urlscan.io logo urlscan.io
SecurityTrails logo

threatpost.com Open in urlscan Pro
35.173.160.135  Public Scan

Go To Rescan Add Verdict Report
URL: https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
Submission: On March 26 via api from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 29 IPs in 7 countries across 26 domains to perform 116 HTTP transactions. The main IP is 35.173.160.135, located in Ashburn, United States and belongs to AMAZON-AES, US. The main domain is threatpost.com.
TLS certificate: Issued by Thawte EV RSA CA 2018 on June 17th 2019. Valid for: a year.
This is the only time threatpost.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
17 35.173.160.135 14618 (AMAZON-AES)
6 2600:9000:20e... 16509 (AMAZON-02)
9 2600:9000:20e... 16509 (AMAZON-02)
25 63.250.56.23 41436 (CLOUDWEBM...)
1 2a00:1450:400... 15169 (GOOGLE)
1 2 2a00:1450:400... 15169 (GOOGLE)
1 91.228.74.224 27281 (QUANTCAST)
1 151.101.112.157 54113 (FASTLY)
1 1 2a00:1450:400... 15169 (GOOGLE)
1 1 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
1 104.244.42.197 13414 (TWITTER)
2 13.224.199.29 16509 (AMAZON-02)
2 2a00:1450:400... 15169 (GOOGLE)
22 185.220.204.11 41436 (CLOUDWEBM...)
1 2600:9000:21f... 16509 (AMAZON-02)
1 2a00:1450:400... 15169 (GOOGLE)
2 185.33.223.80 29990 (ASN-APPNEX)
2 95.101.185.51 20940 (AKAMAI-ASN1)
2 185.64.189.112 62713 (AS-PUBMATIC)
2 35.158.0.61 16509 (AMAZON-02)
2 18.194.129.81 16509 (AMAZON-02)
1 91.228.74.210 27281 (QUANTCAST)
2 7 34.95.120.147 15169 (GOOGLE)
1 104.244.42.195 13414 (TWITTER)
1 104.109.78.125 20940 (AKAMAI-ASN1)
1 2a00:1288:110... 34010 (YAHOO-IRD)
2 2 63.33.80.49 16509 (AMAZON-02)
2 3 3.123.244.246 16509 (AMAZON-02)
2 2 216.58.205.226 15169 (GOOGLE)
1 18.156.0.31 16509 (AMAZON-02)
2 2 151.101.114.49 54113 (FASTLY)
1 1 35.168.89.112 14618 (AMAZON-AES)
1 52.0.180.19 14618 (AMAZON-AES)
116 29
17    35.173.160.135 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-35-173-160-135.compute-1.amazonaws.com
threatpost.com
kasperskycontenthub.com
6    2600:9000:20e8:1400:2:9275:3d40:93a1 (United States)

ASN16509 (AMAZON-02, US)
assets.threatpost.com
9    2600:9000:20e8:5c00:0:5c46:4f40:93a1 (United States)

ASN16509 (AMAZON-02, US)
media.threatpost.com
25    63.250.56.23 (United States)

ASN41436 (CLOUDWEBMANAGE-EU, GB)
live.sekindo.com
1    2a00:1450:4001:800::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.googletagmanager.com
2    2a00:1450:4001:817::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google-analytics.com
1    91.228.74.224 (United Kingdom)

ASN27281 (QUANTCAST, US)
secure.quantserve.com
1    151.101.112.157 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)
static.ads-twitter.com
1    2a00:1450:400c:c07::9c (Brussels, Belgium)

ASN15169 (GOOGLE, US)
stats.g.doubleclick.net
1    2a00:1450:4001:808::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google.com
1    2a00:1450:4001:81e::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google.de
1    104.244.42.197 (United States)

ASN13414 (TWITTER, US)
t.co
2    13.224.199.29 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-224-199-29.fra2.r.cloudfront.net
c.amazon-adsystem.com
2    2a00:1450:4001:821::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.googleapis.com
22    185.220.204.11 (Amsterdam, Netherlands)

ASN41436 (CLOUDWEBMANAGE-EU, GB)
video.sekindo.com
1    2600:9000:21f3:800:6:44e3:f8c0:93a1 (United States)

ASN16509 (AMAZON-02, US)
rules.quantcount.com
1    2a00:1450:4001:814::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.gstatic.com
2    185.33.223.80 (Netherlands)

ASN29990 (ASN-APPNEX, US)
PTR: 251.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
ib.adnxs.com
2    95.101.185.51 (Ascension Island)

ASN20940 (AKAMAI-ASN1, US)
PTR: a95-101-185-51.deploy.static.akamaitechnologies.com
as-sec.casalemedia.com
2    185.64.189.112 (United Kingdom)

ASN62713 (AS-PUBMATIC, US)
hbopenbid.pubmatic.com
2    35.158.0.61 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-35-158-0-61.eu-central-1.compute.amazonaws.com
prebid-server.rubiconproject.com
2    18.194.129.81 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-194-129-81.eu-central-1.compute.amazonaws.com
ads.adaptv.advertising.com
1    91.228.74.210 (United Kingdom)

ASN27281 (QUANTCAST, US)
pixel.quantserve.com
7    34.95.120.147 (United States)

ASN15169 (GOOGLE, US)
PTR: 147.120.95.34.bc.googleusercontent.com
primis-d.openx.net
u.openx.net
teachingaids-d.openx.net
1    104.244.42.195 (United States)

ASN13414 (TWITTER, US)
analytics.twitter.com
1    104.109.78.125 (Netherlands)

ASN20940 (AKAMAI-ASN1, US)
PTR: a104-109-78-125.deploy.static.akamaitechnologies.com
eus.rubiconproject.com
1    2a00:1288:110:c305::8000 (United Kingdom)

ASN34010 (YAHOO-IRD, GB)
pr-bh.ybp.yahoo.com
2    63.33.80.49 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-63-33-80-49.eu-west-1.compute.amazonaws.com
match.adsrvr.org
3    3.123.244.246 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-123-244-246.eu-central-1.compute.amazonaws.com
pixel.advertising.com
2    216.58.205.226 (Mountain View, United States)

ASN15169 (GOOGLE, US)
PTR: fra15s24-in-f2.1e100.net
cm.g.doubleclick.net
1    18.156.0.31 (United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-156-0-31.eu-central-1.compute.amazonaws.com
ups.analytics.yahoo.com
2    151.101.114.49 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)
sync-tm.everesttech.net
1    35.168.89.112 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-35-168-89-112.compute-1.amazonaws.com
sync.adap.tv
1    52.0.180.19 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-0-180-19.compute-1.amazonaws.com
sync.adaptv.advertising.com
Domain Requested by
25 live.sekindo.com threatpost.com
live.sekindo.com
22 video.sekindo.com threatpost.com
live.sekindo.com
16 threatpost.com threatpost.com
live.sekindo.com
9 media.threatpost.com threatpost.com
6 assets.threatpost.com threatpost.com
4 u.openx.net 2 redirects live.sekindo.com
3 pixel.advertising.com 2 redirects threatpost.com
2 sync-tm.everesttech.net 2 redirects
2 cm.g.doubleclick.net 2 redirects
2 match.adsrvr.org 2 redirects
2 primis-d.openx.net live.sekindo.com
2 ads.adaptv.advertising.com live.sekindo.com
2 prebid-server.rubiconproject.com live.sekindo.com
2 hbopenbid.pubmatic.com live.sekindo.com
2 as-sec.casalemedia.com live.sekindo.com
2 ib.adnxs.com live.sekindo.com
2 fonts.googleapis.com live.sekindo.com
2 c.amazon-adsystem.com live.sekindo.com
c.amazon-adsystem.com
2 www.google-analytics.com 1 redirects www.googletagmanager.com
1 sync.adaptv.advertising.com threatpost.com
1 sync.adap.tv 1 redirects
1 ups.analytics.yahoo.com threatpost.com
1 pr-bh.ybp.yahoo.com threatpost.com
1 eus.rubiconproject.com live.sekindo.com
1 analytics.twitter.com static.ads-twitter.com
1 pixel.quantserve.com threatpost.com
1 teachingaids-d.openx.net live.sekindo.com
1 fonts.gstatic.com threatpost.com
1 rules.quantcount.com secure.quantserve.com
1 t.co threatpost.com
1 www.google.de threatpost.com
1 www.google.com 1 redirects
1 stats.g.doubleclick.net 1 redirects
1 static.ads-twitter.com www.googletagmanager.com
1 secure.quantserve.com www.googletagmanager.com
1 www.googletagmanager.com threatpost.com
1 kasperskycontenthub.com threatpost.com
116 37
Subject Issuer Validity Valid
threatpost.com
Thawte EV RSA CA 2018		 2019-06-17 -
2020-06-17		 a year crt.sh
assets.threatpost.com
Amazon		 2020-03-04 -
2021-04-04		 a year crt.sh
kasperskycontenthub.com
Thawte RSA CA 2018		 2019-06-14 -
2020-06-13		 a year crt.sh
media.threatpost.com
Amazon		 2020-03-04 -
2021-04-04		 a year crt.sh
www.sekindo.com
Go Daddy Secure Certificate Authority - G2		 2019-05-23 -
2020-06-18		 a year crt.sh
*.google-analytics.com
GTS CA 1O1		 2020-03-03 -
2020-05-26		 3 months crt.sh
*.quantserve.com
DigiCert SHA2 High Assurance Server CA		 2019-10-04 -
2020-10-07		 a year crt.sh
ads-twitter.com
DigiCert SHA2 High Assurance Server CA		 2019-08-14 -
2020-08-18		 a year crt.sh
www.google.de
GTS CA 1O1		 2020-03-03 -
2020-05-26		 3 months crt.sh
t.co
DigiCert SHA2 High Assurance Server CA		 2020-03-05 -
2021-03-02		 a year crt.sh
c.amazon-adsystem.com
Amazon		 2019-10-07 -
2020-09-29		 a year crt.sh
*.storage.googleapis.com
GTS CA 1O1		 2020-03-03 -
2020-05-26		 3 months crt.sh
*.google.com
GTS CA 1O1		 2020-03-03 -
2020-05-26		 3 months crt.sh
*.adnxs.com
DigiCert ECC Secure Server CA		 2019-01-23 -
2021-03-08		 2 years crt.sh
san.casalemedia.com
GeoTrust RSA CA 2018		 2020-03-02 -
2021-04-01		 a year crt.sh
*.pubmatic.com
Sectigo RSA Organization Validation Secure Server CA		 2019-02-22 -
2021-02-21		 2 years crt.sh
*.rubiconproject.com
DigiCert SHA2 Secure Server CA		 2019-01-10 -
2021-01-14		 2 years crt.sh
*.v.ssp.yahoo.com
DigiCert SHA2 High Assurance Server CA		 2020-03-01 -
2020-08-28		 6 months crt.sh
*.openx.net
GeoTrust RSA CA 2018		 2018-01-04 -
2020-07-09		 3 years crt.sh
*.twitter.com
DigiCert SHA2 High Assurance Server CA		 2020-03-05 -
2021-03-02		 a year crt.sh
*.ybp.yahoo.com
DigiCert SHA2 High Assurance Server CA		 2020-01-04 -
2020-07-02		 6 months crt.sh
pixel.advertising.com
DigiCert SHA2 High Assurance Server CA		 2017-06-14 -
2020-06-18		 3 years crt.sh
ups.analytics.yahoo.com
DigiCert SHA2 High Assurance Server CA		 2020-02-13 -
2020-08-11		 6 months crt.sh

This page contains 7 frames:

Primary Page: https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
Frame ID: F05BD8298E1457EB357E8C94E9D52384
Requests: 44 HTTP requests in this frame

Frame: https://live.sekindo.com/live/liveView.php?s=101281&cbuster=%%CACHEBUSTER%%&pubUrl=%%REFERRER_URL_ESC%%&x=[WIDTH]&y=[HEIGHT]&vp_content=plembed173akunvrojp&vp_template=6615&subId=[SUBID_ENCODED]&schain=1.0,1!admetricspro.com,1005,1&cbuster=1585239515&pubUrlAuto=https%3A%2F%2Fthreatpost.com%2Firanian-apt-targets-govs-with-new-malware%2F%3D&videoType=flow&floatWidth=320&floatHeight=180&floatDirection=br&floatVerticalOffset=10&floatHorizontalOffset=10&floatCloseBtn=1&flowMode=undefined
Frame ID: 9211C2E97D2676D0744E9E00718D108D
Requests: 44 HTTP requests in this frame

Frame: https://fonts.googleapis.com/css?family=Roboto&display=swap
Frame ID: 9615D5677B58130A1A558122994E41A0
Requests: 5 HTTP requests in this frame

Frame: https://fonts.googleapis.com/css?family=Roboto&display=swap
Frame ID: 3C770AD709EBB1C063526DDAC05B2631
Requests: 22 HTTP requests in this frame

Frame: https://u.openx.net/w/1.0/pd?cc=1&gdpr=1&gdpr_consent=
Frame ID: 5EC727DF60E1D5C68BAB6A738B420586
Requests: 1 HTTP requests in this frame

Frame: https://u.openx.net/w/1.0/pd?cc=1&gdpr=1&gdpr_consent=
Frame ID: 44335CE59BC2253B5142F88C4BAE21B6
Requests: 1 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html?gdpr=1&gdpr_consent=
Frame ID: 26593CB642B95199AEE4A0A22DB5F840
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Detected technologies

Overall confidence: 100%
Detected patterns
  • html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
  • script /\/wp-(?:content|includes)\//i
  • headers link /rel="https:\/\/api\.w\.org\/"/i
  • html /<div class=(?:"|')[^>]*gform_wrapper/i
  • html /<div class=(?:"|')[^>]*gform_body/i
  • html /<ul [^>]*class=(?:"|')[^>]*gform_fields/i
Overall confidence: 100%
Detected patterns
  • html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
  • script /\/wp-(?:content|includes)\//i
  • headers link /rel="https:\/\/api\.w\.org\/"/i
  • html /<div class=(?:"|')[^>]*gform_wrapper/i
  • html /<div class=(?:"|')[^>]*gform_body/i
  • html /<ul [^>]*class=(?:"|')[^>]*gform_fields/i
Overall confidence: 100%
Detected patterns
  • html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
  • script /\/wp-(?:content|includes)\//i
  • headers link /rel="https:\/\/api\.w\.org\/"/i
  • html /<div class=(?:"|')[^>]*gform_wrapper/i
  • html /<div class=(?:"|')[^>]*gform_body/i
  • html /<ul [^>]*class=(?:"|')[^>]*gform_fields/i
Overall confidence: 100%
Detected patterns
  • headers server /nginx(?:\/([\d.]+))?/i
Overall confidence: 100%
Detected patterns
  • script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i
Overall confidence: 100%
Detected patterns
  • html /googletagmanager\.com\/ns\.html[^>]+><\/iframe>/i
  • html /<!-- (?:End )?Google Tag Manager -->/i
Overall confidence: 100%
Detected patterns
  • html /<div class=(?:"|')[^>]*gform_wrapper/i
  • html /<div class=(?:"|')[^>]*gform_body/i
  • html /<ul [^>]*class=(?:"|')[^>]*gform_fields/i
Overall confidence: 100%
Detected patterns
  • script /\.quantserve\.com\/quant\.js/i
Overall confidence: 100%
Detected patterns
  • script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

116
Requests

97 %
HTTPS

32 %
IPv6

26
Domains

37
Subdomains

29
IPs

7
Countries

5731 kB
Transfer

7239 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 43
  • https://www.google-analytics.com/r/collect?v=1&_v=j81&aip=1&a=1487547085&t=pageview&_s=1&dl=https%3A%2F%2Fthreatpost.com%2Firanian-apt-targets-govs-with-new-malware%2F%3D&ul=en-us&de=UTF-8&dt=404%20%7C%20Threatpost&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&_u=YEBAAEAB~&jid=1671306874&gjid=455186752&cid=921593550.1585239516&tid=UA-35676203-21&_gid=149282076.1585239516&_r=1&gtm=2wg3i0PM29HLF&z=1828903002 HTTP 302
  • https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-35676203-21&cid=921593550.1585239516&jid=1671306874&_gid=149282076.1585239516&gjid=455186752&_v=j81&z=1828903002 HTTP 302
  • https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-35676203-21&cid=921593550.1585239516&jid=1671306874&_v=j81&z=1828903002 HTTP 302
  • https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-35676203-21&cid=921593550.1585239516&jid=1671306874&_v=j81&z=1828903002&slf_rd=1&random=463711607
Request Chain 90
  • https://u.openx.net/w/1.0/pd?gdpr=1&gdpr_consent= HTTP 302
  • https://u.openx.net/w/1.0/pd?cc=1&gdpr=1&gdpr_consent=
Request Chain 91
  • https://u.openx.net/w/1.0/pd?gdpr=1&gdpr_consent= HTTP 302
  • https://u.openx.net/w/1.0/pd?cc=1&gdpr=1&gdpr_consent=
Request Chain 94
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=adaptv&ttd_tpi=1 HTTP 302
  • https://match.adsrvr.org/track/cmb/generic?ttd_pid=adaptv&ttd_tpi=1 HTTP 302
  • https://pixel.advertising.com/ups/55953/sync?uid=1f5ad252-cb9a-4847-af6c-c805ff5f863f&_origin=1&gdpr=1&gdpr_consent=&piggybackCookie=1f5ad252-cb9a-4847-af6c-c805ff5f863f
Request Chain 95
  • https://cm.g.doubleclick.net/pixel?google_nid=adaptv_dbm&google_cm&google_sc HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=adaptv_dbm&google_cm=&google_sc=&google_tc= HTTP 302
  • https://pixel.advertising.com/ups/57304/sync?uid=CAESEApCdJV4_6OYcnmRLGU2txA&google_cver=1 HTTP 302
  • https://pixel.advertising.com/ups/57304/sync?uid=CAESEApCdJV4_6OYcnmRLGU2txA&google_cver=1&verify=true HTTP 302
  • https://ups.analytics.yahoo.com/ups/57304/sync?uid=CAESEApCdJV4_6OYcnmRLGU2txA&google_cver=1&apid=UP7507295d-6f7d-11ea-949d-0242179982cc
Request Chain 96
  • https://sync-tm.everesttech.net/upi/pid/m7y5t93k?redir=https%3A%2F%2Fsync.adap.tv%2Fsync%3Ftype%3Dgif%26key%3Dtubemogul%26uid%3D%24%7BUSER_ID%7D HTTP 302
  • https://sync-tm.everesttech.net/ct/upi/pid/m7y5t93k?redir=https%3A%2F%2Fsync.adap.tv%2Fsync%3Ftype%3Dgif%26key%3Dtubemogul%26uid%3D%24%7BUSER_ID%7D&_test=XnzV4wAAAJWYawXH HTTP 302
  • https://sync.adap.tv/sync?type=gif&key=tubemogul&uid=XnzV4wAAAJWYawXH&_test=XnzV4wAAAJWYawXH HTTP 302
  • https://sync.adaptv.advertising.com/sync?type=gif&key=tubemogul&uid=XnzV4wAAAJWYawXH&_test=XnzV4wAAAJWYawXH

116 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request =
threatpost.com/iranian-apt-targets-govs-with-new-malware/ 		58 KB
13 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
32d47e707cccc00f62878c5b28e53336810758f069580ca174e98cdced03d903
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Host
threatpost.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
document
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
none
Sec-Fetch-Mode
navigate
Sec-Fetch-User
?1
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
document

Response headers

Server
nginx
Date
Thu, 26 Mar 2020 16:18:34 GMT
Content-Type
text/html; charset=UTF-8
Transfer-Encoding
chunked
Connection
close
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-Content-Type-Options
nosniff
X-XSS-Protection
1; mode=block
Expires
Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control
no-cache, must-revalidate, max-age=0, no-store
Link
<https://threatpost.com/wp-json/>; rel="https://api.w.org/"
Content-Encoding
gzip
main.css
threatpost.com/wp-content/themes/threatpost-2018/assets/css/ 		234 KB
35 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1585224699
Requested by
Host: threatpost.com
URL: https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
56ab0f61f8ed6030bdd684f3752233177da0555b07cb172e0abffe8e02978bc5

Request headers

Referer
https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
style

Response headers

Pragma
public
Date
Thu, 26 Mar 2020 16:18:35 GMT
Content-Encoding
gzip
Last-Modified
Thu, 26 Mar 2020 12:12:05 GMT
Server
nginx
ETag
W/"5e7c9c15-3a94d"
Transfer-Encoding
chunked
Content-Type
text/css
Cache-Control
max-age=604800, public
Connection
close
Expires
Thu, 02 Apr 2020 16:18:35 GMT
/
assets.threatpost.com/wp-content/plugins/bwp-minify/min/ 		77 KB
17 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-includes/css/dist/block-library/style.min.css,wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css&ver=3b294457
Requested by
Host: threatpost.com
URL: https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:20e8:1400:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
2ed8662cb6ca4b48b146127db22ebd71f824d54fb6ca11601bd8fa97ff572cf2
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
style

Response headers

date
Thu, 26 Mar 2020 12:13:42 GMT
content-encoding
gzip
age
14693
x-cache
Hit from cloudfront
status
200
content-length
16477
last-modified
Thu, 26 Mar 2020 12:11:39 GMT
server
nginx
cache-control
max-age=86400
x-frame-options
SAMEORIGIN
vary
Accept-Encoding
content-type
text/css; charset=utf-8
via
1.1 03c38fb105b43128049da1df5835ab5e.cloudfront.net (CloudFront)
x-cache-hit
HIT
x-debug-auth
off
x-amz-cf-pop
TXL52-C1
x-request-host
kasperskycontenthub.com
x-amz-cf-id
-uckFne7I5jyKvJfYkY6z6zNIEBpUSXxEMOMSXSi3qd3m7razPZHyw==
expires
Fri, 27 Mar 2020 12:13:09 GMT
jquery.js
threatpost.com/wp-includes/js/jquery/ 		95 KB
37 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://threatpost.com/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp
Requested by
Host: threatpost.com
URL: https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
1db21d816296e6939ba1f42962496e4134ae2b0081e26970864c40c6d02bb1df

Request headers

Referer
https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

Pragma
public
Date
Thu, 26 Mar 2020 16:18:35 GMT
Content-Encoding
gzip
Last-Modified
Wed, 18 Dec 2019 22:32:15 GMT
Server
nginx
ETag
W/"5dfaa8ef-17a69"
Transfer-Encoding
chunked
Content-Type
application/x-javascript
Cache-Control
max-age=604800, public
Connection
close
Expires
Thu, 02 Apr 2020 16:18:35 GMT
/
assets.threatpost.com/wp-content/plugins/bwp-minify/min/ 		175 KB
55 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/kaspersky-cookies-notification/scripts/alert_text.js,wp-content/plugins/kaspersky-cookies-notification/scripts/alert.js,wp-content/plugins/honeypot-comments/public/assets/js/public.js,wp-content/plugins/kspr_twitter_pullquote/js/kaspersky-twitter-pullquote.js,wp-content/themes/threatpost-2018/assets/js/main.js,wp-content/themes/threatpost-2018/assets/js/loadmore.js,wp-content/plugins/kaspersky-social-sharing/assets/js/social-share.js&ver=3b294457
Requested by
Host: threatpost.com
URL: https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:20e8:1400:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
f89d17dc2e4ecb385243b7b4cdaf5d8d9f6d4b9829e2be80afb66d01721835e3
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Thu, 26 Mar 2020 12:13:42 GMT
content-encoding
gzip
age
14693
x-cache
Hit from cloudfront
status
200
content-length
55884
last-modified
Thu, 26 Mar 2020 12:12:06 GMT
server
nginx
cache-control
max-age=86400
x-frame-options
SAMEORIGIN
vary
Accept-Encoding
content-type
application/x-javascript; charset=utf-8
via
1.1 03c38fb105b43128049da1df5835ab5e.cloudfront.net (CloudFront)
x-cache-hit
HIT
x-debug-auth
off
x-amz-cf-pop
TXL52-C1
x-request-host
kasperskycontenthub.com
x-amz-cf-id
dxJkg9A3C0ljre7tVWPmjXdd9pt8_baDjNDQaxwi7FNCipqViUopyg==
expires
Fri, 27 Mar 2020 12:13:31 GMT
/
kasperskycontenthub.com/ 		0
399 B 		Script
General
Check archive.org
Download Go to
Full URL
https://kasperskycontenthub.com/?dm=ed1f9e435dc885292eab65620c51f3fb&action=load&blogid=103&siteid=1&t=1143764043&back=https%3A%2F%2Fthreatpost.com%2Firanian-apt-targets-govs-with-new-malware%2F%3D
Requested by
Host: threatpost.com
URL: https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

Date
Thu, 26 Mar 2020 16:18:36 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-Content-Type-Options
nosniff
Server
nginx
X-Frame-Options
SAMEORIGIN
Content-Type
application/javascript
x-cache-hit
MISS
Transfer-Encoding
chunked
X-Debug-Auth
off
Connection
close
X-Request-Host
kasperskycontenthub.com
X-XSS-Protection
1; mode=block
Olympics-18-june-2019-570x285.jpg
media.threatpost.com/wp-content/uploads/sites/103/2020/03/25170152/ 		29 KB
30 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://media.threatpost.com/wp-content/uploads/sites/103/2020/03/25170152/Olympics-18-june-2019-570x285.jpg
Requested by
Host: threatpost.com
URL: https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:20e8:5c00:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
1a4764f71c27fdf06dc584d0729841f1e5a29024c10c6a42ef9e1beaf7d96bff

Request headers

Referer
https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Thu, 26 Mar 2020 13:41:49 GMT
via
1.1 5755f825ee6ab59b8a6349608c249e4e.cloudfront.net (CloudFront), 1.1 458f29e42261f01e7368474593f44b66.cloudfront.net (CloudFront)
last-modified
Wed, 25 Mar 2020 21:01:56 GMT
server
AmazonS3
age
9407
etag
"86018bce1b00edc8f20f0092d1069e6f"
x-cache
Hit from cloudfront
content-type
image/jpeg
status
200
cache-control
max-age=31536000
x-amz-cf-pop
FRA54, TXL52-C1
accept-ranges
bytes
content-length
30035
x-amz-cf-id
gd7n3v3AV5h0MtQUXtJSu9VOP4DNTG4eqXDsB-4WEwngkctPUchBag==
expires
Thu, 25 Mar 2021 21:01:55 GMT
apple-rainbow-logo-540x270.jpg
media.threatpost.com/wp-content/uploads/sites/103/2019/10/14080919/ 		27 KB
28 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://media.threatpost.com/wp-content/uploads/sites/103/2019/10/14080919/apple-rainbow-logo-540x270.jpg
Requested by
Host: threatpost.com
URL: https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:20e8:5c00:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
eac173b38cb8a2dee61ed09d2cffc1ac3a8c28a3c222fe470623c25076eb1b4c

Request headers

Referer
https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Sun, 16 Feb 2020 07:40:35 GMT
via
1.1 163be08bc1bc44818353c4fd88655bee.cloudfront.net (CloudFront), 1.1 458f29e42261f01e7368474593f44b66.cloudfront.net (CloudFront)
last-modified
Mon, 14 Oct 2019 12:09:22 GMT
server
AmazonS3
age
3400681
etag
"191413194eead0d841b6d0e29d9b3209"
x-cache
Hit from cloudfront
content-type
image/jpeg
status
200
cache-control
max-age=31536000
x-amz-cf-pop
FRA6-C1, TXL52-C1
accept-ranges
bytes
content-length
28083
x-amz-cf-id
GacgT2BCXLqMutKA8jkuiXHaoxNTCZYnIufzarDh_GlVwwFtAgF46A==
expires
Tue, 13 Oct 2020 12:09:19 GMT
china-hack-apt41-540x270.jpg
media.threatpost.com/wp-content/uploads/sites/103/2020/03/25105551/ 		23 KB
23 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://media.threatpost.com/wp-content/uploads/sites/103/2020/03/25105551/china-hack-apt41-540x270.jpg
Requested by
Host: threatpost.com
URL: https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:20e8:5c00:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
392ee73494ad87dfd8e26d58894a845e8b3f2f8b0e4faea89562c45014be5ccb

Request headers

Referer
https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Wed, 25 Mar 2020 15:58:14 GMT
via
1.1 f1a4124f4c347609b380426ba659692a.cloudfront.net (CloudFront), 1.1 458f29e42261f01e7368474593f44b66.cloudfront.net (CloudFront)
last-modified
Wed, 25 Mar 2020 14:55:55 GMT
server
AmazonS3
age
87622
etag
"47f38a2c0dcffc1771fb30754bf2af62"
x-cache
Hit from cloudfront
content-type
image/jpeg
status
200
cache-control
max-age=31536000
x-amz-cf-pop
MUC51-C1, TXL52-C1
accept-ranges
bytes
content-length
23082
x-amz-cf-id
R-GwlG-MM3TKzJqgpGpFELF5_ClI-CRJWiGLqT4mKweYIOmVZZSsew==
expires
Thu, 25 Mar 2021 14:55:54 GMT
ge-540x270.jpg
media.threatpost.com/wp-content/uploads/sites/103/2020/03/25111238/ 		32 KB
32 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://media.threatpost.com/wp-content/uploads/sites/103/2020/03/25111238/ge-540x270.jpg
Requested by
Host: threatpost.com
URL: https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:20e8:5c00:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
9d472cb43e4b1b45017fd51ee4f226c9b94ac04da07e66a8513ef8283d3080ed

Request headers

Referer
https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Wed, 25 Mar 2020 15:38:38 GMT
via
1.1 8d84df16ba20ff1d2ca3914948494e04.cloudfront.net (CloudFront), 1.1 458f29e42261f01e7368474593f44b66.cloudfront.net (CloudFront)
last-modified
Wed, 25 Mar 2020 15:23:54 GMT
server
AmazonS3
age
88798
etag
"4263ec26fe88302b418228386e0d0cae"
x-cache
Hit from cloudfront
content-type
image/jpeg
status
200
cache-control
max-age=31536000
x-amz-cf-pop
FRA54, TXL52-C1
accept-ranges
bytes
content-length
32503
x-amz-cf-id
uaw_Vgbo7Kf_lmLKZVmhqLoF8sRt7SgaaQmdsNvmgokCfAAJPwwjAQ==
expires
Thu, 25 Mar 2021 15:23:51 GMT
facial-recognition-64x64.jpg
media.threatpost.com/wp-content/uploads/sites/103/2020/03/19155354/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://media.threatpost.com/wp-content/uploads/sites/103/2020/03/19155354/facial-recognition-64x64.jpg
Requested by
Host: threatpost.com
URL: https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:20e8:5c00:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
5fccf04445879579853f1dcbff29a1b6554b84940bbfef87495d921f7074eda5

Request headers

Referer
https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Sat, 21 Mar 2020 20:34:03 GMT
via
1.1 e019c898b002c690a9d0386f5c93064b.cloudfront.net (CloudFront), 1.1 458f29e42261f01e7368474593f44b66.cloudfront.net (CloudFront)
last-modified
Thu, 19 Mar 2020 19:53:58 GMT
server
AmazonS3
age
416673
etag
"69d7bd4a87caf61397a9061593eebf7d"
x-cache
Hit from cloudfront
content-type
image/jpeg
status
200
cache-control
max-age=31536000
x-amz-cf-pop
FRA54, TXL52-C1
accept-ranges
bytes
content-length
1901
x-amz-cf-id
vElKMYhPi-wQ5B__bQYYZSMUSDquc59eQi5VyuEgoMCW6CWY4n9JdA==
expires
Fri, 19 Mar 2021 19:53:57 GMT
Zyxel-NAS-64x64.png
media.threatpost.com/wp-content/uploads/sites/103/2020/03/20091135/ 		3 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://media.threatpost.com/wp-content/uploads/sites/103/2020/03/20091135/Zyxel-NAS-64x64.png
Requested by
Host: threatpost.com
URL: https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:20e8:5c00:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
6ebc39dd9f5d0636ce21bfb5e649135592ea460f7d914ebce9d3c31934084344

Request headers

Referer
https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Tue, 24 Mar 2020 15:22:00 GMT
via
1.1 fabe381dacc990f9c402cdc69b69dd26.cloudfront.net (CloudFront), 1.1 458f29e42261f01e7368474593f44b66.cloudfront.net (CloudFront)
last-modified
Fri, 20 Mar 2020 13:11:40 GMT
server
AmazonS3
age
176196
etag
"6ae623562370cc2b56e5645cdabcc212"
x-cache
Hit from cloudfront
content-type
image/png
status
200
cache-control
max-age=31536000
x-amz-cf-pop
FRA54, TXL52-C1
accept-ranges
bytes
content-length
3321
x-amz-cf-id
fYrTeE2z81wJrgTTwYDjxlk8lKEOT5oeyhfvkBZaDPWVHms5_OUPPQ==
expires
Sat, 20 Mar 2021 13:11:39 GMT
coronavirus2-64x64.jpg
media.threatpost.com/wp-content/uploads/sites/103/2020/03/19172625/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://media.threatpost.com/wp-content/uploads/sites/103/2020/03/19172625/coronavirus2-64x64.jpg
Requested by
Host: threatpost.com
URL: https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:20e8:5c00:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
8ed681a83db7d4d3cf3456a8074806806a93e8fe21dde41830da052c2f8f019a

Request headers

Referer
https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Mon, 23 Mar 2020 20:37:22 GMT
via
1.1 e30a30fbecb84c672048f3a7284aefa1.cloudfront.net (CloudFront), 1.1 458f29e42261f01e7368474593f44b66.cloudfront.net (CloudFront)
last-modified
Thu, 19 Mar 2020 21:26:30 GMT
server
AmazonS3
age
243675
etag
"6787fae27d062496e54fd7879a2c0105"
x-cache
Hit from cloudfront
content-type
image/jpeg
status
200
cache-control
max-age=31536000
x-amz-cf-pop
MUC51-C1, TXL52-C1
accept-ranges
bytes
content-length
2034
x-amz-cf-id
fwM20P-QMEkwpyDfr3t2tan6Yn-LxL2RQ-PtI9xgOGNMSBwfQoL7nA==
expires
Fri, 19 Mar 2021 21:26:29 GMT
cisco_patches-680x400-64x64.jpg
media.threatpost.com/wp-content/uploads/sites/103/2019/03/14115506/ 		1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://media.threatpost.com/wp-content/uploads/sites/103/2019/03/14115506/cisco_patches-680x400-64x64.jpg
Requested by
Host: threatpost.com
URL: https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:20e8:5c00:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
4741ff734da9b39028a4e4c753fe270823859cd88532ea40083e1647580a48df

Request headers

Referer
https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Tue, 24 Mar 2020 15:22:49 GMT
via
1.1 48d48000b22cc0a73550fdae51ee2662.cloudfront.net (CloudFront), 1.1 458f29e42261f01e7368474593f44b66.cloudfront.net (CloudFront)
last-modified
Thu, 14 Mar 2019 15:55:09 GMT
server
AmazonS3
age
176148
etag
"8f35bbd796334e38943cb74663021ddc"
x-cache
Hit from cloudfront
content-type
image/jpeg
status
200
cache-control
max-age=31536000
x-amz-cf-pop
MUC51-C1, TXL52-C1
accept-ranges
bytes
content-length
1458
x-amz-cf-id
mjZZIMVXOwO6oIG8wfWuRG8j8IWzx7271cKnukyaqr5sQ4rvaCwqGQ==
expires
Fri, 13 Mar 2020 15:55:06 GMT
work-from-home-64x64.jpg
media.threatpost.com/wp-content/uploads/sites/103/2020/03/13163335/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://media.threatpost.com/wp-content/uploads/sites/103/2020/03/13163335/work-from-home-64x64.jpg
Requested by
Host: threatpost.com
URL: https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:20e8:5c00:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
3435531b595fb1b2b529346e1df8c979a1fd727f56ea8c0d792316035440cac5

Request headers

Referer
https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Wed, 18 Mar 2020 14:57:00 GMT
via
1.1 e019c898b002c690a9d0386f5c93064b.cloudfront.net (CloudFront), 1.1 458f29e42261f01e7368474593f44b66.cloudfront.net (CloudFront)
last-modified
Fri, 13 Mar 2020 20:33:52 GMT
server
AmazonS3
age
696097
etag
"fd4942a0704785b24b44d177f4a57d86"
x-cache
Hit from cloudfront
content-type
image/jpeg
status
200
cache-control
max-age=31536000
x-amz-cf-pop
FRA54, TXL52-C1
accept-ranges
bytes
content-length
2098
x-amz-cf-id
glJmoHqKhkkvTURXxzlDiJVbyvOOdzNc20yZngvbQgxxEsTNW9qlxw==
expires
Sat, 13 Mar 2021 20:33:49 GMT
liveView.php
live.sekindo.com/live/ 		24 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://live.sekindo.com/live/liveView.php?s=101281&cbuster=%%CACHEBUSTER%%&pubUrl=%%REFERRER_URL_ESC%%&x=[WIDTH]&y=[HEIGHT]&vp_content=plembed173akunvrojp&vp_template=6615&subId=[SUBID_ENCODED]&schain=1.0,1!admetricspro.com,1005,1
Requested by
Host: threatpost.com
URL: https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
63.250.56.23 , United States, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software
nginx / PHP/7.3.15
Resource Hash
065b293b19740f39c385d1b0e8a3cc01a385a6d74edab2127096ceaec68175e2

Request headers

Referer
https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

Pragma
no-cache
Date
Thu, 26 Mar 2020 16:18:35 GMT
Content-Encoding
gzip
Server
nginx
Age
0
X-Powered-By
PHP/7.3.15
Transfer-Encoding
chunked
P3P
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin
*
Cache-Control
no-store
Content-Type
text/javascript; charset=utf-8
/
assets.threatpost.com/wp-content/plugins/bwp-minify/min/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/gravityforms/js/jquery.json.min.js&ver=3b294457
Requested by
Host: threatpost.com
URL: https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:20e8:1400:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
a9f6c03ce6f4d1654f29f2136651e883198d509cb2e26af1c24b1f87b6ccae13
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Thu, 26 Mar 2020 12:13:18 GMT
content-encoding
gzip
age
14717
x-cache
Hit from cloudfront
status
200
content-length
935
last-modified
Thu, 26 Mar 2020 12:12:02 GMT
server
nginx
cache-control
max-age=86400
x-frame-options
SAMEORIGIN
vary
Accept-Encoding
content-type
application/x-javascript; charset=utf-8
via
1.1 03c38fb105b43128049da1df5835ab5e.cloudfront.net (CloudFront)
x-cache-hit
MISS
x-debug-auth
off
x-amz-cf-pop
TXL52-C1
x-request-host
kasperskycontenthub.com
x-amz-cf-id
JJ6PIsatCiCVJGvzAUw3Y6BW0CIRrmZfVndNn-jvnxHU-81ppLxhWQ==
expires
Fri, 27 Mar 2020 12:13:18 GMT
gravityforms.min.js
threatpost.com/wp-content/plugins/gravityforms/js/ 		26 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://threatpost.com/wp-content/plugins/gravityforms/js/gravityforms.min.js?ver=2.2.6.5
Requested by
Host: threatpost.com
URL: https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
a783d2ad42c380bc896219c080fa845d1e9f2e77483558103aeb296b95b85701

Request headers

Referer
https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

Pragma
public
Date
Thu, 26 Mar 2020 16:18:40 GMT
Content-Encoding
gzip
Last-Modified
Thu, 26 Mar 2020 12:12:02 GMT
Server
nginx
ETag
W/"5e7c9c12-6923"
Transfer-Encoding
chunked
Content-Type
application/x-javascript
Cache-Control
max-age=604800, public
Connection
close
Expires
Thu, 02 Apr 2020 16:18:40 GMT
/
assets.threatpost.com/wp-content/plugins/bwp-minify/min/ 		6 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/gravityforms/js/conditional_logic.min.js&ver=3b294457
Requested by
Host: threatpost.com
URL: https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:20e8:1400:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
663ac3773e9741ad638447e6e9478f83e10e073c5ee433c5de3c640c7dae8c32
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Thu, 26 Mar 2020 12:13:17 GMT
content-encoding
gzip
age
14718
x-cache
Hit from cloudfront
status
200
content-length
2338
last-modified
Thu, 26 Mar 2020 12:11:37 GMT
server
nginx
cache-control
max-age=86400
x-frame-options
SAMEORIGIN
vary
Accept-Encoding
content-type
application/x-javascript; charset=utf-8
via
1.1 03c38fb105b43128049da1df5835ab5e.cloudfront.net (CloudFront)
x-cache-hit
MISS
x-debug-auth
off
x-amz-cf-pop
TXL52-C1
x-request-host
kasperskycontenthub.com
x-amz-cf-id
gyn9uABXZyZi17kmSbMnnFbiCPOPCZgwKGNwMbpF8weEnOR5DxWFlA==
expires
Fri, 27 Mar 2020 12:13:17 GMT
/
assets.threatpost.com/wp-content/plugins/bwp-minify/min/ 		5 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/gravityforms/js/placeholders.jquery.min.js&ver=3b294457
Requested by
Host: threatpost.com
URL: https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:20e8:1400:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
d62a7b7ec5313469ebff5c006b9068dc44d6d1c122cf787ffa29a10113b34060
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Thu, 26 Mar 2020 12:13:18 GMT
content-encoding
gzip
age
14717
x-cache
Hit from cloudfront
status
200
content-length
1747
last-modified
Thu, 26 Mar 2020 12:11:37 GMT
server
nginx
cache-control
max-age=86400
x-frame-options
SAMEORIGIN
vary
Accept-Encoding
content-type
application/x-javascript; charset=utf-8
via
1.1 03c38fb105b43128049da1df5835ab5e.cloudfront.net (CloudFront)
x-cache-hit
HIT
x-debug-auth
off
x-amz-cf-pop
TXL52-C1
x-request-host
kasperskycontenthub.com
x-amz-cf-id
0qQuDlLLf0rpH8-M3Sj5nw-lg5q3UC7o7ENLqHbutTADeqh-OKoJ3w==
expires
Fri, 27 Mar 2020 12:12:27 GMT
/
assets.threatpost.com/wp-content/plugins/bwp-minify/min/ 		1 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-includes/js/wp-embed.min.js&ver=3b294457
Requested by
Host: threatpost.com
URL: https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:20e8:1400:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
0284cbccebf1682452d62d06efa3665c874d642d4e03f5f5f9bb0f555da9251b
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Thu, 26 Mar 2020 12:13:17 GMT
content-encoding
gzip
age
14718
x-cache
Hit from cloudfront
status
200
content-length
740
last-modified
Wed, 18 Dec 2019 22:32:15 GMT
server
nginx
cache-control
max-age=86400
x-frame-options
SAMEORIGIN
vary
Accept-Encoding
content-type
application/x-javascript; charset=utf-8
via
1.1 03c38fb105b43128049da1df5835ab5e.cloudfront.net (CloudFront)
x-cache-hit
MISS
x-debug-auth
off
x-amz-cf-pop
TXL52-C1
x-request-host
kasperskycontenthub.com
x-amz-cf-id
IGHdM1e_NsbYLywn5oMv0S3cLoVzceQuoS3icyNK6o3Vh_IySvDvcA==
expires
Fri, 27 Mar 2020 12:13:17 GMT
gtm.js
www.googletagmanager.com/ 		71 KB
24 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-PM29HLF
Requested by
Host: threatpost.com
URL: https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:800::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
a6d511bca686ce80ae1e714e422c0e2b614d827ec7c9e7c40f60650d4098b4b6
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Referer
https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Thu, 26 Mar 2020 16:18:36 GMT
content-encoding
br
status
200
strict-transport-security
max-age=31536000; includeSubDomains
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
24361
x-xss-protection
0
last-modified
Thu, 26 Mar 2020 15:00:00 GMT
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
http://www.googletagmanager.com
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Thu, 26 Mar 2020 16:18:36 GMT
icons.svg
threatpost.com/wp-content/themes/threatpost-2018//assets/sprite/ 		11 KB
4 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://threatpost.com/wp-content/themes/threatpost-2018//assets/sprite/icons.svg
Requested by
Host: threatpost.com
URL: https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
76ba07e059d9e2113f9c940f1a31efc95bd9d5badd68bbc3637177e892a08099

Request headers

Referer
https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

Pragma
public
Date
Thu, 26 Mar 2020 16:18:40 GMT
Content-Encoding
gzip
Last-Modified
Thu, 26 Mar 2020 12:12:05 GMT
Server
nginx
ETag
W/"5e7c9c15-2b9f"
Transfer-Encoding
chunked
Content-Type
image/svg+xml
Cache-Control
max-age=604800, public
Connection
close
Expires
Thu, 02 Apr 2020 16:18:40 GMT
icons.svg
threatpost.com/wp-content/themes/threatpost-2018/assets/sprite/ 		11 KB
4 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://threatpost.com/wp-content/themes/threatpost-2018/assets/sprite/icons.svg
Requested by
Host: threatpost.com
URL: https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
76ba07e059d9e2113f9c940f1a31efc95bd9d5badd68bbc3637177e892a08099

Request headers

Referer
https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

Pragma
public
Date
Thu, 26 Mar 2020 16:18:40 GMT
Content-Encoding
gzip
Last-Modified
Thu, 26 Mar 2020 12:12:05 GMT
Server
nginx
ETag
W/"5e7c9c15-2b9f"
Transfer-Encoding
chunked
Content-Type
image/svg+xml
Cache-Control
max-age=604800, public
Connection
close
Expires
Thu, 02 Apr 2020 16:18:40 GMT
logo.png
threatpost.com/wp-content/themes/threatpost-2018/assets/images/ 		19 KB
19 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://threatpost.com/wp-content/themes/threatpost-2018/assets/images/logo.png
Requested by
Host: live.sekindo.com
URL: https://live.sekindo.com/live/liveView.php?s=101281&cbuster=%%CACHEBUSTER%%&pubUrl=%%REFERRER_URL_ESC%%&x=[WIDTH]&y=[HEIGHT]&vp_content=plembed173akunvrojp&vp_template=6615&subId=[SUBID_ENCODED]&schain=1.0,1!admetricspro.com,1005,1
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
39af7c1116fb967a330e8770f775e6b5ee871add01ed45c98a1634911cebfb0a

Request headers

Referer
https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1585224699
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

Pragma
public
Date
Thu, 26 Mar 2020 16:18:41 GMT
Last-Modified
Thu, 26 Mar 2020 12:12:05 GMT
Server
nginx
ETag
"5e7c9c15-4a32"
Content-Type
image/png
Cache-Control
max-age=604800, public
Connection
close
Accept-Ranges
bytes
Content-Length
18994
Expires
Thu, 02 Apr 2020 16:18:41 GMT
error-large-dark.svg
threatpost.com/wp-content/themes/threatpost-2018/assets/images/ 		629 B
673 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://threatpost.com/wp-content/themes/threatpost-2018/assets/images/error-large-dark.svg
Requested by
Host: live.sekindo.com
URL: https://live.sekindo.com/live/liveView.php?s=101281&cbuster=%%CACHEBUSTER%%&pubUrl=%%REFERRER_URL_ESC%%&x=[WIDTH]&y=[HEIGHT]&vp_content=plembed173akunvrojp&vp_template=6615&subId=[SUBID_ENCODED]&schain=1.0,1!admetricspro.com,1005,1
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
88c398db0cfca92ee248bd9e6aad3868c2ac54ae713370c93708b283dfb11c29

Request headers

Referer
https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1585224699
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

Pragma
public
Date
Thu, 26 Mar 2020 16:18:43 GMT
Content-Encoding
gzip
Last-Modified
Thu, 26 Mar 2020 12:12:05 GMT
Server
nginx
ETag
W/"5e7c9c15-275"
Transfer-Encoding
chunked
Content-Type
image/svg+xml
Cache-Control
max-age=604800, public
Connection
close
Expires
Thu, 02 Apr 2020 16:18:43 GMT
museosans-700-webfont.woff2
threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/ 		20 KB
21 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-700-webfont.woff2
Requested by
Host: live.sekindo.com
URL: https://live.sekindo.com/live/liveView.php?s=101281&cbuster=%%CACHEBUSTER%%&pubUrl=%%REFERRER_URL_ESC%%&x=[WIDTH]&y=[HEIGHT]&vp_content=plembed173akunvrojp&vp_template=6615&subId=[SUBID_ENCODED]&schain=1.0,1!admetricspro.com,1005,1
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
ae00ae9c862bc8b8923efd1d9a18befa912678a869d4dd01179a59ed3de731be

Request headers

Referer
https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1585224699
Origin
https://threatpost.com
Sec-Fetch-Dest
font
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
public
Date
Thu, 26 Mar 2020 16:18:36 GMT
Last-Modified
Thu, 26 Mar 2020 12:12:05 GMT
Server
nginx
ETag
"5e7c9c15-51a4"
Content-Type
font/woff2
Access-Control-Allow-Origin
*
Cache-Control
max-age=31536000, public
Connection
close
Accept-Ranges
bytes
Content-Length
20900
Expires
Fri, 26 Mar 2021 16:18:36 GMT
museosans-100-webfont.woff2
threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/ 		20 KB
21 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-100-webfont.woff2
Requested by
Host: live.sekindo.com
URL: https://live.sekindo.com/live/liveView.php?s=101281&cbuster=%%CACHEBUSTER%%&pubUrl=%%REFERRER_URL_ESC%%&x=[WIDTH]&y=[HEIGHT]&vp_content=plembed173akunvrojp&vp_template=6615&subId=[SUBID_ENCODED]&schain=1.0,1!admetricspro.com,1005,1
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
06fc565587b8b700936a1677218cb269a6cc31ca5f701eb45461e86a3d54d5c7

Request headers

Referer
https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1585224699
Origin
https://threatpost.com
Sec-Fetch-Dest
font
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
public
Date
Thu, 26 Mar 2020 16:18:37 GMT
Last-Modified
Thu, 26 Mar 2020 12:11:39 GMT
Server
nginx
ETag
"5e7c9bfb-50c8"
Content-Type
font/woff2
Access-Control-Allow-Origin
*
Cache-Control
max-age=31536000, public
Connection
close
Accept-Ranges
bytes
Content-Length
20680
Expires
Fri, 26 Mar 2021 16:18:37 GMT
museosans-300-webfont.woff2
threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/ 		20 KB
21 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-300-webfont.woff2
Requested by
Host: live.sekindo.com
URL: https://live.sekindo.com/live/liveView.php?s=101281&cbuster=%%CACHEBUSTER%%&pubUrl=%%REFERRER_URL_ESC%%&x=[WIDTH]&y=[HEIGHT]&vp_content=plembed173akunvrojp&vp_template=6615&subId=[SUBID_ENCODED]&schain=1.0,1!admetricspro.com,1005,1
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
45ddc09b0ad6ab916bd9a0282070b161045e186fc025303f4aa1aa821fc45ac7

Request headers

Referer
https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1585224699
Origin
https://threatpost.com
Sec-Fetch-Dest
font
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
public
Date
Thu, 26 Mar 2020 16:18:38 GMT
Last-Modified
Thu, 26 Mar 2020 12:12:05 GMT
Server
nginx
ETag
"5e7c9c15-51b8"
Content-Type
font/woff2
Access-Control-Allow-Origin
*
Cache-Control
max-age=31536000, public
Connection
close
Accept-Ranges
bytes
Content-Length
20920
Expires
Fri, 26 Mar 2021 16:18:38 GMT
museosans-500-webfont.woff2
threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/ 		20 KB
21 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-500-webfont.woff2
Requested by
Host: live.sekindo.com
URL: https://live.sekindo.com/live/liveView.php?s=101281&cbuster=%%CACHEBUSTER%%&pubUrl=%%REFERRER_URL_ESC%%&x=[WIDTH]&y=[HEIGHT]&vp_content=plembed173akunvrojp&vp_template=6615&subId=[SUBID_ENCODED]&schain=1.0,1!admetricspro.com,1005,1
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
2de77164bb9924542e1dea4ee4a0ff27d40b51a3d7939dac7db11a95045c9b7d

Request headers

Referer
https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1585224699
Origin
https://threatpost.com
Sec-Fetch-Dest
font
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
public
Date
Thu, 26 Mar 2020 16:18:38 GMT
Last-Modified
Thu, 26 Mar 2020 12:12:05 GMT
Server
nginx
ETag
"5e7c9c15-5194"
Content-Type
font/woff2
Access-Control-Allow-Origin
*
Cache-Control
max-age=31536000, public
Connection
close
Accept-Ranges
bytes
Content-Length
20884
Expires
Fri, 26 Mar 2021 16:18:38 GMT
museosans-300italic-webfont.woff2
threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/ 		23 KB
23 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-300italic-webfont.woff2
Requested by
Host: live.sekindo.com
URL: https://live.sekindo.com/live/liveView.php?s=101281&cbuster=%%CACHEBUSTER%%&pubUrl=%%REFERRER_URL_ESC%%&x=[WIDTH]&y=[HEIGHT]&vp_content=plembed173akunvrojp&vp_template=6615&subId=[SUBID_ENCODED]&schain=1.0,1!admetricspro.com,1005,1
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
f8a2b5b62eb722c3379b30cf0cc58d3176ee6be48036d6ad2aa838d2029c4189

Request headers

Referer
https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1585224699
Origin
https://threatpost.com
Sec-Fetch-Dest
font
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
public
Date
Thu, 26 Mar 2020 16:18:39 GMT
Last-Modified
Thu, 26 Mar 2020 12:11:39 GMT
Server
nginx
ETag
"5e7c9bfb-5bac"
Content-Type
font/woff2
Access-Control-Allow-Origin
*
Cache-Control
max-age=31536000, public
Connection
close
Accept-Ranges
bytes
Content-Length
23468
Expires
Fri, 26 Mar 2021 16:18:39 GMT
liveView.php
live.sekindo.com/live/ Frame 9211 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://live.sekindo.com/live/liveView.php?s=101281&cbuster=%%CACHEBUSTER%%&pubUrl=%%REFERRER_URL_ESC%%&x=[WIDTH]&y=[HEIGHT]&vp_content=plembed173akunvrojp&vp_template=6615&subId=[SUBID_ENCODED]&schain=1.0,1!admetricspro.com,1005,1&cbuster=1585239515&pubUrlAuto=https%3A%2F%2Fthreatpost.com%2Firanian-apt-targets-govs-with-new-malware%2F%3D&videoType=flow&floatWidth=320&floatHeight=180&floatDirection=br&floatVerticalOffset=10&floatHorizontalOffset=10&floatCloseBtn=1&flowMode=undefined
Requested by
Host: live.sekindo.com
URL: https://live.sekindo.com/live/liveView.php?s=101281&cbuster=%%CACHEBUSTER%%&pubUrl=%%REFERRER_URL_ESC%%&x=[WIDTH]&y=[HEIGHT]&vp_content=plembed173akunvrojp&vp_template=6615&subId=[SUBID_ENCODED]&schain=1.0,1!admetricspro.com,1005,1
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
63.250.56.23 , United States, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software
nginx / PHP/7.3.15
Resource Hash
6bd9e5a7f4cbf05c024f933c04b204deb17bff95a3a63131e2507161ae87156c

Request headers

Referer
https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

Pragma
no-cache
Date
Thu, 26 Mar 2020 16:18:35 GMT
Content-Encoding
gzip
Server
nginx
Age
0
X-Powered-By
PHP/7.3.15
Transfer-Encoding
chunked
P3P
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin
*
Cache-Control
no-store
Content-Type
text/javascript; charset=utf-8
mail-plane-large-dark.svg
threatpost.com/wp-content/themes/threatpost-2018/assets/images/ 		812 B
722 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://threatpost.com/wp-content/themes/threatpost-2018/assets/images/mail-plane-large-dark.svg
Requested by
Host: threatpost.com
URL: https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
a9d2b2df99c1a115d5394c70a898d8801092208dc582f8bd6fb01b35c30d6b22

Request headers

Referer
https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1585224699
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

Pragma
public
Date
Thu, 26 Mar 2020 16:18:51 GMT
Content-Encoding
gzip
Last-Modified
Thu, 26 Mar 2020 12:12:05 GMT
Server
nginx
ETag
W/"5e7c9c15-32c"
Transfer-Encoding
chunked
Content-Type
image/svg+xml
Cache-Control
max-age=604800, public
Connection
close
Expires
Thu, 02 Apr 2020 16:18:51 GMT
logo-white.png
threatpost.com/wp-content/themes/threatpost-2018/assets/images/ 		10 KB
10 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://threatpost.com/wp-content/themes/threatpost-2018/assets/images/logo-white.png
Requested by
Host: threatpost.com
URL: https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
e4058d4ee9da1ceaddfa91ddb63650ba67285f1bbfee487d9dfe648bced669a0

Request headers

Referer
https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1585224699
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

Pragma
public
Date
Thu, 26 Mar 2020 16:18:51 GMT
Last-Modified
Thu, 26 Mar 2020 12:12:05 GMT
Server
nginx
ETag
"5e7c9c15-260a"
Content-Type
image/png
Cache-Control
max-age=604800, public
Connection
close
Accept-Ranges
bytes
Content-Length
9738
Expires
Thu, 02 Apr 2020 16:18:51 GMT
museosans-700italic-webfont.woff2
threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/ 		15 KB
16 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-700italic-webfont.woff2
Requested by
Host: threatpost.com
URL: https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
859faa9b9ed0990288b2f393a102b1fe2668ac79088b113b6f0beaee521221eb

Request headers

Referer
https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1585224699
Origin
https://threatpost.com
Sec-Fetch-Dest
font
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
public
Date
Thu, 26 Mar 2020 16:18:40 GMT
Last-Modified
Thu, 26 Mar 2020 12:11:39 GMT
Server
nginx
ETag
"5e7c9bfb-3dcc"
Content-Type
font/woff2
Access-Control-Allow-Origin
*
Cache-Control
max-age=31536000, public
Connection
close
Accept-Ranges
bytes
Content-Length
15820
Expires
Fri, 26 Mar 2021 16:18:40 GMT
DetectGDPR2.v1.0.js
live.sekindo.com/content/ClientDetections/ Frame 9211 		8 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://live.sekindo.com/content/ClientDetections/DetectGDPR2.v1.0.js
Requested by
Host: live.sekindo.com
URL: https://live.sekindo.com/live/liveView.php?s=101281&cbuster=%%CACHEBUSTER%%&pubUrl=%%REFERRER_URL_ESC%%&x=[WIDTH]&y=[HEIGHT]&vp_content=plembed173akunvrojp&vp_template=6615&subId=[SUBID_ENCODED]&schain=1.0,1!admetricspro.com,1005,1&cbuster=1585239515&pubUrlAuto=https%3A%2F%2Fthreatpost.com%2Firanian-apt-targets-govs-with-new-malware%2F%3D&videoType=flow&floatWidth=320&floatHeight=180&floatDirection=br&floatVerticalOffset=10&floatHorizontalOffset=10&floatCloseBtn=1&flowMode=undefined
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
63.250.56.23 , United States, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software
nginx /
Resource Hash
ace61d80f3fe90bbb02ab328d9705b57a9c8a95d3a0bf6b4cd510d4dacd033df

Request headers

Referer
https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

Date
Thu, 26 Mar 2020 16:18:36 GMT
Content-Encoding
gzip
Last-Modified
Sun, 26 Jan 2020 18:48:12 GMT
Server
nginx
ETag
W/"5e2ddeec-211f"
Transfer-Encoding
chunked
Content-Type
application/javascript
Cache-Control
max-age=31536000, public
Expires
Fri, 26 Mar 2021 16:18:36 GMT
iab_consent_sdk.v1.0.js
live.sekindo.com/content/ClientDetections/ Frame 9211 		19 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://live.sekindo.com/content/ClientDetections/iab_consent_sdk.v1.0.js
Requested by
Host: live.sekindo.com
URL: https://live.sekindo.com/live/liveView.php?s=101281&cbuster=%%CACHEBUSTER%%&pubUrl=%%REFERRER_URL_ESC%%&x=[WIDTH]&y=[HEIGHT]&vp_content=plembed173akunvrojp&vp_template=6615&subId=[SUBID_ENCODED]&schain=1.0,1!admetricspro.com,1005,1&cbuster=1585239515&pubUrlAuto=https%3A%2F%2Fthreatpost.com%2Firanian-apt-targets-govs-with-new-malware%2F%3D&videoType=flow&floatWidth=320&floatHeight=180&floatDirection=br&floatVerticalOffset=10&floatHorizontalOffset=10&floatCloseBtn=1&flowMode=undefined
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
63.250.56.23 , United States, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software
nginx /
Resource Hash
a3336e3373c170b40764f5a62d121335bec4243b0034e561937194dfe2e413fd

Request headers

Referer
https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

Date
Thu, 26 Mar 2020 16:18:36 GMT
Content-Encoding
gzip
Last-Modified
Wed, 12 Feb 2020 15:01:36 GMT
Server
nginx
ETag
W/"5e441350-4be0"
Transfer-Encoding
chunked
Content-Type
application/javascript
Cache-Control
max-age=31536000, public
Expires
Fri, 26 Mar 2021 16:18:36 GMT
DetectGDPR.v1.0.js
live.sekindo.com/content/ClientDetections/ Frame 9211 		7 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://live.sekindo.com/content/ClientDetections/DetectGDPR.v1.0.js
Requested by
Host: live.sekindo.com
URL: https://live.sekindo.com/live/liveView.php?s=101281&cbuster=%%CACHEBUSTER%%&pubUrl=%%REFERRER_URL_ESC%%&x=[WIDTH]&y=[HEIGHT]&vp_content=plembed173akunvrojp&vp_template=6615&subId=[SUBID_ENCODED]&schain=1.0,1!admetricspro.com,1005,1&cbuster=1585239515&pubUrlAuto=https%3A%2F%2Fthreatpost.com%2Firanian-apt-targets-govs-with-new-malware%2F%3D&videoType=flow&floatWidth=320&floatHeight=180&floatDirection=br&floatVerticalOffset=10&floatHorizontalOffset=10&floatCloseBtn=1&flowMode=undefined
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
63.250.56.23 , United States, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software
nginx /
Resource Hash
993ebc45d9927d420801f05819222e8cc1aa523187e4c0b290df02b23ce18093

Request headers

Referer
https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

Date
Thu, 26 Mar 2020 16:18:35 GMT
Content-Encoding
gzip
Last-Modified
Sun, 26 Jan 2020 11:58:13 GMT
Server
nginx
ETag
W/"5e2d7ed5-1d87"
Transfer-Encoding
chunked
Content-Type
application/javascript
Cache-Control
max-age=31536000, public
Expires
Fri, 26 Mar 2021 16:18:35 GMT
hls.0.12.4_1.min.js
live.sekindo.com/content/video/hls/ Frame 9211 		247 KB
85 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://live.sekindo.com/content/video/hls/hls.0.12.4_1.min.js
Requested by
Host: live.sekindo.com
URL: https://live.sekindo.com/live/liveView.php?s=101281&cbuster=%%CACHEBUSTER%%&pubUrl=%%REFERRER_URL_ESC%%&x=[WIDTH]&y=[HEIGHT]&vp_content=plembed173akunvrojp&vp_template=6615&subId=[SUBID_ENCODED]&schain=1.0,1!admetricspro.com,1005,1&cbuster=1585239515&pubUrlAuto=https%3A%2F%2Fthreatpost.com%2Firanian-apt-targets-govs-with-new-malware%2F%3D&videoType=flow&floatWidth=320&floatHeight=180&floatDirection=br&floatVerticalOffset=10&floatHorizontalOffset=10&floatCloseBtn=1&flowMode=undefined
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
63.250.56.23 , United States, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software
nginx /
Resource Hash
7d0492c66125b1c2bdc419641e41542857e7d90e323d355ee0b8bb268da121fb

Request headers

Referer
https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

Date
Thu, 26 Mar 2020 16:18:36 GMT
Content-Encoding
gzip
Last-Modified
Mon, 06 Jan 2020 15:31:56 GMT
Server
nginx
ETag
W/"5e1352ec-3dcb9"
Transfer-Encoding
chunked
Content-Type
application/javascript
Cache-Control
max-age=31536000, public
Expires
Fri, 26 Mar 2021 16:18:36 GMT
prebidVid.2.44.3_2.min.js
live.sekindo.com/content/prebid/ Frame 9211 		267 KB
99 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://live.sekindo.com/content/prebid/prebidVid.2.44.3_2.min.js
Requested by
Host: live.sekindo.com
URL: https://live.sekindo.com/live/liveView.php?s=101281&cbuster=%%CACHEBUSTER%%&pubUrl=%%REFERRER_URL_ESC%%&x=[WIDTH]&y=[HEIGHT]&vp_content=plembed173akunvrojp&vp_template=6615&subId=[SUBID_ENCODED]&schain=1.0,1!admetricspro.com,1005,1&cbuster=1585239515&pubUrlAuto=https%3A%2F%2Fthreatpost.com%2Firanian-apt-targets-govs-with-new-malware%2F%3D&videoType=flow&floatWidth=320&floatHeight=180&floatDirection=br&floatVerticalOffset=10&floatHorizontalOffset=10&floatCloseBtn=1&flowMode=undefined
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
63.250.56.23 , United States, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software
nginx /
Resource Hash
4ee36d77a67f176a8468c3fafd5c230a2b8584293b81221b004619e700f84106

Request headers

Referer
https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

Date
Thu, 26 Mar 2020 16:18:36 GMT
Content-Encoding
gzip
Last-Modified
Thu, 30 Jan 2020 06:21:36 GMT
Server
nginx
ETag
W/"5e3275f0-42b3f"
Transfer-Encoding
chunked
Content-Type
application/javascript
Cache-Control
max-age=31536000, public
Expires
Fri, 26 Mar 2021 16:18:36 GMT
liveVideo.php
live.sekindo.com/live/ Frame 9211 		364 KB
106 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://live.sekindo.com/live/liveVideo.php?vpaidManager=sekindo&s=58057&ri=6C69766553746174737C736B317B54307D7B64323032302D30332D32365F31387D7B7331323334383830387D7B4338357D7B53644768795A5746306347397A6443356A6232303D7D7B626368726F6D657D7B716465736B746F707D7B6F6D61636F73787D7B583330307D7B593235307D7B66317D7B4C363631357DFEFE&userIpAddr=82.102.19.134&userUA=Mozilla%2F5.0+%28Macintosh%3B+Intel+Mac+OS+X+10_14_5%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F74.0.3729.169+Safari%2F537.36&playerVersion=3.0.0&fpl=-1&debugInformation=&isWePassGdpr=0&schain=1.0%2C1%21admetricspro.com%2C1005%2C1&csuuid=5e7cd5dc462d3&debugInfo=12348808_&debugPlayerSession=&sta=12348808&showLogo=0&clkUrl=&plMult=-1&schedule=eyJwcmVfcm9sbCI6MSwibWlkX3JvbGwiOltdLCJnYXAiOiJhdXRvIn0%3D&content=plembed173akunvrojp&secondaryContent=&x=300&y=250&pubUrl=https%3A%2F%2Fthreatpost.com%2Firanian-apt-targets-govs-with-new-malware%2F%3D&contentNum=1&flow_closeBtn=1&flowCloseTimeout=0&flow_direction=br&flow_horizontalOffset=10&flow_bottomOffset=10&impGap=2&flow_width=320&flow_height=180&videoType=flow&gdpr=1&gdprConsent=&contentFeedId=&geoLati=50.884700775146484&geoLong=4.504899978637695&vpTemplate=6615&flowMode=both&isRealPreroll=0&playerApiId=&isApp=0&gdpr2Consent=&ccpa=0&ccpaConsent=
Requested by
Host: live.sekindo.com
URL: https://live.sekindo.com/live/liveView.php?s=101281&cbuster=%%CACHEBUSTER%%&pubUrl=%%REFERRER_URL_ESC%%&x=[WIDTH]&y=[HEIGHT]&vp_content=plembed173akunvrojp&vp_template=6615&subId=[SUBID_ENCODED]&schain=1.0,1!admetricspro.com,1005,1&cbuster=1585239515&pubUrlAuto=https%3A%2F%2Fthreatpost.com%2Firanian-apt-targets-govs-with-new-malware%2F%3D&videoType=flow&floatWidth=320&floatHeight=180&floatDirection=br&floatVerticalOffset=10&floatHorizontalOffset=10&floatCloseBtn=1&flowMode=undefined
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
63.250.56.23 , United States, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software
nginx / PHP/7.3.15
Resource Hash
bb0c184958d3cddcd59e211f3c8c85905b5cfe0c48b79cbb09b59d8d79487502

Request headers

Referer
https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

Date
Thu, 26 Mar 2020 16:18:35 GMT
Content-Encoding
gzip
Server
nginx
X-Powered-By
PHP/7.3.15
Transfer-Encoding
chunked
Content-Type
text/html; charset=UTF-8
analytics.js
www.google-analytics.com/ 		44 KB
18 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PM29HLF
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:817::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
eaf1b128b927ac2868755cb7366d35554255c8af362235afe270f9614f8c806d
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 06 Feb 2020 00:21:02 GMT
server
Golfe2
age
6001
date
Thu, 26 Mar 2020 14:38:35 GMT
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=7200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
18174
expires
Thu, 26 Mar 2020 16:38:35 GMT
quant.js
secure.quantserve.com/ 		13 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://secure.quantserve.com/quant.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PM29HLF
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
91.228.74.224 , United Kingdom, ASN27281 (QUANTCAST, US),
Reverse DNS
Software
QS /
Resource Hash
e8d7c60749c1d62942a8e0a6f901800bd14ff3094251373626cd99a8875c6391
Security Headers
Name Value
Strict-Transport-Security max-age=86400

Request headers

Referer
https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

Date
Thu, 26 Mar 2020 16:18:36 GMT
Content-Encoding
gzip
Last-Modified
Thu, 26-Mar-2020 16:18:36 GMT
Server
QS
Etag
M0-56c8c653
Vary
Accept-Encoding
Strict-Transport-Security
max-age=86400
Content-Type
application/x-javascript
Cache-Control
private, no-transform, max-age=604800
Connection
keep-alive
Content-Length
5651
Expires
Thu, 02 Apr 2020 16:18:36 GMT
uwt.js
static.ads-twitter.com/ 		5 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.ads-twitter.com/uwt.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PM29HLF
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.112.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
319949c8c08b86e9c35ea542c0dc0c30cedaa9b8d3d3c3327a36c91aefbd8af5

Request headers

Referer
https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Thu, 26 Mar 2020 16:18:36 GMT
content-encoding
gzip
age
29078
x-cache
HIT
p3p
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status
200
content-length
1954
x-served-by
cache-hhn4060-HHN
last-modified
Tue, 23 Jan 2018 20:09:00 GMT
x-timer
S1585239516.453339,VS0,VE0
etag
"b7b33882a4f3ffd5cbf07434f3137166+gzip"
vary
Accept-Encoding,Host
content-type
application/javascript; charset=utf-8
via
1.1 varnish
cache-control
no-cache
accept-ranges
bytes
ga-audiences
www.google.de/ads/
Redirect Chain
  • https://www.google-analytics.com/r/collect?v=1&_v=j81&aip=1&a=1487547085&t=pageview&_s=1&dl=https%3A%2F%2Fthreatpost.com%2Firanian-apt-targets-govs-with-new-malware%2F%3D&ul=en-us&de=UTF-8&dt=404%2...
  • https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-35676203-21&cid=921593550.1585239516&jid=1671306874&_gid=149282076.1585239516&gjid=455186752&_v=j81&z=1828903002
  • https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-35676203-21&cid=921593550.1585239516&jid=1671306874&_v=j81&z=1828903002
  • https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-35676203-21&cid=921593550.1585239516&jid=1671306874&_v=j81&z=1828903002&slf_rd=1&random=463711607
42 B
109 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-35676203-21&cid=921593550.1585239516&jid=1671306874&_v=j81&z=1828903002&slf_rd=1&random=463711607
Requested by
Host: threatpost.com
URL: https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 26 Mar 2020 16:18:36 GMT
x-content-type-options
nosniff
content-type
image/gif
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
no-cache, no-store, must-revalidate
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Thu, 26 Mar 2020 16:18:36 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
location
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-35676203-21&cid=921593550.1585239516&jid=1671306874&_v=j81&z=1828903002&slf_rd=1&random=463711607
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
302
cache-control
no-cache, no-store, must-revalidate
content-type
text/html; charset=UTF-8
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
adsct
t.co/i/ 		43 B
448 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://t.co/i/adsct?p_id=Twitter&p_user_id=0&txn_id=ntt0j&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0
Requested by
Host: threatpost.com
URL: https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.244.42.197 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=0
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Thu, 26 Mar 2020 16:18:37 GMT
content-encoding
gzip
x-content-type-options
nosniff
status
200, 200 OK
x-twitter-response-tags
BouncerCompliant
strict-transport-security
max-age=0
content-length
65
x-xss-protection
0
x-response-time
120
pragma
no-cache
last-modified
Thu, 26 Mar 2020 16:18:37 GMT
server
tsa_o
x-frame-options
SAMEORIGIN
content-type
image/gif;charset=utf-8
cache-control
no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash
d098ed41a0a8dad02e6dcda861d8eba8
x-transaction
00fedcbd00a12ac9
expires
Tue, 31 Mar 1981 05:00:00 GMT
apstag.js
c.amazon-adsystem.com/aax2/ Frame 9211 		87 KB
25 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://c.amazon-adsystem.com/aax2/apstag.js
Requested by
Host: live.sekindo.com
URL: https://live.sekindo.com/live/liveVideo.php?vpaidManager=sekindo&s=58057&ri=6C69766553746174737C736B317B54307D7B64323032302D30332D32365F31387D7B7331323334383830387D7B4338357D7B53644768795A5746306347397A6443356A6232303D7D7B626368726F6D657D7B716465736B746F707D7B6F6D61636F73787D7B583330307D7B593235307D7B66317D7B4C363631357DFEFE&userIpAddr=82.102.19.134&userUA=Mozilla%2F5.0+%28Macintosh%3B+Intel+Mac+OS+X+10_14_5%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F74.0.3729.169+Safari%2F537.36&playerVersion=3.0.0&fpl=-1&debugInformation=&isWePassGdpr=0&schain=1.0%2C1%21admetricspro.com%2C1005%2C1&csuuid=5e7cd5dc462d3&debugInfo=12348808_&debugPlayerSession=&sta=12348808&showLogo=0&clkUrl=&plMult=-1&schedule=eyJwcmVfcm9sbCI6MSwibWlkX3JvbGwiOltdLCJnYXAiOiJhdXRvIn0%3D&content=plembed173akunvrojp&secondaryContent=&x=300&y=250&pubUrl=https%3A%2F%2Fthreatpost.com%2Firanian-apt-targets-govs-with-new-malware%2F%3D&contentNum=1&flow_closeBtn=1&flowCloseTimeout=0&flow_direction=br&flow_horizontalOffset=10&flow_bottomOffset=10&impGap=2&flow_width=320&flow_height=180&videoType=flow&gdpr=1&gdprConsent=&contentFeedId=&geoLati=50.884700775146484&geoLong=4.504899978637695&vpTemplate=6615&flowMode=both&isRealPreroll=0&playerApiId=&isApp=0&gdpr2Consent=&ccpa=0&ccpaConsent=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
13.224.199.29 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-224-199-29.fra2.r.cloudfront.net
Software
Server /
Resource Hash
ac2a58f9d55c4642121cfb6f7e213cbc882bbdd75ef171ca8a07ed982ef693ce

Request headers

Referer
https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Wed, 25 Mar 2020 22:00:55 GMT
content-encoding
gzip
server
Server
age
65861
etag
1dcfbf3986ee8b9c3abbc67eb808ab43
x-cache
Hit from cloudfront
content-type
application/javascript
status
200
cache-control
public, max-age=86400
x-amz-cf-pop
FRA2-C1
accept-ranges
bytes
x-amz-cf-id
1EFgnENPflwHTvx6xJS3rZHbKIiIEoFAdrQABwve0Yuk3e6Wz5MLtA==
via
1.1 eb83e7e264681d87a86c9b6a2159e502.cloudfront.net (CloudFront)
aps_csm.js
c.amazon-adsystem.com/bao-csm/aps-comm/ Frame 9211 		6 KB
3 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by
Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
13.224.199.29 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-224-199-29.fra2.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844

Request headers

Referer
https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
Origin
https://threatpost.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 26 Mar 2020 03:02:36 GMT
content-encoding
gzip
vary
Origin
age
47762
x-cache
Hit from cloudfront
status
200
access-control-allow-origin
*
last-modified
Thu, 05 Mar 2020 08:28:46 GMT
server
AmazonS3
access-control-max-age
3000
access-control-allow-methods
GET
content-type
application/javascript
via
1.1 2ec3090d74e200e4acdb2780da3c3c44.cloudfront.net (CloudFront)
cache-control
public, max-age=86400
x-amz-cf-pop
FRA2-C1
x-amz-cf-id
QlGLuodwXDjocoGlrJ1mmWtxuIU97qYXCsgvtcprQ_qm4jJtt36KCg==
css
fonts.googleapis.com/ Frame 9615 		2 KB
677 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Roboto&display=swap
Requested by
Host: live.sekindo.com
URL: https://live.sekindo.com/live/liveVideo.php?vpaidManager=sekindo&s=58057&ri=6C69766553746174737C736B317B54307D7B64323032302D30332D32365F31387D7B7331323334383830387D7B4338357D7B53644768795A5746306347397A6443356A6232303D7D7B626368726F6D657D7B716465736B746F707D7B6F6D61636F73787D7B583330307D7B593235307D7B66317D7B4C363631357DFEFE&userIpAddr=82.102.19.134&userUA=Mozilla%2F5.0+%28Macintosh%3B+Intel+Mac+OS+X+10_14_5%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F74.0.3729.169+Safari%2F537.36&playerVersion=3.0.0&fpl=-1&debugInformation=&isWePassGdpr=0&schain=1.0%2C1%21admetricspro.com%2C1005%2C1&csuuid=5e7cd5dc462d3&debugInfo=12348808_&debugPlayerSession=&sta=12348808&showLogo=0&clkUrl=&plMult=-1&schedule=eyJwcmVfcm9sbCI6MSwibWlkX3JvbGwiOltdLCJnYXAiOiJhdXRvIn0%3D&content=plembed173akunvrojp&secondaryContent=&x=300&y=250&pubUrl=https%3A%2F%2Fthreatpost.com%2Firanian-apt-targets-govs-with-new-malware%2F%3D&contentNum=1&flow_closeBtn=1&flowCloseTimeout=0&flow_direction=br&flow_horizontalOffset=10&flow_bottomOffset=10&impGap=2&flow_width=320&flow_height=180&videoType=flow&gdpr=1&gdprConsent=&contentFeedId=&geoLati=50.884700775146484&geoLong=4.504899978637695&vpTemplate=6615&flowMode=both&isRealPreroll=0&playerApiId=&isApp=0&gdpr2Consent=&ccpa=0&ccpaConsent=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:821::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
00d4fbacbadc6ecbd73be323ec77febf3d856ce00dc5334d06462a315c7da8e7
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
style

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
x-xss-protection
0
last-modified
Thu, 26 Mar 2020 16:18:36 GMT
server
ESF
date
Thu, 26 Mar 2020 16:18:36 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Thu, 26 Mar 2020 16:18:36 GMT
css
fonts.googleapis.com/ Frame 3C77 		2 KB
632 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Roboto&display=swap
Requested by
Host: live.sekindo.com
URL: https://live.sekindo.com/live/liveVideo.php?vpaidManager=sekindo&s=58057&ri=6C69766553746174737C736B317B54307D7B64323032302D30332D32365F31387D7B7331323334383830387D7B4338357D7B53644768795A5746306347397A6443356A6232303D7D7B626368726F6D657D7B716465736B746F707D7B6F6D61636F73787D7B583330307D7B593235307D7B66317D7B4C363631357DFEFE&userIpAddr=82.102.19.134&userUA=Mozilla%2F5.0+%28Macintosh%3B+Intel+Mac+OS+X+10_14_5%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F74.0.3729.169+Safari%2F537.36&playerVersion=3.0.0&fpl=-1&debugInformation=&isWePassGdpr=0&schain=1.0%2C1%21admetricspro.com%2C1005%2C1&csuuid=5e7cd5dc462d3&debugInfo=12348808_&debugPlayerSession=&sta=12348808&showLogo=0&clkUrl=&plMult=-1&schedule=eyJwcmVfcm9sbCI6MSwibWlkX3JvbGwiOltdLCJnYXAiOiJhdXRvIn0%3D&content=plembed173akunvrojp&secondaryContent=&x=300&y=250&pubUrl=https%3A%2F%2Fthreatpost.com%2Firanian-apt-targets-govs-with-new-malware%2F%3D&contentNum=1&flow_closeBtn=1&flowCloseTimeout=0&flow_direction=br&flow_horizontalOffset=10&flow_bottomOffset=10&impGap=2&flow_width=320&flow_height=180&videoType=flow&gdpr=1&gdprConsent=&contentFeedId=&geoLati=50.884700775146484&geoLong=4.504899978637695&vpTemplate=6615&flowMode=both&isRealPreroll=0&playerApiId=&isApp=0&gdpr2Consent=&ccpa=0&ccpaConsent=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:821::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
00d4fbacbadc6ecbd73be323ec77febf3d856ce00dc5334d06462a315c7da8e7
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
style

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
x-xss-protection
0
last-modified
Thu, 26 Mar 2020 16:18:36 GMT
server
ESF
date
Thu, 26 Mar 2020 16:18:36 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Thu, 26 Mar 2020 16:18:36 GMT
placeHolder.png
live.sekindo.com/content/video/splayer/assets/ 		23 KB
24 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://live.sekindo.com/content/video/splayer/assets/placeHolder.png
Requested by
Host: threatpost.com
URL: https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
63.250.56.23 , United States, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software
nginx /
Resource Hash
76102878c1198de858725194952ba1c6b35bdee0f870cc6a124e93d17385e64e

Request headers

Referer
https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

Date
Thu, 26 Mar 2020 16:18:36 GMT
Last-Modified
Sun, 11 Jun 2017 08:03:58 GMT
Server
nginx
ETag
"593cf96e-5dbf"
Content-Type
image/png
Cache-Control
no-cache, private
Accept-Ranges
bytes
Content-Length
23999
Expires
Thu, 26 Mar 2020 16:18:35 GMT
vid5e7bc8c759a30254664862.jpg
video.sekindo.com/uploads/cn11/video/users/converted/28530/video_5d5baf9fe4c32389620327/ Frame 3C77 		11 KB
11 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://video.sekindo.com/uploads/cn11/video/users/converted/28530/video_5d5baf9fe4c32389620327/vid5e7bc8c759a30254664862.jpg?cbuster=1585170639
Requested by
Host: threatpost.com
URL: https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
185.220.204.11 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software
Tengine /
Resource Hash
a4fa6b6ff70552afacee85cdc4cc79e92eb662513ca8c93ee2bca4d2c265f661
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Referer
https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

Date
Thu, 26 Mar 2020 16:18:34 GMT
Last-Modified
Wed, 25 Mar 2020 21:11:34 GMT
Server
Tengine
ETag
"5e7bc906-2c48"
X-Cache-Status
HIT
Strict-Transport-Security
max-age=31536000
Content-Type
image/jpeg
Cache-Control
max-age=315360000
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=25
Content-Length
11336
Expires
Thu, 31 Dec 2037 23:55:55 GMT
vid5e7bc8cf7d7ab632262345.jpg
video.sekindo.com/uploads/cn11/video/users/converted/28530/video_5d5baf9fe4c32389620327/ Frame 3C77 		29 KB
29 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://video.sekindo.com/uploads/cn11/video/users/converted/28530/video_5d5baf9fe4c32389620327/vid5e7bc8cf7d7ab632262345.jpg?cbuster=1585170643
Requested by
Host: threatpost.com
URL: https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
185.220.204.11 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software
Tengine /
Resource Hash
9e97043df2dc7e0f4f3a898102f5a6e93bb1b01d03a55ede10f8f97bd8079a18
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Referer
https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

Date
Thu, 26 Mar 2020 16:18:34 GMT
Last-Modified
Wed, 25 Mar 2020 21:11:42 GMT
Server
Tengine
ETag
"5e7bc90e-7438"
X-Cache-Status
HIT
Strict-Transport-Security
max-age=31536000
Content-Type
image/jpeg
Cache-Control
max-age=315360000
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=25
Content-Length
29752
Expires
Thu, 31 Dec 2037 23:55:55 GMT
vid5e755143ae5c1045852669.jpg
video.sekindo.com/uploads/cn4/video/users/converted/24485/video1523972806/ Frame 3C77 		12 KB
12 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://video.sekindo.com/uploads/cn4/video/users/converted/24485/video1523972806/vid5e755143ae5c1045852669.jpg?cbuster=1584746820
Requested by
Host: threatpost.com
URL: https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
185.220.204.11 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software
Tengine /
Resource Hash
7fe9c9bddddeedcfcc45dadb0f0c5f57cce1393013fff5d2c85ec6e9556d1414
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Referer
https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

Date
Thu, 26 Mar 2020 16:18:34 GMT
Last-Modified
Sat, 21 Mar 2020 08:19:02 GMT
Server
Tengine
ETag
"5e75cdf6-3019"
X-Cache-Status
HIT
Strict-Transport-Security
max-age=31536000
Content-Type
image/jpeg
Cache-Control
max-age=315360000
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=25
Content-Length
12313
Expires
Thu, 31 Dec 2037 23:55:55 GMT
vid5e7497d367e55463572644.jpg
video.sekindo.com/uploads/cn5/video/users/converted/24485/video1523972806/ Frame 3C77 		18 KB
18 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://video.sekindo.com/uploads/cn5/video/users/converted/24485/video1523972806/vid5e7497d367e55463572644.jpg?cbuster=1584699348
Requested by
Host: threatpost.com
URL: https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
185.220.204.11 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software
Tengine /
Resource Hash
1375c3a601c8c119942e35a8a9b340c0a44c53b15983e961295f04dc66889da9
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Referer
https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

Date
Thu, 26 Mar 2020 16:18:34 GMT
Last-Modified
Fri, 20 Mar 2020 16:35:26 GMT
Server
Tengine
ETag
"5e74f0ce-47da"
X-Cache-Status
HIT
Strict-Transport-Security
max-age=31536000
Content-Type
image/jpeg
Cache-Control
max-age=315360000
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=25
Content-Length
18394
Expires
Thu, 31 Dec 2037 23:55:55 GMT
vid5e78c63388ed7519841362.jpg
video.sekindo.com/uploads/cn3/video/users/converted/24485/video1523972806/ Frame 3C77 		20 KB
20 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://video.sekindo.com/uploads/cn3/video/users/converted/24485/video1523972806/vid5e78c63388ed7519841362.jpg?cbuster=1584973364
Requested by
Host: threatpost.com
URL: https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
185.220.204.11 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software
Tengine /
Resource Hash
a7b094f48e6774d82dfc7864e438d35675e5dad0ba6f3222a8003e9a932f104e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Referer
https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

Date
Thu, 26 Mar 2020 16:18:35 GMT
Last-Modified
Mon, 23 Mar 2020 14:23:17 GMT
Server
Tengine
ETag
"5e78c655-4fb6"
X-Cache-Status
HIT
Strict-Transport-Security
max-age=31536000
Content-Type
image/jpeg
Cache-Control
max-age=315360000
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=25
Content-Length
20406
Expires
Thu, 31 Dec 2037 23:55:55 GMT
vid5e7aa5fa02206483346051.jpg
video.sekindo.com/uploads/cn11/video/users/converted/24485/video1523972806/ Frame 3C77 		14 KB
14 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://video.sekindo.com/uploads/cn11/video/users/converted/24485/video1523972806/vid5e7aa5fa02206483346051.jpg?cbuster=1585096186
Requested by
Host: threatpost.com
URL: https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
185.220.204.11 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software
Tengine /
Resource Hash
b2e11a6d036e47dd106daa0d14d175a42337d24f1bb5b5df546b3096931f725c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Referer
https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

Date
Thu, 26 Mar 2020 16:18:35 GMT
Last-Modified
Wed, 25 Mar 2020 00:30:09 GMT
Server
Tengine
ETag
"5e7aa611-386b"
X-Cache-Status
HIT
Strict-Transport-Security
max-age=31536000
Content-Type
image/jpeg
Cache-Control
max-age=315360000
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=25
Content-Length
14443
Expires
Thu, 31 Dec 2037 23:55:55 GMT
vid5e71c75337a14771087703.jpg
video.sekindo.com/uploads/cn4/video/users/converted/24485/video1523972806/ Frame 3C77 		26 KB
27 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://video.sekindo.com/uploads/cn4/video/users/converted/24485/video1523972806/vid5e71c75337a14771087703.jpg?cbuster=1584514900
Requested by
Host: threatpost.com
URL: https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
185.220.204.11 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software
Tengine /
Resource Hash
8fa3dc8d99f9c768dab8377000d306d6c3795c024993ab8a7f42e29f5f236ddd
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Referer
https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

Date
Thu, 26 Mar 2020 16:18:35 GMT
Last-Modified
Wed, 18 Mar 2020 07:02:09 GMT
Server
Tengine
ETag
"5e71c771-6929"
X-Cache-Status
HIT
Strict-Transport-Security
max-age=31536000
Content-Type
image/jpeg
Cache-Control
max-age=315360000
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=25
Content-Length
26921
Expires
Thu, 31 Dec 2037 23:55:55 GMT
vid5e71c7543988d790150959.jpg
video.sekindo.com/uploads/cn4/video/users/converted/24485/video1523972806/ Frame 3C77 		21 KB
21 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://video.sekindo.com/uploads/cn4/video/users/converted/24485/video1523972806/vid5e71c7543988d790150959.jpg?cbuster=1584514901
Requested by
Host: threatpost.com
URL: https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
185.220.204.11 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software
Tengine /
Resource Hash
03d95929b0703d04e46b6957a7d8794f27214673987b91c56a020dabe35e8a10
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Referer
https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

Date
Thu, 26 Mar 2020 16:18:35 GMT
Last-Modified
Wed, 18 Mar 2020 07:02:25 GMT
Server
Tengine
ETag
"5e71c781-52c4"
X-Cache-Status
HIT
Strict-Transport-Security
max-age=31536000
Content-Type
image/jpeg
Cache-Control
max-age=315360000
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=25
Content-Length
21188
Expires
Thu, 31 Dec 2037 23:55:55 GMT
vid5e7c157550e0f156545230.jpg
video.sekindo.com/uploads/cn11/video/users/converted/24485/video1523972806/ Frame 3C77 		15 KB
15 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://video.sekindo.com/uploads/cn11/video/users/converted/24485/video1523972806/vid5e7c157550e0f156545230.jpg?cbuster=1585190262
Requested by
Host: threatpost.com
URL: https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
185.220.204.11 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software
Tengine /
Resource Hash
97ac40ffcd418ff8129707fbb9f30c752c46a570112184af185b71fb91a06126
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Referer
https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

Date
Thu, 26 Mar 2020 16:18:35 GMT
Last-Modified
Thu, 26 Mar 2020 02:38:33 GMT
Server
Tengine
ETag
"5e7c15a9-3a2c"
X-Cache-Status
HIT
Strict-Transport-Security
max-age=31536000
Content-Type
image/jpeg
Cache-Control
max-age=315360000
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=25
Content-Length
14892
Expires
Thu, 31 Dec 2037 23:55:55 GMT
vid5e7c15771d551501079486.jpg
video.sekindo.com/uploads/cn11/video/users/converted/24485/video1523972806/ Frame 3C77 		23 KB
24 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://video.sekindo.com/uploads/cn11/video/users/converted/24485/video1523972806/vid5e7c15771d551501079486.jpg?cbuster=1585190264
Requested by
Host: threatpost.com
URL: https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
185.220.204.11 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software
Tengine /
Resource Hash
023957d3df430a0358f0049277daa338a0533d72e5faa57b28569f8a5b45155b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Referer
https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

Date
Thu, 26 Mar 2020 16:18:35 GMT
Last-Modified
Thu, 26 Mar 2020 02:39:09 GMT
Server
Tengine
ETag
"5e7c15cd-5d1f"
X-Cache-Status
HIT
Strict-Transport-Security
max-age=31536000
Content-Type
image/jpeg
Cache-Control
max-age=315360000
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=25
Content-Length
23839
Expires
Thu, 31 Dec 2037 23:55:55 GMT
vid5e7bc8c759a30254664862.jpg
video.sekindo.com/uploads/cn11/video/users/converted/28530/video_5d5baf9fe4c32389620327/ Frame 9615 		11 KB
11 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://video.sekindo.com/uploads/cn11/video/users/converted/28530/video_5d5baf9fe4c32389620327/vid5e7bc8c759a30254664862.jpg?cbuster=1585170639
Requested by
Host: threatpost.com
URL: https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
185.220.204.11 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software
Tengine /
Resource Hash
a4fa6b6ff70552afacee85cdc4cc79e92eb662513ca8c93ee2bca4d2c265f661
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Referer
https://amli.sekindo.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

Date
Thu, 26 Mar 2020 16:18:34 GMT
Last-Modified
Wed, 25 Mar 2020 21:11:34 GMT
Server
Tengine
ETag
"5e7bc906-2c48"
X-Cache-Status
HIT
Strict-Transport-Security
max-age=31536000
Content-Type
image/jpeg
Cache-Control
max-age=315360000
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=25
Content-Length
11336
Expires
Thu, 31 Dec 2037 23:55:55 GMT
truncated
/ Frame 9615 		2 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
9d02d662da8a47fb5fb610b545007507b6017028043dbb63cd09ec897d3b9627

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ Frame 9615 		715 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
5a3f1dd74233f605e511f1b5b244bedf85ac88ba264caf4d6401bc7ec2017dcd

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/png
liveView.php
live.sekindo.com/live/ Frame 9211 		70 KB
3 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://live.sekindo.com/live/liveView.php?s=58057&vid_vastTimeout=-1&vid_vastType=3&vid_playerVer=3.0.0&vid_viewabilityState=1&vid_playbackMethod=auto&vid_content_url=https%3A%2F%2Fvideo.sekindo.com%2Fuploads%2Fcn11%2Fvideo%2Fusers%2Fconverted%2F28530%2Fvideo_5d5baf9fe4c32389620327%2Fvid5e7bc8c759a30254664862.mp4&vid_content_id=720411&vid_content_desc=Facebook+offers+message+app+to+support+health+authorities&vid_content_title=Facebook+offers+message+app+to+support+health+authorities&vid_content_duration=70&debugInformation=&x=400&y=225&fpl=2&pubUrl=https%3A%2F%2Fthreatpost.com%2Firanian-apt-targets-govs-with-new-malware%2F%3D&ri=6C69766553746174737C736B317B54307D7B64323032302D30332D32365F31387D7B7331323334383830387D7B4338357D7B53644768795A5746306347397A6443356A6232303D7D7B626368726F6D657D7B716465736B746F707D7B6F6D61636F73787D7B583330307D7B593235307D7B66317D7B4C363631357DFEFE&isApp=0&geoLati=50.884700775146484&geoLong=4.504899978637695&userIpAddr=82.102.19.134&userUA=Mozilla%2F5.0+%28Macintosh%3B+Intel+Mac+OS+X+10_14_5%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F74.0.3729.169+Safari%2F537.36&schain=1.0%2C1%21admetricspro.com%2C1005%2C1&csuuid=5e7cd5dc462d3&cbuster=1585239516786&gdpr=1&gdprConsent=&isWePassGdpr=0&gdpr2Consent=&isWePassGdpr2=0
Requested by
Host: live.sekindo.com
URL: https://live.sekindo.com/live/liveVideo.php?vpaidManager=sekindo&s=58057&ri=6C69766553746174737C736B317B54307D7B64323032302D30332D32365F31387D7B7331323334383830387D7B4338357D7B53644768795A5746306347397A6443356A6232303D7D7B626368726F6D657D7B716465736B746F707D7B6F6D61636F73787D7B583330307D7B593235307D7B66317D7B4C363631357DFEFE&userIpAddr=82.102.19.134&userUA=Mozilla%2F5.0+%28Macintosh%3B+Intel+Mac+OS+X+10_14_5%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F74.0.3729.169+Safari%2F537.36&playerVersion=3.0.0&fpl=-1&debugInformation=&isWePassGdpr=0&schain=1.0%2C1%21admetricspro.com%2C1005%2C1&csuuid=5e7cd5dc462d3&debugInfo=12348808_&debugPlayerSession=&sta=12348808&showLogo=0&clkUrl=&plMult=-1&schedule=eyJwcmVfcm9sbCI6MSwibWlkX3JvbGwiOltdLCJnYXAiOiJhdXRvIn0%3D&content=plembed173akunvrojp&secondaryContent=&x=300&y=250&pubUrl=https%3A%2F%2Fthreatpost.com%2Firanian-apt-targets-govs-with-new-malware%2F%3D&contentNum=1&flow_closeBtn=1&flowCloseTimeout=0&flow_direction=br&flow_horizontalOffset=10&flow_bottomOffset=10&impGap=2&flow_width=320&flow_height=180&videoType=flow&gdpr=1&gdprConsent=&contentFeedId=&geoLati=50.884700775146484&geoLong=4.504899978637695&vpTemplate=6615&flowMode=both&isRealPreroll=0&playerApiId=&isApp=0&gdpr2Consent=&ccpa=0&ccpaConsent=
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
63.250.56.23 , United States, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software
nginx / PHP/7.3.15
Resource Hash
aa24855cd33034eb1ed77708f83bf520e25c48624e1cb7891dbe081d586593e3

Request headers

Referer
https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
Origin
https://threatpost.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 26 Mar 2020 16:18:36 GMT
Content-Encoding
gzip
Server
nginx
Age
0
X-Powered-By
PHP/7.3.15
P3P
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin
https://threatpost.com
Cache-Control
no-store
Access-Control-Allow-Credentials
true
Content-Type
application/json; charset=utf-8
Content-Length
2901
liveView.php
live.sekindo.com/live/ Frame 9211 		70 KB
3 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://live.sekindo.com/live/liveView.php?s=58057&vid_vastTimeout=-1&vid_vastType=3&vid_playerVer=3.0.0&vid_viewabilityState=1&vid_playbackMethod=auto&vid_content_url=https%3A%2F%2Fvideo.sekindo.com%2Fuploads%2Fcn11%2Fvideo%2Fusers%2Fconverted%2F28530%2Fvideo_5d5baf9fe4c32389620327%2Fvid5e7bc8c759a30254664862.mp4&vid_content_id=720411&vid_content_desc=Facebook+offers+message+app+to+support+health+authorities&vid_content_title=Facebook+offers+message+app+to+support+health+authorities&vid_content_duration=70&debugInformation=&x=320&y=180&fpl=2&pubUrl=https%3A%2F%2Fthreatpost.com%2Firanian-apt-targets-govs-with-new-malware%2F%3D&ri=6C69766553746174737C736B317B54307D7B64323032302D30332D32365F31387D7B7331323334383830387D7B4338357D7B53644768795A5746306347397A6443356A6232303D7D7B626368726F6D657D7B716465736B746F707D7B6F6D61636F73787D7B583330307D7B593235307D7B66317D7B4C363631357DFEFE&isApp=0&geoLati=50.884700775146484&geoLong=4.504899978637695&userIpAddr=82.102.19.134&userUA=Mozilla%2F5.0+%28Macintosh%3B+Intel+Mac+OS+X+10_14_5%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F74.0.3729.169+Safari%2F537.36&schain=1.0%2C1%21admetricspro.com%2C1005%2C1&csuuid=5e7cd5dc462d3&cbuster=1585239516786&gdpr=1&gdprConsent=&isWePassGdpr=0&gdpr2Consent=&isWePassGdpr2=0
Requested by
Host: live.sekindo.com
URL: https://live.sekindo.com/live/liveVideo.php?vpaidManager=sekindo&s=58057&ri=6C69766553746174737C736B317B54307D7B64323032302D30332D32365F31387D7B7331323334383830387D7B4338357D7B53644768795A5746306347397A6443356A6232303D7D7B626368726F6D657D7B716465736B746F707D7B6F6D61636F73787D7B583330307D7B593235307D7B66317D7B4C363631357DFEFE&userIpAddr=82.102.19.134&userUA=Mozilla%2F5.0+%28Macintosh%3B+Intel+Mac+OS+X+10_14_5%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F74.0.3729.169+Safari%2F537.36&playerVersion=3.0.0&fpl=-1&debugInformation=&isWePassGdpr=0&schain=1.0%2C1%21admetricspro.com%2C1005%2C1&csuuid=5e7cd5dc462d3&debugInfo=12348808_&debugPlayerSession=&sta=12348808&showLogo=0&clkUrl=&plMult=-1&schedule=eyJwcmVfcm9sbCI6MSwibWlkX3JvbGwiOltdLCJnYXAiOiJhdXRvIn0%3D&content=plembed173akunvrojp&secondaryContent=&x=300&y=250&pubUrl=https%3A%2F%2Fthreatpost.com%2Firanian-apt-targets-govs-with-new-malware%2F%3D&contentNum=1&flow_closeBtn=1&flowCloseTimeout=0&flow_direction=br&flow_horizontalOffset=10&flow_bottomOffset=10&impGap=2&flow_width=320&flow_height=180&videoType=flow&gdpr=1&gdprConsent=&contentFeedId=&geoLati=50.884700775146484&geoLong=4.504899978637695&vpTemplate=6615&flowMode=both&isRealPreroll=0&playerApiId=&isApp=0&gdpr2Consent=&ccpa=0&ccpaConsent=
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
63.250.56.23 , United States, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software
nginx / PHP/7.3.15
Resource Hash
0f36540ce2d3d59ad44a3077fa738822877ad09b9f7e7c5362fb8e8f8ad75f79

Request headers

Referer
https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
Origin
https://threatpost.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 26 Mar 2020 16:18:36 GMT
Content-Encoding
gzip
Server
nginx
Age
0
X-Powered-By
PHP/7.3.15
P3P
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin
https://threatpost.com
Cache-Control
no-store
Access-Control-Allow-Credentials
true
Content-Type
application/json; charset=utf-8
Content-Length
3003
liveView.php
live.sekindo.com/live/ Frame 9211 		23 KB
2 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://live.sekindo.com/live/liveView.php?s=58057&vid_vastTimeout=-1&vid_vastType=3&vid_playerVer=3.0.0&vid_viewabilityState=0&vid_playbackMethod=auto&vid_content_url=https%3A%2F%2Fvideo.sekindo.com%2Fuploads%2Fcn11%2Fvideo%2Fusers%2Fconverted%2F28530%2Fvideo_5d5baf9fe4c32389620327%2Fvid5e7bc8c759a30254664862.mp4&vid_content_id=720411&vid_content_desc=Facebook+offers+message+app+to+support+health+authorities&vid_content_title=Facebook+offers+message+app+to+support+health+authorities&vid_content_duration=70&debugInformation=&x=400&y=225&fpl=2&pubUrl=https%3A%2F%2Fthreatpost.com%2Firanian-apt-targets-govs-with-new-malware%2F%3D&ri=6C69766553746174737C736B317B54307D7B64323032302D30332D32365F31387D7B7331323334383830387D7B4338357D7B53644768795A5746306347397A6443356A6232303D7D7B626368726F6D657D7B716465736B746F707D7B6F6D61636F73787D7B583330307D7B593235307D7B66317D7B4C363631357DFEFE&isApp=0&geoLati=50.884700775146484&geoLong=4.504899978637695&userIpAddr=82.102.19.134&userUA=Mozilla%2F5.0+%28Macintosh%3B+Intel+Mac+OS+X+10_14_5%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F74.0.3729.169+Safari%2F537.36&schain=1.0%2C1%21admetricspro.com%2C1005%2C1&csuuid=5e7cd5dc462d3&cbuster=1585239516787&gdpr=1&gdprConsent=&isWePassGdpr=0&gdpr2Consent=&isWePassGdpr2=0
Requested by
Host: live.sekindo.com
URL: https://live.sekindo.com/live/liveVideo.php?vpaidManager=sekindo&s=58057&ri=6C69766553746174737C736B317B54307D7B64323032302D30332D32365F31387D7B7331323334383830387D7B4338357D7B53644768795A5746306347397A6443356A6232303D7D7B626368726F6D657D7B716465736B746F707D7B6F6D61636F73787D7B583330307D7B593235307D7B66317D7B4C363631357DFEFE&userIpAddr=82.102.19.134&userUA=Mozilla%2F5.0+%28Macintosh%3B+Intel+Mac+OS+X+10_14_5%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F74.0.3729.169+Safari%2F537.36&playerVersion=3.0.0&fpl=-1&debugInformation=&isWePassGdpr=0&schain=1.0%2C1%21admetricspro.com%2C1005%2C1&csuuid=5e7cd5dc462d3&debugInfo=12348808_&debugPlayerSession=&sta=12348808&showLogo=0&clkUrl=&plMult=-1&schedule=eyJwcmVfcm9sbCI6MSwibWlkX3JvbGwiOltdLCJnYXAiOiJhdXRvIn0%3D&content=plembed173akunvrojp&secondaryContent=&x=300&y=250&pubUrl=https%3A%2F%2Fthreatpost.com%2Firanian-apt-targets-govs-with-new-malware%2F%3D&contentNum=1&flow_closeBtn=1&flowCloseTimeout=0&flow_direction=br&flow_horizontalOffset=10&flow_bottomOffset=10&impGap=2&flow_width=320&flow_height=180&videoType=flow&gdpr=1&gdprConsent=&contentFeedId=&geoLati=50.884700775146484&geoLong=4.504899978637695&vpTemplate=6615&flowMode=both&isRealPreroll=0&playerApiId=&isApp=0&gdpr2Consent=&ccpa=0&ccpaConsent=
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
63.250.56.23 , United States, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software
nginx / PHP/7.3.15
Resource Hash
886624e576ddaccc6ae7fbab6aeb2bc12bd213f07ef721622f022900efc9be10

Request headers

Referer
https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
Origin
https://threatpost.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 26 Mar 2020 16:18:36 GMT
Content-Encoding
gzip
Server
nginx
Age
0
X-Powered-By
PHP/7.3.15
P3P
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin
https://threatpost.com
Cache-Control
no-store
Access-Control-Allow-Credentials
true
Content-Type
application/json; charset=utf-8
Content-Length
1731
rules-p-_7kVx0t9Jqj90.js
rules.quantcount.com/ 		3 B
356 B 		Script
General
Check archive.org
Download Go to
Full URL
https://rules.quantcount.com/rules-p-_7kVx0t9Jqj90.js
Requested by
Host: secure.quantserve.com
URL: https://secure.quantserve.com/quant.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:21f3:800:6:44e3:f8c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356

Request headers

Referer
https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Thu, 26 Mar 2020 16:15:20 GMT
via
1.1 90cf045072373c2c671297de3161846f.cloudfront.net (CloudFront)
last-modified
Fri, 03 Mar 2017 23:52:35 GMT
server
AmazonS3
age
198
etag
"8a80554c91d9fca8acb82f023de02f11"
x-cache
Error from cloudfront
content-type
application/x-javascript
status
200
cache-control
max-age=300
x-amz-cf-pop
FRA2-C2
accept-ranges
bytes
content-length
3
x-amz-cf-id
KzS2ttSe3pqEpvqcSu5ZBmyYMQmLnUSrKu6gmIcF2d9FJ7_-L7Svkg==
liveView.php
live.sekindo.com/live/ Frame 9211 		23 KB
2 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://live.sekindo.com/live/liveView.php?s=58057&vid_vastTimeout=-1&vid_vastType=3&vid_playerVer=3.0.0&vid_viewabilityState=0&vid_playbackMethod=auto&vid_content_url=https%3A%2F%2Fvideo.sekindo.com%2Fuploads%2Fcn11%2Fvideo%2Fusers%2Fconverted%2F28530%2Fvideo_5d5baf9fe4c32389620327%2Fvid5e7bc8c759a30254664862.mp4&vid_content_id=720411&vid_content_desc=Facebook+offers+message+app+to+support+health+authorities&vid_content_title=Facebook+offers+message+app+to+support+health+authorities&vid_content_duration=70&debugInformation=&x=320&y=180&fpl=2&pubUrl=https%3A%2F%2Fthreatpost.com%2Firanian-apt-targets-govs-with-new-malware%2F%3D&ri=6C69766553746174737C736B317B54307D7B64323032302D30332D32365F31387D7B7331323334383830387D7B4338357D7B53644768795A5746306347397A6443356A6232303D7D7B626368726F6D657D7B716465736B746F707D7B6F6D61636F73787D7B583330307D7B593235307D7B66317D7B4C363631357DFEFE&isApp=0&geoLati=50.884700775146484&geoLong=4.504899978637695&userIpAddr=82.102.19.134&userUA=Mozilla%2F5.0+%28Macintosh%3B+Intel+Mac+OS+X+10_14_5%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F74.0.3729.169+Safari%2F537.36&schain=1.0%2C1%21admetricspro.com%2C1005%2C1&csuuid=5e7cd5dc462d3&cbuster=1585239516935&gdpr=1&gdprConsent=&isWePassGdpr=0&gdpr2Consent=&isWePassGdpr2=0
Requested by
Host: live.sekindo.com
URL: https://live.sekindo.com/live/liveVideo.php?vpaidManager=sekindo&s=58057&ri=6C69766553746174737C736B317B54307D7B64323032302D30332D32365F31387D7B7331323334383830387D7B4338357D7B53644768795A5746306347397A6443356A6232303D7D7B626368726F6D657D7B716465736B746F707D7B6F6D61636F73787D7B583330307D7B593235307D7B66317D7B4C363631357DFEFE&userIpAddr=82.102.19.134&userUA=Mozilla%2F5.0+%28Macintosh%3B+Intel+Mac+OS+X+10_14_5%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F74.0.3729.169+Safari%2F537.36&playerVersion=3.0.0&fpl=-1&debugInformation=&isWePassGdpr=0&schain=1.0%2C1%21admetricspro.com%2C1005%2C1&csuuid=5e7cd5dc462d3&debugInfo=12348808_&debugPlayerSession=&sta=12348808&showLogo=0&clkUrl=&plMult=-1&schedule=eyJwcmVfcm9sbCI6MSwibWlkX3JvbGwiOltdLCJnYXAiOiJhdXRvIn0%3D&content=plembed173akunvrojp&secondaryContent=&x=300&y=250&pubUrl=https%3A%2F%2Fthreatpost.com%2Firanian-apt-targets-govs-with-new-malware%2F%3D&contentNum=1&flow_closeBtn=1&flowCloseTimeout=0&flow_direction=br&flow_horizontalOffset=10&flow_bottomOffset=10&impGap=2&flow_width=320&flow_height=180&videoType=flow&gdpr=1&gdprConsent=&contentFeedId=&geoLati=50.884700775146484&geoLong=4.504899978637695&vpTemplate=6615&flowMode=both&isRealPreroll=0&playerApiId=&isApp=0&gdpr2Consent=&ccpa=0&ccpaConsent=
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
63.250.56.23 , United States, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software
nginx / PHP/7.3.15
Resource Hash
b9c9d9797e752f6495f9ab07c2e8c029dbf0b910eb46a806a9efdcabd082d123

Request headers

Referer
https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
Origin
https://threatpost.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 26 Mar 2020 16:18:37 GMT
Content-Encoding
gzip
Server
nginx
Age
0
X-Powered-By
PHP/7.3.15
P3P
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin
https://threatpost.com
Cache-Control
no-store
Access-Control-Allow-Credentials
true
Content-Type
application/json; charset=utf-8
Content-Length
1737
chunklist_640.m3u8
video.sekindo.com/uploads/cn11/video/users/hls/28530/video_5d5baf9fe4c32389620327/vid5e7bc8c759a30254664862.mp4/ Frame 9211 		485 B
885 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://video.sekindo.com/uploads/cn11/video/users/hls/28530/video_5d5baf9fe4c32389620327/vid5e7bc8c759a30254664862.mp4/chunklist_640.m3u8
Requested by
Host: live.sekindo.com
URL: https://live.sekindo.com/content/video/hls/hls.0.12.4_1.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
185.220.204.11 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software
Tengine /
Resource Hash
cdc1f29426a41b502d6db3bf338de6096590046961508a7d23a68bb7635a5a2d

Request headers

Referer
https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
Origin
https://threatpost.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Thu, 26 Mar 2020 16:18:36 GMT
Last-Modified
Wed, 25 Mar 2020 21:12:19 GMT
Server
Tengine
ETag
"5e7bc933-1e5"
Content-Type
application/vnd.apple.mpegurl
Access-Control-Allow-Origin
*
Expires
Thu, 02 Apr 2020 16:18:36 GMT
Cache-Control
max-age=604800
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=25
Content-Length
485
X-Proxy-Cache
HIT
KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2
fonts.gstatic.com/s/roboto/v20/ Frame 9615 		11 KB
11 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v20/KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2
Requested by
Host: threatpost.com
URL: https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:814::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
5d1bc9b443f3f81fa4b4ad4634c1bb9702194c1898e3a9de0ab5e2cdc0e9f479
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/css?family=Roboto&display=swap
Origin
https://threatpost.com
Sec-Fetch-Dest
font
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 27 Feb 2020 08:47:06 GMT
x-content-type-options
nosniff
last-modified
Wed, 24 Jul 2019 01:18:50 GMT
server
sffe
age
2446290
content-type
font/woff2
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-origin
*
content-length
11016
x-xss-protection
0
expires
Fri, 26 Feb 2021 08:47:06 GMT
prebid
ib.adnxs.com/ut/v3/ Frame 9211 		143 B
835 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/ut/v3/prebid
Requested by
Host: live.sekindo.com
URL: https://live.sekindo.com/content/prebid/prebidVid.2.44.3_2.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.33.223.80 , Netherlands, ASN29990 (ASN-APPNEX, US),
Reverse DNS
251.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
Software
nginx/1.13.4 /
Resource Hash
14ecac620a63195eae43a57fefb8466ceda47fa6e3681296eb9615d469a46581
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
Origin
https://threatpost.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Thu, 26 Mar 2020 16:18:39 GMT
X-Proxy-Origin
82.102.19.134; 82.102.19.134; 251.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.222.245:80
AN-X-Request-Uuid
511e6203-2c49-4a8b-ba85-6d04bedb6c72
Server
nginx/1.13.4
P3P
policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://threatpost.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json; charset=utf-8
Content-Length
143
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
cygnus
as-sec.casalemedia.com/ Frame 9211 		24 B
986 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://as-sec.casalemedia.com/cygnus?s=435871&v=8.1&r=%7B%22id%22%3A%2236273b5525d47d%22%2C%22imp%22%3A%5B%7B%22id%22%3A%2244472a817bd3bd%22%2C%22ext%22%3A%7B%22siteID%22%3A%22435871%22%2C%22sid%22%3A%22320x180%22%7D%2C%22bidfloor%22%3A1.92%2C%22bidfloorcur%22%3A%22USD%22%2C%22video%22%3A%7B%22mimes%22%3A%5B%22video%2Fmp4%22%2C%22application%2Fjavascript%22%5D%2C%22minduration%22%3A1%2C%22maxduration%22%3A200%2C%22api%22%3A%5B1%2C2%5D%2C%22protocols%22%3A%5B1%2C2%2C3%2C4%2C5%2C6%5D%2C%22linearity%22%3A1%2C%22startdelay%22%3A0%2C%22skip%22%3A1%2C%22w%22%3A320%2C%22h%22%3A180%2C%22placement%22%3A1%7D%7D%2C%7B%22id%22%3A%22502e9f049d1fc3%22%2C%22ext%22%3A%7B%22siteID%22%3A%22435870%22%2C%22sid%22%3A%22320x180%22%7D%2C%22bidfloor%22%3A1.92%2C%22bidfloorcur%22%3A%22USD%22%2C%22video%22%3A%7B%22mimes%22%3A%5B%22video%2Fmp4%22%2C%22application%2Fjavascript%22%5D%2C%22minduration%22%3A1%2C%22maxduration%22%3A200%2C%22api%22%3A%5B1%2C2%5D%2C%22protocols%22%3A%5B1%2C2%2C3%2C4%2C5%2C6%5D%2C%22linearity%22%3A1%2C%22startdelay%22%3A0%2C%22skip%22%3A1%2C%22w%22%3A320%2C%22h%22%3A180%2C%22placement%22%3A1%7D%7D%5D%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fthreatpost.com%2Firanian-apt-targets-govs-with-new-malware%2F%3D%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%7D%2C%22regs%22%3A%7B%22ext%22%3A%7B%22gdpr%22%3A1%7D%7D%2C%22user%22%3A%7B%22ext%22%3A%7B%22consent%22%3A%22%22%7D%7D%7D&ac=j&sd=1&nf=1&
Requested by
Host: live.sekindo.com
URL: https://live.sekindo.com/content/prebid/prebidVid.2.44.3_2.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
95.101.185.51 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a95-101-185-51.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
4d975445b1a028326a81fc08acbd255392f79270d1feebefaa69e34069fdc75f

Request headers

Referer
https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
Origin
https://threatpost.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Thu, 26 Mar 2020 16:18:37 GMT
Content-Encoding
gzip
Server
Apache
Vary
Accept-Encoding
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Access-Control-Allow-Origin
https://threatpost.com
Cache-Control
max-age=0, no-cache, no-store
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json
Content-Length
44
Expires
Thu, 26 Mar 2020 16:18:37 GMT
translator
hbopenbid.pubmatic.com/ Frame 9211 		0
115 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by
Host: live.sekindo.com
URL: https://live.sekindo.com/content/prebid/prebidVid.2.44.3_2.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.189.112 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
Origin
https://threatpost.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
text/plain

Response headers

status
204
date
Thu, 26 Mar 2020 16:18:38 GMT
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
access-control-allow-origin
https://threatpost.com
auction
prebid-server.rubiconproject.com/openrtb2/ Frame 9211 		140 B
361 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://prebid-server.rubiconproject.com/openrtb2/auction
Requested by
Host: live.sekindo.com
URL: https://live.sekindo.com/content/prebid/prebidVid.2.44.3_2.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.158.0.61 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-35-158-0-61.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
68f2d69f97d2bda52a3269d36a9a59d7a5a978ac71ce8fae552b270e454a2ae2

Request headers

Referer
https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
Origin
https://threatpost.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Thu, 26 Mar 2020 16:18:38 GMT
content-encoding
gzip
status
200
content-type
application/json
access-control-allow-origin
https://threatpost.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
content-length
148
expires
0
avjp
teachingaids-d.openx.net/v/1.0/ Frame 9211 		0
0
openrtb
ads.adaptv.advertising.com/rtb/ Frame 9211 		0
215 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://ads.adaptv.advertising.com/rtb/openrtb?ext_id=TeachingAidsLLC
Requested by
Host: live.sekindo.com
URL: https://live.sekindo.com/content/prebid/prebidVid.2.44.3_2.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.194.129.81 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-194-129-81.eu-central-1.compute.amazonaws.com
Software
adaptv/1.0 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
Origin
https://threatpost.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
text/plain

Response headers

Access-Control-Allow-Origin
https://threatpost.com
Access-Control-Allow-Credentials
true
Server
adaptv/1.0
Connection
keep-alive
Content-Length
0
Content-Type
application/json
liveView.php
live.sekindo.com/live/ Frame 3C77 		43 B
463 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://live.sekindo.com/live/liveView.php?njs=1&ito=1&vid_event=6&serverTime=1585239516&s=58057&sta=12604079&x=320&y=180&msta=12348808&vid_vastType=3&vid_viewabilityState=1&vid_passDomain=threatpost.com&subId=threatpost.com&debugInformation=&playbackMethod=auto&isApp=0&userIpAddr=82.102.19.134&userUA=Mozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010_14_5%29%20AppleWebKit%2F537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome%2F74.0.3729.169%20Safari%2F537.36&csuuid=5e7cd5dc462d3&rvn=${VP_RVN_MACRO}&attemptMultiplier=10&contentFileId=0&mediaPlayListId=0&playerVer=3.0.0&cbuster=1585239517093&gdpr=1&gdprConsent=&isWePassGdpr=0&gdpr2Consent=&isWePassGdpr2=0&ccpa=0&ccpaConsent=
Requested by
Host: threatpost.com
URL: https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
63.250.56.23 , United States, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software
nginx / PHP/7.3.15
Resource Hash
42b976597a2d977d0e300f6d06bc903db389e5c112d33c1c8c249690a522d9f2

Request headers

Referer
https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

Pragma
no-cache
Date
Thu, 26 Mar 2020 16:18:37 GMT
Server
nginx
Age
0
X-Powered-By
PHP/7.3.15
Transfer-Encoding
chunked
P3P
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin
*
Cache-Control
max-age=315360000
Content-Disposition
inline; filename="pixel.gif"
Content-Type
image/gif
Expires
Thu, 31 Dec 2037 23:55:55 GMT
pixel;r=1724354620;source=gtm;rf=0;a=p-_7kVx0t9Jqj90;url=https%3A%2F%2Fthreatpost.com%2Firanian-apt-targets-govs-with-new-malware%2F%3D;fpan=1;fpa=P0-1847089959-1585239517180;ns=0;ce=1;qjs=1;qv=0e9...
pixel.quantserve.com/ 		35 B
658 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.quantserve.com/pixel;r=1724354620;source=gtm;rf=0;a=p-_7kVx0t9Jqj90;url=https%3A%2F%2Fthreatpost.com%2Firanian-apt-targets-govs-with-new-malware%2F%3D;fpan=1;fpa=P0-1847089959-1585239517180;ns=0;ce=1;qjs=1;qv=0e9a7da-20191205140709;cm=;ref=;je=0;sr=1600x1200x24;enc=n;dst=1;et=1585239517180;tzo=-60;ogl=
Requested by
Host: threatpost.com
URL: https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
91.228.74.210 , United Kingdom, ASN27281 (QUANTCAST, US),
Reverse DNS
Software
QS /
Resource Hash
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
Security Headers
Name Value
Strict-Transport-Security max-age=86400

Request headers

Referer
https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

Pragma
no-cache
Date
Thu, 26 Mar 2020 16:18:38 GMT
Server
QS
Strict-Transport-Security
max-age=86400
P3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
Cache-Control
private, no-cache, no-store, proxy-revalidate
Connection
keep-alive
Content-Type
image/gif
Content-Length
35
Expires
Fri, 04 Aug 1978 12:00:00 GMT
w_640_000.ts
video.sekindo.com/uploads/cn11/video/users/hls/28530/video_5d5baf9fe4c32389620327/vid5e7bc8c759a30254664862.mp4/ Frame 9211 		406 KB
406 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://video.sekindo.com/uploads/cn11/video/users/hls/28530/video_5d5baf9fe4c32389620327/vid5e7bc8c759a30254664862.mp4/w_640_000.ts
Requested by
Host: live.sekindo.com
URL: https://live.sekindo.com/content/video/hls/hls.0.12.4_1.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
185.220.204.11 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software
Tengine /
Resource Hash
7c8f72da57351d58b172c7844766589b872a13d5a3477e581452639c33b8078e

Request headers

Referer
https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
Origin
https://threatpost.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Thu, 26 Mar 2020 16:18:36 GMT
Last-Modified
Wed, 25 Mar 2020 21:12:07 GMT
Server
Tengine
ETag
"5e7bc927-65870"
Content-Type
video/mp2t
Access-Control-Allow-Origin
*
Expires
Thu, 02 Apr 2020 16:18:36 GMT
Cache-Control
max-age=604800
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=25
Content-Length
415856
X-Proxy-Cache
HIT
08138626-c027-41fe-847f-052e460049bf
https://threatpost.com/ Frame 9211 		63 KB
0 		Other
General
Check archive.org
Download Go to
Full URL
blob:https://threatpost.com/08138626-c027-41fe-847f-052e460049bf
Requested by
Host: live.sekindo.com
URL: https://live.sekindo.com/content/video/hls/hls.0.12.4_1.min.js
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
e1c3c2dafe2208caea4f809f414a89a9d256deb8671e1c5d49bff9a873782796

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
worker

Response headers

Content-Length
64352
Content-Type
text/javascript
w_640_001.ts
video.sekindo.com/uploads/cn11/video/users/hls/28530/video_5d5baf9fe4c32389620327/vid5e7bc8c759a30254664862.mp4/ Frame 9211 		438 KB
439 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://video.sekindo.com/uploads/cn11/video/users/hls/28530/video_5d5baf9fe4c32389620327/vid5e7bc8c759a30254664862.mp4/w_640_001.ts
Requested by
Host: live.sekindo.com
URL: https://live.sekindo.com/content/video/hls/hls.0.12.4_1.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
185.220.204.11 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software
Tengine /
Resource Hash
fe84f4f47a52ae0b2f512359034c5e68a5ed257f62e994083d2b3ac6a0996141

Request headers

Referer
https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
Origin
https://threatpost.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Thu, 26 Mar 2020 16:18:36 GMT
Last-Modified
Wed, 25 Mar 2020 21:12:08 GMT
Server
Tengine
ETag
"5e7bc928-6d8f4"
Content-Type
video/mp2t
Access-Control-Allow-Origin
*
Expires
Thu, 02 Apr 2020 16:18:36 GMT
Cache-Control
max-age=604800
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=25
Content-Length
448756
X-Proxy-Cache
HIT
liveView.php
live.sekindo.com/live/ Frame 3C77 		0
379 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://live.sekindo.com/live/liveView.php?njs=1&ito=1&vid_event=16&serverTime=1585239516&s=0&sta=12348808&x=320&y=180&vid_passDomain=threatpost.com&subId=threatpost.com&debugInformation=&isApp=0&userIpAddr=82.102.19.134&userUA=Mozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010_14_5%29%20AppleWebKit%2F537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome%2F74.0.3729.169%20Safari%2F537.36&csuuid=5e7cd5dc462d3&contentFileId=720411&mediaPlayListId=5946&playerVer=3.0.0&contentMatchType=&isExcludeFromOpt=0&cbuster=1585239518155&gdpr=1&gdprConsent=&isWePassGdpr=0&gdpr2Consent=&isWePassGdpr2=0&ccpa=0&ccpaConsent=
Requested by
Host: threatpost.com
URL: https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
63.250.56.23 , United States, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software
nginx / PHP/7.3.15
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

Pragma
no-cache
Date
Thu, 26 Mar 2020 16:18:37 GMT
Content-Encoding
gzip
Server
nginx
Age
0
X-Powered-By
PHP/7.3.15
Transfer-Encoding
chunked
P3P
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin
*
Cache-Control
no-store
Content-Type
text/html; charset=UTF-8
w_640_002.ts
video.sekindo.com/uploads/cn11/video/users/hls/28530/video_5d5baf9fe4c32389620327/vid5e7bc8c759a30254664862.mp4/ Frame 9211 		454 KB
454 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://video.sekindo.com/uploads/cn11/video/users/hls/28530/video_5d5baf9fe4c32389620327/vid5e7bc8c759a30254664862.mp4/w_640_002.ts
Requested by
Host: live.sekindo.com
URL: https://live.sekindo.com/content/video/hls/hls.0.12.4_1.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
185.220.204.11 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software
Tengine /
Resource Hash
1cfa89f491c7aef3daef0f5491ac09de2a7c81fcadb03bc71f93128f73db2d36

Request headers

Referer
https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
Origin
https://threatpost.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Thu, 26 Mar 2020 16:18:36 GMT
Last-Modified
Wed, 25 Mar 2020 21:12:09 GMT
Server
Tengine
ETag
"5e7bc929-71760"
Content-Type
video/mp2t
Access-Control-Allow-Origin
*
Expires
Thu, 02 Apr 2020 16:18:36 GMT
Cache-Control
max-age=604800
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=25
Content-Length
464736
X-Proxy-Cache
HIT
w_640_003.ts
video.sekindo.com/uploads/cn11/video/users/hls/28530/video_5d5baf9fe4c32389620327/vid5e7bc8c759a30254664862.mp4/ Frame 9211 		488 KB
488 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://video.sekindo.com/uploads/cn11/video/users/hls/28530/video_5d5baf9fe4c32389620327/vid5e7bc8c759a30254664862.mp4/w_640_003.ts
Requested by
Host: live.sekindo.com
URL: https://live.sekindo.com/content/video/hls/hls.0.12.4_1.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
185.220.204.11 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software
Tengine /
Resource Hash
69a0433c5504c307c5fca5d2b19ca8d1d9a11d07d97a8918fa714cd68d2900b5

Request headers

Referer
https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
Origin
https://threatpost.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Thu, 26 Mar 2020 16:18:36 GMT
Last-Modified
Wed, 25 Mar 2020 21:12:10 GMT
Server
Tengine
ETag
"5e7bc92a-79ff8"
Content-Type
video/mp2t
Access-Control-Allow-Origin
*
Expires
Thu, 02 Apr 2020 16:18:36 GMT
Cache-Control
max-age=604800
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=25
Content-Length
499704
X-Proxy-Cache
HIT
w_640_004.ts
video.sekindo.com/uploads/cn11/video/users/hls/28530/video_5d5baf9fe4c32389620327/vid5e7bc8c759a30254664862.mp4/ Frame 9211 		447 KB
448 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://video.sekindo.com/uploads/cn11/video/users/hls/28530/video_5d5baf9fe4c32389620327/vid5e7bc8c759a30254664862.mp4/w_640_004.ts
Requested by
Host: live.sekindo.com
URL: https://live.sekindo.com/content/video/hls/hls.0.12.4_1.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
185.220.204.11 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software
Tengine /
Resource Hash
de00567068a84230436328764006db43d6adacbda8e80fac6a8eb7192789b58f

Request headers

Referer
https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
Origin
https://threatpost.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Thu, 26 Mar 2020 16:18:36 GMT
Last-Modified
Wed, 25 Mar 2020 21:12:11 GMT
Server
Tengine
ETag
"5e7bc92b-6fcf0"
Content-Type
video/mp2t
Access-Control-Allow-Origin
*
Expires
Thu, 02 Apr 2020 16:18:36 GMT
Cache-Control
max-age=604800
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=25
Content-Length
457968
X-Proxy-Cache
HIT
w_640_005.ts
video.sekindo.com/uploads/cn11/video/users/hls/28530/video_5d5baf9fe4c32389620327/vid5e7bc8c759a30254664862.mp4/ Frame 9211 		433 KB
433 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://video.sekindo.com/uploads/cn11/video/users/hls/28530/video_5d5baf9fe4c32389620327/vid5e7bc8c759a30254664862.mp4/w_640_005.ts
Requested by
Host: live.sekindo.com
URL: https://live.sekindo.com/content/video/hls/hls.0.12.4_1.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
185.220.204.11 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software
Tengine /
Resource Hash
d80d8b9670d119f8a1009f617d5145101fb81bd242e5d290fc0477c71f5aa7b2

Request headers

Referer
https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
Origin
https://threatpost.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Thu, 26 Mar 2020 16:18:36 GMT
Last-Modified
Wed, 25 Mar 2020 21:12:12 GMT
Server
Tengine
ETag
"5e7bc92c-6c3a8"
Content-Type
video/mp2t
Access-Control-Allow-Origin
*
Expires
Thu, 02 Apr 2020 16:18:36 GMT
Cache-Control
max-age=604800
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=25
Content-Length
443304
X-Proxy-Cache
HIT
liveView.php
live.sekindo.com/live/ Frame 3C77 		0
379 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://live.sekindo.com/live/liveView.php?njs=1&ito=1&vid_event=36&serverTime=1585239516&s=101281&sta=0&x=300&y=250&vid_passDomain=threatpost.com&subId=threatpost.com&debugInformation=&isApp=0&userIpAddr=82.102.19.134&userUA=Mozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010_14_5%29%20AppleWebKit%2F537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome%2F74.0.3729.169%20Safari%2F537.36&csuuid=5e7cd5dc462d3&contentFileId=0&mediaPlayListId=0&cbuster=1585239518985&gdpr=1&gdprConsent=&isWePassGdpr=0&gdpr2Consent=&isWePassGdpr2=0&ccpa=0&ccpaConsent=
Requested by
Host: threatpost.com
URL: https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
63.250.56.23 , United States, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software
nginx / PHP/7.3.15
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

Pragma
no-cache
Date
Thu, 26 Mar 2020 16:18:38 GMT
Content-Encoding
gzip
Server
nginx
Age
0
X-Powered-By
PHP/7.3.15
Transfer-Encoding
chunked
P3P
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin
*
Cache-Control
no-store
Content-Type
text/html; charset=UTF-8
avjp
primis-d.openx.net/v/1.0/ Frame 9211 		92 B
472 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://primis-d.openx.net/v/1.0/avjp?ju=https%3A%2F%2Fthreatpost.com%2Firanian-apt-targets-govs-with-new-malware%2F%3D&ch=UTF-8&res=1600x1200x24&ifr=true&tz=-60&tws=1600x1200&be=1&bc=hb_pb_3.0.1&dddid=b952b35f-69a4-4266-ab5f-7ff2909c8a61&nocache=1585239520106&gdpr_consent=&gdpr=1&schain=1.0%2C1!admetricspro.com%2C1005%2C1%2C%2C%2C!primis.tech%2C19668%2C1%2C%2C%2C&skip=1&auid=540392761&vwd=320&vht=180&
Requested by
Host: live.sekindo.com
URL: https://live.sekindo.com/content/prebid/prebidVid.2.44.3_2.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.95.120.147 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
147.120.95.34.bc.googleusercontent.com
Software
OXGW/16.182.1 /
Resource Hash
004e5faf0bf890f61697daeede9f21826affd1137fb2cb58eaf4719937a04a14

Request headers

Referer
https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
Origin
https://threatpost.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Thu, 26 Mar 2020 16:18:40 GMT
via
1.1 google
server
OXGW/16.182.1
status
200
p3p
CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin
https://threatpost.com
cache-control
private, max-age=0, no-cache
access-control-allow-credentials
true
content-type
application/json
alt-svc
clear
content-length
92
expires
Mon, 26 Jul 1997 05:00:00 GMT
photo-newsletter.jpg
threatpost.com/wp-content/themes/threatpost-2018/assets/images/ 		0
0
adsct
analytics.twitter.com/i/ 		31 B
651 B 		Script
General
Check archive.org
Download Go to
Full URL
https://analytics.twitter.com/i/adsct?p_id=Twitter&p_user_id=0&txn_id=ntt0j&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&tpx_cb=twttr.conversion.loadPixels&tw_document_href=https%3A%2F%2Fthreatpost.com%2Firanian-apt-targets-govs-with-new-malware%2F%3D
Requested by
Host: static.ads-twitter.com
URL: https://static.ads-twitter.com/uwt.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.244.42.195 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf
Security Headers
Name Value
Strict-Transport-Security max-age=631138519
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Thu, 26 Mar 2020 16:18:41 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status
200, 200 OK
x-twitter-response-tags
BouncerCompliant
content-length
57
x-xss-protection
0
x-response-time
122
pragma
no-cache
last-modified
Thu, 26 Mar 2020 16:18:41 GMT
server
tsa_o
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=631138519
content-type
application/javascript;charset=utf-8
cache-control
no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash
d253f23a53b1c2ce6d92f31e0dcd5b8d
x-transaction
002d331200aac81e
expires
Tue, 31 Mar 1981 05:00:00 GMT
pd
u.openx.net/w/1.0/ Frame 5EC7
Redirect Chain
  • https://u.openx.net/w/1.0/pd?gdpr=1&gdpr_consent=
  • https://u.openx.net/w/1.0/pd?cc=1&gdpr=1&gdpr_consent=
0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://u.openx.net/w/1.0/pd?cc=1&gdpr=1&gdpr_consent=
Requested by
Host: live.sekindo.com
URL: https://live.sekindo.com/content/prebid/prebidVid.2.44.3_2.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.95.120.147 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
147.120.95.34.bc.googleusercontent.com
Software
OXGW/16.182.1 /
Resource Hash

Request headers

:method
GET
:authority
u.openx.net
:scheme
https
:path
/w/1.0/pd?cc=1&gdpr=1&gdpr_consent=
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest
iframe
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
referer
https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
i=6b20cc7d-ca49-40b0-9fa0-36790e2e3227|1585239521
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
iframe
Referer
https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=

Response headers

status
200
vary
Accept, Accept-Encoding
set-cookie
i=6b20cc7d-ca49-40b0-9fa0-36790e2e3227|1585239521; Version=1; Expires=Fri, 26-Mar-2021 16:18:41 GMT; Max-Age=31536000; Secure; Domain=.openx.net; Path=/; SameSite=None pd=v2|1585239521|mOgikimWiygu; Version=1; Expires=Fri, 10-Apr-2020 16:18:41 GMT; Max-Age=1296000; Secure; Domain=.openx.net; Path=/; SameSite=None
server
OXGW/16.182.1
p3p
CP="CUR ADM OUR NOR STA NID"
date
Thu, 26 Mar 2020 16:18:41 GMT
content-type
text/html
content-length
375
content-encoding
gzip
via
1.1 google
alt-svc
clear

Redirect headers

status
302
set-cookie
i=6b20cc7d-ca49-40b0-9fa0-36790e2e3227|1585239521; Version=1; Expires=Fri, 26-Mar-2021 16:18:41 GMT; Max-Age=31536000; Secure; Domain=.openx.net; Path=/; SameSite=None
server
OXGW/16.182.1
p3p
CP="CUR ADM OUR NOR STA NID"
location
https://u.openx.net/w/1.0/pd?cc=1&gdpr=1&gdpr_consent=
date
Thu, 26 Mar 2020 16:18:41 GMT
content-length
0
via
1.1 google
alt-svc
clear
pd
u.openx.net/w/1.0/ Frame 4433
Redirect Chain
  • https://u.openx.net/w/1.0/pd?gdpr=1&gdpr_consent=
  • https://u.openx.net/w/1.0/pd?cc=1&gdpr=1&gdpr_consent=
0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://u.openx.net/w/1.0/pd?cc=1&gdpr=1&gdpr_consent=
Requested by
Host: live.sekindo.com
URL: https://live.sekindo.com/content/prebid/prebidVid.2.44.3_2.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.95.120.147 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
147.120.95.34.bc.googleusercontent.com
Software
OXGW/16.182.1 /
Resource Hash

Request headers

:method
GET
:authority
u.openx.net
:scheme
https
:path
/w/1.0/pd?cc=1&gdpr=1&gdpr_consent=
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest
iframe
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
referer
https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
i=2f9fc63f-9830-4fef-baf4-89336a9b191d|1585239521
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
iframe
Referer
https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=

Response headers

status
200
vary
Accept, Accept-Encoding
set-cookie
i=2f9fc63f-9830-4fef-baf4-89336a9b191d|1585239521; Version=1; Expires=Fri, 26-Mar-2021 16:18:41 GMT; Max-Age=31536000; Secure; Domain=.openx.net; Path=/; SameSite=None pd=v2|1585239521|mOgikimWiygu; Version=1; Expires=Fri, 10-Apr-2020 16:18:41 GMT; Max-Age=1296000; Secure; Domain=.openx.net; Path=/; SameSite=None
server
OXGW/16.182.1
p3p
CP="CUR ADM OUR NOR STA NID"
date
Thu, 26 Mar 2020 16:18:41 GMT
content-type
text/html
content-length
375
content-encoding
gzip
via
1.1 google
alt-svc
clear

Redirect headers

status
302
set-cookie
i=2f9fc63f-9830-4fef-baf4-89336a9b191d|1585239521; Version=1; Expires=Fri, 26-Mar-2021 16:18:41 GMT; Max-Age=31536000; Secure; Domain=.openx.net; Path=/; SameSite=None
server
OXGW/16.182.1
p3p
CP="CUR ADM OUR NOR STA NID"
location
https://u.openx.net/w/1.0/pd?cc=1&gdpr=1&gdpr_consent=
date
Thu, 26 Mar 2020 16:18:41 GMT
content-length
0
via
1.1 google
alt-svc
clear
usync.html
eus.rubiconproject.com/ Frame 2659 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://eus.rubiconproject.com/usync.html?gdpr=1&gdpr_consent=
Requested by
Host: live.sekindo.com
URL: https://live.sekindo.com/content/prebid/prebidVid.2.44.3_2.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.109.78.125 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a104-109-78-125.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash

Request headers

Host
eus.rubiconproject.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
iframe
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Referer
https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
iframe
Referer
https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=

Response headers

Server
Apache/2.2.15 (CentOS)
X-Powered-By
PHP/5.3.3
p3p
CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Last-Modified
Wed, 04 Mar 2020 22:48:14 GMT
Content-Encoding
gzip
Content-Length
7619
Content-Type
text/html; charset=UTF-8
Cache-Control
max-age=43619
Expires
Fri, 27 Mar 2020 04:25:43 GMT
Date
Thu, 26 Mar 2020 16:18:44 GMT
Connection
keep-alive
Vary
Accept-Encoding
%7Bcombo_uid%7D
pr-bh.ybp.yahoo.com/sync/adaptv_ortb/ Frame 9211 		43 B
794 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pr-bh.ybp.yahoo.com/sync/adaptv_ortb/%7Bcombo_uid%7D
Requested by
Host: threatpost.com
URL: https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1288:110:c305::8000 , United Kingdom, ASN34010 (YAHOO-IRD, GB),
Reverse DNS
Software
ATS /
Resource Hash
48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Thu, 26 Mar 2020 16:18:41 GMT
referrer-policy
strict-origin-when-cross-origin
server
ATS
age
0
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security
max-age=31536000
content-type
image/gif
status
200
x-content-type-options
nosniff
content-length
43
x-xss-protection
1; mode=block
expires
Thu, 01 Jan 1970 00:00:00 GMT
sync
pixel.advertising.com/ups/55953/ Frame 9211
Redirect Chain
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=adaptv&ttd_tpi=1
  • https://match.adsrvr.org/track/cmb/generic?ttd_pid=adaptv&ttd_tpi=1
  • https://pixel.advertising.com/ups/55953/sync?uid=1f5ad252-cb9a-4847-af6c-c805ff5f863f&_origin=1&gdpr=1&gdpr_consent=&piggybackCookie=1f5ad252-cb9a-4847-af6c-c805ff5f863f
0
124 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.advertising.com/ups/55953/sync?uid=1f5ad252-cb9a-4847-af6c-c805ff5f863f&_origin=1&gdpr=1&gdpr_consent=&piggybackCookie=1f5ad252-cb9a-4847-af6c-c805ff5f863f
Requested by
Host: threatpost.com
URL: https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.123.244.246 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-123-244-246.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Referer
https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status
204
date
Thu, 26 Mar 2020 16:18:41 GMT
strict-transport-security
max-age=31536000
p3p
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

Redirect headers

pragma
no-cache
date
Thu, 26 Mar 2020 16:18:41 GMT
x-aspnet-version
4.0.30319
location
https://pixel.advertising.com/ups/55953/sync?uid=1f5ad252-cb9a-4847-af6c-c805ff5f863f&_origin=1&gdpr=1&gdpr_consent=&piggybackCookie=1f5ad252-cb9a-4847-af6c-c805ff5f863f
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
status
302
cache-control
private,no-cache, must-revalidate
content-type
text/html
content-length
369
sync
ups.analytics.yahoo.com/ups/57304/ Frame 9211
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=adaptv_dbm&google_cm&google_sc
  • https://cm.g.doubleclick.net/pixel?google_nid=adaptv_dbm&google_cm=&google_sc=&google_tc=
  • https://pixel.advertising.com/ups/57304/sync?uid=CAESEApCdJV4_6OYcnmRLGU2txA&google_cver=1
  • https://pixel.advertising.com/ups/57304/sync?uid=CAESEApCdJV4_6OYcnmRLGU2txA&google_cver=1&verify=true
  • https://ups.analytics.yahoo.com/ups/57304/sync?uid=CAESEApCdJV4_6OYcnmRLGU2txA&google_cver=1&apid=UP7507295d-6f7d-11ea-949d-0242179982cc
0
977 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ups.analytics.yahoo.com/ups/57304/sync?uid=CAESEApCdJV4_6OYcnmRLGU2txA&google_cver=1&apid=UP7507295d-6f7d-11ea-949d-0242179982cc
Requested by
Host: threatpost.com
URL: https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
18.156.0.31 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-156-0-31.eu-central-1.compute.amazonaws.com
Software
ATS/7.1.2.106 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Referer
https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Thu, 26 Mar 2020 16:18:41 GMT
Server
ATS/7.1.2.106
Connection
keep-alive
Age
0
Strict-Transport-Security
max-age=31536000
P3P
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

Redirect headers

status
302
date
Thu, 26 Mar 2020 16:18:41 GMT
strict-transport-security
max-age=31536000
content-length
0
location
https://ups.analytics.yahoo.com/ups/57304/sync?uid=CAESEApCdJV4_6OYcnmRLGU2txA&google_cver=1&apid=UP7507295d-6f7d-11ea-949d-0242179982cc
p3p
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
sync
sync.adaptv.advertising.com/ Frame 9211
Redirect Chain
  • https://sync-tm.everesttech.net/upi/pid/m7y5t93k?redir=https%3A%2F%2Fsync.adap.tv%2Fsync%3Ftype%3Dgif%26key%3Dtubemogul%26uid%3D%24%7BUSER_ID%7D
  • https://sync-tm.everesttech.net/ct/upi/pid/m7y5t93k?redir=https%3A%2F%2Fsync.adap.tv%2Fsync%3Ftype%3Dgif%26key%3Dtubemogul%26uid%3D%24%7BUSER_ID%7D&_test=XnzV4wAAAJWYawXH
  • https://sync.adap.tv/sync?type=gif&key=tubemogul&uid=XnzV4wAAAJWYawXH&_test=XnzV4wAAAJWYawXH
  • https://sync.adaptv.advertising.com/sync?type=gif&key=tubemogul&uid=XnzV4wAAAJWYawXH&_test=XnzV4wAAAJWYawXH
10 B
118 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync.adaptv.advertising.com/sync?type=gif&key=tubemogul&uid=XnzV4wAAAJWYawXH&_test=XnzV4wAAAJWYawXH
Requested by
Host: threatpost.com
URL: https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.0.180.19 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-0-180-19.compute-1.amazonaws.com
Software
ribs2.0 /
Resource Hash
42e2bdfb6f2641ab97b6a586c31e591246a5240bc86e504d6ec02c616aeb8e4e

Request headers

Referer
https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Server
ribs2.0
Connection
keep-alive
Content-Length
10
Content-Type
text/plain

Redirect headers

Location
//sync.adaptv.advertising.com/sync?type=gif&key=tubemogul&uid=XnzV4wAAAJWYawXH&_test=XnzV4wAAAJWYawXH
Server
ribs2.0
Connection
keep-alive
Content-Length
0
Content-Type
text/plain
liveMatching.php
live.sekindo.com/live/ Frame 9211 		0
445 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://live.sekindo.com/live/liveMatching.php
Requested by
Host: live.sekindo.com
URL: https://live.sekindo.com/live/liveVideo.php?vpaidManager=sekindo&s=58057&ri=6C69766553746174737C736B317B54307D7B64323032302D30332D32365F31387D7B7331323334383830387D7B4338357D7B53644768795A5746306347397A6443356A6232303D7D7B626368726F6D657D7B716465736B746F707D7B6F6D61636F73787D7B583330307D7B593235307D7B66317D7B4C363631357DFEFE&userIpAddr=82.102.19.134&userUA=Mozilla%2F5.0+%28Macintosh%3B+Intel+Mac+OS+X+10_14_5%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F74.0.3729.169+Safari%2F537.36&playerVersion=3.0.0&fpl=-1&debugInformation=&isWePassGdpr=0&schain=1.0%2C1%21admetricspro.com%2C1005%2C1&csuuid=5e7cd5dc462d3&debugInfo=12348808_&debugPlayerSession=&sta=12348808&showLogo=0&clkUrl=&plMult=-1&schedule=eyJwcmVfcm9sbCI6MSwibWlkX3JvbGwiOltdLCJnYXAiOiJhdXRvIn0%3D&content=plembed173akunvrojp&secondaryContent=&x=300&y=250&pubUrl=https%3A%2F%2Fthreatpost.com%2Firanian-apt-targets-govs-with-new-malware%2F%3D&contentNum=1&flow_closeBtn=1&flowCloseTimeout=0&flow_direction=br&flow_horizontalOffset=10&flow_bottomOffset=10&impGap=2&flow_width=320&flow_height=180&videoType=flow&gdpr=1&gdprConsent=&contentFeedId=&geoLati=50.884700775146484&geoLong=4.504899978637695&vpTemplate=6615&flowMode=both&isRealPreroll=0&playerApiId=&isApp=0&gdpr2Consent=&ccpa=0&ccpaConsent=
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
63.250.56.23 , United States, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software
nginx / PHP/7.3.15
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
Origin
https://threatpost.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-type
application/x-www-form-urlencoded

Response headers

Pragma
no-cache
Date
Thu, 26 Mar 2020 16:18:40 GMT
Content-Encoding
gzip
Server
nginx
Age
0
X-Powered-By
PHP/7.3.15
Transfer-Encoding
chunked
Content-Type
text/html; charset=UTF-8
Access-Control-Allow-Origin
*
Cache-Control
no-store
liveView.php
live.sekindo.com/live/ Frame 3C77 		0
379 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://live.sekindo.com/live/liveView.php?njs=1&ito=1&vid_event=42&serverTime=1585239516&s=101281&sta=0&x=300&y=250&vid_passDomain=threatpost.com&subId=threatpost.com&debugInformation=&isApp=0&userIpAddr=82.102.19.134&userUA=Mozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010_14_5%29%20AppleWebKit%2F537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome%2F74.0.3729.169%20Safari%2F537.36&csuuid=5e7cd5dc462d3&contentFileId=0&mediaPlayListId=0&dur=500&cbuster=1585239521971&gdpr=1&gdprConsent=&isWePassGdpr=0&gdpr2Consent=&isWePassGdpr2=0&ccpa=0&ccpaConsent=
Requested by
Host: threatpost.com
URL: https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
63.250.56.23 , United States, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software
nginx / PHP/7.3.15
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

Pragma
no-cache
Date
Thu, 26 Mar 2020 16:18:41 GMT
Content-Encoding
gzip
Server
nginx
Age
0
X-Powered-By
PHP/7.3.15
Transfer-Encoding
chunked
P3P
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin
*
Cache-Control
no-store
Content-Type
text/html; charset=UTF-8
w_640_006.ts
video.sekindo.com/uploads/cn11/video/users/hls/28530/video_5d5baf9fe4c32389620327/vid5e7bc8c759a30254664862.mp4/ Frame 9211 		479 KB
480 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://video.sekindo.com/uploads/cn11/video/users/hls/28530/video_5d5baf9fe4c32389620327/vid5e7bc8c759a30254664862.mp4/w_640_006.ts
Requested by
Host: live.sekindo.com
URL: https://live.sekindo.com/content/video/hls/hls.0.12.4_1.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
185.220.204.11 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software
Tengine /
Resource Hash
db269e91e135d5c44c8742e13754d9ff9a2ae47d06c58673810c78ec9cd801aa

Request headers

Referer
https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
Origin
https://threatpost.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Thu, 26 Mar 2020 16:18:42 GMT
Last-Modified
Wed, 25 Mar 2020 21:12:13 GMT
Server
Tengine
ETag
"5e7bc92d-77d74"
Content-Type
video/mp2t
Access-Control-Allow-Origin
*
Expires
Thu, 02 Apr 2020 16:18:42 GMT
Cache-Control
max-age=604800
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=25
Content-Length
490868
X-Proxy-Cache
HIT
liveView.php
live.sekindo.com/live/ Frame 3C77 		0
379 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://live.sekindo.com/live/liveView.php?njs=1&ito=1&vid_event=25&serverTime=1585239516&s=101281&sta=0&x=300&y=250&vid_passDomain=threatpost.com&subId=threatpost.com&debugInformation=&isApp=0&userIpAddr=82.102.19.134&userUA=Mozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010_14_5%29%20AppleWebKit%2F537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome%2F74.0.3729.169%20Safari%2F537.36&csuuid=5e7cd5dc462d3&contentFileId=0&mediaPlayListId=0&dur=1000&cbuster=1585239526759&gdpr=1&gdprConsent=&isWePassGdpr=0&gdpr2Consent=&isWePassGdpr2=0&ccpa=0&ccpaConsent=
Requested by
Host: threatpost.com
URL: https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
63.250.56.23 , United States, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software
nginx / PHP/7.3.15
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

Pragma
no-cache
Date
Thu, 26 Mar 2020 16:18:46 GMT
Content-Encoding
gzip
Server
nginx
Age
0
X-Powered-By
PHP/7.3.15
Transfer-Encoding
chunked
P3P
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin
*
Cache-Control
no-store
Content-Type
text/html; charset=UTF-8
liveView.php
live.sekindo.com/live/ Frame 3C77 		0
379 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://live.sekindo.com/live/liveView.php?njs=1&ito=1&vid_event=42&serverTime=1585239516&s=101281&sta=0&x=300&y=250&vid_passDomain=threatpost.com&subId=threatpost.com&debugInformation=&isApp=0&userIpAddr=82.102.19.134&userUA=Mozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010_14_5%29%20AppleWebKit%2F537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome%2F74.0.3729.169%20Safari%2F537.36&csuuid=5e7cd5dc462d3&contentFileId=0&mediaPlayListId=0&dur=500&cbuster=1585239526969&gdpr=1&gdprConsent=&isWePassGdpr=0&gdpr2Consent=&isWePassGdpr2=0&ccpa=0&ccpaConsent=
Requested by
Host: threatpost.com
URL: https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
63.250.56.23 , United States, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software
nginx / PHP/7.3.15
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

Pragma
no-cache
Date
Thu, 26 Mar 2020 16:18:46 GMT
Content-Encoding
gzip
Server
nginx
Age
0
X-Powered-By
PHP/7.3.15
Transfer-Encoding
chunked
P3P
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin
*
Cache-Control
no-store
Content-Type
text/html; charset=UTF-8
w_640_007.ts
video.sekindo.com/uploads/cn11/video/users/hls/28530/video_5d5baf9fe4c32389620327/vid5e7bc8c759a30254664862.mp4/ Frame 9211 		476 KB
476 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://video.sekindo.com/uploads/cn11/video/users/hls/28530/video_5d5baf9fe4c32389620327/vid5e7bc8c759a30254664862.mp4/w_640_007.ts
Requested by
Host: live.sekindo.com
URL: https://live.sekindo.com/content/video/hls/hls.0.12.4_1.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
185.220.204.11 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software
Tengine /
Resource Hash
169a94ce182e14bec05b0e32440cb104307479b805cc9a5a4680877f91c8e367

Request headers

Referer
https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
Origin
https://threatpost.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Thu, 26 Mar 2020 16:18:48 GMT
Last-Modified
Wed, 25 Mar 2020 21:12:15 GMT
Server
Tengine
ETag
"5e7bc92f-76e08"
Content-Type
video/mp2t
Access-Control-Allow-Origin
*
Expires
Thu, 02 Apr 2020 16:18:48 GMT
Cache-Control
max-age=604800
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=25
Content-Length
486920
X-Proxy-Cache
HIT
liveView.php
live.sekindo.com/live/ Frame 3C77 		0
379 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://live.sekindo.com/live/liveView.php?njs=1&ito=1&vid_event=42&serverTime=1585239516&s=101281&sta=0&x=300&y=250&vid_passDomain=threatpost.com&subId=threatpost.com&debugInformation=&isApp=0&userIpAddr=82.102.19.134&userUA=Mozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010_14_5%29%20AppleWebKit%2F537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome%2F74.0.3729.169%20Safari%2F537.36&csuuid=5e7cd5dc462d3&contentFileId=0&mediaPlayListId=0&dur=500&cbuster=1585239531969&gdpr=1&gdprConsent=&isWePassGdpr=0&gdpr2Consent=&isWePassGdpr2=0&ccpa=0&ccpaConsent=
Requested by
Host: threatpost.com
URL: https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
63.250.56.23 , United States, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software
nginx / PHP/7.3.15
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

Pragma
no-cache
Date
Thu, 26 Mar 2020 16:18:51 GMT
Content-Encoding
gzip
Server
nginx
Age
0
X-Powered-By
PHP/7.3.15
Transfer-Encoding
chunked
P3P
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin
*
Cache-Control
no-store
Content-Type
text/html; charset=UTF-8
translator
hbopenbid.pubmatic.com/ Frame 9211 		0
59 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by
Host: live.sekindo.com
URL: https://live.sekindo.com/content/prebid/prebidVid.2.44.3_2.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.189.112 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
Origin
https://threatpost.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
text/plain

Response headers

status
204
date
Thu, 26 Mar 2020 16:18:54 GMT
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
access-control-allow-origin
https://threatpost.com
auction
prebid-server.rubiconproject.com/openrtb2/ Frame 9211 		141 B
361 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://prebid-server.rubiconproject.com/openrtb2/auction
Requested by
Host: live.sekindo.com
URL: https://live.sekindo.com/content/prebid/prebidVid.2.44.3_2.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.158.0.61 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-35-158-0-61.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
eb8e5c8a3c03c030d2eb2a66d8eaa6496d340899c7cfc45f8762a0d1e2b118bc

Request headers

Referer
https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
Origin
https://threatpost.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Thu, 26 Mar 2020 16:18:54 GMT
content-encoding
gzip
status
200
content-type
application/json
access-control-allow-origin
https://threatpost.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
content-length
148
expires
0
openrtb
ads.adaptv.advertising.com/rtb/ Frame 9211 		0
215 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://ads.adaptv.advertising.com/rtb/openrtb?ext_id=TeachingAidsLLC
Requested by
Host: live.sekindo.com
URL: https://live.sekindo.com/content/prebid/prebidVid.2.44.3_2.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.194.129.81 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-194-129-81.eu-central-1.compute.amazonaws.com
Software
adaptv/1.0 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
Origin
https://threatpost.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
text/plain

Response headers

Access-Control-Allow-Origin
https://threatpost.com
Access-Control-Allow-Credentials
true
Server
adaptv/1.0
Connection
keep-alive
Content-Length
0
Content-Type
application/json
prebid
ib.adnxs.com/ut/v3/ Frame 9211 		144 B
836 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/ut/v3/prebid
Requested by
Host: live.sekindo.com
URL: https://live.sekindo.com/content/prebid/prebidVid.2.44.3_2.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.33.223.80 , Netherlands, ASN29990 (ASN-APPNEX, US),
Reverse DNS
251.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
Software
nginx/1.13.4 /
Resource Hash
2f28bae790dd4db40e9b4fc0055b28fea870fe6f821e7988519114281bf6ad16
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
Origin
https://threatpost.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Thu, 26 Mar 2020 16:18:56 GMT
X-Proxy-Origin
82.102.19.134; 82.102.19.134; 251.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.220.116:80
AN-X-Request-Uuid
0832e70d-3378-43fb-a279-ffe933efeee8
Server
nginx/1.13.4
P3P
policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://threatpost.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json; charset=utf-8
Content-Length
144
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
avjp
teachingaids-d.openx.net/v/1.0/ Frame 9211 		92 B
472 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://teachingaids-d.openx.net/v/1.0/avjp?ju=https%3A%2F%2Fthreatpost.com%2Firanian-apt-targets-govs-with-new-malware%2F%3D&ch=UTF-8&res=1600x1200x24&ifr=true&tz=-60&tws=1600x1200&be=1&bc=hb_pb_3.0.1&dddid=e5153325-223e-48cc-8a03-9fc9b3d69f0e&nocache=1585239534258&gdpr_consent=&gdpr=1&schain=1.0%2C1!admetricspro.com%2C1005%2C1%2C%2C%2C&skip=1&auid=540882779&vwd=320&vht=180&
Requested by
Host: live.sekindo.com
URL: https://live.sekindo.com/content/prebid/prebidVid.2.44.3_2.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.95.120.147 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
147.120.95.34.bc.googleusercontent.com
Software
OXGW/16.182.1 /
Resource Hash
004e5faf0bf890f61697daeede9f21826affd1137fb2cb58eaf4719937a04a14

Request headers

Referer
https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
Origin
https://threatpost.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Thu, 26 Mar 2020 16:18:54 GMT
via
1.1 google
server
OXGW/16.182.1
status
200
p3p
CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin
https://threatpost.com
cache-control
private, max-age=0, no-cache
access-control-allow-credentials
true
content-type
application/json
alt-svc
clear
content-length
92
expires
Mon, 26 Jul 1997 05:00:00 GMT
cygnus
as-sec.casalemedia.com/ Frame 9211 		25 B
987 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://as-sec.casalemedia.com/cygnus?s=435870&v=8.1&r=%7B%22id%22%3A%222911461648b90c2%22%2C%22imp%22%3A%5B%7B%22id%22%3A%223014e2a26dcf2b3%22%2C%22ext%22%3A%7B%22siteID%22%3A%22435870%22%2C%22sid%22%3A%22320x180%22%7D%2C%22bidfloor%22%3A1.92%2C%22bidfloorcur%22%3A%22USD%22%2C%22video%22%3A%7B%22mimes%22%3A%5B%22video%2Fmp4%22%2C%22application%2Fjavascript%22%5D%2C%22minduration%22%3A1%2C%22maxduration%22%3A200%2C%22api%22%3A%5B1%2C2%5D%2C%22protocols%22%3A%5B1%2C2%2C3%2C4%2C5%2C6%5D%2C%22linearity%22%3A1%2C%22startdelay%22%3A0%2C%22skip%22%3A1%2C%22w%22%3A320%2C%22h%22%3A180%2C%22placement%22%3A1%7D%7D%5D%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fthreatpost.com%2Firanian-apt-targets-govs-with-new-malware%2F%3D%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%7D%2C%22regs%22%3A%7B%22ext%22%3A%7B%22gdpr%22%3A1%7D%7D%2C%22user%22%3A%7B%22ext%22%3A%7B%22consent%22%3A%22%22%7D%7D%7D&ac=j&sd=1&nf=1&
Requested by
Host: live.sekindo.com
URL: https://live.sekindo.com/content/prebid/prebidVid.2.44.3_2.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
95.101.185.51 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a95-101-185-51.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
929a2abf0d382f05ecef465f803a4725e4020a8543aca0281c12751576755bc7

Request headers

Referer
https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
Origin
https://threatpost.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Thu, 26 Mar 2020 16:18:54 GMT
Content-Encoding
gzip
Server
Apache
Vary
Accept-Encoding
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Access-Control-Allow-Origin
https://threatpost.com
Cache-Control
max-age=0, no-cache, no-store
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json
Content-Length
45
Expires
Thu, 26 Mar 2020 16:18:54 GMT
liveView.php
live.sekindo.com/live/ Frame 3C77 		43 B
463 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://live.sekindo.com/live/liveView.php?njs=1&ito=1&vid_event=6&serverTime=1585239517&s=58057&sta=12604104&x=320&y=180&msta=12348808&vid_vastType=3&vid_viewabilityState=1&vid_passDomain=threatpost.com&subId=threatpost.com&debugInformation=&playbackMethod=auto&isApp=0&userIpAddr=82.102.19.134&userUA=Mozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010_14_5%29%20AppleWebKit%2F537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome%2F74.0.3729.169%20Safari%2F537.36&csuuid=5e7cd5dc462d3&rvn=${VP_RVN_MACRO}&attemptMultiplier=10&contentFileId=0&mediaPlayListId=0&playerVer=3.0.0&cbuster=1585239534250&gdpr=1&gdprConsent=&isWePassGdpr=0&gdpr2Consent=&isWePassGdpr2=0&ccpa=0&ccpaConsent=
Requested by
Host: threatpost.com
URL: https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
63.250.56.23 , United States, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software
nginx / PHP/7.3.15
Resource Hash
42b976597a2d977d0e300f6d06bc903db389e5c112d33c1c8c249690a522d9f2

Request headers

Referer
https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

Pragma
no-cache
Date
Thu, 26 Mar 2020 16:18:53 GMT
Server
nginx
Age
0
X-Powered-By
PHP/7.3.15
Transfer-Encoding
chunked
P3P
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin
*
Cache-Control
max-age=315360000
Content-Disposition
inline; filename="pixel.gif"
Content-Type
image/gif
Expires
Thu, 31 Dec 2037 23:55:55 GMT
avjp
primis-d.openx.net/v/1.0/ Frame 9211 		92 B
292 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://primis-d.openx.net/v/1.0/avjp?ju=https%3A%2F%2Fthreatpost.com%2Firanian-apt-targets-govs-with-new-malware%2F%3D&ch=UTF-8&res=1600x1200x24&ifr=true&tz=-60&tws=1600x1200&be=1&bc=hb_pb_3.0.1&dddid=e4ce2fec-5177-43d8-89ac-fe738b041d72&nocache=1585239534666&gdpr_consent=&gdpr=1&schain=1.0%2C1!admetricspro.com%2C1005%2C1%2C%2C%2C!primis.tech%2C19668%2C1%2C%2C%2C&skip=1&auid=540392761&vwd=320&vht=180&
Requested by
Host: live.sekindo.com
URL: https://live.sekindo.com/content/prebid/prebidVid.2.44.3_2.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.95.120.147 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
147.120.95.34.bc.googleusercontent.com
Software
OXGW/16.182.1 /
Resource Hash
004e5faf0bf890f61697daeede9f21826affd1137fb2cb58eaf4719937a04a14

Request headers

Referer
https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
Origin
https://threatpost.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Thu, 26 Mar 2020 16:18:54 GMT
via
1.1 google
server
OXGW/16.182.1
status
200
p3p
CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin
https://threatpost.com
cache-control
private, max-age=0, no-cache
access-control-allow-credentials
true
content-type
application/json
alt-svc
clear
content-length
92
expires
Mon, 26 Jul 1997 05:00:00 GMT
w_640_008.ts
video.sekindo.com/uploads/cn11/video/users/hls/28530/video_5d5baf9fe4c32389620327/vid5e7bc8c759a30254664862.mp4/ Frame 9211 		507 KB
507 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://video.sekindo.com/uploads/cn11/video/users/hls/28530/video_5d5baf9fe4c32389620327/vid5e7bc8c759a30254664862.mp4/w_640_008.ts
Requested by
Host: live.sekindo.com
URL: https://live.sekindo.com/content/video/hls/hls.0.12.4_1.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
185.220.204.11 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software
Tengine /
Resource Hash
c50b5ccedda8ee007d2a503c8aad26a2413ecdfe519f51b44f4e66e0558a8c7f

Request headers

Referer
https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
Origin
https://threatpost.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Thu, 26 Mar 2020 16:18:54 GMT
Last-Modified
Wed, 25 Mar 2020 21:12:16 GMT
Server
Tengine
ETag
"5e7bc930-7ea24"
Content-Type
video/mp2t
Access-Control-Allow-Origin
*
Expires
Thu, 02 Apr 2020 16:18:54 GMT
Cache-Control
max-age=604800
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=25
Content-Length
518692
X-Proxy-Cache
HIT
liveView.php
live.sekindo.com/live/ Frame 3C77 		0
379 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://live.sekindo.com/live/liveView.php?njs=1&ito=1&vid_event=25&serverTime=1585239516&s=101281&sta=0&x=300&y=250&vid_passDomain=threatpost.com&subId=threatpost.com&debugInformation=&isApp=0&userIpAddr=82.102.19.134&userUA=Mozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010_14_5%29%20AppleWebKit%2F537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome%2F74.0.3729.169%20Safari%2F537.36&csuuid=5e7cd5dc462d3&contentFileId=0&mediaPlayListId=0&dur=1000&cbuster=1585239536758&gdpr=1&gdprConsent=&isWePassGdpr=0&gdpr2Consent=&isWePassGdpr2=0&ccpa=0&ccpaConsent=
Requested by
Host: threatpost.com
URL: https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
63.250.56.23 , United States, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software
nginx / PHP/7.3.15
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

Pragma
no-cache
Date
Thu, 26 Mar 2020 16:18:56 GMT
Content-Encoding
gzip
Server
nginx
Age
0
X-Powered-By
PHP/7.3.15
Transfer-Encoding
chunked
P3P
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin
*
Cache-Control
no-store
Content-Type
text/html; charset=UTF-8
liveView.php
live.sekindo.com/live/ Frame 3C77 		0
379 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://live.sekindo.com/live/liveView.php?njs=1&ito=1&vid_event=42&serverTime=1585239516&s=101281&sta=0&x=300&y=250&vid_passDomain=threatpost.com&subId=threatpost.com&debugInformation=&isApp=0&userIpAddr=82.102.19.134&userUA=Mozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010_14_5%29%20AppleWebKit%2F537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome%2F74.0.3729.169%20Safari%2F537.36&csuuid=5e7cd5dc462d3&contentFileId=0&mediaPlayListId=0&dur=500&cbuster=1585239536969&gdpr=1&gdprConsent=&isWePassGdpr=0&gdpr2Consent=&isWePassGdpr2=0&ccpa=0&ccpaConsent=
Requested by
Host: threatpost.com
URL: https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
63.250.56.23 , United States, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software
nginx / PHP/7.3.15
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

Pragma
no-cache
Date
Thu, 26 Mar 2020 16:18:56 GMT
Content-Encoding
gzip
Server
nginx
Age
0
X-Powered-By
PHP/7.3.15
Transfer-Encoding
chunked
P3P
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin
*
Cache-Control
no-store
Content-Type
text/html; charset=UTF-8
liveView.php
live.sekindo.com/live/ Frame 3C77 		0
379 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://live.sekindo.com/live/liveView.php?njs=1&ito=1&vid_event=42&serverTime=1585239516&s=101281&sta=0&x=300&y=250&vid_passDomain=threatpost.com&subId=threatpost.com&debugInformation=&isApp=0&userIpAddr=82.102.19.134&userUA=Mozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010_14_5%29%20AppleWebKit%2F537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome%2F74.0.3729.169%20Safari%2F537.36&csuuid=5e7cd5dc462d3&contentFileId=0&mediaPlayListId=0&dur=500&cbuster=1585239541969&gdpr=1&gdprConsent=&isWePassGdpr=0&gdpr2Consent=&isWePassGdpr2=0&ccpa=0&ccpaConsent=
Requested by
Host: threatpost.com
URL: https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
63.250.56.23 , United States, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software
nginx / PHP/7.3.15
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

Pragma
no-cache
Date
Thu, 26 Mar 2020 16:19:01 GMT
Content-Encoding
gzip
Server
nginx
Age
0
X-Powered-By
PHP/7.3.15
Transfer-Encoding
chunked
P3P
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin
*
Cache-Control
no-store
Content-Type
text/html; charset=UTF-8
w_640_009.ts
video.sekindo.com/uploads/cn11/video/users/hls/28530/video_5d5baf9fe4c32389620327/vid5e7bc8c759a30254664862.mp4/ Frame 9211 		483 KB
484 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://video.sekindo.com/uploads/cn11/video/users/hls/28530/video_5d5baf9fe4c32389620327/vid5e7bc8c759a30254664862.mp4/w_640_009.ts
Requested by
Host: live.sekindo.com
URL: https://live.sekindo.com/content/video/hls/hls.0.12.4_1.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
185.220.204.11 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software
Tengine /
Resource Hash
7b9f0c8303c8e33a7e94654610189cd2de6fcb71660aff04fbf4b52198dacc6e

Request headers

Referer
https://threatpost.com/iranian-apt-targets-govs-with-new-malware/=
Origin
https://threatpost.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Thu, 26 Mar 2020 16:19:00 GMT
Last-Modified
Wed, 25 Mar 2020 21:12:17 GMT
Server
Tengine
ETag
"5e7bc931-78ce0"
Content-Type
video/mp2t
Access-Control-Allow-Origin
*
Expires
Thu, 02 Apr 2020 16:19:00 GMT
Cache-Control
max-age=604800
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=25
Content-Length
494816
X-Proxy-Cache
HIT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
teachingaids-d.openx.net
URL
https://teachingaids-d.openx.net/v/1.0/avjp?ju=https%3A%2F%2Fthreatpost.com%2Firanian-apt-targets-govs-with-new-malware%2F%3D&ch=UTF-8&res=1600x1200x24&ifr=true&tz=-60&tws=1600x1200&be=1&bc=hb_pb_3.0.1&dddid=f436f0e0-3b11-4aa1-bddc-8e7a726721a8&nocache=1585239517117&gdpr_consent=&gdpr=1&schain=1.0%2C1!admetricspro.com%2C1005%2C1%2C%2C%2C&skip=1&auid=540882778&vwd=320&vht=180&
Domain
threatpost.com
URL
https://threatpost.com/wp-content/themes/threatpost-2018/assets/images/photo-newsletter.jpg

Verdicts & Comments Add Verdict or Comment

112 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate undefined| $ function| jQuery object| gdprDynamicStrings object| kss object| gdprStrings object| __core-js_shared__ object| core function| setImmediate function| clearImmediate object| regeneratorRuntime boolean| _babelPolyfill object| dataLayer object| gf_global object| viewPortSize object| debugIp object| debugId function| constructsekindoParent637 object| google_tag_manager string| GoogleAnalyticsObject function| ga object| _qevents function| twq object| google_tag_data object| gaplugins object| gaGlobal object| gaData object| twttr boolean| sekindoFlowingPlayerOn function| quantserve function| __qc object| ezt object| _qoptions function| gformBindFormatPricingFields function| Currency function| gformCleanNumber function| gformGetDecimalSeparator function| gformIsNumber function| gformIsNumeric function| gformDeleteUploadedFile function| gformIsHidden function| gformCalculateTotalPrice function| gformGetShippingPrice function| gformGetFieldId function| gformCalculateProductPrice function| gformGetProductQuantity function| gformIsProductSelected function| gformGetBasePrice function| gformFormatMoney function| gformFormatPricingField function| gformToNumber function| gformGetPriceDifference function| gformGetOptionLabel function| gformGetProductIds function| gformGetPrice function| gformRegisterPriceField function| gformInitPriceFields function| gformShowPasswordStrength function| gformPasswordStrength function| gformAddListItem function| gformDeleteListItem function| gformAdjustClasses function| gformToggleIcons function| gformMatchCard function| gformFindCardType function| gformToggleCreditCard function| gformInitChosenFields function| gformInitCurrencyFormatFields function| gformFormatNumber function| getMatchGroups function| gf_get_field_number_format function| renderRecaptcha function| gformValidateFileSize function| gformInitSpinner function| gformAddSpinner function| gf_raw_input_change function| gf_get_input_id_by_html_id function| gf_get_form_id_by_html_id function| gf_get_ids_by_html_id function| gf_input_change function| gformExtractFieldId function| gformExtractInputIndex function| rgars function| rgar object| _gformPriceFields undefined| _anyProductSelected function| GFCalc object| gform undefined| __gf_keyup_timeout object| gfMultiFileUploader function| gf_apply_rules function| gf_check_field_rule function| gf_apply_field_rule function| gf_get_field_action function| gf_is_match function| gf_is_match_checkable function| gf_is_match_default function| gf_format_number function| gf_try_convert_float function| gf_matches_operation function| gf_get_value function| gf_do_field_action function| gf_do_next_button_action function| gf_do_action function| gf_reset_to_default undefined| __gf_timeout_handle object| Placeholders object| wp object| gf_form_conditional_logic string| gf_number_format function| do_callback

0 Cookies

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ads.adaptv.advertising.com
analytics.twitter.com
as-sec.casalemedia.com
assets.threatpost.com
c.amazon-adsystem.com
cm.g.doubleclick.net
eus.rubiconproject.com
fonts.googleapis.com
fonts.gstatic.com
hbopenbid.pubmatic.com
ib.adnxs.com
kasperskycontenthub.com
live.sekindo.com
match.adsrvr.org
media.threatpost.com
pixel.advertising.com
pixel.quantserve.com
pr-bh.ybp.yahoo.com
prebid-server.rubiconproject.com
primis-d.openx.net
rules.quantcount.com
secure.quantserve.com
static.ads-twitter.com
stats.g.doubleclick.net
sync-tm.everesttech.net
sync.adap.tv
sync.adaptv.advertising.com
t.co
teachingaids-d.openx.net
threatpost.com
u.openx.net
ups.analytics.yahoo.com
video.sekindo.com
www.google-analytics.com
www.google.com
www.google.de
www.googletagmanager.com
teachingaids-d.openx.net
threatpost.com
104.109.78.125
104.244.42.195
104.244.42.197
13.224.199.29
151.101.112.157
151.101.114.49
18.156.0.31
18.194.129.81
185.220.204.11
185.33.223.80
185.64.189.112
216.58.205.226
2600:9000:20e8:1400:2:9275:3d40:93a1
2600:9000:20e8:5c00:0:5c46:4f40:93a1
2600:9000:21f3:800:6:44e3:f8c0:93a1
2a00:1288:110:c305::8000
2a00:1450:4001:800::2008
2a00:1450:4001:808::2004
2a00:1450:4001:814::2003
2a00:1450:4001:817::200e
2a00:1450:4001:81e::2003
2a00:1450:4001:821::200a
2a00:1450:400c:c07::9c
3.123.244.246
34.95.120.147
35.158.0.61
35.168.89.112
35.173.160.135
52.0.180.19
63.250.56.23
63.33.80.49
91.228.74.210
91.228.74.224
95.101.185.51
004e5faf0bf890f61697daeede9f21826affd1137fb2cb58eaf4719937a04a14
00d4fbacbadc6ecbd73be323ec77febf3d856ce00dc5334d06462a315c7da8e7
023957d3df430a0358f0049277daa338a0533d72e5faa57b28569f8a5b45155b
0284cbccebf1682452d62d06efa3665c874d642d4e03f5f5f9bb0f555da9251b
03d95929b0703d04e46b6957a7d8794f27214673987b91c56a020dabe35e8a10
065b293b19740f39c385d1b0e8a3cc01a385a6d74edab2127096ceaec68175e2
06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844
06fc565587b8b700936a1677218cb269a6cc31ca5f701eb45461e86a3d54d5c7
0f36540ce2d3d59ad44a3077fa738822877ad09b9f7e7c5362fb8e8f8ad75f79
1375c3a601c8c119942e35a8a9b340c0a44c53b15983e961295f04dc66889da9
14ecac620a63195eae43a57fefb8466ceda47fa6e3681296eb9615d469a46581
169a94ce182e14bec05b0e32440cb104307479b805cc9a5a4680877f91c8e367
1a4764f71c27fdf06dc584d0729841f1e5a29024c10c6a42ef9e1beaf7d96bff
1cfa89f491c7aef3daef0f5491ac09de2a7c81fcadb03bc71f93128f73db2d36
1db21d816296e6939ba1f42962496e4134ae2b0081e26970864c40c6d02bb1df
2de77164bb9924542e1dea4ee4a0ff27d40b51a3d7939dac7db11a95045c9b7d
2ed8662cb6ca4b48b146127db22ebd71f824d54fb6ca11601bd8fa97ff572cf2
2f28bae790dd4db40e9b4fc0055b28fea870fe6f821e7988519114281bf6ad16
319949c8c08b86e9c35ea542c0dc0c30cedaa9b8d3d3c3327a36c91aefbd8af5
32d47e707cccc00f62878c5b28e53336810758f069580ca174e98cdced03d903
3435531b595fb1b2b529346e1df8c979a1fd727f56ea8c0d792316035440cac5
392ee73494ad87dfd8e26d58894a845e8b3f2f8b0e4faea89562c45014be5ccb
39af7c1116fb967a330e8770f775e6b5ee871add01ed45c98a1634911cebfb0a
42b976597a2d977d0e300f6d06bc903db389e5c112d33c1c8c249690a522d9f2
42e2bdfb6f2641ab97b6a586c31e591246a5240bc86e504d6ec02c616aeb8e4e
45ddc09b0ad6ab916bd9a0282070b161045e186fc025303f4aa1aa821fc45ac7
4741ff734da9b39028a4e4c753fe270823859cd88532ea40083e1647580a48df
48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438
4d975445b1a028326a81fc08acbd255392f79270d1feebefaa69e34069fdc75f
4ee36d77a67f176a8468c3fafd5c230a2b8584293b81221b004619e700f84106
56ab0f61f8ed6030bdd684f3752233177da0555b07cb172e0abffe8e02978bc5
5a3f1dd74233f605e511f1b5b244bedf85ac88ba264caf4d6401bc7ec2017dcd
5d1bc9b443f3f81fa4b4ad4634c1bb9702194c1898e3a9de0ab5e2cdc0e9f479
5fccf04445879579853f1dcbff29a1b6554b84940bbfef87495d921f7074eda5
663ac3773e9741ad638447e6e9478f83e10e073c5ee433c5de3c640c7dae8c32
68f2d69f97d2bda52a3269d36a9a59d7a5a978ac71ce8fae552b270e454a2ae2
69a0433c5504c307c5fca5d2b19ca8d1d9a11d07d97a8918fa714cd68d2900b5
6bd9e5a7f4cbf05c024f933c04b204deb17bff95a3a63131e2507161ae87156c
6ebc39dd9f5d0636ce21bfb5e649135592ea460f7d914ebce9d3c31934084344
76102878c1198de858725194952ba1c6b35bdee0f870cc6a124e93d17385e64e
76ba07e059d9e2113f9c940f1a31efc95bd9d5badd68bbc3637177e892a08099
7b9f0c8303c8e33a7e94654610189cd2de6fcb71660aff04fbf4b52198dacc6e
7c8f72da57351d58b172c7844766589b872a13d5a3477e581452639c33b8078e
7d0492c66125b1c2bdc419641e41542857e7d90e323d355ee0b8bb268da121fb
7fe9c9bddddeedcfcc45dadb0f0c5f57cce1393013fff5d2c85ec6e9556d1414
859faa9b9ed0990288b2f393a102b1fe2668ac79088b113b6f0beaee521221eb
886624e576ddaccc6ae7fbab6aeb2bc12bd213f07ef721622f022900efc9be10
88c398db0cfca92ee248bd9e6aad3868c2ac54ae713370c93708b283dfb11c29
8ed681a83db7d4d3cf3456a8074806806a93e8fe21dde41830da052c2f8f019a
8fa3dc8d99f9c768dab8377000d306d6c3795c024993ab8a7f42e29f5f236ddd
929a2abf0d382f05ecef465f803a4725e4020a8543aca0281c12751576755bc7
97ac40ffcd418ff8129707fbb9f30c752c46a570112184af185b71fb91a06126
993ebc45d9927d420801f05819222e8cc1aa523187e4c0b290df02b23ce18093
9d02d662da8a47fb5fb610b545007507b6017028043dbb63cd09ec897d3b9627
9d472cb43e4b1b45017fd51ee4f226c9b94ac04da07e66a8513ef8283d3080ed
9e97043df2dc7e0f4f3a898102f5a6e93bb1b01d03a55ede10f8f97bd8079a18
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
a3336e3373c170b40764f5a62d121335bec4243b0034e561937194dfe2e413fd
a4fa6b6ff70552afacee85cdc4cc79e92eb662513ca8c93ee2bca4d2c265f661
a6d511bca686ce80ae1e714e422c0e2b614d827ec7c9e7c40f60650d4098b4b6
a783d2ad42c380bc896219c080fa845d1e9f2e77483558103aeb296b95b85701
a7b094f48e6774d82dfc7864e438d35675e5dad0ba6f3222a8003e9a932f104e
a9d2b2df99c1a115d5394c70a898d8801092208dc582f8bd6fb01b35c30d6b22
a9f6c03ce6f4d1654f29f2136651e883198d509cb2e26af1c24b1f87b6ccae13
aa24855cd33034eb1ed77708f83bf520e25c48624e1cb7891dbe081d586593e3
ac2a58f9d55c4642121cfb6f7e213cbc882bbdd75ef171ca8a07ed982ef693ce
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
ace61d80f3fe90bbb02ab328d9705b57a9c8a95d3a0bf6b4cd510d4dacd033df
ae00ae9c862bc8b8923efd1d9a18befa912678a869d4dd01179a59ed3de731be
b2e11a6d036e47dd106daa0d14d175a42337d24f1bb5b5df546b3096931f725c
b9c9d9797e752f6495f9ab07c2e8c029dbf0b910eb46a806a9efdcabd082d123
bb0c184958d3cddcd59e211f3c8c85905b5cfe0c48b79cbb09b59d8d79487502
c50b5ccedda8ee007d2a503c8aad26a2413ecdfe519f51b44f4e66e0558a8c7f
ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356
cdc1f29426a41b502d6db3bf338de6096590046961508a7d23a68bb7635a5a2d
d62a7b7ec5313469ebff5c006b9068dc44d6d1c122cf787ffa29a10113b34060
d80d8b9670d119f8a1009f617d5145101fb81bd242e5d290fc0477c71f5aa7b2
db269e91e135d5c44c8742e13754d9ff9a2ae47d06c58673810c78ec9cd801aa
de00567068a84230436328764006db43d6adacbda8e80fac6a8eb7192789b58f
df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf
e1c3c2dafe2208caea4f809f414a89a9d256deb8671e1c5d49bff9a873782796
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e4058d4ee9da1ceaddfa91ddb63650ba67285f1bbfee487d9dfe648bced669a0
e8d7c60749c1d62942a8e0a6f901800bd14ff3094251373626cd99a8875c6391
eac173b38cb8a2dee61ed09d2cffc1ac3a8c28a3c222fe470623c25076eb1b4c
eaf1b128b927ac2868755cb7366d35554255c8af362235afe270f9614f8c806d
eb8e5c8a3c03c030d2eb2a66d8eaa6496d340899c7cfc45f8762a0d1e2b118bc
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f89d17dc2e4ecb385243b7b4cdaf5d8d9f6d4b9829e2be80afb66d01721835e3
f8a2b5b62eb722c3379b30cf0cc58d3176ee6be48036d6ad2aa838d2029c4189
fe84f4f47a52ae0b2f512359034c5e68a5ed257f62e994083d2b3ac6a0996141