:29::19 8068 (MICROSOFT...)
1 2a00:1450:400... 15169 (GOOGLE)
5 2a03:2880:f01... 32934 (FACEBOOK)
5 2a00:1450:400... 15169 (GOOGLE)
2 13.32.25.43 16509 (AMAZON-02)
3 151.101.112.134 54113 (FASTLY)
2 2a03:2880:f11... 32934 (FACEBOOK)
20 2606:4700::68... 13335 (CLOUDFLAR...)
5 151.101.0.134 54113 (FASTLY)
2 51.107.59.180 8075 (MICROSOFT...)
2 2a00:1450:400... 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
1 151.101.112.64 54113 (FASTLY)
2 3 99.84.156.6 16509 (AMAZON-02)
4 7 35.244.174.68 15169 (GOOGLE)
2 2 142.250.185.162 15169 (GOOGLE)
1 2 52.215.145.5 16509 (AMAZON-02)
3 3 185.33.221.91 29990 (ASN-APPNEX)
2 2 193.0.160.128 54312 (ROCKETFUEL)
2 2 2a02:2638::1c 44788 (ASN-CRITE...)
86 18
28    2606:2800:233:1cb7:261b:1f9c:2074:3c (United States)

ASN15133 (EDGECAST, US)
www.welivesecurity.com
az416426.vo.msecnd.net
2    2620:1ec:29::19 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
assets.esetstatic.com
1    2a00:1450:4001:82a::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.googletagmanager.com
5    2a03:2880:f01c:8012:face:b00c:0:3 (United States)

ASN32934 (FACEBOOK, US)
connect.facebook.net
5    2a00:1450:4001:82b::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google-analytics.com
2    13.32.25.43 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-32-25-43.fra56.r.cloudfront.net
cdn1.esetstatic.com
3    151.101.112.134 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)
welivesecurity.disqus.com
referrer.disqus.com
2    2a03:2880:f11c:8183:face:b00c:0:25de (United States)

ASN32934 (FACEBOOK, US)
www.facebook.com
20    2606:4700::6812:a813 (United States)

ASN13335 (CLOUDFLARENET, US)
c.disquscdn.com
5    151.101.0.134 (United States)

ASN54113 (FASTLY, US)
disqus.com
2    51.107.59.180 (Zurich, Switzerland)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
dc.services.visualstudio.com
2    2a00:1450:4001:80e::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
apis.google.com
2    2a00:1450:4001:808::200d (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
accounts.google.com
1    2a00:1450:4001:827::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
ssl.gstatic.com
1    151.101.112.64 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)
glitter.services.disqus.com
3    99.84.156.6 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-99-84-156-6.txl52.r.cloudfront.net
live.rezync.com
7    35.244.174.68 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 68.174.244.35.bc.googleusercontent.com
ejp.rlcdn.com
idsync.rlcdn.com
2    142.250.185.162 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s51-in-f2.1e100.net
cm.g.doubleclick.net
2    52.215.145.5 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-215-145-5.eu-west-1.compute.amazonaws.com
io.narrative.io
3    185.33.221.91 (Amsterdam, Netherlands)

ASN29990 (ASN-APPNEX, US)
PTR: 721.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
ib.adnxs.com
2    193.0.160.128 (United States)

ASN54312 (ROCKETFUEL, US)
p.rfihub.com
2    2a02:2638::1c (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)
gum.criteo.com
Domain Requested by
27 www.welivesecurity.com www.welivesecurity.com
20 c.disquscdn.com welivesecurity.disqus.com
disqus.com
c.disquscdn.com
5 idsync.rlcdn.com 2 redirects c.disquscdn.com
live.rezync.com
5 disqus.com welivesecurity.disqus.com
c.disquscdn.com
5 www.google-analytics.com www.welivesecurity.com
www.googletagmanager.com
5 connect.facebook.net www.welivesecurity.com
connect.facebook.net
c.disquscdn.com
3 ib.adnxs.com 3 redirects
3 live.rezync.com 2 redirects c.disquscdn.com
2 gum.criteo.com 2 redirects
2 p.rfihub.com 2 redirects
2 io.narrative.io 1 redirects
2 cm.g.doubleclick.net 2 redirects
2 ejp.rlcdn.com 2 redirects
2 accounts.google.com apis.google.com
ssl.gstatic.com
2 apis.google.com c.disquscdn.com
apis.google.com
2 dc.services.visualstudio.com az416426.vo.msecnd.net
2 www.facebook.com www.welivesecurity.com
c.disquscdn.com
2 welivesecurity.disqus.com www.welivesecurity.com
2 cdn1.esetstatic.com www.welivesecurity.com
2 assets.esetstatic.com www.welivesecurity.com
1 referrer.disqus.com
1 glitter.services.disqus.com c.disquscdn.com
1 ssl.gstatic.com accounts.google.com
1 az416426.vo.msecnd.net www.welivesecurity.com
1 www.googletagmanager.com www.welivesecurity.com
86 25

This site contains links to these domains. Also see Links.

Domain
www.eset.com
www.facebook.com
twitter.com
www.linkedin.com
attack.mitre.org
eset.com
Subject Issuer Validity Valid
www.welivesecurity.com
Thawte RSA CA 2018		 2021-01-26 -
2022-02-03		 a year crt.sh
assets.esetstatic.com
Thawte RSA CA 2018		 2020-11-09 -
2021-11-12		 a year crt.sh
*.google-analytics.com
GTS CA 1O1		 2021-03-16 -
2021-06-08		 3 months crt.sh
*.facebook.com
DigiCert SHA2 High Assurance Server CA		 2021-02-10 -
2021-05-10		 3 months crt.sh
sni1e6ffgl.wpc.edgecastcdn.net
DigiCert SHA2 Secure Server CA		 2020-04-16 -
2022-04-21		 2 years crt.sh
*.esetstatic.com
Thawte RSA CA 2018		 2019-09-05 -
2021-10-04		 2 years crt.sh
*.disqus.com
DigiCert SHA2 Secure Server CA		 2020-04-20 -
2022-05-09		 2 years crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2020-08-15 -
2021-08-15		 a year crt.sh
in.applicationinsights.azure.com
Microsoft RSA TLS CA 02		 2021-03-09 -
2022-03-09		 a year crt.sh
*.apis.google.com
GTS CA 1O1		 2021-03-16 -
2021-06-08		 3 months crt.sh
*.google.com
GTS CA 1O1		 2021-03-16 -
2021-06-08		 3 months crt.sh
accounts.google.com
GTS CA 1O1		 2021-03-16 -
2021-06-08		 3 months crt.sh
*.gstatic.com
GTS CA 1O1		 2021-03-23 -
2021-06-15		 3 months crt.sh
f.ssl.fastly.net
GlobalSign Organization Validation CA - SHA256 - G2		 2021-03-31 -
2021-12-27		 9 months crt.sh
*.rezync.com
Amazon		 2021-01-26 -
2022-02-23		 a year crt.sh
*.rlcdn.com
Sectigo RSA Domain Validation Secure Server CA		 2021-02-25 -
2022-03-28		 a year crt.sh
*.narrative.io
Amazon		 2021-04-07 -
2022-05-06		 a year crt.sh

This page contains 5 frames:

Primary Page: https://www.welivesecurity.com/2021/04/08/are-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor/
Frame ID: B123D7981F0DA2E43A3194F9185498F9
Requests: 49 HTTP requests in this frame

Frame: https://disqus.com/embed/comments/?base=default&f=welivesecurity&t_i=149397%20https%3A%2F%2Fbackend.welivesecurity.com%2F%3Fp%3D149397&t_u=https%3A%2F%2Fwww.welivesecurity.com%2F2021%2F04%2F08%2Fare-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor%2F&t_e=(Are%20you)%20afreight%20of%20the%20dark%3F%20Watch%20out%20for%20Vyveva%2C%20new%20Lazarus%20backdoor&t_d=(Are%20you)%20afreight%20of%20the%20dark%3F%20Watch%20out%20for%20Vyveva%2C%20new%20Lazarus%20backdoor&t_t=(Are%20you)%20afreight%20of%20the%20dark%3F%20Watch%20out%20for%20Vyveva%2C%20new%20Lazarus%20backdoor&s_o=default&l=en
Frame ID: ABA991AD5CFC849ED32B542C1455D105
Requests: 29 HTTP requests in this frame

Frame: https://accounts.google.com/o/oauth2/iframe
Frame ID: 1DE09FAB89860E466A794CA2F35AF674
Requests: 3 HTTP requests in this frame

Frame: https://live.rezync.com/pixel.html?c=4656c20ee35215f78e9273796625d90b&cid=c7mvhd0e25mie09&pctry=DE&referrer=https%3A%2F%2Fwww.welivesecurity.com%2F2021%2F04%2F08%2Fare-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor%2F
Frame ID: FFC595949C9D1404FAFEDFF0470E1B48
Requests: 3 HTTP requests in this frame

Frame: https://idsync.rlcdn.com/362358.gif?google_gid=CAESEEOR8ziO8vWfDLk_Qrm11WY&google_cver=1
Frame ID: 536A81C351551AC094095BDB6FC7B645
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /^(?:ECAcc|ECS|ECD)/i

Page Statistics

86
Requests

100 %
HTTPS

50 %
IPv6

19
Domains

25
Subdomains

18
IPs

6
Countries

2265 kB
Transfer

3921 kB
Size

4
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 79
  • https://ejp.rlcdn.com/501709.html HTTP 307
  • https://ejp.rlcdn.com/1000.gif?memo=CM3PHhoNCOet14MGEgUI6AcQAEIASgA HTTP 307
  • https://cm.g.doubleclick.net/pixel?google_nid=epsilon&google_cm HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=epsilon&google_cm=&google_tc= HTTP 302
  • https://idsync.rlcdn.com/362358.gif?google_gid=CAESEEOR8ziO8vWfDLk_Qrm11WY&google_cver=1
Request Chain 80
  • https://io.narrative.io/?companyId=19&id=disqus_id%3Ac7mvhd0e25mie09&ret=img&ref=https%3A%2F%2Fwww.welivesecurity.com%2F2021%2F04%2F08%2Fare-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor%2F HTTP 302
  • https://io.narrative.io/?io.narrative.guid.v2=f3f25750-9c7e-11eb-906c-06452aced0fe&companyId=19&id=disqus_id%3Ac7mvhd0e25mie09&ret=img&ref=https%3A%2F%2Fwww.welivesecurity.com%2F2021%2F04%2F08%2Fare-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor%2F
Request Chain 81
  • https://ib.adnxs.com/getuid?https%3A//live.rezync.com/sync%3Fc%3D4656c20ee35215f78e9273796625d90b%26p%3D093016b0419d19c905c78c859b815219%26pid%3D%24UID HTTP 307
  • https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%253A%2F%2Flive.rezync.com%2Fsync%253Fc%253D4656c20ee35215f78e9273796625d90b%2526p%253D093016b0419d19c905c78c859b815219%2526pid%253D%2524UID HTTP 302
  • https://live.rezync.com/sync?c=4656c20ee35215f78e9273796625d90b&p=093016b0419d19c905c78c859b815219&pid=2945442588821959322 HTTP 302
  • https://p.rfihub.com/cm?pub=39342&in=1&userid=40ddcea7-ffb0-4a07-a2ff-da9b92f1bd60%3A1618335463.83&forward=https%3A//idsync.rlcdn.com/501709.gif%3Fpartner_uid%3Dc7mvhd0e25mie09 HTTP 302
  • https://idsync.rlcdn.com/501709.gif?partner_uid=c7mvhd0e25mie09 HTTP 307
  • https://gum.criteo.com/sync?c=6&r=1&a=1&u=https%3A%2F%2Fidsync.rlcdn.com%2F397676.gif%3Fserved_by%3Devergreen%26partner_uid%3D%40USERID%40 HTTP 302
  • https://gum.criteo.com/sync?s=1&c=6&r=1&a=1&u=https%3A%2F%2Fidsync.rlcdn.com%2F397676.gif%3Fserved_by%3Devergreen%26partner_uid%3D%40USERID%40 HTTP 302
  • https://idsync.rlcdn.com/397676.gif?served_by=evergreen&partner_uid=fSM4QG9YhnyGiXcBxpx0Hl17NhUvvRDx
Request Chain 82
  • https://p.rfihub.com/cm?pub=39342&in=1&userid=40ddcea7-ffb0-4a07-a2ff-da9b92f1bd60%3A1618335463.83&forward=https%3A//live.rezync.com/sync%3Fc%3D4656c20ee35215f78e9273796625d90b%26p%3D260a954059a0ab1986e4ee8c5c88c54c%26pid%3D%7Buserid%7D HTTP 302
  • https://live.rezync.com/sync?c=4656c20ee35215f78e9273796625d90b&p=260a954059a0ab1986e4ee8c5c88c54c&pid=1870471594275988505 HTTP 302
  • https://idsync.rlcdn.com/501709.gif?partner_uid=c7mvhd0e25mie09 HTTP 307
  • https://ib.adnxs.com/getuid?https%3A%2F%2Fidsync.rlcdn.com%2F52154.gif%3Fserved_by%3Devergreen%26partner_uid%3D%24UID HTTP 302
  • https://idsync.rlcdn.com/52154.gif?served_by=evergreen&partner_uid=2945442588821959322

86 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
www.welivesecurity.com/2021/04/08/are-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor/ 		69 KB
14 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.welivesecurity.com/2021/04/08/are-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:233:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (frc/8F7D) /
Resource Hash
9c4add8d1cc4b907c18f06006214c46323c31de476aa7631ca1537af92e60b4e
Security Headers
Name Value
Strict-Transport-Security max-age=15724800
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:method
GET
:authority
www.welivesecurity.com
:scheme
https
:path
/2021/04/08/are-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor/
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-encoding
gzip
access-control-allow-origin
*
age
1488
cache-control
max-age=3600, public
content-type
text/html; charset=UTF-8
date
Tue, 13 Apr 2021 17:37:42 GMT
expires
Tue, 13 Apr 2021 18:37:42 GMT
last-modified
Tue, 13 Apr 2021 17:12:55 GMT
link
<https://www.welivesecurity.com/?p=149397>; rel=shortlink
referrer-policy
no-referrer-when-downgrade
server
ECAcc (frc/8F7D)
strict-transport-security
max-age=15724800
vary
Accept-Encoding
x-cache
HIT
x-content-type-options
nosniff
x-xss-protection
1; mode=block
content-length
14604
main-8633bd3c28.css
www.welivesecurity.com/wp-content/themes/eset-wls-2018/assets/build/css/ 		277 KB
44 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.welivesecurity.com/wp-content/themes/eset-wls-2018/assets/build/css/main-8633bd3c28.css
Requested by
Host: www.welivesecurity.com
URL: https://www.welivesecurity.com/2021/04/08/are-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:233:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (frc/8FBF) /
Resource Hash
1846a9c9605f590bf6cb37a20cde9454f58de8a74de5822bd242187fa83b2074
Security Headers
Name Value
Strict-Transport-Security max-age=15724800
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.welivesecurity.com/2021/04/08/are-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 13 Apr 2021 17:37:42 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
6490203
x-cache
HIT
strict-transport-security
max-age=15724800
content-length
45389
x-xss-protection
1; mode=block
referrer-policy
no-referrer-when-downgrade
last-modified
Thu, 28 Jan 2021 02:02:01 GMT
server
ECAcc (frc/8FBF)
etag
W/"60121b19-453ed"
vary
Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
max-age=7776000, public
expires
Mon, 12 Jul 2021 17:37:42 GMT
cookiebar.min.css
assets.esetstatic.com/3PS/ 		5 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://assets.esetstatic.com/3PS/cookiebar.min.css
Requested by
Host: www.welivesecurity.com
URL: https://www.welivesecurity.com/2021/04/08/are-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:29::19 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Apache /
Resource Hash
b77d351f5c5eaa164ee1f7aedd5c0c172a91284ae5d9ad544713af3a69cb3ed7
Security Headers
Name Value
Strict-Transport-Security max-age=2592000;
X-Content-Type-Options nosniff
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.welivesecurity.com/2021/04/08/are-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=2592000;
content-encoding
gzip
referrer-policy
no-referrer
server
Apache
date
Tue, 13 Apr 2021 17:37:42 GMT
x-frame-options
sameorigin
x-cache
TCP_HIT
content-type
text/css;charset=UTF-8
x-xss-protection
1; mode=block
cache-control
max-age=3600, s-maxage=3600
x-azure-ref
05tZ1YAAAAADhnkegsHhsTqOV0N8dVsqhTE9OMjFFREdFMDIwNgBlNDE3MmJjMS00ZmVlLTQzZTYtYTdlOC0zNWRmNWNhZDcwM2U=
vary
Accept-Encoding
content-length
1482
x-content-type-options
nosniff
eset-wls-dark-header-1.svg
www.welivesecurity.com/wp-content/themes/eset-wls-2018/assets/img/new-logo/ 		3 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.welivesecurity.com/wp-content/themes/eset-wls-2018/assets/img/new-logo/eset-wls-dark-header-1.svg
Requested by
Host: www.welivesecurity.com
URL: https://www.welivesecurity.com/2021/04/08/are-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:233:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (frc/8F63) /
Resource Hash
f0edf4ed283d119399dcb7025914b6a68a187667085bcbc49fe91db20f952cc1
Security Headers
Name Value
Strict-Transport-Security max-age=15724800
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.welivesecurity.com/2021/04/08/are-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 13 Apr 2021 17:37:42 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
7763880
x-cache
HIT
strict-transport-security
max-age=15724800
content-length
1162
x-xss-protection
1; mode=block
referrer-policy
no-referrer-when-downgrade
last-modified
Tue, 12 Jan 2021 07:31:16 GMT
server
ECAcc (frc/8F63)
etag
W/"5ffd5044-bb2"
vary
Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
max-age=7776000, public
expires
Mon, 12 Jul 2021 17:37:42 GMT
eset-wls-dark-header-2.svg
www.welivesecurity.com/wp-content/themes/eset-wls-2018/assets/img/new-logo/ 		3 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.welivesecurity.com/wp-content/themes/eset-wls-2018/assets/img/new-logo/eset-wls-dark-header-2.svg
Requested by
Host: www.welivesecurity.com
URL: https://www.welivesecurity.com/2021/04/08/are-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:233:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (frc/8FAF) /
Resource Hash
35ccbb14f6d8b7ed5eb03728f94221f27ed194ae83b32c40315d531f49b10bc1
Security Headers
Name Value
Strict-Transport-Security max-age=15724800
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.welivesecurity.com/2021/04/08/are-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 13 Apr 2021 17:37:42 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
1210070
x-cache
HIT
strict-transport-security
max-age=15724800
content-length
1263
x-xss-protection
1; mode=block
referrer-policy
no-referrer-when-downgrade
last-modified
Tue, 30 Mar 2021 13:32:57 GMT
server
ECAcc (frc/8FAF)
etag
W/"60632889-a8a"
vary
Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
max-age=7776000, public
accept-ranges
bytes
expires
Mon, 12 Jul 2021 17:37:42 GMT
eset-wls-light-header-1.svg
www.welivesecurity.com/wp-content/themes/eset-wls-2018/assets/img/new-logo/ 		3 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.welivesecurity.com/wp-content/themes/eset-wls-2018/assets/img/new-logo/eset-wls-light-header-1.svg
Requested by
Host: www.welivesecurity.com
URL: https://www.welivesecurity.com/2021/04/08/are-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:233:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (frc/8FFC) /
Resource Hash
5813b04bb0c879b76179735995127ddc2af1867f42d4a4b5a8d7c3103f348b05
Security Headers
Name Value
Strict-Transport-Security max-age=15724800
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.welivesecurity.com/2021/04/08/are-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 13 Apr 2021 17:37:42 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
7761465
x-cache
HIT
strict-transport-security
max-age=15724800
content-length
1177
x-xss-protection
1; mode=block
referrer-policy
no-referrer-when-downgrade
last-modified
Wed, 13 Jan 2021 21:35:42 GMT
server
ECAcc (frc/8FFC)
etag
W/"5fff67ae-bc1"
vary
Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
max-age=7776000, public
expires
Mon, 12 Jul 2021 17:37:42 GMT
eset-wls-light-header-2.svg
www.welivesecurity.com/wp-content/themes/eset-wls-2018/assets/img/new-logo/ 		2 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.welivesecurity.com/wp-content/themes/eset-wls-2018/assets/img/new-logo/eset-wls-light-header-2.svg
Requested by
Host: www.welivesecurity.com
URL: https://www.welivesecurity.com/2021/04/08/are-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:233:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (frc/8FE5) /
Resource Hash
12c42fa79dc321e56bb3c23008cacf7a79771bab4fa61f765556e24ba13a89ff
Security Headers
Name Value
Strict-Transport-Security max-age=15724800
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.welivesecurity.com/2021/04/08/are-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 13 Apr 2021 17:37:42 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
1210070
x-cache
HIT
strict-transport-security
max-age=15724800
content-length
1109
x-xss-protection
1; mode=block
referrer-policy
no-referrer-when-downgrade
last-modified
Tue, 30 Mar 2021 13:32:57 GMT
server
ECAcc (frc/8FE5)
etag
W/"60632889-967"
vary
Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
max-age=7776000, public
accept-ranges
bytes
expires
Mon, 12 Jul 2021 17:37:42 GMT
filip_jurcacko-222x179.jpg
www.welivesecurity.com/wp-content/uploads/2021/04/ 		5 KB
5 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.welivesecurity.com/wp-content/uploads/2021/04/filip_jurcacko-222x179.jpg
Requested by
Host: www.welivesecurity.com
URL: https://www.welivesecurity.com/2021/04/08/are-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:233:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (frc/8F99) /
Resource Hash
e49e818924b2d3f07c19d83857c4bcd7047f175041ada63af602bd9ab12d9949
Security Headers
Name Value
Strict-Transport-Security max-age=15724800
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.welivesecurity.com/2021/04/08/are-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 13 Apr 2021 17:37:42 GMT
x-content-type-options
nosniff
age
461135
x-cache
HIT
content-length
5175
x-xss-protection
1; mode=block
referrer-policy
no-referrer-when-downgrade
last-modified
Tue, 06 Apr 2021 13:59:51 GMT
server
ECAcc (frc/8F99)
etag
"606c6957-1437"
strict-transport-security
max-age=15724800
content-type
image/jpeg
access-control-allow-origin
*
cache-control
max-age=7776000, public
accept-ranges
bytes
expires
Mon, 12 Jul 2021 17:37:42 GMT
Figure-1.-Hex-Rays-decompilation-showing-similarity-between-Vyveva-left-and-NukeSped-sample-right-768x275.png
www.welivesecurity.com/wp-content/uploads/2021/04/ 		164 KB
164 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.welivesecurity.com/wp-content/uploads/2021/04/Figure-1.-Hex-Rays-decompilation-showing-similarity-between-Vyveva-left-and-NukeSped-sample-right-768x275.png
Requested by
Host: www.welivesecurity.com
URL: https://www.welivesecurity.com/2021/04/08/are-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:233:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (frc/8F2C) /
Resource Hash
cc6f42cec1cc6c7a2d649b851a29895949749068e7f97f98172ecff86cf587df
Security Headers
Name Value
Strict-Transport-Security max-age=15724800
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.welivesecurity.com/2021/04/08/are-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 13 Apr 2021 17:37:42 GMT
x-content-type-options
nosniff
age
460529
x-cache
HIT
content-length
167618
x-xss-protection
1; mode=block
referrer-policy
no-referrer-when-downgrade
last-modified
Fri, 02 Apr 2021 01:15:01 GMT
server
ECAcc (frc/8F2C)
etag
"60667015-28ec2"
strict-transport-security
max-age=15724800
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=7776000, public
accept-ranges
bytes
expires
Mon, 12 Jul 2021 17:37:42 GMT
Figure-2.-Overview-of-Vyveva-components-768x751.png
www.welivesecurity.com/wp-content/uploads/2021/04/ 		223 KB
224 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.welivesecurity.com/wp-content/uploads/2021/04/Figure-2.-Overview-of-Vyveva-components-768x751.png
Requested by
Host: www.welivesecurity.com
URL: https://www.welivesecurity.com/2021/04/08/are-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:233:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (frc/8FA3) /
Resource Hash
b750e9a2d5ccec23e8e4587c3a6b15ee4dc1c1d0dd84a99f478e86be5c7aa693
Security Headers
Name Value
Strict-Transport-Security max-age=15724800
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.welivesecurity.com/2021/04/08/are-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 13 Apr 2021 17:37:42 GMT
x-content-type-options
nosniff
age
460529
x-cache
HIT
content-length
228661
x-xss-protection
1; mode=block
referrer-policy
no-referrer-when-downgrade
last-modified
Thu, 01 Apr 2021 14:03:01 GMT
server
ECAcc (frc/8FA3)
etag
"6065d295-37d35"
strict-transport-security
max-age=15724800
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=7776000, public
accept-ranges
bytes
expires
Mon, 12 Jul 2021 17:37:42 GMT
Figure-4.-Configuration-structure-and-annotated-example-768x337.png
www.welivesecurity.com/wp-content/uploads/2021/04/ 		227 KB
228 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.welivesecurity.com/wp-content/uploads/2021/04/Figure-4.-Configuration-structure-and-annotated-example-768x337.png
Requested by
Host: www.welivesecurity.com
URL: https://www.welivesecurity.com/2021/04/08/are-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:233:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (frc/8F63) /
Resource Hash
b0e5c38bc6a2bd7237847084573d9a28e122b85268233107bfd014b340249577
Security Headers
Name Value
Strict-Transport-Security max-age=15724800
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.welivesecurity.com/2021/04/08/are-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 13 Apr 2021 17:37:42 GMT
x-content-type-options
nosniff
age
460529
x-cache
HIT
content-length
232799
x-xss-protection
1; mode=block
referrer-policy
no-referrer-when-downgrade
last-modified
Fri, 02 Apr 2021 01:15:04 GMT
server
ECAcc (frc/8F63)
etag
"60667018-38d5f"
strict-transport-security
max-age=15724800
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=7776000, public
accept-ranges
bytes
expires
Mon, 12 Jul 2021 17:37:42 GMT
software-supply-chain-attacks-trust-1-623x432.jpg
www.welivesecurity.com/wp-content/uploads/2021/04/ 		26 KB
26 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.welivesecurity.com/wp-content/uploads/2021/04/software-supply-chain-attacks-trust-1-623x432.jpg
Requested by
Host: www.welivesecurity.com
URL: https://www.welivesecurity.com/2021/04/08/are-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:233:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (frc/8F53) /
Resource Hash
89930700e50c08786e5758144c8d62b777efaaac9225c62dd2c555bfdcc65137
Security Headers
Name Value
Strict-Transport-Security max-age=15724800
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.welivesecurity.com/2021/04/08/are-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 13 Apr 2021 17:37:42 GMT
x-content-type-options
nosniff
age
545120
x-cache
HIT
content-length
26185
x-xss-protection
1; mode=block
referrer-policy
no-referrer-when-downgrade
last-modified
Wed, 07 Apr 2021 09:37:09 GMT
server
ECAcc (frc/8F53)
etag
"606d7d45-6649"
strict-transport-security
max-age=15724800
content-type
image/jpeg
access-control-allow-origin
*
cache-control
max-age=7776000, public
accept-ranges
bytes
expires
Mon, 12 Jul 2021 17:37:42 GMT
janeleiro-brazil-malware-banking-trojan-brazil-623x432.jpg
www.welivesecurity.com/wp-content/uploads/2021/04/ 		45 KB
45 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.welivesecurity.com/wp-content/uploads/2021/04/janeleiro-brazil-malware-banking-trojan-brazil-623x432.jpg
Requested by
Host: www.welivesecurity.com
URL: https://www.welivesecurity.com/2021/04/08/are-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:233:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (frc/8F6A) /
Resource Hash
aac0985d82f461dfcac802ece43c41cd98f245828ad0768758889ab6ea78bb7e
Security Headers
Name Value
Strict-Transport-Security max-age=15724800
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.welivesecurity.com/2021/04/08/are-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 13 Apr 2021 17:37:42 GMT
x-content-type-options
nosniff
age
633068
x-cache
HIT
content-length
45840
x-xss-protection
1; mode=block
referrer-policy
no-referrer-when-downgrade
last-modified
Fri, 02 Apr 2021 01:15:04 GMT
server
ECAcc (frc/8F6A)
etag
"60667018-b310"
strict-transport-security
max-age=15724800
content-type
image/jpeg
access-control-allow-origin
*
cache-control
max-age=7776000, public
accept-ranges
bytes
expires
Mon, 12 Jul 2021 17:37:42 GMT
php-source-code-git-repository-server-breach-623x432.jpg
www.welivesecurity.com/wp-content/uploads/2021/03/ 		40 KB
40 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.welivesecurity.com/wp-content/uploads/2021/03/php-source-code-git-repository-server-breach-623x432.jpg
Requested by
Host: www.welivesecurity.com
URL: https://www.welivesecurity.com/2021/04/08/are-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:233:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (frc/8F91) /
Resource Hash
f16416804f84dbe7a5d95a3d2333e107dc1774a612f0fc1611e1ffbfc10f0d6b
Security Headers
Name Value
Strict-Transport-Security max-age=15724800
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.welivesecurity.com/2021/04/08/are-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 13 Apr 2021 17:37:42 GMT
x-content-type-options
nosniff
age
1215181
x-cache
HIT
content-length
40943
x-xss-protection
1; mode=block
referrer-policy
no-referrer-when-downgrade
last-modified
Tue, 30 Mar 2021 14:56:21 GMT
server
ECAcc (frc/8F91)
etag
"60633c15-9fef"
strict-transport-security
max-age=15724800
content-type
image/jpeg
access-control-allow-origin
*
cache-control
max-age=7776000, public
accept-ranges
bytes
expires
Mon, 12 Jul 2021 17:37:42 GMT
exchange-servers-under-siege-10-apt-groups-623x432.jpg
www.welivesecurity.com/wp-content/uploads/2021/03/ 		28 KB
28 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.welivesecurity.com/wp-content/uploads/2021/03/exchange-servers-under-siege-10-apt-groups-623x432.jpg
Requested by
Host: www.welivesecurity.com
URL: https://www.welivesecurity.com/2021/04/08/are-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:233:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (frc/8E92) /
Resource Hash
2bb338589acb03e0bc2a0ebf4208c2f098c632e991bf452b2ec508b42d087222
Security Headers
Name Value
Strict-Transport-Security max-age=15724800
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.welivesecurity.com/2021/04/08/are-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 13 Apr 2021 17:37:42 GMT
x-content-type-options
nosniff
age
2953960
x-cache
HIT
content-length
29068
x-xss-protection
1; mode=block
referrer-policy
no-referrer-when-downgrade
last-modified
Wed, 10 Mar 2021 07:53:25 GMT
server
ECAcc (frc/8E92)
etag
"60487af5-718c"
strict-transport-security
max-age=15724800
content-type
image/jpeg
access-control-allow-origin
*
cache-control
max-age=7776000, public
accept-ranges
bytes
expires
Mon, 12 Jul 2021 17:37:42 GMT
eset-wls-footer-1.svg
www.welivesecurity.com/wp-content/themes/eset-wls-2018/assets/img/new-logo/ 		3 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.welivesecurity.com/wp-content/themes/eset-wls-2018/assets/img/new-logo/eset-wls-footer-1.svg
Requested by
Host: www.welivesecurity.com
URL: https://www.welivesecurity.com/2021/04/08/are-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:233:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (frc/8F2E) /
Resource Hash
7df5345a52f22643ef051bf74f41d9a5a5644d5e699480a81ae8825b8ab5e533
Security Headers
Name Value
Strict-Transport-Security max-age=15724800
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.welivesecurity.com/2021/04/08/are-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 13 Apr 2021 17:37:42 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
7761141
x-cache
HIT
strict-transport-security
max-age=15724800
content-length
1217
x-xss-protection
1; mode=block
referrer-policy
no-referrer-when-downgrade
last-modified
Wed, 13 Jan 2021 20:29:03 GMT
server
ECAcc (frc/8F2E)
etag
W/"5fff580f-be5"
vary
Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
max-age=7776000, public
expires
Mon, 12 Jul 2021 17:37:42 GMT
eset-wls-footer-2.svg
www.welivesecurity.com/wp-content/themes/eset-wls-2018/assets/img/new-logo/ 		3 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.welivesecurity.com/wp-content/themes/eset-wls-2018/assets/img/new-logo/eset-wls-footer-2.svg
Requested by
Host: www.welivesecurity.com
URL: https://www.welivesecurity.com/2021/04/08/are-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:233:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (frc/8E88) /
Resource Hash
e22e3416c5b454c2fc3c8e8185b478647446789abbee258ec18a5791880eaf1b
Security Headers
Name Value
Strict-Transport-Security max-age=15724800
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.welivesecurity.com/2021/04/08/are-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 13 Apr 2021 17:37:42 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
7759666
x-cache
HIT
strict-transport-security
max-age=15724800
content-length
1192
x-xss-protection
1; mode=block
referrer-policy
no-referrer-when-downgrade
last-modified
Wed, 13 Jan 2021 20:03:19 GMT
server
ECAcc (frc/8E88)
etag
W/"5fff5207-a0b"
vary
Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
max-age=7776000, public
accept-ranges
bytes
expires
Mon, 12 Jul 2021 17:37:42 GMT
main-0ba0c3843d.js
www.welivesecurity.com/wp-content/themes/eset-wls-2018/assets/build/js/ 		324 KB
101 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.welivesecurity.com/wp-content/themes/eset-wls-2018/assets/build/js/main-0ba0c3843d.js
Requested by
Host: www.welivesecurity.com
URL: https://www.welivesecurity.com/2021/04/08/are-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:233:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (frc/8E89) /
Resource Hash
a493d727aee756ab02e03abcc0432cf03c057d3b84549fa78a963f1e5a511ace
Security Headers
Name Value
Strict-Transport-Security max-age=15724800
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.welivesecurity.com/2021/04/08/are-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 13 Apr 2021 17:37:42 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
7762307
x-cache
HIT
strict-transport-security
max-age=15724800
content-length
103432
x-xss-protection
1; mode=block
referrer-policy
no-referrer-when-downgrade
last-modified
Wed, 13 Jan 2021 20:29:03 GMT
server
ECAcc (frc/8E89)
etag
W/"5fff580f-51012"
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
max-age=7776000, public
expires
Mon, 12 Jul 2021 17:37:42 GMT
crayon.min.js
www.welivesecurity.com/wp-content/themes/eset-wls-2018/assets/static/js/ 		22 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.welivesecurity.com/wp-content/themes/eset-wls-2018/assets/static/js/crayon.min.js
Requested by
Host: www.welivesecurity.com
URL: https://www.welivesecurity.com/2021/04/08/are-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:233:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (frc/8FDE) /
Resource Hash
193fbb968733b8a7049da19274546e6b80b76e9a8f1b837fee9a5fdeb8f97c7b
Security Headers
Name Value
Strict-Transport-Security max-age=15724800
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.welivesecurity.com/2021/04/08/are-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 13 Apr 2021 17:37:42 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
7760552
x-cache
HIT
strict-transport-security
max-age=15724800
content-length
6790
x-xss-protection
1; mode=block
referrer-policy
no-referrer-when-downgrade
last-modified
Wed, 13 Jan 2021 20:29:03 GMT
server
ECAcc (frc/8FDE)
etag
W/"5fff580f-5741"
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
max-age=7776000, public
expires
Mon, 12 Jul 2021 17:37:42 GMT
comment_count.js
www.welivesecurity.com/wp-content/plugins/disqus-comment-system/public/js/ 		889 B
553 B 		Script
General
Check archive.org
Download Go to
Full URL
https://www.welivesecurity.com/wp-content/plugins/disqus-comment-system/public/js/comment_count.js?ver=3.0.16
Requested by
Host: www.welivesecurity.com
URL: https://www.welivesecurity.com/2021/04/08/are-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:233:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (frc/8FA1) /
Resource Hash
cea0a05c5af6e21a409875328ed2e3dba79131b7c41f8ea07d0e0e02c7b7b59e
Security Headers
Name Value
Strict-Transport-Security max-age=15724800
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.welivesecurity.com/2021/04/08/are-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 13 Apr 2021 17:37:42 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
7758933
x-cache
HIT
strict-transport-security
max-age=15724800
content-length
446
x-xss-protection
1; mode=block
referrer-policy
no-referrer-when-downgrade
last-modified
Wed, 13 Jan 2021 22:20:45 GMT
server
ECAcc (frc/8FA1)
etag
W/"5fff723d-379"
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
max-age=7776000, public
accept-ranges
bytes
expires
Mon, 12 Jul 2021 17:37:42 GMT
comment_embed.js
www.welivesecurity.com/wp-content/plugins/disqus-comment-system/public/js/ 		1 KB
606 B 		Script
General
Check archive.org
Download Go to
Full URL
https://www.welivesecurity.com/wp-content/plugins/disqus-comment-system/public/js/comment_embed.js?ver=3.0.16
Requested by
Host: www.welivesecurity.com
URL: https://www.welivesecurity.com/2021/04/08/are-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:233:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (frc/8F51) /
Resource Hash
f055e217bde76d711bd8b42af773f9f99b8a29d81ad9ed10b6379cc7e6c60452
Security Headers
Name Value
Strict-Transport-Security max-age=15724800
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.welivesecurity.com/2021/04/08/are-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 13 Apr 2021 17:37:42 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
5586603
x-cache
HIT
strict-transport-security
max-age=15724800
content-length
505
x-xss-protection
1; mode=block
referrer-policy
no-referrer-when-downgrade
last-modified
Mon, 08 Feb 2021 00:23:27 GMT
server
ECAcc (frc/8F51)
etag
W/"6020847f-47e"
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
max-age=7776000, public
expires
Mon, 12 Jul 2021 17:37:42 GMT
app.min.js
assets.esetstatic.com/3PR/ 		20 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://assets.esetstatic.com/3PR/app.min.js
Requested by
Host: www.welivesecurity.com
URL: https://www.welivesecurity.com/2021/04/08/are-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:29::19 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Apache /
Resource Hash
e6d45d5070166bf5619c3934ec8cacbb331279340b55eec41cbeb8f5ac7fb69f
Security Headers
Name Value
Strict-Transport-Security max-age=2592000;
X-Content-Type-Options nosniff
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.welivesecurity.com/2021/04/08/are-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=2592000;
content-encoding
gzip
referrer-policy
no-referrer
server
Apache
date
Tue, 13 Apr 2021 17:37:42 GMT
x-frame-options
sameorigin
x-cache
TCP_HIT
content-type
application/javascript
x-xss-protection
1; mode=block
cache-control
max-age=3600, s-maxage=3600
x-azure-ref
05tZ1YAAAAAA75Vf7yV3CQrMC4B4PwjPRTE9OMjFFREdFMDIwNgBlNDE3MmJjMS00ZmVlLTQzZTYtYTdlOC0zNWRmNWNhZDcwM2U=
vary
Accept-Encoding
content-length
4900
x-content-type-options
nosniff
gtm.js
www.googletagmanager.com/ 		166 KB
56 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-PMDGSM
Requested by
Host: www.welivesecurity.com
URL: https://www.welivesecurity.com/2021/04/08/are-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
56d0f6e7a41b34c245b58ca6e50c7e180093fa9283c8eb7bab0a40589a07dbcb
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Referer
https://www.welivesecurity.com/2021/04/08/are-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 13 Apr 2021 17:37:42 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
56835
x-xss-protection
0
last-modified
Tue, 13 Apr 2021 16:23:04 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Tue, 13 Apr 2021 17:37:42 GMT
fbds.js
connect.facebook.net/en_US/ 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://connect.facebook.net/en_US/fbds.js
Requested by
Host: www.welivesecurity.com
URL: https://www.welivesecurity.com/2021/04/08/are-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f01c:8012:face:b00c:0:3 , United States, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
d39b91321f1f8eca1fa10e9c06b58698e9784f5b9917a8143371dee70590dc11
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

Referer
https://www.welivesecurity.com/2021/04/08/are-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; preload; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
content-md5
Hoz8aC3HVgbK7K3VLkC/Vg==
cross-origin-resource-policy
cross-origin
expires
Tue, 13 Apr 2021 17:44:47 GMT
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length
2118
x-fb-rlafr
0
x-fb-debug
GQyl10y4P5SBcCa5rhF65EmxVBtVfbCFuuJsBfsTSDY9RNulQgD4juKAy+TT7v4XEFzFMTrBmFf/3W5OHj/dOA==
x-fb-trip-id
686109401
x-fb-content-md5
f827702b281569d84d031b7c2be1205d
cross-origin-embedder-policy-report-only
require-corp;report-to="coep_report"
date
Tue, 13 Apr 2021 17:37:42 GMT
x-frame-options
DENY
report-to
{"group":"coep_report","max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}]}
content-type
application/x-javascript; charset=utf-8
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public,max-age=1200,stale-while-revalidate=3600
etag
"086eeb07f31a367e844fae569f9db773"
timing-allow-origin
*
access-control-expose-headers
X-FB-Content-MD5
ai.0.js
az416426.vo.msecnd.net/scripts/a/ 		94 KB
22 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Requested by
Host: www.welivesecurity.com
URL: https://www.welivesecurity.com/2021/04/08/are-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:233:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (frc/8FA5) /
Resource Hash
5201c813c37a4168cc5c20c701d4391fd0a55625f97eb9f263a74fb52b52fd0e

Request headers

Referer
https://www.welivesecurity.com/2021/04/08/are-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Tue, 13 Apr 2021 17:37:42 GMT
content-encoding
gzip
x-ms-meta-lastmodified
2020-10-01 19:31:04
content-md5
HdY95yzx9wIyQkVEGES+Ew==
age
1034
x-cache
HIT
content-length
22495
x-ms-lease-status
unlocked
last-modified
Thu, 11 Mar 2021 07:46:59 GMT
server
ECAcc (frc/8FA5)
etag
0x8D8E461DA1A5889
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
*
x-ms-request-id
22a95ec2-601e-00a7-4989-3000b7000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=1800
x-ms-version
2009-09-19
expires
Tue, 13 Apr 2021 18:07:42 GMT
sdk.js
connect.facebook.net/en_US/ 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://connect.facebook.net/en_US/sdk.js
Requested by
Host: www.welivesecurity.com
URL: https://www.welivesecurity.com/2021/04/08/are-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f01c:8012:face:b00c:0:3 , United States, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
4dad11be5c8c65e8cac9b84b6852c6c218d8e45c6f6a9027f511df8f15769aaa
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

Referer
https://www.welivesecurity.com/2021/04/08/are-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; preload; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
content-md5
aaj+yTVuiPiyUvcxCBWQtQ==
cross-origin-resource-policy
cross-origin
expires
Tue, 13 Apr 2021 17:42:59 GMT
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length
1780
x-fb-rlafr
0
x-fb-debug
fVpWnCqyuNMswKBt/H/E8s29kI7BMgVJEAjmgskry+hNuqwa3vdSkrCswt/kxngsfM8lUqmsUtEQutcR4lfRiQ==
x-fb-trip-id
686109401
x-fb-content-md5
aa24a6ec067e5f9371b27ba83b4ac7da
date
Tue, 13 Apr 2021 17:37:42 GMT
x-frame-options
DENY
content-type
application/x-javascript; charset=utf-8
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public,max-age=1200,stale-while-revalidate=3600
etag
"b43efc604147eb33a3eab9a8df6138e8"
timing-allow-origin
*
priority
u=3,i
access-control-expose-headers
X-FB-Content-MD5
single-wide-header-fade.png
www.welivesecurity.com/wp-content/themes/eset-wls-2018/assets/img/ 		92 KB
92 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.welivesecurity.com/wp-content/themes/eset-wls-2018/assets/img/single-wide-header-fade.png
Requested by
Host: www.welivesecurity.com
URL: https://www.welivesecurity.com/wp-content/themes/eset-wls-2018/assets/build/css/main-8633bd3c28.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:233:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (frc/8FC3) /
Resource Hash
e2a1c2c0322c2737e986c860da67fbb2b9e93b70527a943b8c35b9d6e81ebb42
Security Headers
Name Value
Strict-Transport-Security max-age=15724800
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.welivesecurity.com/wp-content/themes/eset-wls-2018/assets/build/css/main-8633bd3c28.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 13 Apr 2021 17:37:42 GMT
x-content-type-options
nosniff
age
7759574
x-cache
HIT
content-length
94055
x-xss-protection
1; mode=block
referrer-policy
no-referrer-when-downgrade
last-modified
Tue, 12 Jan 2021 04:25:47 GMT
server
ECAcc (frc/8FC3)
etag
"5ffd24cb-16f67"
strict-transport-security
max-age=15724800
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=7776000, public
accept-ranges
bytes
expires
Mon, 12 Jul 2021 17:37:42 GMT
vyveva-lazarus-backdoor-south-africa.jpg
www.welivesecurity.com/wp-content/uploads/2021/04/ 		167 KB
167 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.welivesecurity.com/wp-content/uploads/2021/04/vyveva-lazarus-backdoor-south-africa.jpg
Requested by
Host: www.welivesecurity.com
URL: https://www.welivesecurity.com/2021/04/08/are-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:233:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (frc/8F1A) /
Resource Hash
ba5b8184b4a58cb3398e8722b92ab2f57a500a0b4aa9662a3abbcf7b3cd1910c
Security Headers
Name Value
Strict-Transport-Security max-age=15724800
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.welivesecurity.com/2021/04/08/are-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 13 Apr 2021 17:37:42 GMT
x-content-type-options
nosniff
age
460628
x-cache
HIT
content-length
171096
x-xss-protection
1; mode=block
referrer-policy
no-referrer-when-downgrade
last-modified
Thu, 08 Apr 2021 08:34:55 GMT
server
ECAcc (frc/8F1A)
etag
"606ec02f-29c58"
strict-transport-security
max-age=15724800
content-type
image/jpeg
access-control-allow-origin
*
cache-control
max-age=7776000, public
accept-ranges
bytes
expires
Mon, 12 Jul 2021 17:37:42 GMT
li-shield-icon.svg
www.welivesecurity.com/wp-content/themes/eset-wls-2018/assets/img/ 		961 B
661 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.welivesecurity.com/wp-content/themes/eset-wls-2018/assets/img/li-shield-icon.svg
Requested by
Host: www.welivesecurity.com
URL: https://www.welivesecurity.com/wp-content/themes/eset-wls-2018/assets/build/css/main-8633bd3c28.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:233:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (frc/8FBF) /
Resource Hash
e0c2fd69b7d441b42045d474afe52d2bdbb81a44c8d73e2c8271e4114003d991
Security Headers
Name Value
Strict-Transport-Security max-age=15724800
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.welivesecurity.com/wp-content/themes/eset-wls-2018/assets/build/css/main-8633bd3c28.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 13 Apr 2021 17:37:42 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
7761064
x-cache
HIT
strict-transport-security
max-age=15724800
content-length
597
x-xss-protection
1; mode=block
referrer-policy
no-referrer-when-downgrade
last-modified
Wed, 13 Jan 2021 20:29:03 GMT
server
ECAcc (frc/8FBF)
etag
W/"5fff580f-3c1"
vary
Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
max-age=7776000, public
accept-ranges
bytes
expires
Mon, 12 Jul 2021 17:37:42 GMT
Fedra-Sans-Alt-Book.woff
www.welivesecurity.com/wp-content/themes/eset-wls-2018/assets/fonts/ 		40 KB
40 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://www.welivesecurity.com/wp-content/themes/eset-wls-2018/assets/fonts/Fedra-Sans-Alt-Book.woff
Requested by
Host: www.welivesecurity.com
URL: https://www.welivesecurity.com/wp-content/themes/eset-wls-2018/assets/build/css/main-8633bd3c28.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:233:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (frc/8F21) /
Resource Hash
1ba0ff3994900740a94dc37300b7415b25d642f6ef495afc5ae4e16ae1128e66
Security Headers
Name Value
Strict-Transport-Security max-age=15724800
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Origin
https://www.welivesecurity.com
Referer
https://www.welivesecurity.com/wp-content/themes/eset-wls-2018/assets/build/css/main-8633bd3c28.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 13 Apr 2021 17:37:42 GMT
x-content-type-options
nosniff
age
31092476
x-cache
HIT
content-length
40945
x-xss-protection
1; mode=block
referrer-policy
no-referrer-when-downgrade
last-modified
Sat, 18 Apr 2020 20:42:34 GMT
server
ECAcc (frc/8F21)
etag
"5e9b663a-9ff1"
strict-transport-security
max-age=15724800
content-type
font/woff
access-control-allow-origin
*
cache-control
max-age=31536000
accept-ranges
bytes
expires
Wed, 13 Apr 2022 17:37:42 GMT
Fedra-Sans-Alt-Bold.woff
www.welivesecurity.com/wp-content/themes/eset-wls-2018/assets/fonts/ 		40 KB
40 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://www.welivesecurity.com/wp-content/themes/eset-wls-2018/assets/fonts/Fedra-Sans-Alt-Bold.woff
Requested by
Host: www.welivesecurity.com
URL: https://www.welivesecurity.com/wp-content/themes/eset-wls-2018/assets/build/css/main-8633bd3c28.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:233:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (frc/8F8B) /
Resource Hash
12f37c0a70377ac636345742e2eb0d2acb70d411612020ae1608193330a5b15d
Security Headers
Name Value
Strict-Transport-Security max-age=15724800
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Origin
https://www.welivesecurity.com
Referer
https://www.welivesecurity.com/wp-content/themes/eset-wls-2018/assets/build/css/main-8633bd3c28.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 13 Apr 2021 17:37:42 GMT
x-content-type-options
nosniff
age
31091589
x-cache
HIT
content-length
40563
x-xss-protection
1; mode=block
referrer-policy
no-referrer-when-downgrade
last-modified
Sat, 18 Apr 2020 20:41:05 GMT
server
ECAcc (frc/8F8B)
etag
"5e9b65e1-9e73"
strict-transport-security
max-age=15724800
content-type
font/woff
access-control-allow-origin
*
cache-control
max-age=31536000
accept-ranges
bytes
expires
Wed, 13 Apr 2022 17:37:42 GMT
icomoon.ttf
www.welivesecurity.com/wp-content/themes/eset-wls-2018/assets/fonts/ 		4 KB
2 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://www.welivesecurity.com/wp-content/themes/eset-wls-2018/assets/fonts/icomoon.ttf?460of5
Requested by
Host: www.welivesecurity.com
URL: https://www.welivesecurity.com/wp-content/themes/eset-wls-2018/assets/build/css/main-8633bd3c28.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:233:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (frc/8F69) /
Resource Hash
d33fbf33d2895817029b01cf16d273104474646e4e441988ab4efcfa7563991b
Security Headers
Name Value
Strict-Transport-Security max-age=15724800
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Origin
https://www.welivesecurity.com
Referer
https://www.welivesecurity.com/wp-content/themes/eset-wls-2018/assets/build/css/main-8633bd3c28.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 13 Apr 2021 17:37:42 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
30082
x-cache
HIT
strict-transport-security
max-age=15724800
content-length
2156
x-xss-protection
1; mode=block
referrer-policy
no-referrer-when-downgrade
last-modified
Tue, 13 Apr 2021 02:50:28 GMT
server
ECAcc (frc/8F69)
etag
W/"607506f4-f94"
vary
Accept-Encoding
content-type
text/plain; charset=UTF-8
access-control-allow-origin
*
cache-control
max-age=86400, public
accept-ranges
bytes
expires
Wed, 14 Apr 2021 17:37:42 GMT
Fedra-Sans-Alt-Book-Italic.woff
www.welivesecurity.com/wp-content/themes/eset-wls-2018/assets/fonts/ 		40 KB
40 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://www.welivesecurity.com/wp-content/themes/eset-wls-2018/assets/fonts/Fedra-Sans-Alt-Book-Italic.woff
Requested by
Host: www.welivesecurity.com
URL: https://www.welivesecurity.com/wp-content/themes/eset-wls-2018/assets/build/css/main-8633bd3c28.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:233:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (frc/8F0D) /
Resource Hash
63a41173db39c92635a87b39eedb581e8a1c3142372ebced441ce927fef343a1
Security Headers
Name Value
Strict-Transport-Security max-age=15724800
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Origin
https://www.welivesecurity.com
Referer
https://www.welivesecurity.com/wp-content/themes/eset-wls-2018/assets/build/css/main-8633bd3c28.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 13 Apr 2021 17:37:42 GMT
x-content-type-options
nosniff
age
31092823
x-cache
HIT
content-length
40640
x-xss-protection
1; mode=block
referrer-policy
no-referrer-when-downgrade
last-modified
Sat, 18 Apr 2020 20:35:45 GMT
server
ECAcc (frc/8F0D)
etag
"5e9b64a1-9ec0"
strict-transport-security
max-age=15724800
content-type
font/woff
access-control-allow-origin
*
cache-control
max-age=31536000
accept-ranges
bytes
expires
Wed, 13 Apr 2022 17:37:42 GMT
collect
www.google-analytics.com/ 		35 B
194 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google-analytics.com/collect?v=1&cid=503501.34906424436&tid=UA-76266002-27&dl=https://www.welivesecurity.com/2021/04/08/are-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor/&t=event&ec=Tracking%20check%20-%20recurring&ea=Script%20loaded&ni=1&cd1=wls&aip=1&z=330427
Requested by
Host: www.welivesecurity.com
URL: https://www.welivesecurity.com/2021/04/08/are-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.welivesecurity.com/2021/04/08/are-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 13 Apr 2021 10:03:38 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
27244
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
check.png
cdn1.esetstatic.com/ESET/INT/assets/img/ 		68 B
384 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cdn1.esetstatic.com/ESET/INT/assets/img/check.png?country=wls&gcode=scriptLoaded&z=256863
Requested by
Host: www.welivesecurity.com
URL: https://www.welivesecurity.com/2021/04/08/are-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.32.25.43 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-32-25-43.fra56.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
260865134b6e69ca7bafa9e8ddcd59fb6ffbf727f50a3d2dd186d217c8c79694

Request headers

Referer
https://www.welivesecurity.com/2021/04/08/are-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 13 Apr 2021 11:08:31 GMT
via
1.1 3298c44116035984c2fac24b89183c4e.cloudfront.net (CloudFront)
last-modified
Tue, 10 Mar 2020 18:17:48 GMT
server
AmazonS3
age
23352
etag
"5df0ac2d51cfecbde35e8dd1ba3a8d77"
x-cache
Hit from cloudfront
content-type
image/png
x-amz-cf-pop
FRA56-C2
accept-ranges
bytes
content-length
68
x-amz-cf-id
JYzO4ck8XHYqnKvzOoVq3pzW4-bueGSml5BfEpJ6o2rfCWO4VXz74Q==
count.js
welivesecurity.disqus.com/ 		1 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://welivesecurity.disqus.com/count.js
Requested by
Host: www.welivesecurity.com
URL: https://www.welivesecurity.com/wp-content/plugins/disqus-comment-system/public/js/comment_count.js?ver=3.0.16
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.112.134 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
3487ef2baf0c08ba660a8a143cdeb8ebeec961eea04bccd7c49096b4eb26b875
Security Headers
Name Value
Strict-Transport-Security max-age=300; includeSubdomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.welivesecurity.com/2021/04/08/are-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Tue, 13 Apr 2021 17:37:42 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Age
1248073
P3P
CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
Connection
keep-alive
Content-Length
871
X-XSS-Protection
1; mode=block
Last-Modified
Wed, 24 Mar 2021 19:08:53 GMT
Server
nginx
ETag
"605b8e45-367"
Vary
Accept-Encoding
Strict-Transport-Security
max-age=300; includeSubdomains
Content-Type
application/javascript; charset=utf-8
Cache-Control
public, max-age=300
X-Amz-Cf-Pop
DFW55-C3
Link
<https://disqus.com>; rel=preconnect, <https://c.disquscdn.com>; rel=preconnect
X-Amz-Cf-Id
KErR2xNPj8cwdsjlBOPdJH7mEFMI-oZj1EFS-2QuoYYHmA6Y4BxqxQ==
embed.js
welivesecurity.disqus.com/ 		73 KB
24 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://welivesecurity.disqus.com/embed.js
Requested by
Host: www.welivesecurity.com
URL: https://www.welivesecurity.com/wp-content/plugins/disqus-comment-system/public/js/comment_embed.js?ver=3.0.16
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.112.134 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
openresty /
Resource Hash
34f43b4966020a59a3a3e099f9dbe930d8ae84430ab1239b0d9f5055310c5ac3
Security Headers
Name Value
Strict-Transport-Security max-age=300; includeSubdomains

Request headers

Referer
https://www.welivesecurity.com/2021/04/08/are-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Tue, 13 Apr 2021 17:37:42 GMT
Content-Encoding
gzip
Server
openresty
Age
54
Vary
Accept-Encoding
Connection
keep-alive
Content-Type
application/javascript; charset=utf-8
Cache-Control
private, max-age=60
X-Service
router
Strict-Transport-Security
max-age=300; includeSubdomains
Link
<https://disqus.com>; rel=preconnect, <https://c.disquscdn.com>; rel=preconnect
Content-Length
24257
/
www.facebook.com/tr/ 		44 B
258 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.facebook.com/tr/?id=1518099328403839&ev=PixelInitialized&dl=https%3A%2F%2Fwww.welivesecurity.com%2F2021%2F04%2F08%2Fare-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor%2F&rl=&if=false&ts=1618335462762
Requested by
Host: www.welivesecurity.com
URL: https://www.welivesecurity.com/2021/04/08/are-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f11c:8183:face:b00c:0:25de , United States, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://www.welivesecurity.com/2021/04/08/are-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 13 Apr 2021 17:37:42 GMT
last-modified
Fri, 21 Dec 2012 00:00:01 GMT
server
proxygen-bolt
strict-transport-security
max-age=31536000; includeSubDomains
content-type
image/gif
cache-control
no-cache, must-revalidate, max-age=0
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length
44
expires
Tue, 13 Apr 2021 17:37:42 GMT
sdk.js
connect.facebook.net/en_US/ 		216 KB
64 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://connect.facebook.net/en_US/sdk.js?hash=fa453af630c58b2876b111b83c0b61da&ua=modern_es6
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/sdk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f01c:8012:face:b00c:0:3 , United States, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
cea1cc1bda5686330e67daf6537a80f848672e3d5bd251568581212bb3933788
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

Origin
https://www.welivesecurity.com
Referer
https://www.welivesecurity.com/2021/04/08/are-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; preload; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
content-md5
6tPZGMwdB6UquoKTpB+SXw==
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length
65484
x-fb-rlafr
0
x-fb-debug
PrjNcUS4CJ3h+iK+iIYUBxc0MIyLg8AeQD8HuyNX/rO1WmOlm1C3sVcofKuy7A8wyfSkRGOMs2V5PIPvCjFEeQ==
x-fb-trip-id
686109401
x-fb-content-md5
2f06735ebf2fb5c51f9e3855a92c1982
x-frame-options
DENY
date
Tue, 13 Apr 2021 17:37:42 GMT
vary
Accept-Encoding
content-type
application/x-javascript; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
X-FB-Content-MD5
cache-control
public,max-age=31536000,stale-while-revalidate=3600,immutable
etag
"aae4fa7af7d41b60f53b791f25ee6386"
timing-allow-origin
*
priority
u=3,i
expires
Wed, 13 Apr 2022 16:13:39 GMT
analytics.js
www.google-analytics.com/ 		48 KB
19 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PMDGSM
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
f79723478f4c48501cd49ac52b81d6244a6562b9d3f08ce8ab208a8b8878d4c4
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.welivesecurity.com/2021/04/08/are-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Fri, 19 Mar 2021 19:22:18 GMT
server
Golfe2
age
2668
date
Tue, 13 Apr 2021 16:53:14 GMT
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
19463
expires
Tue, 13 Apr 2021 18:53:14 GMT
lounge.c82b267b396dfbc10ae5113342115da8.css
c.disquscdn.com/next/embed/styles/ 		0
23 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://c.disquscdn.com/next/embed/styles/lounge.c82b267b396dfbc10ae5113342115da8.css
Requested by
Host: welivesecurity.disqus.com
URL: https://welivesecurity.disqus.com/embed.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:a813 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=300; includeSubdomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.welivesecurity.com/2021/04/08/are-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 13 Apr 2021 17:37:42 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
3539410
strict-transport-security
max-age=300; includeSubdomains
content-length
22713
cf-request-id
096de88dfe0000062df82f6000000001
timing-allow-origin
*
last-modified
Wed, 03 Mar 2021 01:20:39 GMT
server
cloudflare
etag
"603ee467-58b9"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/css; charset=utf-8
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=31536000, public, immutable, no-transform
x-amz-cf-pop
FRA56-C2
accept-ranges
bytes
cf-ray
63f676c32ada062d-FRA
x-amz-cf-id
8iHhdnaJ5uIRYSyeUnp9kgCqelvQxggEWvWNZtCLHCvwamS-AeRHKw==
expires
Thu, 03 Mar 2022 18:27:32 GMT
common.bundle.f485ba8b89bf2153fdb9f493ec342aed.js
c.disquscdn.com/next/embed/ 		0
93 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://c.disquscdn.com/next/embed/common.bundle.f485ba8b89bf2153fdb9f493ec342aed.js
Requested by
Host: welivesecurity.disqus.com
URL: https://welivesecurity.disqus.com/embed.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:a813 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=300; includeSubdomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.welivesecurity.com/2021/04/08/are-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 13 Apr 2021 17:37:42 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
3022051
strict-transport-security
max-age=300; includeSubdomains
content-length
94786
cf-request-id
096de88dff0000062de4036000000001
timing-allow-origin
*
last-modified
Tue, 09 Mar 2021 17:57:38 GMT
server
cloudflare
etag
"6047b712-17242"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=31536000, public, immutable, no-transform
x-amz-cf-pop
FRA56-C2
accept-ranges
bytes
cf-ray
63f676c32adf062d-FRA
x-amz-cf-id
iGbO1sC_L2SXajbXh3fns4o9OWy9yuPPlUqsvZKLIHAqbdlN6Dbhow==
expires
Wed, 09 Mar 2022 18:10:09 GMT
lounge.bundle.5c8cd56736a07a84352a4d37a862a762.js
c.disquscdn.com/next/embed/ 		0
115 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://c.disquscdn.com/next/embed/lounge.bundle.5c8cd56736a07a84352a4d37a862a762.js
Requested by
Host: welivesecurity.disqus.com
URL: https://welivesecurity.disqus.com/embed.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:a813 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=300; includeSubdomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.welivesecurity.com/2021/04/08/are-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 13 Apr 2021 17:37:42 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
1714702
strict-transport-security
max-age=300; includeSubdomains
content-length
117042
cf-request-id
096de88dff0000062d04910000000001
timing-allow-origin
*
last-modified
Wed, 24 Mar 2021 20:33:38 GMT
server
cloudflare
etag
"605ba222-1c932"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=31536000, public, immutable, no-transform
x-amz-cf-pop
FRA6-C1
accept-ranges
bytes
cf-ray
63f676c32ae0062d-FRA
x-amz-cf-id
wHMVdFIOKMWmxOB1tyUv-pM5OppW3IdhZaJR7RDK4a0KJo8VIfLMZg==
expires
Thu, 24 Mar 2022 21:19:19 GMT
config.js
disqus.com/next/ 		0
12 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://disqus.com/next/config.js
Requested by
Host: welivesecurity.disqus.com
URL: https://welivesecurity.disqus.com/embed.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.0.134 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=300; includeSubdomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.welivesecurity.com/2021/04/08/are-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Tue, 13 Apr 2021 17:37:42 GMT
X-Content-Type-Options
nosniff
Content-Type
application/javascript; charset=UTF-8
Server
nginx
Age
18
X-Frame-Options
SAMEORIGIN
Strict-Transport-Security
max-age=300; includeSubdomains
p3p
CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
Access-Control-Allow-Origin
*
Cache-Control
public, stale-while-revalidate=300, s-stalewhilerevalidate=3600, max-age=60
Connection
keep-alive
Timing-Allow-Origin
*
Content-Length
11508
X-XSS-Protection
1; mode=block
collect
www.google-analytics.com/ 		35 B
63 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google-analytics.com/collect?v=1&_v=j89&aip=1&a=312634481&t=pageview&_s=1&dl=https%3A%2F%2Fwww.welivesecurity.com%2F2021%2F04%2F08%2Fare-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor%2F&ul=en-us&de=UTF-8&dt=(Are%20you)%20afreight%20of%20the%20dark%3F%20Watch%20out%20for%20Vyveva%2C%20new%20Lazarus%20backdoor%20%7C%20WeLiveSecurity&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAEAB~&cid=198682803.1618335463&tid=UA-37839312-1&_gid=566125294.1618335463&gtm=2wg3v0PMDGSM&cd1=Malware&cd2=Filip%20Jur%C4%8Dacko&cd3=1.5k-2k&cd4=&cd5=2021-04-13T19%3A37%3A42.857%2B02%3A00&cd6=Non-Office%20Hours&cd7=www.welivesecurity.com%2F2021%2F04%2F08%2Fare-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor%2F&cd8=https%3A%2F%2Fwww.welivesecurity.com%2F2021%2F04%2F08%2Fare-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor%2F&cd10=Research&cd11=en&cd20=false&cd25=GTM-PMDGSM&cd33=consent%20not%20set&cd34=consent%20not%20set&z=1961568526
Requested by
Host: www.welivesecurity.com
URL: https://www.welivesecurity.com/2021/04/08/are-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor/
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.welivesecurity.com/2021/04/08/are-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 13 Apr 2021 10:03:38 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
27244
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
collect
www.google-analytics.com/ 		35 B
58 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google-analytics.com/collect?v=1&_v=j89&aip=1&a=312634481&t=event&ni=1&_s=1&dl=https%3A%2F%2Fwww.welivesecurity.com%2F2021%2F04%2F08%2Fare-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor%2F&ul=en-us&de=UTF-8&dt=(Are%20you)%20afreight%20of%20the%20dark%3F%20Watch%20out%20for%20Vyveva%2C%20new%20Lazarus%20backdoor%20%7C%20WeLiveSecurity&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=cookie%20consent&ea=cookie-consent-visible&_u=YEDAAEAB~&cid=198682803.1618335463&tid=UA-37839312-1&_gid=566125294.1618335463&gtm=2wg3v0PMDGSM&cd1=Malware&cd2=Filip%20Jur%C4%8Dacko&cd3=1.5k-2k&cd4=&cd5=2021-04-13T19%3A37%3A42.898%2B02%3A00&cd6=Non-Office%20Hours&cd7=www.welivesecurity.com%2F2021%2F04%2F08%2Fare-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor%2F&cd8=https%3A%2F%2Fwww.welivesecurity.com%2F2021%2F04%2F08%2Fare-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor%2F&cd10=Research&cd11=en&cd20=false&cd25=GTM-PMDGSM&cd33=consent%20not%20set&cd34=consent%20not%20set&z=223625325
Requested by
Host: www.welivesecurity.com
URL: https://www.welivesecurity.com/2021/04/08/are-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor/
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.welivesecurity.com/2021/04/08/are-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 13 Apr 2021 10:03:38 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
27244
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
track
dc.services.visualstudio.com/v2/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://dc.services.visualstudio.com/v2/track
Protocol
H2
Server
51.107.59.180 Zurich, Switzerland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Accept
*/*
Access-Control-Request-Method
POST
Access-Control-Request-Headers
content-type,sdk-context
Origin
https://www.welivesecurity.com
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

access-control-allow-methods
POST
access-control-allow-headers
Origin, X-Requested-With, Content-Name, Content-Type, Accept, Sdk-Context
access-control-allow-origin
*
access-control-max-age
3600
x-content-type-options
nosniff
date
Tue, 13 Apr 2021 17:37:42 GMT
content-length
0
track
dc.services.visualstudio.com/v2/ 		96 B
186 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://dc.services.visualstudio.com/v2/track
Requested by
Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
51.107.59.180 Zurich, Switzerland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
0d12043c7051fe9e78060b7ae447ec5aa8bfa744dd5520fb12e745a2bb0076da
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff

Request headers

Referer
https://www.welivesecurity.com/2021/04/08/are-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor/
Sdk-Context
appId
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-type
application/json

Response headers

x-ms-session-id
850CB26D-96AB-419B-B636-EE0DFF2736FF
strict-transport-security
max-age=31536000
x-content-type-options
nosniff
date
Tue, 13 Apr 2021 17:37:43 GMT
access-control-max-age
3600
content-type
application/json; charset=utf-8
access-control-allow-origin
*
access-control-allow-headers
Origin, X-Requested-With, Content-Name, Content-Type, Accept, Sdk-Context
content-length
96
/
disqus.com/embed/comments/ Frame ABA9 		8 KB
4 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://disqus.com/embed/comments/?base=default&f=welivesecurity&t_i=149397%20https%3A%2F%2Fbackend.welivesecurity.com%2F%3Fp%3D149397&t_u=https%3A%2F%2Fwww.welivesecurity.com%2F2021%2F04%2F08%2Fare-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor%2F&t_e=(Are%20you)%20afreight%20of%20the%20dark%3F%20Watch%20out%20for%20Vyveva%2C%20new%20Lazarus%20backdoor&t_d=(Are%20you)%20afreight%20of%20the%20dark%3F%20Watch%20out%20for%20Vyveva%2C%20new%20Lazarus%20backdoor&t_t=(Are%20you)%20afreight%20of%20the%20dark%3F%20Watch%20out%20for%20Vyveva%2C%20new%20Lazarus%20backdoor&s_o=default&l=en
Requested by
Host: welivesecurity.disqus.com
URL: https://welivesecurity.disqus.com/embed.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.0.134 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
44f82284979403a96c5ae28e102b7f1709d755605f714120daa8b824aca60f72
Security Headers
Name Value
Content-Security-Policy script-src https://*.twitter.com:* https://www.gstatic.com/recaptcha/ https://a.disquscdn.com https://c.disquscdn.com c.disquscdn.com https://*.services.disqus.com:* https://cdn.boomtrain.com/p13n/ https://apis.google.com https://cdn.syndication.twimg.com/tweets.json https://connect.facebook.net/en_US/sdk.js https://referrer.disqus.com/juggler/ 'unsafe-inline' https://com-disqus.netmng.com:* https://www.google.com/recaptcha/ https://cf.ignitionone.com:* https://disqus.com
Strict-Transport-Security max-age=300; includeSubdomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Host
disqus.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
iframe
Referer
https://www.welivesecurity.com/2021/04/08/are-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor/
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://www.welivesecurity.com/2021/04/08/are-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor/

Response headers

Connection
keep-alive
Content-Length
3250
Server
nginx
Content-Security-Policy
script-src https://*.twitter.com:* https://www.gstatic.com/recaptcha/ https://a.disquscdn.com https://c.disquscdn.com c.disquscdn.com https://*.services.disqus.com:* https://cdn.boomtrain.com/p13n/ https://apis.google.com https://cdn.syndication.twimg.com/tweets.json https://connect.facebook.net/en_US/sdk.js https://referrer.disqus.com/juggler/ 'unsafe-inline' https://com-disqus.netmng.com:* https://www.google.com/recaptcha/ https://cf.ignitionone.com:* https://disqus.com
Link
<https://c.disquscdn.com>;rel=preconnect,<https://c.disquscdn.com>;rel=dns-prefetch
Cache-Control
stale-if-error=3600, s-stalewhilerevalidate=3600, stale-while-revalidate=30, no-cache, must-revalidate, public, s-maxage=5
p3p
CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
Timing-Allow-Origin
*
X-Content-Type-Options
nosniff
X-XSS-Protection
1; mode=block
Content-Type
text/html; charset=utf-8
Last-Modified
Thu, 08 Apr 2021 09:31:26 GMT
ETag
W/"lounge:view:8469709655.4d36cdb7b68b7602ec39071a098594cb.2"
Referrer-Policy
no-referrer-when-downgrade
Content-Encoding
gzip
Date
Tue, 13 Apr 2021 17:37:43 GMT
Age
6
Vary
Accept-Encoding
Strict-Transport-Security
max-age=300; includeSubdomains
lounge.load.a658a7c16140d8728cc859daf581cbbc.js
c.disquscdn.com/next/embed/ Frame ABA9 		1 KB
656 B 		Script
General
Check archive.org
Download Go to
Full URL
https://c.disquscdn.com/next/embed/lounge.load.a658a7c16140d8728cc859daf581cbbc.js
Requested by
Host: disqus.com
URL: https://disqus.com/embed/comments/?base=default&f=welivesecurity&t_i=149397%20https%3A%2F%2Fbackend.welivesecurity.com%2F%3Fp%3D149397&t_u=https%3A%2F%2Fwww.welivesecurity.com%2F2021%2F04%2F08%2Fare-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor%2F&t_e=(Are%20you)%20afreight%20of%20the%20dark%3F%20Watch%20out%20for%20Vyveva%2C%20new%20Lazarus%20backdoor&t_d=(Are%20you)%20afreight%20of%20the%20dark%3F%20Watch%20out%20for%20Vyveva%2C%20new%20Lazarus%20backdoor&t_t=(Are%20you)%20afreight%20of%20the%20dark%3F%20Watch%20out%20for%20Vyveva%2C%20new%20Lazarus%20backdoor&s_o=default&l=en
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:a813 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ce33b36f16a953ed16394b859ee8f1a6e7fd9785869fe62e3af78aa019c07f7b
Security Headers
Name Value
Strict-Transport-Security max-age=300; includeSubdomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Origin
https://disqus.com
Referer
https://disqus.com/embed/comments/?base=default&f=welivesecurity&t_i=149397%20https%3A%2F%2Fbackend.welivesecurity.com%2F%3Fp%3D149397&t_u=https%3A%2F%2Fwww.welivesecurity.com%2F2021%2F04%2F08%2Fare-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor%2F&t_e=(Are%20you)%20afreight%20of%20the%20dark%3F%20Watch%20out%20for%20Vyveva%2C%20new%20Lazarus%20backdoor&t_d=(Are%20you)%20afreight%20of%20the%20dark%3F%20Watch%20out%20for%20Vyveva%2C%20new%20Lazarus%20backdoor&t_t=(Are%20you)%20afreight%20of%20the%20dark%3F%20Watch%20out%20for%20Vyveva%2C%20new%20Lazarus%20backdoor&s_o=default&l=en
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 13 Apr 2021 17:37:43 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
1714703
strict-transport-security
max-age=300; includeSubdomains
content-length
535
cf-request-id
096de88ed80000d7294d1a2000000001
timing-allow-origin
*
last-modified
Wed, 24 Mar 2021 20:33:38 GMT
server
cloudflare
etag
"605ba222-217"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=31536000, public, immutable, no-transform
x-amz-cf-pop
FRA6-C1
accept-ranges
bytes
cf-ray
63f676c48fafd729-FRA
x-amz-cf-id
UvupA6cr16mXG4PtlTB7U9JZSc9DPN4CceokOKQXSpBYeLhaNgD-yw==
expires
Thu, 24 Mar 2022 21:19:18 GMT
common.bundle.f485ba8b89bf2153fdb9f493ec342aed.js
c.disquscdn.com/next/embed/ Frame ABA9 		282 KB
93 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://c.disquscdn.com/next/embed/common.bundle.f485ba8b89bf2153fdb9f493ec342aed.js
Requested by
Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/lounge.load.a658a7c16140d8728cc859daf581cbbc.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:a813 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
33d9c56f2b1408711b9b963963790177ac4e7c38a5ecf0e3c12f558c676e294b
Security Headers
Name Value
Strict-Transport-Security max-age=300; includeSubdomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://disqus.com/embed/comments/?base=default&f=welivesecurity&t_i=149397%20https%3A%2F%2Fbackend.welivesecurity.com%2F%3Fp%3D149397&t_u=https%3A%2F%2Fwww.welivesecurity.com%2F2021%2F04%2F08%2Fare-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor%2F&t_e=(Are%20you)%20afreight%20of%20the%20dark%3F%20Watch%20out%20for%20Vyveva%2C%20new%20Lazarus%20backdoor&t_d=(Are%20you)%20afreight%20of%20the%20dark%3F%20Watch%20out%20for%20Vyveva%2C%20new%20Lazarus%20backdoor&t_t=(Are%20you)%20afreight%20of%20the%20dark%3F%20Watch%20out%20for%20Vyveva%2C%20new%20Lazarus%20backdoor&s_o=default&l=en
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 13 Apr 2021 17:37:43 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
3022052
strict-transport-security
max-age=300; includeSubdomains
content-length
94786
cf-request-id
096de88ef00000062dbd169000000001
timing-allow-origin
*
last-modified
Tue, 09 Mar 2021 17:57:38 GMT
server
cloudflare
etag
"6047b712-17242"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=31536000, public, immutable, no-transform
x-amz-cf-pop
FRA56-C2
accept-ranges
bytes
cf-ray
63f676c4bf8c062d-FRA
x-amz-cf-id
iGbO1sC_L2SXajbXh3fns4o9OWy9yuPPlUqsvZKLIHAqbdlN6Dbhow==
expires
Wed, 09 Mar 2022 18:10:09 GMT
lounge.c82b267b396dfbc10ae5113342115da8.css
c.disquscdn.com/next/embed/styles/ Frame ABA9 		126 KB
22 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://c.disquscdn.com/next/embed/styles/lounge.c82b267b396dfbc10ae5113342115da8.css
Requested by
Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/common.bundle.f485ba8b89bf2153fdb9f493ec342aed.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:a813 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
20b6097504aed42f81fd7492b0e20ee87c7e7d8f9e0a367081741ec0c405f740
Security Headers
Name Value
Strict-Transport-Security max-age=300; includeSubdomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://disqus.com/embed/comments/?base=default&f=welivesecurity&t_i=149397%20https%3A%2F%2Fbackend.welivesecurity.com%2F%3Fp%3D149397&t_u=https%3A%2F%2Fwww.welivesecurity.com%2F2021%2F04%2F08%2Fare-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor%2F&t_e=(Are%20you)%20afreight%20of%20the%20dark%3F%20Watch%20out%20for%20Vyveva%2C%20new%20Lazarus%20backdoor&t_d=(Are%20you)%20afreight%20of%20the%20dark%3F%20Watch%20out%20for%20Vyveva%2C%20new%20Lazarus%20backdoor&t_t=(Are%20you)%20afreight%20of%20the%20dark%3F%20Watch%20out%20for%20Vyveva%2C%20new%20Lazarus%20backdoor&s_o=default&l=en
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 13 Apr 2021 17:37:43 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
3539411
strict-transport-security
max-age=300; includeSubdomains
content-length
22713
cf-request-id
096de88f2a0000062d30be1000000001
timing-allow-origin
*
last-modified
Wed, 03 Mar 2021 01:20:39 GMT
server
cloudflare
etag
"603ee467-58b9"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/css; charset=utf-8
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=31536000, public, immutable, no-transform
x-amz-cf-pop
FRA56-C2
accept-ranges
bytes
cf-ray
63f676c51891062d-FRA
x-amz-cf-id
8iHhdnaJ5uIRYSyeUnp9kgCqelvQxggEWvWNZtCLHCvwamS-AeRHKw==
expires
Thu, 03 Mar 2022 18:27:32 GMT
lounge.bundle.5c8cd56736a07a84352a4d37a862a762.js
c.disquscdn.com/next/embed/ Frame ABA9 		453 KB
115 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://c.disquscdn.com/next/embed/lounge.bundle.5c8cd56736a07a84352a4d37a862a762.js
Requested by
Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/common.bundle.f485ba8b89bf2153fdb9f493ec342aed.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:a813 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ce8fc5b6de8c12b2eac649cc45206787aa6d5c9ab0987020574349688c3df288
Security Headers
Name Value
Strict-Transport-Security max-age=300; includeSubdomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://disqus.com/embed/comments/?base=default&f=welivesecurity&t_i=149397%20https%3A%2F%2Fbackend.welivesecurity.com%2F%3Fp%3D149397&t_u=https%3A%2F%2Fwww.welivesecurity.com%2F2021%2F04%2F08%2Fare-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor%2F&t_e=(Are%20you)%20afreight%20of%20the%20dark%3F%20Watch%20out%20for%20Vyveva%2C%20new%20Lazarus%20backdoor&t_d=(Are%20you)%20afreight%20of%20the%20dark%3F%20Watch%20out%20for%20Vyveva%2C%20new%20Lazarus%20backdoor&t_t=(Are%20you)%20afreight%20of%20the%20dark%3F%20Watch%20out%20for%20Vyveva%2C%20new%20Lazarus%20backdoor&s_o=default&l=en
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 13 Apr 2021 17:37:43 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
1714703
strict-transport-security
max-age=300; includeSubdomains
content-length
117042
cf-request-id
096de88f300000062dc982b000000001
timing-allow-origin
*
last-modified
Wed, 24 Mar 2021 20:33:38 GMT
server
cloudflare
etag
"605ba222-1c932"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=31536000, public, immutable, no-transform
x-amz-cf-pop
FRA6-C1
accept-ranges
bytes
cf-ray
63f676c518ba062d-FRA
x-amz-cf-id
wHMVdFIOKMWmxOB1tyUv-pM5OppW3IdhZaJR7RDK4a0KJo8VIfLMZg==
expires
Thu, 24 Mar 2022 21:19:19 GMT
config.js
disqus.com/next/ Frame ABA9 		11 KB
12 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://disqus.com/next/config.js
Requested by
Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/common.bundle.f485ba8b89bf2153fdb9f493ec342aed.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.0.134 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
9fa67da84c690615b1dc83b460c777f1c0c9fa1799c60f9681b4fc7876787136
Security Headers
Name Value
Strict-Transport-Security max-age=300; includeSubdomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://disqus.com/embed/comments/?base=default&f=welivesecurity&t_i=149397%20https%3A%2F%2Fbackend.welivesecurity.com%2F%3Fp%3D149397&t_u=https%3A%2F%2Fwww.welivesecurity.com%2F2021%2F04%2F08%2Fare-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor%2F&t_e=(Are%20you)%20afreight%20of%20the%20dark%3F%20Watch%20out%20for%20Vyveva%2C%20new%20Lazarus%20backdoor&t_d=(Are%20you)%20afreight%20of%20the%20dark%3F%20Watch%20out%20for%20Vyveva%2C%20new%20Lazarus%20backdoor&t_t=(Are%20you)%20afreight%20of%20the%20dark%3F%20Watch%20out%20for%20Vyveva%2C%20new%20Lazarus%20backdoor&s_o=default&l=en
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Tue, 13 Apr 2021 17:37:43 GMT
X-Content-Type-Options
nosniff
Content-Type
application/javascript; charset=UTF-8
Server
nginx
Age
18
X-Frame-Options
SAMEORIGIN
Strict-Transport-Security
max-age=300; includeSubdomains
p3p
CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
Access-Control-Allow-Origin
*
Cache-Control
public, stale-while-revalidate=300, s-stalewhilerevalidate=3600, max-age=60
Connection
keep-alive
Timing-Allow-Origin
*
Content-Length
11508
X-XSS-Protection
1; mode=block
details
disqus.com/api/3.0/forums/ Frame ABA9 		4 KB
4 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://disqus.com/api/3.0/forums/details?forum=welivesecurity&attach=forumFeatures&api_key=E8Uh5l5fHZ6gD8U3KycjAIAk46f68Zw7C6eW8WSjZvCLXebZ7p0r1yrYDrLilk2F
Requested by
Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/common.bundle.f485ba8b89bf2153fdb9f493ec342aed.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.0.134 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
731031267f76a329d15dfff5385558bcde35de883c4f296340f9b9feff0cd1ea
Security Headers
Name Value
Strict-Transport-Security max-age=300; includeSubdomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept
*/*
Referer
https://disqus.com/embed/comments/?base=default&f=welivesecurity&t_i=149397%20https%3A%2F%2Fbackend.welivesecurity.com%2F%3Fp%3D149397&t_u=https%3A%2F%2Fwww.welivesecurity.com%2F2021%2F04%2F08%2Fare-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor%2F&t_e=(Are%20you)%20afreight%20of%20the%20dark%3F%20Watch%20out%20for%20Vyveva%2C%20new%20Lazarus%20backdoor&t_d=(Are%20you)%20afreight%20of%20the%20dark%3F%20Watch%20out%20for%20Vyveva%2C%20new%20Lazarus%20backdoor&t_t=(Are%20you)%20afreight%20of%20the%20dark%3F%20Watch%20out%20for%20Vyveva%2C%20new%20Lazarus%20backdoor&s_o=default&l=en
X-Requested-With
XMLHttpRequest
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Tue, 13 Apr 2021 17:37:43 GMT
X-Content-Type-Options
nosniff
Server
nginx
Age
14
X-Frame-Options
SAMEORIGIN
Strict-Transport-Security
max-age=300; includeSubdomains
p3p
CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
Connection
keep-alive
Content-Type
application/json
Vary
Origin, Cookie
Content-Length
3845
X-XSS-Protection
1; mode=block
loadReactions
disqus.com/api/3.0/threadReactions/ Frame ABA9 		1 KB
2 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://disqus.com/api/3.0/threadReactions/loadReactions?thread=8469709655&api_key=E8Uh5l5fHZ6gD8U3KycjAIAk46f68Zw7C6eW8WSjZvCLXebZ7p0r1yrYDrLilk2F
Requested by
Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/common.bundle.f485ba8b89bf2153fdb9f493ec342aed.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.0.134 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
1f0116f3ae1bd3c01cbcfd73d0c6306233386526b7855d8041d7ebb362b1a565
Security Headers
Name Value
Strict-Transport-Security max-age=300; includeSubdomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept
application/json, text/javascript, */*; q=0.01
Referer
https://disqus.com/embed/comments/?base=default&f=welivesecurity&t_i=149397%20https%3A%2F%2Fbackend.welivesecurity.com%2F%3Fp%3D149397&t_u=https%3A%2F%2Fwww.welivesecurity.com%2F2021%2F04%2F08%2Fare-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor%2F&t_e=(Are%20you)%20afreight%20of%20the%20dark%3F%20Watch%20out%20for%20Vyveva%2C%20new%20Lazarus%20backdoor&t_d=(Are%20you)%20afreight%20of%20the%20dark%3F%20Watch%20out%20for%20Vyveva%2C%20new%20Lazarus%20backdoor&t_t=(Are%20you)%20afreight%20of%20the%20dark%3F%20Watch%20out%20for%20Vyveva%2C%20new%20Lazarus%20backdoor&s_o=default&l=en
X-Requested-With
XMLHttpRequest
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Tue, 13 Apr 2021 17:37:43 GMT
X-Content-Type-Options
nosniff
Server
nginx
Age
42
X-Frame-Options
SAMEORIGIN
Strict-Transport-Security
max-age=300; includeSubdomains
p3p
CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
Cache-Control
stale-while-revalidate=30, max-age=60
Connection
keep-alive
Content-Type
application/json
Vary
Origin, Cookie
Content-Length
1351
X-XSS-Protection
1; mode=block
avatar92.jpg
c.disquscdn.com/uploads/forums/215/2520/ Frame ABA9 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://c.disquscdn.com/uploads/forums/215/2520/avatar92.jpg?1422638690
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:a813 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
55c9540888569c09e72cbfbadbe3a3fe888b0a3dec19d5a6fd085dcf09162cc8
Security Headers
Name Value
Strict-Transport-Security max-age=300; includeSubdomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://disqus.com/embed/comments/?base=default&f=welivesecurity&t_i=149397%20https%3A%2F%2Fbackend.welivesecurity.com%2F%3Fp%3D149397&t_u=https%3A%2F%2Fwww.welivesecurity.com%2F2021%2F04%2F08%2Fare-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor%2F&t_e=(Are%20you)%20afreight%20of%20the%20dark%3F%20Watch%20out%20for%20Vyveva%2C%20new%20Lazarus%20backdoor&t_d=(Are%20you)%20afreight%20of%20the%20dark%3F%20Watch%20out%20for%20Vyveva%2C%20new%20Lazarus%20backdoor&t_t=(Are%20you)%20afreight%20of%20the%20dark%3F%20Watch%20out%20for%20Vyveva%2C%20new%20Lazarus%20backdoor&s_o=default&l=en
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 13 Apr 2021 17:37:43 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
age
9374990
strict-transport-security
max-age=300; includeSubdomains
content-length
3039
cf-request-id
096de88fd60000062dbca0f000000001
expires
Sat, 13 Nov 2021 07:14:59 GMT
last-modified
Fri, 30 Jan 2015 17:24:51 GMT
server
cloudflare
etag
"24223861b0bcda3344ae2ab0243903e2"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/jpeg
x-xss-protection
1; mode=block
cache-control
max-age=31536000, public, immutable
x-amz-cf-pop
DFW55-C3
accept-ranges
bytes
cf-ray
63f676c62c1a062d-FRA
x-amz-cf-id
rMZ1SAdjApG_bzHEh5ishu5XK8BfzZsM4fdI_LO3aWnaOSCQ2g9jHA==
cf-bgj
h2pri
svg-sprite.4da5413f5086c5755b46094b813dbfcd.svg
c.disquscdn.com/next/embed/assets/img/ Frame ABA9 		13 KB
13 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://c.disquscdn.com/next/embed/assets/img/svg-sprite.4da5413f5086c5755b46094b813dbfcd.svg
Requested by
Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/styles/lounge.c82b267b396dfbc10ae5113342115da8.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:a813 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3270642c89180c12db93775e2a774b6dadd9bd98cffc963075c85afd2c17b6e4
Security Headers
Name Value
Strict-Transport-Security max-age=300; includeSubdomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://c.disquscdn.com/next/embed/styles/lounge.c82b267b396dfbc10ae5113342115da8.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 13 Apr 2021 17:37:43 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
age
13875176
strict-transport-security
max-age=300; includeSubdomains
content-length
13079
cf-request-id
096de88fd80000062de8999000000001
timing-allow-origin
*
last-modified
Mon, 19 Oct 2020 18:27:03 GMT
server
cloudflare
etag
"5f8dda77-3317"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/svg+xml; charset=utf-8
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=31536000, public, immutable, no-transform
accept-ranges
bytes
cf-ray
63f676c62c2a062d-FRA
expires
Tue, 19 Oct 2021 19:08:20 GMT
loader.ba7c86e8b4b6135bb668d05223f8f127.gif
c.disquscdn.com/next/embed/assets/img/ Frame ABA9 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://c.disquscdn.com/next/embed/assets/img/loader.ba7c86e8b4b6135bb668d05223f8f127.gif
Requested by
Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/styles/lounge.c82b267b396dfbc10ae5113342115da8.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:a813 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4c4491dcfa94cb46fb73742fc2caf49a1cd59027304af1830c7dc6ce1889857c
Security Headers
Name Value
Strict-Transport-Security max-age=300; includeSubdomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://c.disquscdn.com/next/embed/styles/lounge.c82b267b396dfbc10ae5113342115da8.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 13 Apr 2021 17:37:43 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
age
4872570
strict-transport-security
max-age=300; includeSubdomains
content-length
2971
cf-request-id
096de88fde0000062dc19a5000000001
timing-allow-origin
*
last-modified
Mon, 14 Dec 2020 22:46:46 GMT
server
cloudflare
etag
"5fd7eb56-b9b"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/gif
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=31536000, public, immutable, no-transform
x-amz-cf-pop
DFW55-C3
accept-ranges
bytes
cf-ray
63f676c62c40062d-FRA
x-amz-cf-id
EvCMTWKCjvve0qmqQvWzwZWa75ce5tSol6Ycs2_dayHQ8JpFyq0ZUw==
expires
Fri, 17 Dec 2021 09:57:52 GMT
sprite.654110a9206fd22f08cca0798e34a65e.png
c.disquscdn.com/next/embed/assets/img/ Frame ABA9 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://c.disquscdn.com/next/embed/assets/img/sprite.654110a9206fd22f08cca0798e34a65e.png
Requested by
Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/styles/lounge.c82b267b396dfbc10ae5113342115da8.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:a813 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
cdba739c28b41f39ce438f2bf204fe739dc81a26cf559a9394ceed56a0666bee
Security Headers
Name Value
Strict-Transport-Security max-age=300; includeSubdomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://c.disquscdn.com/next/embed/styles/lounge.c82b267b396dfbc10ae5113342115da8.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 13 Apr 2021 17:37:43 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
age
4872570
strict-transport-security
max-age=300; includeSubdomains
content-length
1862
cf-request-id
096de88fde0000062d1cb73000000001
timing-allow-origin
*
last-modified
Mon, 18 Jan 2021 17:33:12 GMT
server
cloudflare
etag
"6005c658-746"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=31536000, public, immutable, no-transform
x-amz-cf-pop
DFW53-C1
accept-ranges
bytes
cf-ray
63f676c62c45062d-FRA
x-amz-cf-id
EgON8tp8Et0Hc79zmS9Vbrl1C9iZJkMbKnffWBuVEXPBZ0W_DSkg6Q==
expires
Fri, 21 Jan 2022 12:21:07 GMT
icons.4cc7a703d2fdfe684151ff8ac24d45f1.woff2
c.disquscdn.com/next/embed/assets/font/ Frame ABA9 		8 KB
8 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://c.disquscdn.com/next/embed/assets/font/icons.4cc7a703d2fdfe684151ff8ac24d45f1.woff2
Requested by
Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/styles/lounge.c82b267b396dfbc10ae5113342115da8.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:a813 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f2a341fc815d45c21da726d4c843c2c5d3e1f333465347c3c75d040d556df4e5
Security Headers
Name Value
Strict-Transport-Security max-age=300; includeSubdomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Origin
https://disqus.com
Referer
https://c.disquscdn.com/next/embed/styles/lounge.c82b267b396dfbc10ae5113342115da8.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 13 Apr 2021 17:37:43 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
age
4872569
strict-transport-security
max-age=300; includeSubdomains
content-length
7900
cf-request-id
096de88fde0000d7296ca16000000001
timing-allow-origin
*
last-modified
Wed, 03 Feb 2021 18:02:57 GMT
server
cloudflare
etag
"601ae551-1edc"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/octet-stream
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=31536000, public, immutable, no-transform
x-amz-cf-pop
FRA56-C1
accept-ranges
bytes
cf-ray
63f676c62b4cd729-FRA
x-amz-cf-id
Rgooauymwnrvp5ORnFt12m3Cagi0Qgi2D6GgELQK7gROkGCk4txtzw==
expires
Sun, 06 Feb 2022 07:54:37 GMT
svg-sprite.4da5413f5086c5755b46094b813dbfcd.svg
c.disquscdn.com/next/embed/assets/img/ Frame ABA9 		13 KB
13 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://c.disquscdn.com/next/embed/assets/img/svg-sprite.4da5413f5086c5755b46094b813dbfcd.svg
Requested by
Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/styles/lounge.c82b267b396dfbc10ae5113342115da8.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:a813 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3270642c89180c12db93775e2a774b6dadd9bd98cffc963075c85afd2c17b6e4
Security Headers
Name Value
Strict-Transport-Security max-age=300; includeSubdomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://c.disquscdn.com/next/embed/styles/lounge.c82b267b396dfbc10ae5113342115da8.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 13 Apr 2021 17:37:43 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
age
13875176
strict-transport-security
max-age=300; includeSubdomains
content-length
13079
cf-request-id
096de8902f0000062d36ae0000000001
timing-allow-origin
*
last-modified
Mon, 19 Oct 2020 18:27:03 GMT
server
cloudflare
etag
"5f8dda77-3317"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/svg+xml; charset=utf-8
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=31536000, public, immutable, no-transform
accept-ranges
bytes
cf-ray
63f676c6bd9f062d-FRA
expires
Tue, 19 Oct 2021 19:08:20 GMT
sdk.js
connect.facebook.net/en_US/ Frame ABA9 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://connect.facebook.net/en_US/sdk.js
Requested by
Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/common.bundle.f485ba8b89bf2153fdb9f493ec342aed.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f01c:8012:face:b00c:0:3 , United States, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
4dad11be5c8c65e8cac9b84b6852c6c218d8e45c6f6a9027f511df8f15769aaa
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

Referer
https://disqus.com/embed/comments/?base=default&f=welivesecurity&t_i=149397%20https%3A%2F%2Fbackend.welivesecurity.com%2F%3Fp%3D149397&t_u=https%3A%2F%2Fwww.welivesecurity.com%2F2021%2F04%2F08%2Fare-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor%2F&t_e=(Are%20you)%20afreight%20of%20the%20dark%3F%20Watch%20out%20for%20Vyveva%2C%20new%20Lazarus%20backdoor&t_d=(Are%20you)%20afreight%20of%20the%20dark%3F%20Watch%20out%20for%20Vyveva%2C%20new%20Lazarus%20backdoor&t_t=(Are%20you)%20afreight%20of%20the%20dark%3F%20Watch%20out%20for%20Vyveva%2C%20new%20Lazarus%20backdoor&s_o=default&l=en
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; preload; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
content-md5
aaj+yTVuiPiyUvcxCBWQtQ==
cross-origin-resource-policy
cross-origin
expires
Tue, 13 Apr 2021 17:42:59 GMT
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length
1780
x-fb-rlafr
0
x-fb-debug
fVpWnCqyuNMswKBt/H/E8s29kI7BMgVJEAjmgskry+hNuqwa3vdSkrCswt/kxngsfM8lUqmsUtEQutcR4lfRiQ==
x-fb-trip-id
686109401
x-fb-content-md5
aa24a6ec067e5f9371b27ba83b4ac7da
date
Tue, 13 Apr 2021 17:37:43 GMT
x-frame-options
DENY
content-type
application/x-javascript; charset=utf-8
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public,max-age=1200,stale-while-revalidate=3600
etag
"b43efc604147eb33a3eab9a8df6138e8"
timing-allow-origin
*
priority
u=3,i
access-control-expose-headers
X-FB-Content-MD5
api.js
apis.google.com/js/ Frame ABA9 		12 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://apis.google.com/js/api.js
Requested by
Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/common.bundle.f485ba8b89bf2153fdb9f493ec342aed.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80e::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
0b93183bcc5bda42dc9db65084d052ca8fdb7eb3e3b08a75e5f3884a888cf035
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-3vJZpEp0sGxB2HWq/0hcFw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /_/cspreport
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://disqus.com/embed/comments/?base=default&f=welivesecurity&t_i=149397%20https%3A%2F%2Fbackend.welivesecurity.com%2F%3Fp%3D149397&t_u=https%3A%2F%2Fwww.welivesecurity.com%2F2021%2F04%2F08%2Fare-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor%2F&t_e=(Are%20you)%20afreight%20of%20the%20dark%3F%20Watch%20out%20for%20Vyveva%2C%20new%20Lazarus%20backdoor&t_d=(Are%20you)%20afreight%20of%20the%20dark%3F%20Watch%20out%20for%20Vyveva%2C%20new%20Lazarus%20backdoor&t_t=(Are%20you)%20afreight%20of%20the%20dark%3F%20Watch%20out%20for%20Vyveva%2C%20new%20Lazarus%20backdoor&s_o=default&l=en
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 13 Apr 2021 17:37:43 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
CP="This is not a P3P policy! See g.co/p3phelp for more info."
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
x-ua-compatible
IE=edge, chrome=1
server
ESF
x-frame-options
SAMEORIGIN
etag
"6873478039673be44cc70fd23da24c6e"
strict-transport-security
max-age=31536000
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=1800, stale-while-revalidate=1800
content-security-policy
script-src 'report-sample' 'nonce-3vJZpEp0sGxB2HWq/0hcFw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /_/cspreport
timing-allow-origin
*
expires
Tue, 13 Apr 2021 17:37:43 GMT
upvote-512x512.png
c.disquscdn.com/next/current/publisher-admin/assets/img/emoji/ Frame ABA9 		8 KB
8 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://c.disquscdn.com/next/current/publisher-admin/assets/img/emoji/upvote-512x512.png
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:a813 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f8afec44114c09f3e520fd8c89a7e00386e99bc567ccbbf16f23771b75b58a68
Security Headers
Name Value
Strict-Transport-Security max-age=300; includeSubdomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://disqus.com/embed/comments/?base=default&f=welivesecurity&t_i=149397%20https%3A%2F%2Fbackend.welivesecurity.com%2F%3Fp%3D149397&t_u=https%3A%2F%2Fwww.welivesecurity.com%2F2021%2F04%2F08%2Fare-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor%2F&t_e=(Are%20you)%20afreight%20of%20the%20dark%3F%20Watch%20out%20for%20Vyveva%2C%20new%20Lazarus%20backdoor&t_d=(Are%20you)%20afreight%20of%20the%20dark%3F%20Watch%20out%20for%20Vyveva%2C%20new%20Lazarus%20backdoor&t_t=(Are%20you)%20afreight%20of%20the%20dark%3F%20Watch%20out%20for%20Vyveva%2C%20new%20Lazarus%20backdoor&s_o=default&l=en
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 13 Apr 2021 17:37:43 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
age
694
strict-transport-security
max-age=300; includeSubdomains
content-length
8212
cf-request-id
096de8903c0000062d1cb7d000000001
timing-allow-origin
*
last-modified
Mon, 12 Apr 2021 18:43:10 GMT
server
cloudflare
etag
"607494be-2014"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
public, max-age=1200
x-amz-cf-pop
FRA50-C1
accept-ranges
bytes
cf-ray
63f676c6cdeb062d-FRA
x-amz-cf-id
pFggw9ko5XFPERqjmdRME_OI2DiGg85fLGGuv44nRuCKyD9mFuNnuQ==
funny-512x512.png
c.disquscdn.com/next/current/publisher-admin/assets/img/emoji/ Frame ABA9 		9 KB
9 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://c.disquscdn.com/next/current/publisher-admin/assets/img/emoji/funny-512x512.png
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:a813 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
20a91bd509668238b6af8e16475c5e2611bcd2861d0eec2e0d4f6815e81449bd
Security Headers
Name Value
Strict-Transport-Security max-age=300; includeSubdomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://disqus.com/embed/comments/?base=default&f=welivesecurity&t_i=149397%20https%3A%2F%2Fbackend.welivesecurity.com%2F%3Fp%3D149397&t_u=https%3A%2F%2Fwww.welivesecurity.com%2F2021%2F04%2F08%2Fare-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor%2F&t_e=(Are%20you)%20afreight%20of%20the%20dark%3F%20Watch%20out%20for%20Vyveva%2C%20new%20Lazarus%20backdoor&t_d=(Are%20you)%20afreight%20of%20the%20dark%3F%20Watch%20out%20for%20Vyveva%2C%20new%20Lazarus%20backdoor&t_t=(Are%20you)%20afreight%20of%20the%20dark%3F%20Watch%20out%20for%20Vyveva%2C%20new%20Lazarus%20backdoor&s_o=default&l=en
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 13 Apr 2021 17:37:43 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
age
694
strict-transport-security
max-age=300; includeSubdomains
content-length
8883
cf-request-id
096de8903c0000062dddbe5000000001
timing-allow-origin
*
last-modified
Mon, 12 Apr 2021 18:43:10 GMT
server
cloudflare
etag
"607494be-22b3"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
public, max-age=1200
x-amz-cf-pop
FRA50-C1
accept-ranges
bytes
cf-ray
63f676c6cdf0062d-FRA
x-amz-cf-id
yooLFNdel8wl1vj9gKT_nJwy_hNufG35uZvN99vlYc-Xx05IR98SiQ==
love-512x512.png
c.disquscdn.com/next/current/publisher-admin/assets/img/emoji/ Frame ABA9 		12 KB
12 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://c.disquscdn.com/next/current/publisher-admin/assets/img/emoji/love-512x512.png
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:a813 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e422b07ca1550e55cd90a518e910fd3cfb4d9337ea6092357f9761aa77ac9e33
Security Headers
Name Value
Strict-Transport-Security max-age=300; includeSubdomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://disqus.com/embed/comments/?base=default&f=welivesecurity&t_i=149397%20https%3A%2F%2Fbackend.welivesecurity.com%2F%3Fp%3D149397&t_u=https%3A%2F%2Fwww.welivesecurity.com%2F2021%2F04%2F08%2Fare-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor%2F&t_e=(Are%20you)%20afreight%20of%20the%20dark%3F%20Watch%20out%20for%20Vyveva%2C%20new%20Lazarus%20backdoor&t_d=(Are%20you)%20afreight%20of%20the%20dark%3F%20Watch%20out%20for%20Vyveva%2C%20new%20Lazarus%20backdoor&t_t=(Are%20you)%20afreight%20of%20the%20dark%3F%20Watch%20out%20for%20Vyveva%2C%20new%20Lazarus%20backdoor&s_o=default&l=en
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 13 Apr 2021 17:37:43 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
age
694
strict-transport-security
max-age=300; includeSubdomains
content-length
11910
cf-request-id
096de8903c0000062d14259000000001
timing-allow-origin
*
last-modified
Mon, 12 Apr 2021 18:43:10 GMT
server
cloudflare
etag
"607494be-2e86"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
public, max-age=1200
x-amz-cf-pop
FRA50-C1
accept-ranges
bytes
cf-ray
63f676c6cdf4062d-FRA
x-amz-cf-id
8amj-mTkfSDS3a6G-2JR1yVB8lIAOhXm89vveTEeJ1ncmHIkyRIAfQ==
surprised-512x512.png
c.disquscdn.com/next/current/publisher-admin/assets/img/emoji/ Frame ABA9 		7 KB
7 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://c.disquscdn.com/next/current/publisher-admin/assets/img/emoji/surprised-512x512.png
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:a813 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4e14ce1bd0d4433eee84cbb16196a7a051126f07af888ef7f9d252120f32f907
Security Headers
Name Value
Strict-Transport-Security max-age=300; includeSubdomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://disqus.com/embed/comments/?base=default&f=welivesecurity&t_i=149397%20https%3A%2F%2Fbackend.welivesecurity.com%2F%3Fp%3D149397&t_u=https%3A%2F%2Fwww.welivesecurity.com%2F2021%2F04%2F08%2Fare-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor%2F&t_e=(Are%20you)%20afreight%20of%20the%20dark%3F%20Watch%20out%20for%20Vyveva%2C%20new%20Lazarus%20backdoor&t_d=(Are%20you)%20afreight%20of%20the%20dark%3F%20Watch%20out%20for%20Vyveva%2C%20new%20Lazarus%20backdoor&t_t=(Are%20you)%20afreight%20of%20the%20dark%3F%20Watch%20out%20for%20Vyveva%2C%20new%20Lazarus%20backdoor&s_o=default&l=en
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 13 Apr 2021 17:37:43 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
age
293
strict-transport-security
max-age=300; includeSubdomains
content-length
7308
cf-request-id
096de8903c0000062df8341000000001
timing-allow-origin
*
last-modified
Mon, 12 Apr 2021 18:43:10 GMT
server
cloudflare
etag
"607494be-1c8c"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
public, max-age=1200
x-amz-cf-pop
FRA50-C1
accept-ranges
bytes
cf-ray
63f676c6cdf6062d-FRA
x-amz-cf-id
Fw08fsOa0bL97HN0lCLyluav-6Z8DycmBAYhz8DirW8jAuq09RIv0Q==
angry-512x512.png
c.disquscdn.com/next/current/publisher-admin/assets/img/emoji/ Frame ABA9 		17 KB
18 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://c.disquscdn.com/next/current/publisher-admin/assets/img/emoji/angry-512x512.png
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:a813 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8630d3642f52a29b6198da00f23f7bd2481ad1cc19becfcf441a6c4ffe4ae099
Security Headers
Name Value
Strict-Transport-Security max-age=300; includeSubdomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://disqus.com/embed/comments/?base=default&f=welivesecurity&t_i=149397%20https%3A%2F%2Fbackend.welivesecurity.com%2F%3Fp%3D149397&t_u=https%3A%2F%2Fwww.welivesecurity.com%2F2021%2F04%2F08%2Fare-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor%2F&t_e=(Are%20you)%20afreight%20of%20the%20dark%3F%20Watch%20out%20for%20Vyveva%2C%20new%20Lazarus%20backdoor&t_d=(Are%20you)%20afreight%20of%20the%20dark%3F%20Watch%20out%20for%20Vyveva%2C%20new%20Lazarus%20backdoor&t_t=(Are%20you)%20afreight%20of%20the%20dark%3F%20Watch%20out%20for%20Vyveva%2C%20new%20Lazarus%20backdoor&s_o=default&l=en
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 13 Apr 2021 17:37:43 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
age
694
strict-transport-security
max-age=300; includeSubdomains
content-length
17794
cf-request-id
096de8903d0000062dcc14c000000001
timing-allow-origin
*
last-modified
Mon, 12 Apr 2021 18:43:10 GMT
server
cloudflare
etag
"607494be-4582"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
public, max-age=1200
x-amz-cf-pop
FRA50-C1
accept-ranges
bytes
cf-ray
63f676c6cdfb062d-FRA
x-amz-cf-id
hWUiO74j0_8hYVbkFwml37pwpIzLjRWGI5UeDdPSOuF8HJ4MVjIu4A==
sad-512x512.png
c.disquscdn.com/next/current/publisher-admin/assets/img/emoji/ Frame ABA9 		9 KB
9 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://c.disquscdn.com/next/current/publisher-admin/assets/img/emoji/sad-512x512.png
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:a813 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
11c401a81e32b086bea3798c033009907b429fb601411da6ffc266b78184898a
Security Headers
Name Value
Strict-Transport-Security max-age=300; includeSubdomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://disqus.com/embed/comments/?base=default&f=welivesecurity&t_i=149397%20https%3A%2F%2Fbackend.welivesecurity.com%2F%3Fp%3D149397&t_u=https%3A%2F%2Fwww.welivesecurity.com%2F2021%2F04%2F08%2Fare-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor%2F&t_e=(Are%20you)%20afreight%20of%20the%20dark%3F%20Watch%20out%20for%20Vyveva%2C%20new%20Lazarus%20backdoor&t_d=(Are%20you)%20afreight%20of%20the%20dark%3F%20Watch%20out%20for%20Vyveva%2C%20new%20Lazarus%20backdoor&t_t=(Are%20you)%20afreight%20of%20the%20dark%3F%20Watch%20out%20for%20Vyveva%2C%20new%20Lazarus%20backdoor&s_o=default&l=en
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 13 Apr 2021 17:37:43 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
age
24
strict-transport-security
max-age=300; includeSubdomains
content-length
8986
cf-request-id
096de890400000062dfda40000000001
timing-allow-origin
*
last-modified
Mon, 12 Apr 2021 18:43:10 GMT
server
cloudflare
etag
"607494be-231a"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
public, max-age=1200
x-amz-cf-pop
FRA50-C1
accept-ranges
bytes
cf-ray
63f676c6ce0f062d-FRA
x-amz-cf-id
SdgX4e98zkocjUo93LyWH9B1aDuJFes7RIaQSb2ECG_nsXJrqFLfQg==
sdk.js
connect.facebook.net/en_US/ Frame ABA9 		216 KB
64 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://connect.facebook.net/en_US/sdk.js?hash=fa453af630c58b2876b111b83c0b61da&ua=modern_es6
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/sdk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f01c:8012:face:b00c:0:3 , United States, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
cea1cc1bda5686330e67daf6537a80f848672e3d5bd251568581212bb3933788
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

Origin
https://disqus.com
Referer
https://disqus.com/embed/comments/?base=default&f=welivesecurity&t_i=149397%20https%3A%2F%2Fbackend.welivesecurity.com%2F%3Fp%3D149397&t_u=https%3A%2F%2Fwww.welivesecurity.com%2F2021%2F04%2F08%2Fare-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor%2F&t_e=(Are%20you)%20afreight%20of%20the%20dark%3F%20Watch%20out%20for%20Vyveva%2C%20new%20Lazarus%20backdoor&t_d=(Are%20you)%20afreight%20of%20the%20dark%3F%20Watch%20out%20for%20Vyveva%2C%20new%20Lazarus%20backdoor&t_t=(Are%20you)%20afreight%20of%20the%20dark%3F%20Watch%20out%20for%20Vyveva%2C%20new%20Lazarus%20backdoor&s_o=default&l=en
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; preload; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
content-md5
6tPZGMwdB6UquoKTpB+SXw==
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length
65484
x-fb-rlafr
0
x-fb-debug
PrjNcUS4CJ3h+iK+iIYUBxc0MIyLg8AeQD8HuyNX/rO1WmOlm1C3sVcofKuy7A8wyfSkRGOMs2V5PIPvCjFEeQ==
x-fb-trip-id
686109401
x-fb-content-md5
2f06735ebf2fb5c51f9e3855a92c1982
x-frame-options
DENY
date
Tue, 13 Apr 2021 17:37:43 GMT
vary
Accept-Encoding
content-type
application/x-javascript; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
X-FB-Content-MD5
cache-control
public,max-age=31536000,stale-while-revalidate=3600,immutable
etag
"aae4fa7af7d41b60f53b791f25ee6386"
timing-allow-origin
*
priority
u=3,i
expires
Wed, 13 Apr 2022 16:13:39 GMT
status
www.facebook.com/x/oauth/ Frame ABA9 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://www.facebook.com/x/oauth/status?ancestor_origins=https%3A%2F%2Fwww.welivesecurity.com&client_id=52254943976&input_token&origin=1&redirect_uri=https%3A%2F%2Fdisqus.com%2Fembed%2Fcomments%2F%3Fbase%3Ddefault%26f%3Dwelivesecurity%26t_i%3D149397%2520https%253A%252F%252Fbackend.welivesecurity.com%252F%253Fp%253D149397%26t_u%3Dhttps%253A%252F%252Fwww.welivesecurity.com%252F2021%252F04%252F08%252Fare-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor%252F%26t_e%3D(Are%2520you)%2520afreight%2520of%2520the%2520dark%253F%2520Watch%2520out%2520for%2520Vyveva%252C%2520new%2520Lazarus%2520backdoor%26t_d%3D(Are%2520you)%2520afreight%2520of%2520the%2520dark%253F%2520Watch%2520out%2520for%2520Vyveva%252C%2520new%2520Lazarus%2520backdoor%26t_t%3D(Are%2520you)%2520afreight%2520of%2520the%2520dark%253F%2520Watch%2520out%2520for%2520Vyveva%252C%2520new%2520Lazarus%2520backdoor%26s_o%3Ddefault%26l%3Den%23version%3Da658a7c16140d8728cc859daf581cbbc&sdk=joey&wants_cookie_data=false
Requested by
Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/common.bundle.f485ba8b89bf2153fdb9f493ec342aed.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f11c:8183:face:b00c:0:25de , United States, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://disqus.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
x-content-type-options
nosniff
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length
0
x-fb-rlafr
0
pragma
no-cache
x-fb-debug
EFT+nl7z5Z7gHQ7xjJ7lLYCLXB+vBjEGxsEvXbETvyLPZDfTqdAuX4755oOtkkE1GDQ7gkS+1UAYVzYzoLUmag==
cross-origin-embedder-policy-report-only
require-corp;report-to="coep_report"
fb-s
unknown
cross-origin-opener-policy
same-origin-allow-popups
date
Tue, 13 Apr 2021 17:37:43 GMT
report-to
{"group":"coep_report","max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}]}
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://disqus.com
access-control-expose-headers
fb-s
cache-control
private, no-cache, no-store, must-revalidate
access-control-allow-credentials
true
priority
u=3,i
expires
Sat, 01 Jan 2000 00:00:00 GMT
cb=gapi.loaded_0
apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.en_US.MWM3Xj_RD9s.O/m=auth2/rt=j/sv=1/d=1/ed=1/am=AQ/rs=AGLTcCOUmnuCcTtedasW7L1tq37fs4eoIg/ Frame ABA9 		102 KB
34 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.en_US.MWM3Xj_RD9s.O/m=auth2/rt=j/sv=1/d=1/ed=1/am=AQ/rs=AGLTcCOUmnuCcTtedasW7L1tq37fs4eoIg/cb=gapi.loaded_0
Requested by
Host: apis.google.com
URL: https://apis.google.com/js/api.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80e::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
6289a67bc4acdbdafbc49c8db8bee69deaca8a0a5a9321011b96e2cc9c242eba
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://disqus.com/embed/comments/?base=default&f=welivesecurity&t_i=149397%20https%3A%2F%2Fbackend.welivesecurity.com%2F%3Fp%3D149397&t_u=https%3A%2F%2Fwww.welivesecurity.com%2F2021%2F04%2F08%2Fare-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor%2F&t_e=(Are%20you)%20afreight%20of%20the%20dark%3F%20Watch%20out%20for%20Vyveva%2C%20new%20Lazarus%20backdoor&t_d=(Are%20you)%20afreight%20of%20the%20dark%3F%20Watch%20out%20for%20Vyveva%2C%20new%20Lazarus%20backdoor&t_t=(Are%20you)%20afreight%20of%20the%20dark%3F%20Watch%20out%20for%20Vyveva%2C%20new%20Lazarus%20backdoor&s_o=default&l=en
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Thu, 08 Apr 2021 06:19:25 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Tue, 30 Mar 2021 15:29:21 GMT
server
sffe
age
472698
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, immutable, max-age=31536000
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
34454
x-xss-protection
0
expires
Fri, 08 Apr 2022 06:19:25 GMT
iframe
accounts.google.com/o/oauth2/ Frame 1DE0 		513 B
540 B 		Document
General
Check archive.org
Download Go to
Full URL
https://accounts.google.com/o/oauth2/iframe
Requested by
Host: apis.google.com
URL: https://apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.en_US.MWM3Xj_RD9s.O/m=auth2/rt=j/sv=1/d=1/ed=1/am=AQ/rs=AGLTcCOUmnuCcTtedasW7L1tq37fs4eoIg/cb=gapi.loaded_0
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::200d Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
8d57159ba692c081ef8972c95f4fffaba9faa54edb2539fd6a56d154e6e95cdd
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-uRGv8xwOyrIhmTtc6FrWnw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /o/cspreport
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
accounts.google.com
:scheme
https
:path
/o/oauth2/iframe
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://disqus.com/embed/comments/?base=default&f=welivesecurity&t_i=149397%20https%3A%2F%2Fbackend.welivesecurity.com%2F%3Fp%3D149397&t_u=https%3A%2F%2Fwww.welivesecurity.com%2F2021%2F04%2F08%2Fare-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor%2F&t_e=(Are%20you)%20afreight%20of%20the%20dark%3F%20Watch%20out%20for%20Vyveva%2C%20new%20Lazarus%20backdoor&t_d=(Are%20you)%20afreight%20of%20the%20dark%3F%20Watch%20out%20for%20Vyveva%2C%20new%20Lazarus%20backdoor&t_t=(Are%20you)%20afreight%20of%20the%20dark%3F%20Watch%20out%20for%20Vyveva%2C%20new%20Lazarus%20backdoor&s_o=default&l=en
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
NID=213=cjS0IdRdCRssS1qmxc_bftCACEKgMdaY-1X2BubAsip8ui30UrUxUa2kR-GAXyF6haEgFPgUSdUa5nffYhmZn3CbehLphUwRkICk2GOogQY7HzpvKZk9ZoqBYBB5bbt8Q_4ltrke1WtZvFXkT3WsBE1UB_ieZZCJSBLUqNCn7VI
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://disqus.com/embed/comments/?base=default&f=welivesecurity&t_i=149397%20https%3A%2F%2Fbackend.welivesecurity.com%2F%3Fp%3D149397&t_u=https%3A%2F%2Fwww.welivesecurity.com%2F2021%2F04%2F08%2Fare-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor%2F&t_e=(Are%20you)%20afreight%20of%20the%20dark%3F%20Watch%20out%20for%20Vyveva%2C%20new%20Lazarus%20backdoor&t_d=(Are%20you)%20afreight%20of%20the%20dark%3F%20Watch%20out%20for%20Vyveva%2C%20new%20Lazarus%20backdoor&t_t=(Are%20you)%20afreight%20of%20the%20dark%3F%20Watch%20out%20for%20Vyveva%2C%20new%20Lazarus%20backdoor&s_o=default&l=en

Response headers

content-type
text/html; charset=utf-8
cache-control
no-cache, no-store, max-age=0, must-revalidate
pragma
no-cache
expires
Mon, 01 Jan 1990 00:00:00 GMT
date
Tue, 13 Apr 2021 17:37:43 GMT
content-language
en-US
content-security-policy
script-src 'report-sample' 'nonce-uRGv8xwOyrIhmTtc6FrWnw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /o/cspreport
content-encoding
gzip
server
ESF
x-xss-protection
0
x-content-type-options
nosniff
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
4071097310-idpiframe.js
ssl.gstatic.com/accounts/o/ Frame 1DE0 		112 KB
38 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ssl.gstatic.com/accounts/o/4071097310-idpiframe.js
Requested by
Host: accounts.google.com
URL: https://accounts.google.com/o/oauth2/iframe
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
a1943a600956d093b6bdbd157ffea2a0a738342a1a7a454a31364c3aa41325fa
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://accounts.google.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 12 Apr 2021 11:24:57 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Mon, 05 Apr 2021 20:31:08 GMT
server
sffe
age
108766
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
39191
x-xss-protection
0
expires
Tue, 12 Apr 2022 11:24:57 GMT
iframerpc
accounts.google.com/o/oauth2/ Frame 1DE0 		14 B
105 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://accounts.google.com/o/oauth2/iframerpc?action=checkOrigin&origin=https%3A%2F%2Fdisqus.com&client_id=508198334196-bgmagrg0a2rub674g0shidj8fnd50dji.apps.googleusercontent.com
Requested by
Host: ssl.gstatic.com
URL: https://ssl.gstatic.com/accounts/o/4071097310-idpiframe.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:808::200d Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
8daf09a6fc31937457dd77e9c25ce4b21349d605b561a8c5d557841bf964c9a0
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://accounts.google.com/o/oauth2/iframe
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
X-Requested-With
XmlHttpRequest

Response headers

date
Tue, 13 Apr 2021 17:37:43 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
ESF
content-type
application/json; charset=utf-8
cache-control
public, max-age=3600
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
expires
Tue, 13 Apr 2021 18:37:43 GMT
/
glitter.services.disqus.com/urls/ Frame ABA9 		471 B
775 B 		Script
General
Check archive.org
Download Go to
Full URL
https://glitter.services.disqus.com/urls/?callback=dsqGlitterResponseHandler&forum_shortname=welivesecurity&thread_id=8469709655&referer=
Requested by
Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/common.bundle.f485ba8b89bf2153fdb9f493ec342aed.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.112.64 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
openresty /
Resource Hash
772f94d06973fc24339b35466f5d3bb028257cf1e6bdd41480f86e594265b327
Security Headers
Name Value
Strict-Transport-Security max-age=300; includeSubdomains
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

Referer
https://disqus.com/embed/comments/?base=default&f=welivesecurity&t_i=149397%20https%3A%2F%2Fbackend.welivesecurity.com%2F%3Fp%3D149397&t_u=https%3A%2F%2Fwww.welivesecurity.com%2F2021%2F04%2F08%2Fare-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor%2F&t_e=(Are%20you)%20afreight%20of%20the%20dark%3F%20Watch%20out%20for%20Vyveva%2C%20new%20Lazarus%20backdoor&t_d=(Are%20you)%20afreight%20of%20the%20dark%3F%20Watch%20out%20for%20Vyveva%2C%20new%20Lazarus%20backdoor&t_t=(Are%20you)%20afreight%20of%20the%20dark%3F%20Watch%20out%20for%20Vyveva%2C%20new%20Lazarus%20backdoor&s_o=default&l=en
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Tue, 13 Apr 2021 17:37:43 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Server
openresty
X-Frame-Options
DENY
Connection
keep-alive
Content-Type
application/javascript
Cache-Control
no-cache
transfer-encoding
chunked
X-Service
glitter
Content-Disposition
attachment; filename=f.txt
Strict-Transport-Security
max-age=300; includeSubdomains
Vary
Accept-Encoding, Cookie
avatar92.jpg
c.disquscdn.com/uploads/forums/215/2520/ Frame ABA9 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://c.disquscdn.com/uploads/forums/215/2520/avatar92.jpg?1422638690
Requested by
Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/lounge.bundle.5c8cd56736a07a84352a4d37a862a762.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:a813 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
55c9540888569c09e72cbfbadbe3a3fe888b0a3dec19d5a6fd085dcf09162cc8
Security Headers
Name Value
Strict-Transport-Security max-age=300; includeSubdomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://disqus.com/embed/comments/?base=default&f=welivesecurity&t_i=149397%20https%3A%2F%2Fbackend.welivesecurity.com%2F%3Fp%3D149397&t_u=https%3A%2F%2Fwww.welivesecurity.com%2F2021%2F04%2F08%2Fare-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor%2F&t_e=(Are%20you)%20afreight%20of%20the%20dark%3F%20Watch%20out%20for%20Vyveva%2C%20new%20Lazarus%20backdoor&t_d=(Are%20you)%20afreight%20of%20the%20dark%3F%20Watch%20out%20for%20Vyveva%2C%20new%20Lazarus%20backdoor&t_t=(Are%20you)%20afreight%20of%20the%20dark%3F%20Watch%20out%20for%20Vyveva%2C%20new%20Lazarus%20backdoor&s_o=default&l=en
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 13 Apr 2021 17:37:43 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
age
9374990
strict-transport-security
max-age=300; includeSubdomains
content-length
3039
cf-request-id
096de890c00000062df6a0a000000001
expires
Sat, 13 Nov 2021 07:14:59 GMT
last-modified
Fri, 30 Jan 2015 17:24:51 GMT
server
cloudflare
etag
"24223861b0bcda3344ae2ab0243903e2"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/jpeg
x-xss-protection
1; mode=block
cache-control
max-age=31536000, public, immutable
x-amz-cf-pop
DFW55-C3
accept-ranges
bytes
cf-ray
63f676c7980f062d-FRA
x-amz-cf-id
rMZ1SAdjApG_bzHEh5ishu5XK8BfzZsM4fdI_LO3aWnaOSCQ2g9jHA==
cf-bgj
h2pri
event.gif
referrer.disqus.com/juggler/ Frame ABA9 		43 B
295 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://referrer.disqus.com/juggler/event.gif?abe=0&embed_hidden=0&integration=wordpress%203.0.16&load_time=406&event=init_embed&thread=8469709655&forum=welivesecurity&forum_id=2152520&imp=7mvhcu736gb5fb&prev_imp&thread_slug=are_you_afreight_of_the_dark_watch_out_for_vyveva_new_lazarus_backdoor&user_type=anon&referrer=https%3A%2F%2Fwww.welivesecurity.com%2F2021%2F04%2F08%2Fare-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor%2F&theme=next&dnt=0&tracking_enabled=1&experiment=network_default_hidden&variant=fallthrough&service=dynamic&promoted_enabled=false&max_enabled=false
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.112.134 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://disqus.com/embed/comments/?base=default&f=welivesecurity&t_i=149397%20https%3A%2F%2Fbackend.welivesecurity.com%2F%3Fp%3D149397&t_u=https%3A%2F%2Fwww.welivesecurity.com%2F2021%2F04%2F08%2Fare-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor%2F&t_e=(Are%20you)%20afreight%20of%20the%20dark%3F%20Watch%20out%20for%20Vyveva%2C%20new%20Lazarus%20backdoor&t_d=(Are%20you)%20afreight%20of%20the%20dark%3F%20Watch%20out%20for%20Vyveva%2C%20new%20Lazarus%20backdoor&t_t=(Are%20you)%20afreight%20of%20the%20dark%3F%20Watch%20out%20for%20Vyveva%2C%20new%20Lazarus%20backdoor&s_o=default&l=en
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Tue, 13 Apr 2021 17:37:43 GMT
X-Content-Type-Options
nosniff
Last-Modified
Mon, 28 Sep 1970 06:00:00 GMT
Server
nginx
Content-Type
image/gif
Connection
keep-alive
Content-Length
43
X-XSS-Protection
1; mode=block
pixel.html
live.rezync.com/ Frame FFC5 		507 B
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://live.rezync.com/pixel.html?c=4656c20ee35215f78e9273796625d90b&cid=c7mvhd0e25mie09&pctry=DE&referrer=https%3A%2F%2Fwww.welivesecurity.com%2F2021%2F04%2F08%2Fare-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor%2F
Requested by
Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/common.bundle.f485ba8b89bf2153fdb9f493ec342aed.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
99.84.156.6 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-84-156-6.txl52.r.cloudfront.net
Software
lighttpd/1.4.33 /
Resource Hash
719f5db8e223a043a3cd3122e8c6c231e54c4c622e132b1cfef1e8b25e47e3da

Request headers

:method
GET
:authority
live.rezync.com
:scheme
https
:path
/pixel.html?c=4656c20ee35215f78e9273796625d90b&cid=c7mvhd0e25mie09&pctry=DE&referrer=https%3A%2F%2Fwww.welivesecurity.com%2F2021%2F04%2F08%2Fare-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor%2F
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://disqus.com/embed/comments/?base=default&f=welivesecurity&t_i=149397%20https%3A%2F%2Fbackend.welivesecurity.com%2F%3Fp%3D149397&t_u=https%3A%2F%2Fwww.welivesecurity.com%2F2021%2F04%2F08%2Fare-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor%2F&t_e=(Are%20you)%20afreight%20of%20the%20dark%3F%20Watch%20out%20for%20Vyveva%2C%20new%20Lazarus%20backdoor&t_d=(Are%20you)%20afreight%20of%20the%20dark%3F%20Watch%20out%20for%20Vyveva%2C%20new%20Lazarus%20backdoor&t_t=(Are%20you)%20afreight%20of%20the%20dark%3F%20Watch%20out%20for%20Vyveva%2C%20new%20Lazarus%20backdoor&s_o=default&l=en
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://disqus.com/embed/comments/?base=default&f=welivesecurity&t_i=149397%20https%3A%2F%2Fbackend.welivesecurity.com%2F%3Fp%3D149397&t_u=https%3A%2F%2Fwww.welivesecurity.com%2F2021%2F04%2F08%2Fare-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor%2F&t_e=(Are%20you)%20afreight%20of%20the%20dark%3F%20Watch%20out%20for%20Vyveva%2C%20new%20Lazarus%20backdoor&t_d=(Are%20you)%20afreight%20of%20the%20dark%3F%20Watch%20out%20for%20Vyveva%2C%20new%20Lazarus%20backdoor&t_t=(Are%20you)%20afreight%20of%20the%20dark%3F%20Watch%20out%20for%20Vyveva%2C%20new%20Lazarus%20backdoor&s_o=default&l=en

Response headers

content-type
text/html; charset=utf-8
content-length
507
date
Tue, 13 Apr 2021 17:37:43 GMT
server
lighttpd/1.4.33
set-cookie
zync-uuid=40ddcea7-ffb0-4a07-a2ff-da9b92f1bd60:1618335463.83; Domain=rezync.com; Expires=Sun, 08-May-2022 10:37:43 GMT; Path=/; SameSite=None; Secure sd-session-id=.eJwVyrEOgjAUQNFfMW9maDDESOKggiwWFozpW4jSBl-hqLRogPDv4nZvciYoXqozt1a1DkLX9cqDsqHlLIQTSLLvfikoN-bzkEz5gSHFtjB7YJW19GwLkn-5ui8qjQ41Jmkj8tKhQeJHxkS-X5-v8YBGOEziQOh6QH0ijMQ307HP82rk44WlmvdZxHcwzz_dyTI0.E1doZw.lVEEyJP-ZpRuq-FrQlANUqKH-hQ; Expires=Sun, 08-May-2022 17:37:43 GMT; HttpOnly; Path=/; SameSite=None; Secure
x-cache
Miss from cloudfront
via
1.1 81db6db0bc548ca5046f3395364a3667.cloudfront.net (CloudFront)
x-amz-cf-pop
TXL52-C1
x-amz-cf-id
b9JawdIc7tMY4T5ITjuPdrtMM6TdG6b3p_HNJ-qrrpTd0f6ziAECmQ==
362358.gif
idsync.rlcdn.com/ Frame 536A
Redirect Chain
  • https://ejp.rlcdn.com/501709.html
  • https://ejp.rlcdn.com/1000.gif?memo=CM3PHhoNCOet14MGEgUI6AcQAEIASgA
  • https://cm.g.doubleclick.net/pixel?google_nid=epsilon&google_cm
  • https://cm.g.doubleclick.net/pixel?google_nid=epsilon&google_cm=&google_tc=
  • https://idsync.rlcdn.com/362358.gif?google_gid=CAESEEOR8ziO8vWfDLk_Qrm11WY&google_cver=1
42 B
306 B 		Document
General
Check archive.org
Download Go to
Full URL
https://idsync.rlcdn.com/362358.gif?google_gid=CAESEEOR8ziO8vWfDLk_Qrm11WY&google_cver=1
Requested by
Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/common.bundle.f485ba8b89bf2153fdb9f493ec342aed.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.244.174.68 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
68.174.244.35.bc.googleusercontent.com
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

:method
GET
:authority
idsync.rlcdn.com
:scheme
https
:path
/362358.gif?google_gid=CAESEEOR8ziO8vWfDLk_Qrm11WY&google_cver=1
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://disqus.com/embed/comments/?base=default&f=welivesecurity&t_i=149397%20https%3A%2F%2Fbackend.welivesecurity.com%2F%3Fp%3D149397&t_u=https%3A%2F%2Fwww.welivesecurity.com%2F2021%2F04%2F08%2Fare-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor%2F&t_e=(Are%20you)%20afreight%20of%20the%20dark%3F%20Watch%20out%20for%20Vyveva%2C%20new%20Lazarus%20backdoor&t_d=(Are%20you)%20afreight%20of%20the%20dark%3F%20Watch%20out%20for%20Vyveva%2C%20new%20Lazarus%20backdoor&t_t=(Are%20you)%20afreight%20of%20the%20dark%3F%20Watch%20out%20for%20Vyveva%2C%20new%20Lazarus%20backdoor&s_o=default&l=en
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
rlas3=qRkRaVqv3V+djSt3hg/sDCnpOpEXRcRmaM3r7e6qoDo=; pxrc=COet14MGEgUI6AcQABIGCLrqARAA
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://disqus.com/embed/comments/?base=default&f=welivesecurity&t_i=149397%20https%3A%2F%2Fbackend.welivesecurity.com%2F%3Fp%3D149397&t_u=https%3A%2F%2Fwww.welivesecurity.com%2F2021%2F04%2F08%2Fare-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor%2F&t_e=(Are%20you)%20afreight%20of%20the%20dark%3F%20Watch%20out%20for%20Vyveva%2C%20new%20Lazarus%20backdoor&t_d=(Are%20you)%20afreight%20of%20the%20dark%3F%20Watch%20out%20for%20Vyveva%2C%20new%20Lazarus%20backdoor&t_t=(Are%20you)%20afreight%20of%20the%20dark%3F%20Watch%20out%20for%20Vyveva%2C%20new%20Lazarus%20backdoor&s_o=default&l=en

Response headers

cache-control
no-cache, no-store
content-type
image/gif
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
set-cookie
rlas3=qRkRaVqv3V+djSt3hg/sDCnpOpEXRcRmaM3r7e6qoDo=; Path=/; Domain=rlcdn.com; Expires=Wed, 13 Apr 2022 17:37:43 GMT; Secure; SameSite=None pxrc=COet14MGEgUI6AcQABIGCLrqARAA; Path=/; Domain=rlcdn.com; Expires=Sat, 12 Jun 2021 17:37:43 GMT; Secure; SameSite=None
timing-allow-origin
*
date
Tue, 13 Apr 2021 17:37:43 GMT
content-length
42
via
1.1 google
alt-svc
clear

Redirect headers

p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://idsync.rlcdn.com/362358.gif?google_gid=CAESEEOR8ziO8vWfDLk_Qrm11WY&google_cver=1
date
Tue, 13 Apr 2021 17:37:43 GMT
pragma
no-cache
expires
Fri, 01 Jan 1990 00:00:00 GMT
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
server
HTTP server (unknown)
content-length
289
x-xss-protection
0
set-cookie
IDE=AHWqTUlE0jBFzreBPFg_01HWNJuOjNok4TlQh4avevYZcbiSFvVrG-CAj5iIR0ZWjGg; expires=Sun, 08-May-2022 17:37:43 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none test_cookie=; expires=Fri, 01-Aug-2008 22:45:55 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
/
io.narrative.io/ Frame ABA9
Redirect Chain
  • https://io.narrative.io/?companyId=19&id=disqus_id%3Ac7mvhd0e25mie09&ret=img&ref=https%3A%2F%2Fwww.welivesecurity.com%2F2021%2F04%2F08%2Fare-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor%2F
  • https://io.narrative.io/?io.narrative.guid.v2=f3f25750-9c7e-11eb-906c-06452aced0fe&companyId=19&id=disqus_id%3Ac7mvhd0e25mie09&ret=img&ref=https%3A%2F%2Fwww.welivesecurity.com%2F2021%2F04%2F08%2Far...
35 B
319 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://io.narrative.io/?io.narrative.guid.v2=f3f25750-9c7e-11eb-906c-06452aced0fe&companyId=19&id=disqus_id%3Ac7mvhd0e25mie09&ret=img&ref=https%3A%2F%2Fwww.welivesecurity.com%2F2021%2F04%2F08%2Fare-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor%2F
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.215.145.5 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-215-145-5.eu-west-1.compute.amazonaws.com
Software
nginx/1.16.1 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Request headers

Referer
https://disqus.com/embed/comments/?base=default&f=welivesecurity&t_i=149397%20https%3A%2F%2Fbackend.welivesecurity.com%2F%3Fp%3D149397&t_u=https%3A%2F%2Fwww.welivesecurity.com%2F2021%2F04%2F08%2Fare-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor%2F&t_e=(Are%20you)%20afreight%20of%20the%20dark%3F%20Watch%20out%20for%20Vyveva%2C%20new%20Lazarus%20backdoor&t_d=(Are%20you)%20afreight%20of%20the%20dark%3F%20Watch%20out%20for%20Vyveva%2C%20new%20Lazarus%20backdoor&t_t=(Are%20you)%20afreight%20of%20the%20dark%3F%20Watch%20out%20for%20Vyveva%2C%20new%20Lazarus%20backdoor&s_o=default&l=en
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Tue, 13 Apr 2021 17:37:43 GMT
Cache-Control
no-cache
Server
nginx/1.16.1
Connection
keep-alive
Content-Length
35
Content-Type
image/gif

Redirect headers

Location
https://io.narrative.io/?io.narrative.guid.v2=f3f25750-9c7e-11eb-906c-06452aced0fe&companyId=19&id=disqus_id%3Ac7mvhd0e25mie09&ret=img&ref=https%3A%2F%2Fwww.welivesecurity.com%2F2021%2F04%2F08%2Fare-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor%2F
Date
Tue, 13 Apr 2021 17:37:43 GMT
Server
nginx/1.16.1
Connection
keep-alive
Content-Length
0
397676.gif
idsync.rlcdn.com/ Frame FFC5
Redirect Chain
  • https://ib.adnxs.com/getuid?https%3A//live.rezync.com/sync%3Fc%3D4656c20ee35215f78e9273796625d90b%26p%3D093016b0419d19c905c78c859b815219%26pid%3D%24UID
  • https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%253A%2F%2Flive.rezync.com%2Fsync%253Fc%253D4656c20ee35215f78e9273796625d90b%2526p%253D093016b0419d19c905c78c859b815219%2526pid%253D%2524UID
  • https://live.rezync.com/sync?c=4656c20ee35215f78e9273796625d90b&p=093016b0419d19c905c78c859b815219&pid=2945442588821959322
  • https://p.rfihub.com/cm?pub=39342&in=1&userid=40ddcea7-ffb0-4a07-a2ff-da9b92f1bd60%3A1618335463.83&forward=https%3A//idsync.rlcdn.com/501709.gif%3Fpartner_uid%3Dc7mvhd0e25mie09
  • https://idsync.rlcdn.com/501709.gif?partner_uid=c7mvhd0e25mie09
  • https://gum.criteo.com/sync?c=6&r=1&a=1&u=https%3A%2F%2Fidsync.rlcdn.com%2F397676.gif%3Fserved_by%3Devergreen%26partner_uid%3D%40USERID%40
  • https://gum.criteo.com/sync?s=1&c=6&r=1&a=1&u=https%3A%2F%2Fidsync.rlcdn.com%2F397676.gif%3Fserved_by%3Devergreen%26partner_uid%3D%40USERID%40
  • https://idsync.rlcdn.com/397676.gif?served_by=evergreen&partner_uid=fSM4QG9YhnyGiXcBxpx0Hl17NhUvvRDx
42 B
325 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://idsync.rlcdn.com/397676.gif?served_by=evergreen&partner_uid=fSM4QG9YhnyGiXcBxpx0Hl17NhUvvRDx
Requested by
Host: live.rezync.com
URL: https://live.rezync.com/pixel.html?c=4656c20ee35215f78e9273796625d90b&cid=c7mvhd0e25mie09&pctry=DE&referrer=https%3A%2F%2Fwww.welivesecurity.com%2F2021%2F04%2F08%2Fare-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor%2F
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.244.174.68 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
68.174.244.35.bc.googleusercontent.com
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer
https://live.rezync.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin
*
date
Tue, 13 Apr 2021 17:37:44 GMT
via
1.1 google
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control
no-cache, no-store
content-type
image/gif
alt-svc
clear
content-length
42

Redirect headers

location
https://idsync.rlcdn.com/397676.gif?served_by=evergreen&partner_uid=fSM4QG9YhnyGiXcBxpx0Hl17NhUvvRDx
strict-transport-security
max-age=31536000
cache-control
private, max-age=0, no-cache, no-store, must-revalidate
server-processing-duration-in-ticks
3156
date
Tue, 13 Apr 2021 17:37:44 GMT
content-length
221
content-type
text/html; charset=utf-8
52154.gif
idsync.rlcdn.com/ Frame FFC5
Redirect Chain
  • https://p.rfihub.com/cm?pub=39342&in=1&userid=40ddcea7-ffb0-4a07-a2ff-da9b92f1bd60%3A1618335463.83&forward=https%3A//live.rezync.com/sync%3Fc%3D4656c20ee35215f78e9273796625d90b%26p%3D260a954059a0ab...
  • https://live.rezync.com/sync?c=4656c20ee35215f78e9273796625d90b&p=260a954059a0ab1986e4ee8c5c88c54c&pid=1870471594275988505
  • https://idsync.rlcdn.com/501709.gif?partner_uid=c7mvhd0e25mie09
  • https://ib.adnxs.com/getuid?https%3A%2F%2Fidsync.rlcdn.com%2F52154.gif%3Fserved_by%3Devergreen%26partner_uid%3D%24UID
  • https://idsync.rlcdn.com/52154.gif?served_by=evergreen&partner_uid=2945442588821959322
42 B
325 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://idsync.rlcdn.com/52154.gif?served_by=evergreen&partner_uid=2945442588821959322
Requested by
Host: live.rezync.com
URL: https://live.rezync.com/pixel.html?c=4656c20ee35215f78e9273796625d90b&cid=c7mvhd0e25mie09&pctry=DE&referrer=https%3A%2F%2Fwww.welivesecurity.com%2F2021%2F04%2F08%2Fare-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor%2F
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.244.174.68 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
68.174.244.35.bc.googleusercontent.com
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer
https://live.rezync.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin
*
date
Tue, 13 Apr 2021 17:37:44 GMT
via
1.1 google
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control
no-cache, no-store
content-type
image/gif
alt-svc
clear
content-length
42

Redirect headers

Pragma
no-cache
Date
Tue, 13 Apr 2021 17:37:44 GMT
X-Proxy-Origin
152.89.163.116; 152.89.163.116; 721.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.220.167:80
AN-X-Request-Uuid
b17bebe8-c442-4cff-88d1-3d9bd11f1848
Server
nginx/1.17.9
Access-Control-Allow-Origin
*
P3P
policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location
https://idsync.rlcdn.com/52154.gif?served_by=evergreen&partner_uid=2945442588821959322
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
collect
www.google-analytics.com/ 		35 B
63 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google-analytics.com/collect?v=1&cid=198682803.1618335463&tid=UA-76266002-27&dl=https://www.welivesecurity.com/2021/04/08/are-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor/&t=event&ec=Tracking%20check%20-%20recurring&ea=GA%20loaded,%20GTM%20loaded&ni=1&cd1=wls&aip=1&z=248845
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.welivesecurity.com/2021/04/08/are-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 13 Apr 2021 10:03:38 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
27254
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
check.png
cdn1.esetstatic.com/ESET/INT/assets/img/ 		68 B
384 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cdn1.esetstatic.com/ESET/INT/assets/img/check.png?country=wls&gcode=11
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.32.25.43 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-32-25-43.fra56.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
260865134b6e69ca7bafa9e8ddcd59fb6ffbf727f50a3d2dd186d217c8c79694

Request headers

Referer
https://www.welivesecurity.com/2021/04/08/are-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 13 Apr 2021 11:08:31 GMT
via
1.1 3298c44116035984c2fac24b89183c4e.cloudfront.net (CloudFront)
last-modified
Tue, 10 Mar 2020 18:17:48 GMT
server
AmazonS3
age
23362
etag
"5df0ac2d51cfecbde35e8dd1ba3a8d77"
x-cache
Hit from cloudfront
content-type
image/png
x-amz-cf-pop
FRA56-C2
accept-ranges
bytes
content-length
68
x-amz-cf-id
olYZO4NTwvcBcM92E5MSvmiPjhn2C4ZBp4wGgBrgqQYkcjqZ5QJp_g==

Verdicts & Comments Add Verdict or Comment

83 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| event object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated object| appInsights object| dataLayer object| _fbq string| baseUrl object| Main function| $ function| jQuery object| is function| _ object| html5 object| Modernizr object| transformicons function| disqus_config object| CrayonSyntaxSettings object| CrayonSyntaxStrings function| jQueryCrayon object| CrayonUtil object| jqueryPopup function| popupWindow function| popdownWindow object| CrayonSyntax object| countVars string| disqus_shortname object| embedVars string| disqus_url string| disqus_identifier string| disqus_container_id string| disqus_title function| disqus_config_custom function| _defineProperty object| cookiebar string| esetCookieConsentName string| hostname string| path string| domain object| expireDate function| getCookieValue function| getSvgMid function| getSvgSmall function| getSvgBig function| renderCookieBarSimple function| renderCookieBarAdvanced function| renderCookieBar function| appendOffsetBuffer function| showCookieAdvanced function| showCookieSimple function| hideCookie function| createCookie function| removeCookieBuffer function| createCookieAdvanced function| setCookie function| setCookieForDomains function| cookieForDomainExist object| AI object| Microsoft function| __extends function| _endsWith object| FB string| currentURL string| currentDir object| GET object| google_tag_manager object| google_tag_data string| GoogleAnalyticsObject function| ga object| DISQUSWIDGETS undefined| disqus_domain object| DISQUS object| gaplugins object| gaGlobal object| gaData

4 Cookies

Domain/Path Name / Value
.welivesecurity.com/ Name: _gid
Value: GA1.2.566125294.1618335463
.welivesecurity.com/ Name: _ga
Value: GA1.2.198682803.1618335463
.welivesecurity.com/ Name: _gcl_au
Value: 1.1.1402904351.1618335463
www.welivesecurity.com/ Name: ai_user
Value: wxVaW|2021-04-13T17:37:42.800Z

20 Console Messages

Source Level URL
Text
console-api log URL: https://www.welivesecurity.com/2021/04/08/are-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor/(Line 868)
Message:
Timer: 1
console-api log URL: https://www.welivesecurity.com/2021/04/08/are-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor/(Line 868)
Message:
Timer: 2
console-api log URL: https://www.welivesecurity.com/2021/04/08/are-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor/(Line 868)
Message:
Timer: 3
console-api log URL: https://www.welivesecurity.com/2021/04/08/are-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor/(Line 868)
Message:
Timer: 4
console-api log URL: https://www.welivesecurity.com/2021/04/08/are-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor/(Line 868)
Message:
Timer: 5
console-api log URL: https://www.welivesecurity.com/2021/04/08/are-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor/(Line 868)
Message:
Timer: 6
console-api log URL: https://www.welivesecurity.com/2021/04/08/are-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor/(Line 868)
Message:
Timer: 7
console-api log URL: https://www.welivesecurity.com/2021/04/08/are-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor/(Line 868)
Message:
Timer: 8
console-api log URL: https://www.welivesecurity.com/2021/04/08/are-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor/(Line 868)
Message:
Timer: 9
console-api log URL: https://www.welivesecurity.com/2021/04/08/are-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor/(Line 868)
Message:
Timer: 10
console-api log URL: https://www.welivesecurity.com/2021/04/08/are-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor/(Line 868)
Message:
Timer: 11
console-api log URL: https://www.welivesecurity.com/2021/04/08/are-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor/(Line 868)
Message:
Timer: 12
console-api log URL: https://www.welivesecurity.com/2021/04/08/are-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor/(Line 868)
Message:
Timer: 13
console-api log URL: https://www.welivesecurity.com/2021/04/08/are-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor/(Line 868)
Message:
Timer: 14
console-api log URL: https://www.welivesecurity.com/2021/04/08/are-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor/(Line 868)
Message:
Timer: 15
console-api log URL: https://www.welivesecurity.com/2021/04/08/are-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor/(Line 868)
Message:
Timer: 16
console-api log URL: https://www.welivesecurity.com/2021/04/08/are-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor/(Line 868)
Message:
Timer: 17
console-api log URL: https://www.welivesecurity.com/2021/04/08/are-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor/(Line 868)
Message:
Timer: 18
console-api log URL: https://www.welivesecurity.com/2021/04/08/are-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor/(Line 868)
Message:
Timer: 19
console-api log URL: https://www.welivesecurity.com/2021/04/08/are-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor/(Line 868)
Message:
GA and GTM are loaded.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=15724800
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

accounts.google.com
apis.google.com
assets.esetstatic.com
az416426.vo.msecnd.net
c.disquscdn.com
cdn1.esetstatic.com
cm.g.doubleclick.net
connect.facebook.net
dc.services.visualstudio.com
disqus.com
ejp.rlcdn.com
glitter.services.disqus.com
gum.criteo.com
ib.adnxs.com
idsync.rlcdn.com
io.narrative.io
live.rezync.com
p.rfihub.com
referrer.disqus.com
ssl.gstatic.com
welivesecurity.disqus.com
www.facebook.com
www.google-analytics.com
www.googletagmanager.com
www.welivesecurity.com
13.32.25.43
142.250.185.162
151.101.0.134
151.101.112.134
151.101.112.64
185.33.221.91
193.0.160.128
2606:2800:233:1cb7:261b:1f9c:2074:3c
2606:4700::6812:a813
2620:1ec:29::19
2a00:1450:4001:808::200d
2a00:1450:4001:80e::200e
2a00:1450:4001:827::2003
2a00:1450:4001:82a::2008
2a00:1450:4001:82b::200e
2a02:2638::1c
2a03:2880:f01c:8012:face:b00c:0:3
2a03:2880:f11c:8183:face:b00c:0:25de
35.244.174.68
51.107.59.180
52.215.145.5
99.84.156.6
0b93183bcc5bda42dc9db65084d052ca8fdb7eb3e3b08a75e5f3884a888cf035
0d12043c7051fe9e78060b7ae447ec5aa8bfa744dd5520fb12e745a2bb0076da
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
11c401a81e32b086bea3798c033009907b429fb601411da6ffc266b78184898a
12c42fa79dc321e56bb3c23008cacf7a79771bab4fa61f765556e24ba13a89ff
12f37c0a70377ac636345742e2eb0d2acb70d411612020ae1608193330a5b15d
1846a9c9605f590bf6cb37a20cde9454f58de8a74de5822bd242187fa83b2074
193fbb968733b8a7049da19274546e6b80b76e9a8f1b837fee9a5fdeb8f97c7b
1ba0ff3994900740a94dc37300b7415b25d642f6ef495afc5ae4e16ae1128e66
1f0116f3ae1bd3c01cbcfd73d0c6306233386526b7855d8041d7ebb362b1a565
20a91bd509668238b6af8e16475c5e2611bcd2861d0eec2e0d4f6815e81449bd
20b6097504aed42f81fd7492b0e20ee87c7e7d8f9e0a367081741ec0c405f740
260865134b6e69ca7bafa9e8ddcd59fb6ffbf727f50a3d2dd186d217c8c79694
2bb338589acb03e0bc2a0ebf4208c2f098c632e991bf452b2ec508b42d087222
3270642c89180c12db93775e2a774b6dadd9bd98cffc963075c85afd2c17b6e4
33d9c56f2b1408711b9b963963790177ac4e7c38a5ecf0e3c12f558c676e294b
3487ef2baf0c08ba660a8a143cdeb8ebeec961eea04bccd7c49096b4eb26b875
34f43b4966020a59a3a3e099f9dbe930d8ae84430ab1239b0d9f5055310c5ac3
35ccbb14f6d8b7ed5eb03728f94221f27ed194ae83b32c40315d531f49b10bc1
44f82284979403a96c5ae28e102b7f1709d755605f714120daa8b824aca60f72
4c4491dcfa94cb46fb73742fc2caf49a1cd59027304af1830c7dc6ce1889857c
4dad11be5c8c65e8cac9b84b6852c6c218d8e45c6f6a9027f511df8f15769aaa
4e14ce1bd0d4433eee84cbb16196a7a051126f07af888ef7f9d252120f32f907
5201c813c37a4168cc5c20c701d4391fd0a55625f97eb9f263a74fb52b52fd0e
55c9540888569c09e72cbfbadbe3a3fe888b0a3dec19d5a6fd085dcf09162cc8
56d0f6e7a41b34c245b58ca6e50c7e180093fa9283c8eb7bab0a40589a07dbcb
5813b04bb0c879b76179735995127ddc2af1867f42d4a4b5a8d7c3103f348b05
6289a67bc4acdbdafbc49c8db8bee69deaca8a0a5a9321011b96e2cc9c242eba
63a41173db39c92635a87b39eedb581e8a1c3142372ebced441ce927fef343a1
719f5db8e223a043a3cd3122e8c6c231e54c4c622e132b1cfef1e8b25e47e3da
731031267f76a329d15dfff5385558bcde35de883c4f296340f9b9feff0cd1ea
772f94d06973fc24339b35466f5d3bb028257cf1e6bdd41480f86e594265b327
7df5345a52f22643ef051bf74f41d9a5a5644d5e699480a81ae8825b8ab5e533
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
8630d3642f52a29b6198da00f23f7bd2481ad1cc19becfcf441a6c4ffe4ae099
89930700e50c08786e5758144c8d62b777efaaac9225c62dd2c555bfdcc65137
8d57159ba692c081ef8972c95f4fffaba9faa54edb2539fd6a56d154e6e95cdd
8daf09a6fc31937457dd77e9c25ce4b21349d605b561a8c5d557841bf964c9a0
9c4add8d1cc4b907c18f06006214c46323c31de476aa7631ca1537af92e60b4e
9fa67da84c690615b1dc83b460c777f1c0c9fa1799c60f9681b4fc7876787136
a1943a600956d093b6bdbd157ffea2a0a738342a1a7a454a31364c3aa41325fa
a493d727aee756ab02e03abcc0432cf03c057d3b84549fa78a963f1e5a511ace
aac0985d82f461dfcac802ece43c41cd98f245828ad0768758889ab6ea78bb7e
b0e5c38bc6a2bd7237847084573d9a28e122b85268233107bfd014b340249577
b750e9a2d5ccec23e8e4587c3a6b15ee4dc1c1d0dd84a99f478e86be5c7aa693
b77d351f5c5eaa164ee1f7aedd5c0c172a91284ae5d9ad544713af3a69cb3ed7
ba5b8184b4a58cb3398e8722b92ab2f57a500a0b4aa9662a3abbcf7b3cd1910c
cc6f42cec1cc6c7a2d649b851a29895949749068e7f97f98172ecff86cf587df
cdba739c28b41f39ce438f2bf204fe739dc81a26cf559a9394ceed56a0666bee
ce33b36f16a953ed16394b859ee8f1a6e7fd9785869fe62e3af78aa019c07f7b
ce8fc5b6de8c12b2eac649cc45206787aa6d5c9ab0987020574349688c3df288
cea0a05c5af6e21a409875328ed2e3dba79131b7c41f8ea07d0e0e02c7b7b59e
cea1cc1bda5686330e67daf6537a80f848672e3d5bd251568581212bb3933788
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
d33fbf33d2895817029b01cf16d273104474646e4e441988ab4efcfa7563991b
d39b91321f1f8eca1fa10e9c06b58698e9784f5b9917a8143371dee70590dc11
e0c2fd69b7d441b42045d474afe52d2bdbb81a44c8d73e2c8271e4114003d991
e22e3416c5b454c2fc3c8e8185b478647446789abbee258ec18a5791880eaf1b
e2a1c2c0322c2737e986c860da67fbb2b9e93b70527a943b8c35b9d6e81ebb42
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e422b07ca1550e55cd90a518e910fd3cfb4d9337ea6092357f9761aa77ac9e33
e49e818924b2d3f07c19d83857c4bcd7047f175041ada63af602bd9ab12d9949
e6d45d5070166bf5619c3934ec8cacbb331279340b55eec41cbeb8f5ac7fb69f
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f055e217bde76d711bd8b42af773f9f99b8a29d81ad9ed10b6379cc7e6c60452
f0edf4ed283d119399dcb7025914b6a68a187667085bcbc49fe91db20f952cc1
f16416804f84dbe7a5d95a3d2333e107dc1774a612f0fc1611e1ffbfc10f0d6b
f2a341fc815d45c21da726d4c843c2c5d3e1f333465347c3c75d040d556df4e5
f79723478f4c48501cd49ac52b81d6244a6562b9d3f08ce8ab208a8b8878d4c4
f8afec44114c09f3e520fd8c89a7e00386e99bc567ccbbf16f23771b75b58a68