www.gdatasoftware.com
Open in
urlscan Pro
212.23.151.164
Public Scan
Submission: On June 18 via api from TR — Scanned from DE
Summary
TLS certificate: Issued by Sectigo RSA Organization Validation S... on July 23rd 2023. Valid for: a year.
This is the only time www.gdatasoftware.com was scanned on urlscan.io!
urlscan.io Verdict: No classification
Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
26 | 212.23.151.164 212.23.151.164 | 12329 (TMR) (TMR) | |
26 | 2 |
Apex Domain Subdomains |
Transfer | |
---|---|---|
26 |
gdatasoftware.com
www.gdatasoftware.com |
1 MB |
26 | 1 |
Domain | Requested by | |
---|---|---|
26 | www.gdatasoftware.com |
www.gdatasoftware.com
|
26 | 1 |
This site contains links to these domains. Also see Links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.gdatasoftware.com Sectigo RSA Organization Validation Secure Server CA |
2023-07-23 - 2024-08-22 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://www.gdatasoftware.com/blog/2024/06/37947-badspace-backdoor
Frame ID: 089652369D877E5C1E8F866F22407FF4
Requests: 27 HTTP requests in this frame
23 Outgoing links
These are links going to different origins than the main page.
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Title: Gi7w0rm
Search URL Search Domain Scan URL
Title: backdoor “BadSpace”
Search URL Search Domain Scan URL
Title: @kevross33
Search URL Search Domain Scan URL
Title: mentioned
Search URL Search Domain Scan URL
Title: a report
Search URL Search Domain Scan URL
Title: obfuscator.io
Search URL Search Domain Scan URL
Title: JavaScript Compressor by Dean Edwards
Search URL Search Domain Scan URL
Title: IDA Python script
Search URL Search Domain Scan URL
Title: Mohamed Ashraf
Search URL Search Domain Scan URL
Title: Python script
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Title: Submit a suspicious file, app or URL
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
26 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
37947-badspace-backdoor
www.gdatasoftware.com/blog/2024/06/ |
45 KB 14 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
basic-styles.css
www.gdatasoftware.com/typo3conf/ext/gd_sites/Resources/Public/Styles/ |
136 KB 27 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
gcon.css
www.gdatasoftware.com/typo3conf/ext/gd_sites/Resources/Public/Styles/font/ |
14 KB 4 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
source-sans-pro.css
www.gdatasoftware.com/typo3conf/ext/gd_sites/Resources/Public/Styles/font/ |
1 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
prism.css
www.gdatasoftware.com/typo3conf/ext/gd_sites/Resources/Public/Styles/assets/ |
4 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
menu-2019.css
www.gdatasoftware.com/typo3conf/ext/gd_sites/Resources/Public/Styles/elements/ |
19 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
blogpage.css
www.gdatasoftware.com/typo3conf/ext/gd_sites/Resources/Public/Styles/assets/ |
15 KB 4 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo-for-dark.svg
www.gdatasoftware.com/typo3conf/ext/gd_sites/Resources/Public/Images/ |
3 KB 3 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
DE.svg
www.gdatasoftware.com/typo3conf/ext/gd_sites/Resources/Public/Images/Flags/ |
966 B 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
anna_lvova_1936740544.jpg
www.gdatasoftware.com/fileadmin/_processed_/3/7/ |
4 KB 5 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
hahn_karsten_abecee0563.jpg
www.gdatasoftware.com/fileadmin/_processed_/0/d/ |
4 KB 5 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo-for-light.svg
www.gdatasoftware.com/typo3conf/ext/gd_sites/Resources/Public/Images/ |
3 KB 3 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
merged-84fb12e4dfd0cda1cc670515e3c86ca7.js
www.gdatasoftware.com/typo3temp/assets/compressed/ |
382 KB 122 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
gd-mainmenu-2019.js
www.gdatasoftware.com/typo3conf/ext/gd_sites/Resources/Public/JavaScript/ |
5 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
gd-guidebook.js
www.gdatasoftware.com/typo3conf/ext/gd_pagenews/Resources/Public/JavaScript/ |
2 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
G_DATA_Blog_Badspace_Header.jpg
www.gdatasoftware.com/fileadmin/user_upload/Presse/Deutschland/2024/06/ |
733 KB 735 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
870 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
source-sans-pro-v13-latin-ext_latin-regular.woff2
www.gdatasoftware.com/typo3conf/ext/gd_sites/Resources/Public/Styles/font/source-sans-pro/ |
25 KB 25 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
gcon1-991.ttf
www.gdatasoftware.com/typo3conf/ext/gd_sites/Resources/Public/Styles/font/ |
116 KB 117 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
source-sans-pro-v13-latin-ext_latin-300.woff2
www.gdatasoftware.com/typo3conf/ext/gd_sites/Resources/Public/Styles/font/source-sans-pro/ |
25 KB 25 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
source-sans-pro-v13-latin-ext_latin-600.woff2
www.gdatasoftware.com/typo3conf/ext/gd_sites/Resources/Public/Styles/font/source-sans-pro/ |
25 KB 25 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
GDATA_Badspace_InfectionChain.png
www.gdatasoftware.com/fileadmin/user_upload/Presse/Deutschland/2024/06/ |
107 KB 108 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
GDATA_Badspace_Web_infection.png
www.gdatasoftware.com/fileadmin/user_upload/Presse/Deutschland/2024/06/ |
30 KB 31 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
GDATA_Badspace_Deobfus._mechanism_cade696dcf.png
www.gdatasoftware.com/fileadmin/_processed_/f/f/ |
110 KB 111 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
GDATA_Badspace_PowerShell_code.png
www.gdatasoftware.com/fileadmin/user_upload/Presse/Deutschland/2024/06/ |
16 KB 17 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
GDATA_Badspace_encryptedstrings.png
www.gdatasoftware.com/fileadmin/user_upload/Presse/Deutschland/2024/06/ |
64 KB 65 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
favicon.ico
www.gdatasoftware.com/ |
4 KB 2 KB |
Other
image/x-icon |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
22 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
undefined| event object| fence object| sharedStorage function| setOffline object| GdWebsite function| _createClass function| _classCallCheck object| GdPlatform function| objectFitImages function| GDataBusinessLightboxItem object| _self object| Prism object| html5 object| Modernizr function| $ function| jQuery object| Foundation function| Shariff function| GdTrackingModule function| GDataMainMenu object| GdScrollIndicator object| GdTracking1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
www.gdatasoftware.com/ | Name: GDS_utm Value: {"utm_medium":"","utm_source":"","utm_campaign":"","utm_content":"","utm_term":""} |
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Content-Security-Policy | frame-ancestors 'self' *.gdata.de *.gdata.ch *.gdata.fr *.gdata.at *.gdata.nl *.gdata.it *.gdata.be *.gdata.es *.gdata.pt *.gdatasoftware.co.uk *.gdatasoftware.com *.gdata-software.com *.gdata-advancedanalytics.de *.gdata-advancedanalytics.com *.gdata.co.jp *.gdata-china.com *.gdata-hongkong.com *.inventorofantivirus.com; frame-src 'self' gdata.jobbase.io player.captivate.fm gdata.onlyfy.jobs *.gdata.de *.consentmanager.net www.paypal.com *.criteo.com *.criteo.net *.onfastspring.com *.saferpay.com www.youtube-nocookie.com www.google.com www.google.de *.gdata.ch *.gdata.fr *.gdata.at *.gdata.nl *.gdata.it *.gdata.be *.gdata.es *.gdata.pt *.gdatasoftware.co.uk *.gdatasoftware.com *.gdata-software.com *.gdata-advancedanalytics.de *.gdata.co.jp *.gdata-china.com *.gdata-hongkong.com *.inventorofantivirus.com www.awin1.com *.doubleclick.net bid.g.doubleclick.net tpc.googlesyndication.com fbanalytics.org m.youtube.com player.vimeo.com gdata.jobbase.io gdata-a.akamaihd.net; report-uri https://www.gdatasoftware.com/__cspreporting__ |
Strict-Transport-Security | max-age=31536000; includeSubDomains |
X-Content-Type-Options | nosniff |
X-Frame-Options | SAMEORIGIN |
X-Xss-Protection | 0 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
www.gdatasoftware.com
212.23.151.164
016d9a327e05fe4130b6c813d33ad2b5a8f1b55af3ba6bd98a5bfab46341b9e6
12bbeb4a5c75cfa4f290f8da4a9282a835f6704b94917c5bc05d4430aa9b31dd
188c3ea1e55c5d392684e4ecc57882eada91ad8b1cbbe8286aa0c5c858beff22
19d66a51d12c87c2c254f61d3dc66f4765bc852b03138e4b38ed5fbc3dd01d19
25505d3de5377f4666eefd180acee39dfd4fe86e96408f32b1600aec5e59dc9c
2920a6ee25c03afde8a0332e7fefe7a3e86594975e70584ab4d91aae2ea62bb0
2fbb32a9d8d552b87d7b0011dd665a0910945fcfe2edfa002437953d793fab4a
34db18423a32fefbce75ee874d051473dd8d19f1416a4d330786e78e6899d588
3e17d9ffedd7459d58e6c669de912c510574ec762c6c64fa599ed7e660cad7ba
5b7ade4116e14b315421eb6e4eeabbf1a1c7301a575ee1311fb1659eaaecd6f4
5bd5ebcf03a341e616a7b8361cf09a193e9e4b96fda68c679a6c53a07f5c31bb
5e5d46c22d87bff9d49018172f5764cb39ebcd228577ad17229a7dc67ee65198
649a8ae3e833643e125b17aef198da8f293b7e9040bddf781192c07280d0f23e
66b2ad78e9c125aa2a73010625f5d43b3b2d2648624881015ca07b9eec40cc8c
72e086ecb5eed26e489b633ce3a7a85522747d8583852bf8756e290fec0f3d3b
77f9291def17b8ae239f0f5181ad69a3923dbcc7835ba7aaa4cb1d1cb2142211
7a7abe196a5d8d760adbec74b6dcf7af2f35c91a06b4e033928ee5c03dfb7e9b
91949d92617c19f399a1726ba3fbb060254c9165f3e8cbc931014f732d0c0222
9d20a8fc1de189bad815a78bd3a36550412788bc1d8e6f2d7eba6bb18bc901a2
bff274c9a37425256c5eef9791075ccba934922e61acbe80e8bd4f22e0ac1257
c3a79be670d5d07523605e71791472dfd96bc775de87e3b947458924ce648835
d1f37f8f55965dceb4ae9641045cdf50125223b33cc5bc22b5c6ddc0b58eb008
de29fa42fdcdbc32e060d8e033322b3d0151f70e82dd08e8c9c9996e6c343dcb
e269f4a039beda664bcd9294fe3f36f6ebfdf31dc2c02bee383f47ae67003af8
eaee182f99fdf2d211c29221098ce1d2a326f78ee7126ce481d0c139e91b0d01
f37573409d9e7abddbbfbb516297cd89d7c0901b2743e23f0a7f91ebeac75c79
fd1d3a5290f359c07e822c17a6a8cb10286ae3299292a11ca4713b541228730a