urlscan.io logo urlscan.io
SecurityTrails logo

blog.yoroi.company Open in urlscan Pro
192.0.78.217  Public Scan

Go To Rescan Add Verdict Report
URL: https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/
Submission: On October 14 via api from CH
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 19 IPs in 4 countries across 10 domains to perform 84 HTTP transactions. The main IP is 192.0.78.217, located in San Francisco, United States and belongs to AUTOMATTIC - Automattic, Inc, US. The main domain is blog.yoroi.company.
TLS certificate: Issued by Let's Encrypt Authority X3 on October 5th 2019. Valid for: 3 months.
This is the only time blog.yoroi.company was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 19 192.0.78.217 2635 (AUTOMATTIC)
15 192.0.77.37 2635 (AUTOMATTIC)
1 2a00:1450:400... 15169 (GOOGLE)
1 62.149.144.20 31034 (ARUBA-ASN)
4 192.0.77.2 2635 (AUTOMATTIC)
2 2a00:1450:400... 15169 (GOOGLE)
12 2a00:1450:400... 15169 (GOOGLE)
2 192.0.77.32 2635 (AUTOMATTIC)
3 2a04:fa87:fff... 2635 (AUTOMATTIC)
3 192.0.76.3 2635 (AUTOMATTIC)
1 2a00:1450:400... 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
7 2606:2800:234... 15133 (EDGECAST)
1 2a03:2880:f01... 32934 (FACEBOOK)
3 2606:2800:134... 15133 (EDGECAST)
1 104.244.42.136 13414 (TWITTER)
6 2606:2800:134... 15133 (EDGECAST)
1 1 104.244.42.200 13414 (TWITTER)
84 19
19    192.0.78.217 (San Francisco, United States)

ASN2635 (AUTOMATTIC - Automattic, Inc, US)
blog.yoroi.company
15    192.0.77.37 (San Francisco, United States)

ASN2635 (AUTOMATTIC - Automattic, Inc, US)
PTR: wordpress.com
c0.wp.com
1    2a00:1450:4001:817::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)
fonts.googleapis.com
1    62.149.144.20 (Arezzo, Italy)

ASN31034 (ARUBA-ASN, IT)
PTR: webx498.aruba.it
www.yoroi.company
4    192.0.77.2 (San Francisco, United States)

ASN2635 (AUTOMATTIC - Automattic, Inc, US)
PTR: i1.wp.com
i1.wp.com
i2.wp.com
i0.wp.com
2    2a00:1450:4001:820::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)
lh5.googleusercontent.com
12    2a00:1450:4001:806::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)
lh3.googleusercontent.com
lh6.googleusercontent.com
lh4.googleusercontent.com
2    192.0.77.32 (San Francisco, United States)

ASN2635 (AUTOMATTIC - Automattic, Inc, US)
PTR: wordpress.com
s0.wp.com
widgets.wp.com
3    2a04:fa87:fffe::c000:4902 (Ireland)

ASN2635 (AUTOMATTIC - Automattic, Inc, US)
secure.gravatar.com
3    192.0.76.3 (San Francisco, United States)

ASN2635 (AUTOMATTIC - Automattic, Inc, US)
stats.wp.com
pixel.wp.com
1    2a00:1450:4001:818::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)
fonts.googleapis.com
2    2a00:1450:4001:825::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)
www.google-analytics.com
2    2a00:1450:4001:80b::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)
fonts.gstatic.com
7    2606:2800:234:59:254c:406:2366:268c (United States)

ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US)
platform.twitter.com
1    2a03:2880:f01c:20e:face:b00c:0:2 (Ireland)

ASN32934 (FACEBOOK - Facebook, Inc., US)
graph.facebook.com
3    2606:2800:134:fa2:1627:1fe:edb:1665 (United States)

ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US)
cdn.syndication.twimg.com
ton.twimg.com
1    104.244.42.136 (United States)

ASN13414 (TWITTER - Twitter Inc., US)
syndication.twitter.com
6    2606:2800:134:1a0d:1429:742:782:b6 (United States)

ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US)
pbs.twimg.com
1    104.244.42.200 (United States)

ASN13414 (TWITTER - Twitter Inc., US)
syndication.twitter.com
Domain Requested by
19 blog.yoroi.company 1 redirects blog.yoroi.company
15 c0.wp.com blog.yoroi.company
7 platform.twitter.com c0.wp.com
platform.twitter.com
6 pbs.twimg.com platform.twitter.com
6 lh3.googleusercontent.com blog.yoroi.company
4 lh6.googleusercontent.com blog.yoroi.company
3 secure.gravatar.com blog.yoroi.company
2 ton.twimg.com platform.twitter.com
2 syndication.twitter.com 1 redirects
2 pixel.wp.com blog.yoroi.company
2 fonts.gstatic.com blog.yoroi.company
2 www.google-analytics.com blog.yoroi.company
2 lh4.googleusercontent.com blog.yoroi.company
2 lh5.googleusercontent.com blog.yoroi.company
2 i1.wp.com blog.yoroi.company
2 fonts.googleapis.com blog.yoroi.company
1 cdn.syndication.twimg.com platform.twitter.com
1 graph.facebook.com blog.yoroi.company
1 widgets.wp.com blog.yoroi.company
1 stats.wp.com blog.yoroi.company
1 s0.wp.com blog.yoroi.company
1 i0.wp.com blog.yoroi.company
1 i2.wp.com blog.yoroi.company
1 www.yoroi.company blog.yoroi.company
84 24

This site contains links to these domains. Also see Links.

Domain
www.yoroi.company
www.facebook.com
twitter.com
www.youtube.com
www.linkedin.com
docs.microsoft.com
Subject Issuer Validity Valid
tls.automattic.com
Let's Encrypt Authority X3		 2019-10-05 -
2020-01-03		 3 months crt.sh
*.wp.com
Go Daddy Secure Certificate Authority - G2		 2018-04-10 -
2020-05-11		 2 years crt.sh
*.googleapis.com
GTS CA 1O1		 2019-10-03 -
2019-12-26		 3 months crt.sh
*.yoroi.company
Actalis Domain Validation Server CA G2		 2019-05-01 -
2020-07-31		 a year crt.sh
*.googleusercontent.com
GTS CA 1O1		 2019-09-17 -
2019-12-10		 3 months crt.sh
*.gravatar.com
COMODO RSA Domain Validation Secure Server CA		 2018-09-06 -
2020-09-05		 2 years crt.sh
*.google-analytics.com
GTS CA 1O1		 2019-09-17 -
2019-12-10		 3 months crt.sh
*.google.com
GTS CA 1O1		 2019-09-17 -
2019-12-10		 3 months crt.sh
*.twimg.com
DigiCert SHA2 High Assurance Server CA		 2018-11-19 -
2019-11-27		 a year crt.sh
*.facebook.com
DigiCert SHA2 High Assurance Server CA		 2019-09-22 -
2019-12-20		 3 months crt.sh
syndication.twitter.com
DigiCert SHA2 High Assurance Server CA		 2019-04-09 -
2020-04-01		 a year crt.sh

This page contains 5 frames:

Primary Page: https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/
Frame ID: 68DE813CDFC913C4E6EC0F527477A1CF
Requests: 74 HTTP requests in this frame

Frame: https://widgets.wp.com/likes/master.html?ver=201942
Frame ID: 961EDB41EA9D0D680835C842ACCFBFAF
Requests: 1 HTTP requests in this frame

Frame: https://platform.twitter.com/widgets/widget_iframe.e3a0e1b01ae601b6c9cf798a93ab7e69.html?origin=https%3A%2F%2Fblog.yoroi.company
Frame ID: D66A35D3A1E301640152851FA2007ABB
Requests: 1 HTTP requests in this frame

Frame: https://pbs.twimg.com/card_img/1181318305199591424/ddRTiw-V?format=jpg&name=144x144_2
Frame ID: A7580154AF11B1D39DE167223E6226D7
Requests: 13 HTTP requests in this frame

Frame: https://platform.twitter.com/jot.html
Frame ID: A5680256DB8FA5E89B3EFA7D62F70A07
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign HTTP 301
    https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
  • html /<link[^>]+s\d+\.wp\.com/i
  • script /\/wp-(?:content|includes)\//i
  • headers link /rel="https:\/\/api\.w\.org\/"/i
Overall confidence: 100%
Detected patterns
  • html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
  • html /<link[^>]+s\d+\.wp\.com/i
  • script /\/wp-(?:content|includes)\//i
  • headers link /rel="https:\/\/api\.w\.org\/"/i
Overall confidence: 100%
Detected patterns
  • html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
  • html /<link[^>]+s\d+\.wp\.com/i
  • script /\/wp-(?:content|includes)\//i
  • headers link /rel="https:\/\/api\.w\.org\/"/i
Overall confidence: 100%
Detected patterns
  • headers server /nginx(?:\/([\d.]+))?/i
Overall confidence: 100%
Detected patterns
  • script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i
Overall confidence: 100%
Detected patterns
  • html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i
Overall confidence: 100%
Detected patterns
  • script /\/\/platform\.twitter\.com\/widgets\.js/i
Overall confidence: 100%
Detected patterns
  • script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i
  • script /jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?/i
Overall confidence: 100%
Detected patterns
  • script /jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?/i

Page Statistics

84
Requests

100 %
HTTPS

58 %
IPv6

10
Domains

24
Subdomains

19
IPs

4
Countries

3648 kB
Transfer

5108 kB
Size

3
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign HTTP 301
    https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 88
  • https://syndication.twitter.com/i/jot HTTP 302
  • https://platform.twitter.com/jot.html

84 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/
Redirect Chain
  • https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign
  • https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/
70 KB
21 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.78.217 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
Software
nginx /
Resource Hash
bcb75a8eacd23afcc7eb63ba5e5be68a5916d1211a9cd192dcd5e15cafe1e50a
Security Headers
Name Value
Strict-Transport-Security max-age=86400

Request headers

:method
GET
:authority
blog.yoroi.company
:scheme
https
:path
/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode
navigate
sec-fetch-user
?1
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
none
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
navigate
Sec-Fetch-User
?1

Response headers

status
200
server
nginx
date
Mon, 14 Oct 2019 15:59:22 GMT
content-type
text/html; charset=UTF-8
strict-transport-security
max-age=86400
vary
Accept-Encoding Cookie
last-modified
Mon, 14 Oct 2019 15:57:00 GMT
cache-control
max-age=158, must-revalidate
x-nananana
Batcache
x-pingback
https://blog.yoroi.company/xmlrpc.php
link
<https://blog.yoroi.company/wp-json/>; rel="https://api.w.org/" <https://wp.me/pagkQt-ZB>; rel=shortlink
content-encoding
gzip
x-ac
3.fra _atomic_dca

Redirect headers

status
301
server
nginx
date
Mon, 14 Oct 2019 15:59:21 GMT
content-type
text/html; charset=UTF-8
location
https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/
strict-transport-security
max-age=86400
vary
Cookie
x-pingback
https://blog.yoroi.company/xmlrpc.php
x-redirect-by
WordPress
x-ac
3.fra _atomic_dca
style.min.css
c0.wp.com/c/5.2.3/wp-includes/css/dist/block-library/ 		29 KB
4 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://c0.wp.com/c/5.2.3/wp-includes/css/dist/block-library/style.min.css
Requested by
Host: blog.yoroi.company
URL: https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.37 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
4b8fe5c3d0e5ef7a6582185cbf5c535b5d369c8df1da98c03ed69833e55f474d
Security Headers
Name Value
Strict-Transport-Security max-age=15552000

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-nc
HIT fra 1
date
Mon, 14 Oct 2019 15:59:22 GMT
content-encoding
br
last-modified
Mon, 22 Apr 2019 12:40:04 GMT
server
nginx
vary
Accept-Encoding
content-type
text/css
status
200
cache-control
max-age=31536000
strict-transport-security
max-age=15552000
expires
Tue, 13 Oct 2020 15:59:22 GMT
all.min.css
blog.yoroi.company/wp-content/themes/start-magazine/vendors/font-awesome/css/ 		45 KB
10 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://blog.yoroi.company/wp-content/themes/start-magazine/vendors/font-awesome/css/all.min.css?ver=5.1.1
Requested by
Host: blog.yoroi.company
URL: https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.78.217 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
Software
nginx /
Resource Hash
d98121a51ed3f911f519cf42be28225dc26b4c9d61cfab0a580118e5c3447463
Security Headers
Name Value
Strict-Transport-Security max-age=86400

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 14 Oct 2019 15:59:22 GMT
content-encoding
gzip
last-modified
Mon, 24 Sep 2018 08:49:26 GMT
server
nginx
etag
W/"5ba8a516-b296"
vary
Accept-Encoding
strict-transport-security
max-age=86400
content-type
text/css
status
200
cache-control
max-age=315360000
x-ac
3.fra _atomic_dca
expires
Thu, 31 Dec 2037 23:55:55 GMT
css
fonts.googleapis.com/ 		15 KB
929 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Oswald%3A400%2C500%2C600%2C700%7CRoboto%3A100%2C400%2C500%2C600%2C700&subset=latin%2Clatin-ext
Requested by
Host: blog.yoroi.company
URL: https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:817::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
ESF /
Resource Hash
d0bfcc98828a74351fe3ddb1c750850257c41ae0a6905e4cba599716ec849bc0
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
cors
Referer
https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/
Origin
https://blog.yoroi.company
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
br
last-modified
Mon, 14 Oct 2019 15:59:22 GMT
server
ESF
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
status
200
date
Mon, 14 Oct 2019 15:59:22 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
x-xss-protection
0
expires
Mon, 14 Oct 2019 15:59:22 GMT
jquery.sidr.dark.min.css
blog.yoroi.company/wp-content/themes/start-magazine/vendors/sidr/css/ 		3 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://blog.yoroi.company/wp-content/themes/start-magazine/vendors/sidr/css/jquery.sidr.dark.min.css?ver=2.2.1
Requested by
Host: blog.yoroi.company
URL: https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.78.217 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
Software
nginx /
Resource Hash
bd8b0c2e9c07473382c21f9f245c7a24433c3a100eed41e6e0695d23942b0e4a
Security Headers
Name Value
Strict-Transport-Security max-age=86400

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 14 Oct 2019 15:59:22 GMT
content-encoding
gzip
last-modified
Mon, 24 Sep 2018 08:49:26 GMT
server
nginx
etag
W/"5ba8a516-d8d"
vary
Accept-Encoding
strict-transport-security
max-age=86400
content-type
text/css
status
200
cache-control
max-age=315360000
x-ac
3.fra _atomic_dca
expires
Thu, 31 Dec 2037 23:55:55 GMT
slick.min.css
blog.yoroi.company/wp-content/themes/start-magazine/vendors/slick/ 		1 KB
522 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://blog.yoroi.company/wp-content/themes/start-magazine/vendors/slick/slick.min.css?ver=1.5.9
Requested by
Host: blog.yoroi.company
URL: https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.78.217 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
Software
nginx /
Resource Hash
066e006e482ee3cfd76f37618f99ecad50eed1c9df36841d177f6218cfb38874
Security Headers
Name Value
Strict-Transport-Security max-age=86400

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 14 Oct 2019 15:59:22 GMT
content-encoding
gzip
last-modified
Mon, 24 Sep 2018 08:49:26 GMT
server
nginx
etag
W/"5ba8a516-4fd"
vary
Accept-Encoding
strict-transport-security
max-age=86400
content-type
text/css
status
200
cache-control
max-age=315360000
x-ac
3.fra _atomic_dca
expires
Thu, 31 Dec 2037 23:55:55 GMT
style.css
blog.yoroi.company/wp-content/themes/start-magazine/ 		106 KB
19 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://blog.yoroi.company/wp-content/themes/start-magazine/style.css?ver=1.0.0
Requested by
Host: blog.yoroi.company
URL: https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.78.217 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
Software
nginx /
Resource Hash
41e7c6de1addd5d7f787b6edbcf89d9aa47ab057c3a84165574a8418f16f91fc
Security Headers
Name Value
Strict-Transport-Security max-age=86400

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 14 Oct 2019 15:59:22 GMT
content-encoding
gzip
last-modified
Fri, 28 Sep 2018 12:20:27 GMT
server
nginx
etag
W/"5bae1c8b-1a983"
vary
Accept-Encoding
strict-transport-security
max-age=86400
content-type
text/css
status
200
cache-control
max-age=315360000
x-ac
3.fra _atomic_dca
expires
Thu, 31 Dec 2037 23:55:55 GMT
EnlighterJS.min.css
blog.yoroi.company/wp-content/plugins/enlighter/resources/ 		36 KB
6 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://blog.yoroi.company/wp-content/plugins/enlighter/resources/EnlighterJS.min.css?ver=3.10.0
Requested by
Host: blog.yoroi.company
URL: https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.78.217 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
Software
nginx /
Resource Hash
f4e8c8dbefc2cd77738662930dff811a9608ddae5a042a29737bc6f1921c9b82
Security Headers
Name Value
Strict-Transport-Security max-age=86400

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 14 Oct 2019 15:59:22 GMT
content-encoding
gzip
last-modified
Mon, 29 Apr 2019 16:04:52 GMT
server
nginx
etag
W/"5cc720a4-8f0d"
vary
Accept-Encoding
strict-transport-security
max-age=86400
content-type
text/css
status
200
cache-control
max-age=315360000
x-ac
3.fra _atomic_dca
expires
Thu, 31 Dec 2037 23:55:55 GMT
social-logos.min.css
c0.wp.com/p/jetpack/7.8/_inc/social-logos/ 		26 KB
18 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://c0.wp.com/p/jetpack/7.8/_inc/social-logos/social-logos.min.css
Requested by
Host: blog.yoroi.company
URL: https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.37 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
2e1ced1bd0736a56a0c44fd7b3bf8134850398ecddd52a0f5e6e437c5d527999
Security Headers
Name Value
Strict-Transport-Security max-age=15552000

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-nc
HIT fra 1
date
Mon, 14 Oct 2019 15:59:22 GMT
content-encoding
br
last-modified
Wed, 27 Jun 2018 01:03:44 GMT
server
nginx
vary
Accept-Encoding
content-type
text/css
status
200
cache-control
max-age=31536000
strict-transport-security
max-age=15552000
expires
Tue, 13 Oct 2020 15:59:22 GMT
jetpack.css
c0.wp.com/p/jetpack/7.8/css/ 		70 KB
12 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://c0.wp.com/p/jetpack/7.8/css/jetpack.css
Requested by
Host: blog.yoroi.company
URL: https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.37 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
b42989a0f2a1fb6d69e72c4f548ef2e73c4d3089d53649f5ed75e45c7b91cffb
Security Headers
Name Value
Strict-Transport-Security max-age=15552000

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-nc
HIT fra 1
date
Mon, 14 Oct 2019 15:59:22 GMT
content-encoding
br
last-modified
Tue, 06 Aug 2019 12:48:34 GMT
server
nginx
vary
Accept-Encoding
content-type
text/css
status
200
cache-control
max-age=31536000
strict-transport-security
max-age=15552000
expires
Tue, 13 Oct 2020 15:59:22 GMT
jquery.js
c0.wp.com/c/5.2.3/wp-includes/js/jquery/ 		95 KB
32 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://c0.wp.com/c/5.2.3/wp-includes/js/jquery/jquery.js
Requested by
Host: blog.yoroi.company
URL: https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.37 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
1db21d816296e6939ba1f42962496e4134ae2b0081e26970864c40c6d02bb1df
Security Headers
Name Value
Strict-Transport-Security max-age=15552000

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-nc
HIT fra 1
date
Mon, 14 Oct 2019 15:59:22 GMT
content-encoding
br
last-modified
Fri, 17 May 2019 17:08:53 GMT
server
nginx
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
max-age=31536000
strict-transport-security
max-age=15552000
expires
Tue, 13 Oct 2020 15:59:22 GMT
jquery-migrate.min.js
c0.wp.com/c/5.2.3/wp-includes/js/jquery/ 		10 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://c0.wp.com/c/5.2.3/wp-includes/js/jquery/jquery-migrate.min.js
Requested by
Host: blog.yoroi.company
URL: https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.37 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
48eb8b500ae6a38617b5738d2b3faec481922a7782246e31d2755c034a45cd5d
Security Headers
Name Value
Strict-Transport-Security max-age=15552000

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-nc
HIT fra 1
date
Mon, 14 Oct 2019 15:59:22 GMT
content-encoding
br
last-modified
Fri, 20 May 2016 06:11:28 GMT
server
nginx
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
max-age=31536000
strict-transport-security
max-age=15552000
expires
Tue, 13 Oct 2020 15:59:22 GMT
postmessage.min.js
c0.wp.com/p/jetpack/7.8/_inc/build/ 		9 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://c0.wp.com/p/jetpack/7.8/_inc/build/postmessage.min.js
Requested by
Host: blog.yoroi.company
URL: https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.37 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
96cae96a73c65ceed190aa0b4a9a86f0233798e9a17f27ca57855f4f79ebf678
Security Headers
Name Value
Strict-Transport-Security max-age=15552000

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-nc
HIT fra 1
date
Mon, 14 Oct 2019 15:59:22 GMT
content-encoding
br
last-modified
Wed, 01 May 2019 01:21:49 GMT
server
nginx
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
max-age=31536000
strict-transport-security
max-age=15552000
expires
Tue, 13 Oct 2020 15:59:22 GMT
jquery.jetpack-resize.min.js
c0.wp.com/p/jetpack/7.8/_inc/build/ 		3 KB
1022 B 		Script
General
Check archive.org
Download Go to
Full URL
https://c0.wp.com/p/jetpack/7.8/_inc/build/jquery.jetpack-resize.min.js
Requested by
Host: blog.yoroi.company
URL: https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.37 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
265c34f4c62e6423e270cecb0c422b735dfb0f18cea04c2ac343b6f22106661e
Security Headers
Name Value
Strict-Transport-Security max-age=15552000

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-nc
HIT fra 1
date
Mon, 14 Oct 2019 15:59:22 GMT
content-encoding
br
last-modified
Wed, 01 May 2019 01:21:49 GMT
server
nginx
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
max-age=31536000
strict-transport-security
max-age=15552000
expires
Tue, 13 Oct 2020 15:59:22 GMT
yoroi-min.js
blog.yoroi.company/wordpress/wp-content/themes/start-magazine/js/ 		807 KB
222 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://blog.yoroi.company/wordpress/wp-content/themes/start-magazine/js/yoroi-min.js
Requested by
Host: blog.yoroi.company
URL: https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.78.217 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
Software
nginx /
Resource Hash
3e7a865c8b50bd82db738bff39cedf40d887afc1f5bf8c9ea4c519b6826e5cdd
Security Headers
Name Value
Strict-Transport-Security max-age=86400

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 14 Oct 2019 15:59:22 GMT
content-encoding
gzip
last-modified
Mon, 24 Sep 2018 08:49:26 GMT
server
nginx
etag
W/"5ba8a516-c9a99"
vary
Accept-Encoding
strict-transport-security
max-age=86400
content-type
application/x-javascript
status
200
cache-control
max-age=604800
x-ac
3.fra _atomic_dca
expires
Mon, 21 Oct 2019 15:59:22 GMT
logo_white.svg
www.yoroi.company/images/ 		5 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.yoroi.company/images/logo_white.svg
Requested by
Host: blog.yoroi.company
URL: https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
62.149.144.20 Arezzo, Italy, ASN31034 (ARUBA-ASN, IT),
Reverse DNS
webx498.aruba.it
Software
Apache /
Resource Hash
e298081ec7ee49f98470a1421535423de2ff5f539adfc14d1ba07d8c9e2c6c93

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 14 Oct 2019 15:59:22 GMT
content-encoding
gzip
last-modified
Tue, 17 Sep 2019 15:49:27 GMT
server
Apache
vary
Accept-Encoding
content-type
image/svg+xml
status
200
cache-control
max-age=37739520, public
accept-ranges
bytes
content-length
1871
cropped-maze_labrynth_endpoint-protection_easy-access_bypass-by-gremlin-getty-100798794-large.3x2-2.jpg
i1.wp.com/blog.yoroi.company/wp-content/uploads/2019/09/ 		90 KB
91 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://i1.wp.com/blog.yoroi.company/wp-content/uploads/2019/09/cropped-maze_labrynth_endpoint-protection_easy-access_bypass-by-gremlin-getty-100798794-large.3x2-2.jpg?resize=1024%2C576&ssl=1
Requested by
Host: blog.yoroi.company
URL: https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
i1.wp.com
Software
nginx /
Resource Hash
bc45aae9868fd7a525eae60723b650c9be9235fa4c2cd2a7c9e2b20523932635
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-nc
HIT ams 7
date
Mon, 14 Oct 2019 15:59:22 GMT
x-content-type-options
nosniff
x-bytes-saved
34074
last-modified
Fri, 20 Sep 2019 11:12:04 GMT
server
nginx
etag
"2100fae1b792f41d"
vary
Accept
content-type
image/webp
status
200
cache-control
public, max-age=63115200
link
<https://blog.yoroi.company/wp-content/uploads/2019/09/cropped-maze_labrynth_endpoint-protection_easy-access_bypass-by-gremlin-getty-100798794-large.3x2-2.jpg>; rel="canonical"
content-length
92444
expires
Sun, 19 Sep 2021 23:12:04 GMT
fmLccrjt6-pzfm27oNNTHDgJwcQSymArZWKNy1USYS93TS6t7nYkLzKKiQ8v2M6citF1aM5Bv34zwCkzjRHt-bU5kvMYcdF00TbAEKSYsZxn1fVwi7-VPKBOYbjXddHpFqmMXnI
lh5.googleusercontent.com/ 		15 KB
15 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://lh5.googleusercontent.com/fmLccrjt6-pzfm27oNNTHDgJwcQSymArZWKNy1USYS93TS6t7nYkLzKKiQ8v2M6citF1aM5Bv34zwCkzjRHt-bU5kvMYcdF00TbAEKSYsZxn1fVwi7-VPKBOYbjXddHpFqmMXnI
Requested by
Host: blog.yoroi.company
URL: https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:820::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
fife /
Resource Hash
f3b447e44d5d901f9e077efb1a55665a02fe837f9085ea5de9c102b0dc08f05f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 14 Oct 2019 14:09:00 GMT
x-content-type-options
nosniff
age
6622
status
200
content-disposition
inline;filename="pasted image 0.png"
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
15726
x-xss-protection
0
server
fife
etag
"v1"
vary
Origin
content-type
image/png
access-control-allow-origin
*
access-control-expose-headers
Content-Length
cache-control
public, max-age=86400, no-transform
timing-allow-origin
*
expires
Tue, 15 Oct 2019 10:06:23 GMT
T3KzLcmn0KblVR0Z_sNXG1E2798t2M0dk-P_DEZ8YreyDEWpOQqmb8lLPRe1A4dxmjmavGnWBKy-UzRJDYR1rnbnt0AspMZV6J6jIW6w4Fwz49u_YKNsapTuCZrjfzxJWmtuzq4
lh3.googleusercontent.com/ 		34 KB
35 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://lh3.googleusercontent.com/T3KzLcmn0KblVR0Z_sNXG1E2798t2M0dk-P_DEZ8YreyDEWpOQqmb8lLPRe1A4dxmjmavGnWBKy-UzRJDYR1rnbnt0AspMZV6J6jIW6w4Fwz49u_YKNsapTuCZrjfzxJWmtuzq4
Requested by
Host: blog.yoroi.company
URL: https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
fife /
Resource Hash
690606d96d5142a28d2117f2c89ed92fdb1994e8075eb312f390c894b0fe501d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 14 Oct 2019 14:09:00 GMT
x-content-type-options
nosniff
age
6622
status
200
content-disposition
inline;filename="pasted image 0.png"
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
35269
x-xss-protection
0
server
fife
etag
"v1"
vary
Origin
content-type
image/png
access-control-allow-origin
*
access-control-expose-headers
Content-Length
cache-control
public, max-age=86400, no-transform
timing-allow-origin
*
expires
Sun, 13 Oct 2019 10:34:41 GMT
es3i8nZ-s1K72rlND91C9Bbz0i6YzyYBpNNzpFevxYKZn9TdIh8W_8LypJst_PQatgKaiW2cQ_C5BTDndiWa8bhtyfm_nKnj3gMLIYaeYiB-2myu4WLwwEpggxtuc1fQjtO9jB0
lh6.googleusercontent.com/ 		182 KB
183 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://lh6.googleusercontent.com/es3i8nZ-s1K72rlND91C9Bbz0i6YzyYBpNNzpFevxYKZn9TdIh8W_8LypJst_PQatgKaiW2cQ_C5BTDndiWa8bhtyfm_nKnj3gMLIYaeYiB-2myu4WLwwEpggxtuc1fQjtO9jB0
Requested by
Host: blog.yoroi.company
URL: https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
fife /
Resource Hash
b865b1cd6e9944b158d3df5009c46279d97395858681c5f4fd40c2b2d0c76b7a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 14 Oct 2019 14:09:00 GMT
x-content-type-options
nosniff
age
6622
status
200
content-disposition
inline;filename="pasted image 0.png"
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
186769
x-xss-protection
0
server
fife
etag
"v1"
vary
Origin
content-type
image/png
access-control-allow-origin
*
access-control-expose-headers
Content-Length
cache-control
public, max-age=86400, no-transform
timing-allow-origin
*
expires
Tue, 15 Oct 2019 10:06:23 GMT
wp-emoji-release.min.js
blog.yoroi.company/wp-includes/js/ 		14 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://blog.yoroi.company/wp-includes/js/wp-emoji-release.min.js?ver=5.2.3
Requested by
Host: blog.yoroi.company
URL: https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.78.217 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
Software
nginx /
Resource Hash
f4799ef2939b8377cf33f07b07b6d90a4a245adbf1c6eaf47ee3b0fcefcc07fe
Security Headers
Name Value
Strict-Transport-Security max-age=86400

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 14 Oct 2019 15:59:22 GMT
content-encoding
gzip
last-modified
Mon, 08 Apr 2019 05:22:51 GMT
server
nginx
etag
W/"5caadaab-3610"
vary
Accept-Encoding
strict-transport-security
max-age=86400
content-type
application/x-javascript
status
200
cache-control
max-age=315360000
x-ac
3.fra _atomic_dca
expires
Thu, 31 Dec 2037 23:55:55 GMT
JQiTQBh2xTtguCPDgu7kLxDebyzgXTMiJqDekhlnP6q3KNqGgfhM0m0xVFWR4QKXJhCSXa2XFnATiYtshaeho8rZpY-SEopgtk15ZMr80ZdVgHs6HTZWRBJYeObcZIej5bDWcE8
lh3.googleusercontent.com/ 		25 KB
25 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://lh3.googleusercontent.com/JQiTQBh2xTtguCPDgu7kLxDebyzgXTMiJqDekhlnP6q3KNqGgfhM0m0xVFWR4QKXJhCSXa2XFnATiYtshaeho8rZpY-SEopgtk15ZMr80ZdVgHs6HTZWRBJYeObcZIej5bDWcE8
Requested by
Host: blog.yoroi.company
URL: https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
fife /
Resource Hash
4780f6c640495984cecf3e76a7e486f1cf585e2c859a3c96ee3b9f81d5ae44fd
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 14 Oct 2019 14:09:00 GMT
x-content-type-options
nosniff
age
6622
status
200
content-disposition
inline;filename="pasted image 0.png"
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
25749
x-xss-protection
0
server
fife
etag
"v1"
vary
Origin
content-type
image/png
access-control-allow-origin
*
access-control-expose-headers
Content-Length
cache-control
public, max-age=86400, no-transform
timing-allow-origin
*
expires
Sun, 13 Oct 2019 10:35:04 GMT
lu_NAiqA7R9uD4xuC4vPReeQx7JHa8X7COTVtou37BGCMTgMA4X-oXz-zVDH7eeToKdS1gp7VquF5oWzqpwbmtWP9L7o2rP0xWeSwGzHmna6ancXdLryHNbOPWiw-sZAP_bHCbs
lh4.googleusercontent.com/ 		210 KB
210 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://lh4.googleusercontent.com/lu_NAiqA7R9uD4xuC4vPReeQx7JHa8X7COTVtou37BGCMTgMA4X-oXz-zVDH7eeToKdS1gp7VquF5oWzqpwbmtWP9L7o2rP0xWeSwGzHmna6ancXdLryHNbOPWiw-sZAP_bHCbs
Requested by
Host: blog.yoroi.company
URL: https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
fife /
Resource Hash
016b1417f09b36b5feb9ec8acdfccbc92ee2be9786d7b24572fed66f1844cbfe
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 14 Oct 2019 14:09:00 GMT
x-content-type-options
nosniff
age
6622
status
200
content-disposition
inline;filename="pasted image 0.png"
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
214681
x-xss-protection
0
server
fife
etag
"v1"
vary
Origin
content-type
image/png
access-control-allow-origin
*
access-control-expose-headers
Content-Length
cache-control
public, max-age=86400, no-transform
timing-allow-origin
*
expires
Sun, 13 Oct 2019 10:34:32 GMT
_s4Q8s8bKjIXuyx6AdjZTAakmthojifatHiYpn7vkX6ZicMTFnlX60zCCQgsDIMofNy-ytDJ7MCK4aaR71kz8RXAipKvBCNvdSH5WZnLmPrQeg4JsLNOfmIvMfVo-U-eYZr46U0
lh5.googleusercontent.com/ 		275 KB
275 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://lh5.googleusercontent.com/_s4Q8s8bKjIXuyx6AdjZTAakmthojifatHiYpn7vkX6ZicMTFnlX60zCCQgsDIMofNy-ytDJ7MCK4aaR71kz8RXAipKvBCNvdSH5WZnLmPrQeg4JsLNOfmIvMfVo-U-eYZr46U0
Requested by
Host: blog.yoroi.company
URL: https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:820::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
fife /
Resource Hash
f545217f8912933314f69fc06fc2e4faa6e837b3abdd8e53a6f321693da95784
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 14 Oct 2019 14:09:00 GMT
x-content-type-options
nosniff
age
6622
status
200
content-disposition
inline;filename="pasted image 0.png"
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
281490
x-xss-protection
0
server
fife
etag
"v1"
vary
Origin
content-type
image/png
access-control-allow-origin
*
access-control-expose-headers
Content-Length
cache-control
public, max-age=86400, no-transform
timing-allow-origin
*
expires
Sun, 13 Oct 2019 10:34:35 GMT
Z15th52fEJ1OH_lcRGfJptxA9H11m2OYDFF4-drKGwN7A7DPetcxeuGnsoTD-NYjKoGOIfECER8tqENqR6bwQWdhITXSOGQkdLSQDG-Fq6AEFRMK0zc0-g3yenZN38X8mwcvhQM
lh4.googleusercontent.com/ 		696 KB
697 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://lh4.googleusercontent.com/Z15th52fEJ1OH_lcRGfJptxA9H11m2OYDFF4-drKGwN7A7DPetcxeuGnsoTD-NYjKoGOIfECER8tqENqR6bwQWdhITXSOGQkdLSQDG-Fq6AEFRMK0zc0-g3yenZN38X8mwcvhQM
Requested by
Host: blog.yoroi.company
URL: https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
fife /
Resource Hash
643eea461ad5343f0cf00e3f797828c04b83d4cbaa313255b28c588c9694096f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 14 Oct 2019 14:09:00 GMT
x-content-type-options
nosniff
age
6622
status
200
content-disposition
inline;filename="pasted image 0.png"
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
713154
x-xss-protection
0
server
fife
etag
"v1"
vary
Origin
content-type
image/png
access-control-allow-origin
*
access-control-expose-headers
Content-Length
cache-control
public, max-age=86400, no-transform
timing-allow-origin
*
expires
Sun, 13 Oct 2019 10:34:39 GMT
SFLTMnADj1c8dqAlArgDKIubfxAulSfP-8LTCsE9NXgO1zZJ8OL2kpPX4-kUV_ySRuCWmVUAJ27ehXTGdPhRaZQ0yD0SDqBX9Mu8VUv0NO_xBOqOv4EFXX8aBOUJqH4Q-TdyeCc
lh3.googleusercontent.com/ 		531 KB
531 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://lh3.googleusercontent.com/SFLTMnADj1c8dqAlArgDKIubfxAulSfP-8LTCsE9NXgO1zZJ8OL2kpPX4-kUV_ySRuCWmVUAJ27ehXTGdPhRaZQ0yD0SDqBX9Mu8VUv0NO_xBOqOv4EFXX8aBOUJqH4Q-TdyeCc
Requested by
Host: blog.yoroi.company
URL: https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
fife /
Resource Hash
7a7edf370b4f18e06ad355ed845474020b6198b902398ac93b0b2ae8937711d5
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 14 Oct 2019 14:09:00 GMT
x-content-type-options
nosniff
age
6622
status
200
content-disposition
inline;filename="pasted image 0.png"
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
543512
x-xss-protection
0
server
fife
etag
"v1"
vary
Origin
content-type
image/png
access-control-allow-origin
*
access-control-expose-headers
Content-Length
cache-control
public, max-age=86400, no-transform
timing-allow-origin
*
expires
Fri, 11 Oct 2019 21:31:01 GMT
I1VKCgkSGlfRHgBhYdvZZeFHodd3waZ2JHDNnuUbUCuKGqvjZdaV2xtzWsTVh8j3yitu-uXa1VKmUsdrFERKNkR4kQpMNTrabJy6GQny9Xi2IGAqh8Kn6H_xuXtIXOq80srAhps
lh6.googleusercontent.com/ 		93 KB
93 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://lh6.googleusercontent.com/I1VKCgkSGlfRHgBhYdvZZeFHodd3waZ2JHDNnuUbUCuKGqvjZdaV2xtzWsTVh8j3yitu-uXa1VKmUsdrFERKNkR4kQpMNTrabJy6GQny9Xi2IGAqh8Kn6H_xuXtIXOq80srAhps
Requested by
Host: blog.yoroi.company
URL: https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
fife /
Resource Hash
3b7c5042a783cafa6210a4bff4f8c7821c55dd52f1e962874be48ed78c7a35ed
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 14 Oct 2019 14:09:00 GMT
x-content-type-options
nosniff
age
6622
status
200
content-disposition
inline;filename="pasted image 0.png"
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
95160
x-xss-protection
0
server
fife
etag
"v1"
vary
Origin
content-type
image/png
access-control-allow-origin
*
access-control-expose-headers
Content-Length
cache-control
public, max-age=86400, no-transform
timing-allow-origin
*
expires
Tue, 15 Oct 2019 10:06:23 GMT
EGHVF6sGbY8EeQfRMKFzm8qSGdbudI4O431OYtBahq0uX-zAR1cv0HSIxW9s18mdGtv2_B3gubij_ezxEbk0SF0fLyD9TWs2yqyfPPDdvO4OvRImLYAZnuhrKimKnj_EbsNmKbw
lh3.googleusercontent.com/ 		62 KB
62 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://lh3.googleusercontent.com/EGHVF6sGbY8EeQfRMKFzm8qSGdbudI4O431OYtBahq0uX-zAR1cv0HSIxW9s18mdGtv2_B3gubij_ezxEbk0SF0fLyD9TWs2yqyfPPDdvO4OvRImLYAZnuhrKimKnj_EbsNmKbw
Requested by
Host: blog.yoroi.company
URL: https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
fife /
Resource Hash
5e87ec533498567dd2f14bede6a99ae1d5f5b2fd769f409db6f2f30ee2e961b7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 14 Oct 2019 14:09:00 GMT
x-content-type-options
nosniff
age
6622
status
200
content-disposition
inline;filename="pasted image 0.png"
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
63452
x-xss-protection
0
server
fife
etag
"v1"
vary
Origin
content-type
image/png
access-control-allow-origin
*
access-control-expose-headers
Content-Length
cache-control
public, max-age=86400, no-transform
timing-allow-origin
*
expires
Sun, 13 Oct 2019 10:34:33 GMT
8TY5emJnQCTCSb1gUuNGJnv1VqKhk4carQgNFRyJ4mtSwS8fNShV4VvjNH_YpTPlRw1FElYpZXvw2bbkSMhi7xh9-x8JEPwA9JryWlHemF9B_ppJiU9JpdpxZsevnDngpOb2VPo
lh3.googleusercontent.com/ 		116 KB
116 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://lh3.googleusercontent.com/8TY5emJnQCTCSb1gUuNGJnv1VqKhk4carQgNFRyJ4mtSwS8fNShV4VvjNH_YpTPlRw1FElYpZXvw2bbkSMhi7xh9-x8JEPwA9JryWlHemF9B_ppJiU9JpdpxZsevnDngpOb2VPo
Requested by
Host: blog.yoroi.company
URL: https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
fife /
Resource Hash
53e307bde6eede54adc578d874649ad0ed56bd8ff060a3844e4893328616ed07
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 14 Oct 2019 14:09:00 GMT
x-content-type-options
nosniff
age
6622
status
200
content-disposition
inline;filename="pasted image 0.png"
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
118595
x-xss-protection
0
server
fife
etag
"v1"
vary
Origin
content-type
image/png
access-control-allow-origin
*
access-control-expose-headers
Content-Length
cache-control
public, max-age=86400, no-transform
timing-allow-origin
*
expires
Sun, 13 Oct 2019 10:35:09 GMT
-LrLZr2IHqzIA7WlPdlpHQ4gBZ9kwSI3dpEm3z_-pTt-dH27CUk2Ar1C1CbPcCRMd3UfKSja_DzUYjS_ndg8JITWjUCpTKiCJ-m4OcfFWIkhRFCqifX4NMaemKXQPasOvXTnftM
lh3.googleusercontent.com/ 		42 KB
42 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://lh3.googleusercontent.com/-LrLZr2IHqzIA7WlPdlpHQ4gBZ9kwSI3dpEm3z_-pTt-dH27CUk2Ar1C1CbPcCRMd3UfKSja_DzUYjS_ndg8JITWjUCpTKiCJ-m4OcfFWIkhRFCqifX4NMaemKXQPasOvXTnftM
Requested by
Host: blog.yoroi.company
URL: https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
fife /
Resource Hash
a5628490d00dc398d7872a1fbcbe546f1a8807bacf0b08c673d51176c69820cb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 14 Oct 2019 14:09:00 GMT
x-content-type-options
nosniff
age
6622
status
200
content-disposition
inline;filename="pasted image 0.png"
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
42512
x-xss-protection
0
server
fife
etag
"v1"
vary
Origin
content-type
image/png
access-control-allow-origin
*
access-control-expose-headers
Content-Length
cache-control
public, max-age=86400, no-transform
timing-allow-origin
*
expires
Sun, 13 Oct 2019 10:35:04 GMT
4bbclCULaPBIaFdmaEp_rMA5f40qxC72vnyMxU7_V7JWJbqilmANTPq3SOMOVyOI0yL_cawPBSMiOaBoWzkM1x0N8gzIBzvsWEB-YV2OTbGh7OaBZ-fJNb0cInOWdT9MC7azN-E
lh6.googleusercontent.com/ 		255 KB
255 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://lh6.googleusercontent.com/4bbclCULaPBIaFdmaEp_rMA5f40qxC72vnyMxU7_V7JWJbqilmANTPq3SOMOVyOI0yL_cawPBSMiOaBoWzkM1x0N8gzIBzvsWEB-YV2OTbGh7OaBZ-fJNb0cInOWdT9MC7azN-E
Requested by
Host: blog.yoroi.company
URL: https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
fife /
Resource Hash
09e43ac05f0a03833c38211a04458cd925c4d9d3ee979a468822025fe87648c6
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 14 Oct 2019 14:09:00 GMT
x-content-type-options
nosniff
age
6622
status
200
content-disposition
inline;filename="pasted image 0.png"
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
260612
x-xss-protection
0
server
fife
etag
"v1"
vary
Origin
content-type
image/png
access-control-allow-origin
*
access-control-expose-headers
Content-Length
cache-control
public, max-age=86400, no-transform
timing-allow-origin
*
expires
Tue, 15 Oct 2019 10:06:24 GMT
Ut1fwa4wfRpuQ5MKJy3nT9qaCnqhtaCWPy6zhAsnA_Z8DdBZc0vZ5-6xFhPzcAm2rOHetw-yAE7VLzlpwj2bz4YplWVGs0oorvgT3FsEeCFs1Trp7weHJ7xiuHxZL7xz2SgvAx0
lh6.googleusercontent.com/ 		98 KB
99 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://lh6.googleusercontent.com/Ut1fwa4wfRpuQ5MKJy3nT9qaCnqhtaCWPy6zhAsnA_Z8DdBZc0vZ5-6xFhPzcAm2rOHetw-yAE7VLzlpwj2bz4YplWVGs0oorvgT3FsEeCFs1Trp7weHJ7xiuHxZL7xz2SgvAx0
Requested by
Host: blog.yoroi.company
URL: https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
fife /
Resource Hash
a7b235b1ad885172645a5bb306b2da1475267f3aab0d94c3aadf38827082c75b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 14 Oct 2019 14:09:00 GMT
x-content-type-options
nosniff
age
6622
status
200
content-disposition
inline;filename="pasted image 0.png"
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
100722
x-xss-protection
0
server
fife
etag
"v1"
vary
Origin
content-type
image/png
access-control-allow-origin
*
access-control-expose-headers
Content-Length
cache-control
public, max-age=86400, no-transform
timing-allow-origin
*
expires
Sun, 13 Oct 2019 10:34:36 GMT
powershell.jpg
i2.wp.com/blog.yoroi.company/wp-content/uploads/2019/04/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://i2.wp.com/blog.yoroi.company/wp-content/uploads/2019/04/powershell.jpg?resize=300%2C108&ssl=1
Requested by
Host: blog.yoroi.company
URL: https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
i1.wp.com
Software
nginx /
Resource Hash
f1cfa68361e300705524ba44db2726c59ec935837fb52ac3dc6b5626f74cfb9c
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-nc
HIT ams 5
date
Mon, 14 Oct 2019 15:59:22 GMT
x-content-type-options
nosniff
x-bytes-saved
2971
last-modified
Fri, 04 Oct 2019 13:47:32 GMT
server
nginx
etag
"050e74478f129bf0"
vary
Accept
content-type
image/webp
status
200
cache-control
public, max-age=63115200
link
<https://blog.yoroi.company/wp-content/uploads/2019/04/powershell.jpg>; rel="canonical"
content-length
1672
expires
Mon, 04 Oct 2021 01:47:32 GMT
aggah-apt-.jpg
i0.wp.com/blog.yoroi.company/wp-content/uploads/2019/09/ 		9 KB
9 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://i0.wp.com/blog.yoroi.company/wp-content/uploads/2019/09/aggah-apt-.jpg?resize=300%2C169&ssl=1
Requested by
Host: blog.yoroi.company
URL: https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
i1.wp.com
Software
nginx /
Resource Hash
3d0fe6a075b83a572735c50bb54e129b8067757fef04356d91599681e048e492
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-nc
HIT ams 3
date
Mon, 14 Oct 2019 15:59:22 GMT
x-content-type-options
nosniff
x-bytes-saved
7705
last-modified
Tue, 24 Sep 2019 12:54:34 GMT
server
nginx
etag
"72bd5ad659989179"
vary
Accept
content-type
image/webp
status
200
cache-control
public, max-age=63115200
link
<https://blog.yoroi.company/wp-content/uploads/2019/09/aggah-apt-.jpg>; rel="canonical"
content-length
8852
expires
Fri, 24 Sep 2021 00:54:34 GMT
cropped-photo-1542903660-eedba2cda473.jpeg
i1.wp.com/blog.yoroi.company/wp-content/uploads/2019/09/ 		8 KB
9 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://i1.wp.com/blog.yoroi.company/wp-content/uploads/2019/09/cropped-photo-1542903660-eedba2cda473.jpeg?resize=300%2C169&ssl=1
Requested by
Host: blog.yoroi.company
URL: https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
i1.wp.com
Software
nginx /
Resource Hash
069121a173bd936c85eceee0a301bbb32b8d5e8bf224ed9c3fcb7d8b86e79a4c
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-nc
HIT ams 4
date
Mon, 14 Oct 2019 15:59:22 GMT
x-content-type-options
nosniff
last-modified
Thu, 12 Sep 2019 13:32:23 GMT
server
nginx
etag
"5cb67869d3dcd045"
vary
Accept
content-type
image/jpeg
status
200
cache-control
public, max-age=63115200
link
<https://blog.yoroi.company/wp-content/uploads/2019/09/cropped-photo-1542903660-eedba2cda473.jpeg>; rel="canonical"
content-length
8685
expires
Sun, 12 Sep 2021 01:32:23 GMT
wp-polyfill.min.js
c0.wp.com/c/5.2.3/wp-includes/js/dist/vendor/ 		94 KB
31 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://c0.wp.com/c/5.2.3/wp-includes/js/dist/vendor/wp-polyfill.min.js
Requested by
Host: blog.yoroi.company
URL: https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.37 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
e4c68f0b34a79813171f4674c1d17411378987dccdfa9b1d67ae3582a7b8010a
Security Headers
Name Value
Strict-Transport-Security max-age=15552000

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-nc
HIT fra 1
date
Mon, 14 Oct 2019 15:59:22 GMT
content-encoding
br
last-modified
Thu, 07 Feb 2019 06:28:03 GMT
server
nginx
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
max-age=31536000
strict-transport-security
max-age=15552000
expires
Tue, 13 Oct 2020 15:59:22 GMT
dom-ready.min.js
c0.wp.com/c/5.2.3/wp-includes/js/dist/ 		1 KB
542 B 		Script
General
Check archive.org
Download Go to
Full URL
https://c0.wp.com/c/5.2.3/wp-includes/js/dist/dom-ready.min.js
Requested by
Host: blog.yoroi.company
URL: https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.37 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
c204ed0bcb4aad749f3f2afb5f8dd316bd5327f6c303dcd70ecafdfde3a6b7fe
Security Headers
Name Value
Strict-Transport-Security max-age=15552000

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-nc
HIT fra 1
date
Mon, 14 Oct 2019 15:59:22 GMT
content-encoding
br
last-modified
Thu, 21 Mar 2019 12:48:00 GMT
server
nginx
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
max-age=31536000
strict-transport-security
max-age=15552000
expires
Tue, 13 Oct 2020 15:59:22 GMT
photon.min.js
c0.wp.com/p/jetpack/7.8/_inc/build/photon/ 		661 B
370 B 		Script
General
Check archive.org
Download Go to
Full URL
https://c0.wp.com/p/jetpack/7.8/_inc/build/photon/photon.min.js
Requested by
Host: blog.yoroi.company
URL: https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.37 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
1e588dccca85e2bc6502337ac3c4009b0672b08f1e5847d5d5a0fe3d5d475ab5
Security Headers
Name Value
Strict-Transport-Security max-age=15552000

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-nc
HIT fra 1
date
Mon, 14 Oct 2019 15:59:22 GMT
content-encoding
br
last-modified
Tue, 24 Sep 2019 13:09:34 GMT
server
nginx
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
max-age=31536000
strict-transport-security
max-age=15552000
expires
Tue, 13 Oct 2020 15:59:22 GMT
devicepx-jetpack.js
s0.wp.com/wp-content/js/ 		10 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s0.wp.com/wp-content/js/devicepx-jetpack.js?ver=201942
Requested by
Host: blog.yoroi.company
URL: https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
f32d41f2099a0be20e6b57c5e0d1b71c079d3e1345827b0f5c5b97c6e5e3f78d

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-nc
HIT fra 2
date
Mon, 14 Oct 2019 15:59:22 GMT
content-encoding
gzip
server
nginx
etag
W/"58674312-52b6"
vary
Accept-Encoding
content-type
application/x-javascript
status
200
cache-control
max-age=31536000
x-ac
4.fra _dfw
expires
Sun, 11 Oct 2020 23:12:40 GMT
gprofiles.js
secure.gravatar.com/js/ 		20 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://secure.gravatar.com/js/gprofiles.js?ver=2019Octaa
Requested by
Host: blog.yoroi.company
URL: https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
Software
nginx /
Resource Hash
9c42615b9f87888a452f177c5ea19899fb8a835b8f6d0b458824e6c332a0adce

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 14 Oct 2019 15:59:22 GMT
content-encoding
gzip
last-modified
Thu, 23 Aug 2018 15:01:14 GMT
server
nginx
etag
W/"5b7ecc3a-50bc"
content-type
application/x-javascript
status
200
cache-control
max-age=604800
expires
Mon, 21 Oct 2019 15:59:22 GMT
wpgroho.js
c0.wp.com/p/jetpack/7.8/modules/ 		1 KB
473 B 		Script
General
Check archive.org
Download Go to
Full URL
https://c0.wp.com/p/jetpack/7.8/modules/wpgroho.js
Requested by
Host: blog.yoroi.company
URL: https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.37 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
c1cfa5c2bce904bfc524754a954d2e062c703777ab704134dc5f619dca1e40af
Security Headers
Name Value
Strict-Transport-Security max-age=15552000

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-nc
HIT fra 1
date
Mon, 14 Oct 2019 15:59:22 GMT
content-encoding
br
last-modified
Thu, 04 Apr 2019 21:15:29 GMT
server
nginx
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
max-age=31536000
strict-transport-security
max-age=15552000
expires
Tue, 13 Oct 2020 15:59:22 GMT
skip-link-focus-fix.min.js
blog.yoroi.company/wp-content/themes/start-magazine/js/ 		557 B
347 B 		Script
General
Check archive.org
Download Go to
Full URL
https://blog.yoroi.company/wp-content/themes/start-magazine/js/skip-link-focus-fix.min.js?ver=20130115
Requested by
Host: blog.yoroi.company
URL: https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.78.217 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
Software
nginx /
Resource Hash
818266fe4b7bbf0fe187b6190933c99af05829f70c2d6023acab03f8af5a59b0
Security Headers
Name Value
Strict-Transport-Security max-age=86400

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 14 Oct 2019 15:59:22 GMT
content-encoding
gzip
last-modified
Mon, 24 Sep 2018 08:49:26 GMT
server
nginx
etag
W/"5ba8a516-22d"
vary
Accept-Encoding
strict-transport-security
max-age=86400
content-type
application/x-javascript
status
200
cache-control
max-age=315360000
x-ac
3.fra _atomic_dca
expires
Thu, 31 Dec 2037 23:55:55 GMT
jquery.cycle2.min.js
blog.yoroi.company/wp-content/themes/start-magazine/vendors/cycle2/js/ 		22 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://blog.yoroi.company/wp-content/themes/start-magazine/vendors/cycle2/js/jquery.cycle2.min.js?ver=2.1.6
Requested by
Host: blog.yoroi.company
URL: https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.78.217 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
Software
nginx /
Resource Hash
87a1a7e65f6ceed57d27b07cac22836a7682617932fc9d4376887b0ae1754a35
Security Headers
Name Value
Strict-Transport-Security max-age=86400

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 14 Oct 2019 15:59:22 GMT
content-encoding
gzip
last-modified
Mon, 24 Sep 2018 08:49:26 GMT
server
nginx
etag
W/"5ba8a516-599c"
vary
Accept-Encoding
strict-transport-security
max-age=86400
content-type
application/x-javascript
status
200
cache-control
max-age=315360000
x-ac
3.fra _atomic_dca
expires
Thu, 31 Dec 2037 23:55:55 GMT
jquery.sidr.min.js
blog.yoroi.company/wp-content/themes/start-magazine/vendors/sidr/js/ 		7 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://blog.yoroi.company/wp-content/themes/start-magazine/vendors/sidr/js/jquery.sidr.min.js?ver=2.2.1
Requested by
Host: blog.yoroi.company
URL: https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.78.217 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
Software
nginx /
Resource Hash
fd57ae7228574a83527cb8917ec5a0ff944aa787934ee5b85a7976f259b7ae31
Security Headers
Name Value
Strict-Transport-Security max-age=86400

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 14 Oct 2019 15:59:22 GMT
content-encoding
gzip
last-modified
Mon, 24 Sep 2018 08:49:26 GMT
server
nginx
etag
W/"5ba8a516-1b7a"
vary
Accept-Encoding
strict-transport-security
max-age=86400
content-type
application/x-javascript
status
200
cache-control
max-age=315360000
x-ac
3.fra _atomic_dca
expires
Thu, 31 Dec 2037 23:55:55 GMT
slick.min.js
blog.yoroi.company/wp-content/themes/start-magazine/vendors/slick/ 		40 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://blog.yoroi.company/wp-content/themes/start-magazine/vendors/slick/slick.min.js?ver=1.5.9
Requested by
Host: blog.yoroi.company
URL: https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.78.217 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
Software
nginx /
Resource Hash
4fc7a9c6dd1051ab261a550db0b16147da4236dedfb2efc6311ebff48a045350
Security Headers
Name Value
Strict-Transport-Security max-age=86400

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 14 Oct 2019 15:59:22 GMT
content-encoding
gzip
last-modified
Mon, 24 Sep 2018 08:49:26 GMT
server
nginx
etag
W/"5ba8a516-9e0d"
vary
Accept-Encoding
strict-transport-security
max-age=86400
content-type
application/x-javascript
status
200
cache-control
max-age=315360000
x-ac
3.fra _atomic_dca
expires
Thu, 31 Dec 2037 23:55:55 GMT
custom.min.js
blog.yoroi.company/wp-content/themes/start-magazine/js/ 		944 B
551 B 		Script
General
Check archive.org
Download Go to
Full URL
https://blog.yoroi.company/wp-content/themes/start-magazine/js/custom.min.js?ver=1.0.0
Requested by
Host: blog.yoroi.company
URL: https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.78.217 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
Software
nginx /
Resource Hash
1ee4cfe6a384063358c337aa4d3394cb33ab48becbedb3351c6d1ddf701320a0
Security Headers
Name Value
Strict-Transport-Security max-age=86400

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 14 Oct 2019 15:59:22 GMT
content-encoding
gzip
last-modified
Mon, 24 Sep 2018 08:49:26 GMT
server
nginx
etag
W/"5ba8a516-3b0"
vary
Accept-Encoding
strict-transport-security
max-age=86400
content-type
application/x-javascript
status
200
cache-control
max-age=315360000
x-ac
3.fra _atomic_dca
expires
Thu, 31 Dec 2037 23:55:55 GMT
twitter-timeline.min.js
c0.wp.com/p/jetpack/7.8/_inc/build/ 		331 B
360 B 		Script
General
Check archive.org
Download Go to
Full URL
https://c0.wp.com/p/jetpack/7.8/_inc/build/twitter-timeline.min.js
Requested by
Host: blog.yoroi.company
URL: https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.37 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
291b553dee180f838e513bf2580c9af27f8312320581e3c91029a7c4d5eb2fbc
Security Headers
Name Value
Strict-Transport-Security max-age=15552000

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-nc
HIT fra 1
date
Mon, 14 Oct 2019 15:59:22 GMT
last-modified
Tue, 27 Aug 2019 13:22:22 GMT
server
nginx
strict-transport-security
max-age=15552000
content-type
application/javascript
status
200
cache-control
max-age=31536000
accept-ranges
bytes
content-length
331
expires
Tue, 13 Oct 2020 15:59:22 GMT
queuehandler.min.js
c0.wp.com/p/jetpack/7.8/_inc/build/likes/ 		6 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://c0.wp.com/p/jetpack/7.8/_inc/build/likes/queuehandler.min.js
Requested by
Host: blog.yoroi.company
URL: https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.37 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
ed9451e768c2d762d3d158e05ebed9bd87cdbf6aeb885b3c55e25e8c909ec6da
Security Headers
Name Value
Strict-Transport-Security max-age=15552000

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-nc
HIT fra 1
date
Mon, 14 Oct 2019 15:59:22 GMT
content-encoding
br
last-modified
Wed, 01 May 2019 01:21:49 GMT
server
nginx
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
max-age=31536000
strict-transport-security
max-age=15552000
expires
Tue, 13 Oct 2020 15:59:22 GMT
mootools-core-yc.js
blog.yoroi.company/wp-content/plugins/enlighter/resources/ 		88 KB
28 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://blog.yoroi.company/wp-content/plugins/enlighter/resources/mootools-core-yc.js?ver=3.10.0
Requested by
Host: blog.yoroi.company
URL: https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.78.217 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
Software
nginx /
Resource Hash
bcada3fb8ba74f6737ee9e798c50512e274a4227ef0a165b84d6ef3f2f0f5c1f
Security Headers
Name Value
Strict-Transport-Security max-age=86400

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 14 Oct 2019 15:59:22 GMT
content-encoding
gzip
last-modified
Mon, 29 Apr 2019 16:04:53 GMT
server
nginx
etag
W/"5cc720a5-15e0e"
vary
Accept-Encoding
strict-transport-security
max-age=86400
content-type
application/x-javascript
status
200
cache-control
max-age=315360000
x-ac
3.fra _atomic_dca
expires
Thu, 31 Dec 2037 23:55:55 GMT
EnlighterJS.min.js
blog.yoroi.company/wp-content/plugins/enlighter/resources/ 		49 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://blog.yoroi.company/wp-content/plugins/enlighter/resources/EnlighterJS.min.js?ver=3.10.0
Requested by
Host: blog.yoroi.company
URL: https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.78.217 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
Software
nginx /
Resource Hash
ba248c9f36442fceef93b25bc4577993797ab7255b16ec87be25d8cec31d559d
Security Headers
Name Value
Strict-Transport-Security max-age=86400

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 14 Oct 2019 15:59:23 GMT
content-encoding
gzip
last-modified
Mon, 29 Apr 2019 16:04:53 GMT
server
nginx
etag
W/"5cc720a5-c395"
vary
Accept-Encoding
strict-transport-security
max-age=86400
content-type
application/x-javascript
status
200
cache-control
max-age=315360000
x-ac
3.fra _atomic_dca
expires
Thu, 31 Dec 2037 23:55:55 GMT
wp-embed.min.js
c0.wp.com/c/5.2.3/wp-includes/js/ 		1 KB
667 B 		Script
General
Check archive.org
Download Go to
Full URL
https://c0.wp.com/c/5.2.3/wp-includes/js/wp-embed.min.js
Requested by
Host: blog.yoroi.company
URL: https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.37 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
2152557cac69e2bd7d6debef5037a9f554f9209cc305b8141b3329acb10c42b7
Security Headers
Name Value
Strict-Transport-Security max-age=15552000

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-nc
HIT fra 1
date
Mon, 14 Oct 2019 15:59:22 GMT
content-encoding
br
last-modified
Thu, 30 Aug 2018 12:40:26 GMT
server
nginx
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
max-age=31536000
strict-transport-security
max-age=15552000
expires
Tue, 13 Oct 2020 15:59:22 GMT
sharing.min.js
c0.wp.com/p/jetpack/7.8/_inc/build/sharedaddy/ 		8 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://c0.wp.com/p/jetpack/7.8/_inc/build/sharedaddy/sharing.min.js
Requested by
Host: blog.yoroi.company
URL: https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.37 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
1e99034e4b75a1fb7ba372a3a950fa19ff4688d8561479b1a34dfcbde83ff3d8
Security Headers
Name Value
Strict-Transport-Security max-age=15552000

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-nc
HIT fra 1
date
Mon, 14 Oct 2019 15:59:22 GMT
content-encoding
br
last-modified
Tue, 27 Aug 2019 13:22:22 GMT
server
nginx
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
max-age=31536000
strict-transport-security
max-age=15552000
expires
Tue, 13 Oct 2020 15:59:22 GMT
e-201942.js
stats.wp.com/ 		9 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://stats.wp.com/e-201942.js
Requested by
Host: blog.yoroi.company
URL: https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
Software
nginx /
Resource Hash
0ebbc7fba9a50d36ef5422345f624431710db4528f25749d1d438c2c10bb69f2

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 14 Oct 2019 15:59:22 GMT
content-encoding
gzip
server
nginx
etag
W/"5c6340e3-350a"
vary
Accept-Encoding
content-type
application/x-javascript
status
200
cache-control
max-age=31536000
expires
Mon, 12 Oct 2020 05:11:10 GMT
css
fonts.googleapis.com/ 		14 KB
944 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Pacifico|Open+Sans:300,400,600,700,800
Requested by
Host: blog.yoroi.company
URL: https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:818::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
ESF /
Resource Hash
55ad8df5e3a4303c16d4653830c1940907420b40d902397815b1916446dff72c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
br
last-modified
Mon, 14 Oct 2019 15:59:22 GMT
server
ESF
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
status
200
date
Mon, 14 Oct 2019 15:59:22 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
x-xss-protection
0
expires
Mon, 14 Oct 2019 15:59:22 GMT
analytics.js
www.google-analytics.com/ 		43 KB
17 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: blog.yoroi.company
URL: https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:825::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
dbb67c620eaabf6679a314db18d3ae43037aef71ab27422e6feec08ee987cc0a
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Mon, 19 Aug 2019 17:22:41 GMT
server
Golfe2
age
5283
date
Mon, 14 Oct 2019 14:31:19 GMT
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=7200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
17803
expires
Mon, 14 Oct 2019 16:31:19 GMT
mem8YaGs126MiZpBA-UFVZ0bf8pkAg.woff2
fonts.gstatic.com/s/opensans/v17/ 		9 KB
9 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/opensans/v17/mem8YaGs126MiZpBA-UFVZ0bf8pkAg.woff2
Requested by
Host: blog.yoroi.company
URL: https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
54c64f3c66372027154f01fc9f24b4e25fdfe405b70d1994c79abbc2576ff775
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
cors
Referer
https://fonts.googleapis.com/css?family=Pacifico|Open+Sans:300,400,600,700,800
Origin
https://blog.yoroi.company
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 08 Oct 2019 17:59:15 GMT
x-content-type-options
nosniff
last-modified
Tue, 23 Jul 2019 19:30:49 GMT
server
sffe
age
511207
status
200
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
9132
x-xss-protection
0
expires
Wed, 07 Oct 2020 17:59:15 GMT
fa-brands-400.woff2
blog.yoroi.company/wp-content/themes/start-magazine/vendors/font-awesome/webfonts/ 		62 KB
62 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://blog.yoroi.company/wp-content/themes/start-magazine/vendors/font-awesome/webfonts/fa-brands-400.woff2
Requested by
Host: blog.yoroi.company
URL: https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.78.217 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
Software
nginx /
Resource Hash
3a5a197947223babcd9e0e759e9284202d70ce33b9f8d7e6ffd3f5bce5fec649
Security Headers
Name Value
Strict-Transport-Security max-age=86400

Request headers

Sec-Fetch-Mode
cors
Referer
https://blog.yoroi.company/wp-content/themes/start-magazine/vendors/font-awesome/css/all.min.css?ver=5.1.1
Origin
https://blog.yoroi.company
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 14 Oct 2019 15:59:22 GMT
x-ac
3.fra _atomic_dca
last-modified
Mon, 24 Sep 2018 08:49:26 GMT
server
nginx
status
200
etag
"5ba8a516-f728"
strict-transport-security
max-age=86400
access-control-allow-methods
GET, HEAD
content-type
application/font-woff2
access-control-allow-origin
*
cache-control
max-age=604800
accept-ranges
bytes
content-length
63272
expires
Mon, 21 Oct 2019 15:59:22 GMT
fa-solid-900.woff2
blog.yoroi.company/wp-content/themes/start-magazine/vendors/font-awesome/webfonts/ 		58 KB
58 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://blog.yoroi.company/wp-content/themes/start-magazine/vendors/font-awesome/webfonts/fa-solid-900.woff2
Requested by
Host: blog.yoroi.company
URL: https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.78.217 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
Software
nginx /
Resource Hash
b82ad8fbcf9bf844726f648ef268b74f8c2f668f56eafd98b05703e086ff1d5b
Security Headers
Name Value
Strict-Transport-Security max-age=86400

Request headers

Sec-Fetch-Mode
cors
Referer
https://blog.yoroi.company/wp-content/themes/start-magazine/vendors/font-awesome/css/all.min.css?ver=5.1.1
Origin
https://blog.yoroi.company
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 14 Oct 2019 15:59:22 GMT
x-ac
3.fra _atomic_dca
last-modified
Mon, 24 Sep 2018 08:49:26 GMT
server
nginx
status
200
etag
"5ba8a516-e8d4"
strict-transport-security
max-age=86400
access-control-allow-methods
GET, HEAD
content-type
application/font-woff2
access-control-allow-origin
*
cache-control
max-age=604800
accept-ranges
bytes
content-length
59604
expires
Mon, 21 Oct 2019 15:59:22 GMT
mem5YaGs126MiZpBA-UN7rgOUuhpKKSTjw.woff2
fonts.gstatic.com/s/opensans/v17/ 		9 KB
9 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/opensans/v17/mem5YaGs126MiZpBA-UN7rgOUuhpKKSTjw.woff2
Requested by
Host: blog.yoroi.company
URL: https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
a48a6e4b14fe55f750c0a3dfb5a6f4941bdc06af0aa542b90de25c30c2b4625c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
cors
Referer
https://fonts.googleapis.com/css?family=Pacifico|Open+Sans:300,400,600,700,800
Origin
https://blog.yoroi.company
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 10 Oct 2019 09:41:11 GMT
x-content-type-options
nosniff
last-modified
Tue, 23 Jul 2019 19:31:11 GMT
server
sffe
age
368291
status
200
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
9080
x-xss-protection
0
expires
Fri, 09 Oct 2020 09:41:11 GMT
fa-regular-400.woff2
blog.yoroi.company/wp-content/themes/start-magazine/vendors/font-awesome/webfonts/ 		15 KB
15 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://blog.yoroi.company/wp-content/themes/start-magazine/vendors/font-awesome/webfonts/fa-regular-400.woff2
Requested by
Host: blog.yoroi.company
URL: https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.78.217 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
Software
nginx /
Resource Hash
0fefffa15777b279ce61a06932e05bade8fcb729dd9bee04e93fcdd21e8f4552
Security Headers
Name Value
Strict-Transport-Security max-age=86400

Request headers

Sec-Fetch-Mode
cors
Referer
https://blog.yoroi.company/wp-content/themes/start-magazine/vendors/font-awesome/css/all.min.css?ver=5.1.1
Origin
https://blog.yoroi.company
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 14 Oct 2019 15:59:22 GMT
x-ac
3.fra _atomic_dca
last-modified
Mon, 24 Sep 2018 08:49:26 GMT
server
nginx
status
200
etag
"5ba8a516-3a48"
strict-transport-security
max-age=86400
access-control-allow-methods
GET, HEAD
content-type
application/font-woff2
access-control-allow-origin
*
cache-control
max-age=604800
accept-ranges
bytes
content-length
14920
expires
Mon, 21 Oct 2019 15:59:22 GMT
truncated
/ 		18 KB
18 KB 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
895964971ebdb56ee76d08850bcb4c5a88ec4c65e6a235882304e8ff6767cd7c

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Origin
https://blog.yoroi.company

Response headers

Content-Type
application/font-woff;charset=utf-8
collect
www.google-analytics.com/r/ 		35 B
109 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google-analytics.com/r/collect?v=1&_v=j79&a=1390996805&t=pageview&_s=1&dl=https%3A%2F%2Fblog.yoroi.company%2Fresearch%2Fcommodity-malware-reborn-the-agenttesla-total-oil-themed-campaign%2F&ul=en-us&de=UTF-8&dt=Commodity%20Malware%20Reborn%3A%20The%20AgentTesla%20%E2%80%9CTotal%20Oil%E2%80%9D%20themed%20Campaign%20%E2%80%93%20Yoroi%20Blog&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&_u=YEBAAUAB~&jid=1704264450&gjid=1159722724&cid=1210254361.1571068763&tid=UA-54504571-5&_gid=946334903.1571068763&_r=1&z=673276792
Requested by
Host: blog.yoroi.company
URL: https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:825::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 14 Oct 2019 15:59:22 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
status
200
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
35
expires
Fri, 01 Jan 1990 00:00:00 GMT
widgets.js
platform.twitter.com/ 		95 KB
29 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://platform.twitter.com/widgets.js
Requested by
Host: c0.wp.com
URL: https://c0.wp.com/p/jetpack/7.8/_inc/build/twitter-timeline.min.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECS (fcn/41D8) /
Resource Hash
90476f48e0b8a9f9c5c11fd16f13fc6a8772fe281d12c8e63153a6f948cdd348

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 14 Oct 2019 15:59:22 GMT
Content-Encoding
gzip
Last-Modified
Wed, 02 Oct 2019 20:25:42 GMT
Server
ECS (fcn/41D8)
Etag
"1d8d0709ed691e2bc0472dbfc17c8abd+gzip"
Vary
Accept-Encoding
Access-Control-Allow-Methods
GET
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=1800
X-Cache
HIT
Content-Type
application/javascript; charset=utf-8
Content-Length
28700
master.html
widgets.wp.com/likes/ Frame 961E 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://widgets.wp.com/likes/master.html?ver=201942
Requested by
Host: blog.yoroi.company
URL: https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash

Request headers

:method
GET
:authority
widgets.wp.com
:scheme
https
:path
/likes/master.html?ver=201942
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode
nested-navigate
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
cross-site
referer
https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/

Response headers

status
200
server
nginx
date
Mon, 14 Oct 2019 15:59:23 GMT
content-type
text/html
last-modified
Thu, 21 Mar 2019 13:37:08 GMT
vary
Accept-Encoding
etag
W/"5c939384-84e"
content-encoding
gzip
x-ac
4.fra _dfw
x-nc
HIT fra 2
hovercard.min.css
secure.gravatar.com/dist/css/ 		7 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://secure.gravatar.com/dist/css/hovercard.min.css?ver=2019Octaa
Requested by
Host: blog.yoroi.company
URL: https://blog.yoroi.company/wordpress/wp-content/themes/start-magazine/js/yoroi-min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
Software
nginx /
Resource Hash
7b5e32cb325e9aaef357a421cd16ddf6d6ddb70fec74b6c35a73eccc6817664c

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 14 Oct 2019 15:59:23 GMT
content-encoding
gzip
last-modified
Thu, 22 Mar 2018 09:46:04 GMT
server
nginx
etag
W/"5ab37b5c-1a2e"
content-type
text/css
status
200
cache-control
max-age=604800
expires
Mon, 21 Oct 2019 15:59:23 GMT
services.min.css
secure.gravatar.com/dist/css/ 		3 KB
550 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://secure.gravatar.com/dist/css/services.min.css?ver=2019Octaa
Requested by
Host: blog.yoroi.company
URL: https://blog.yoroi.company/wordpress/wp-content/themes/start-magazine/js/yoroi-min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
Software
nginx /
Resource Hash
e9fc9b1878db1b13b973252b048d19a17abb34a8da464a552c6d401728ed1e86

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 14 Oct 2019 15:59:23 GMT
content-encoding
gzip
last-modified
Thu, 22 Mar 2018 09:46:04 GMT
server
nginx
etag
W/"5ab37b5c-a54"
content-type
text/css
status
200
cache-control
max-age=604800
expires
Mon, 21 Oct 2019 15:59:23 GMT
/
graph.facebook.com/ 		278 B
344 B 		Script
General
Check archive.org
Download Go to
Full URL
https://graph.facebook.com/?callback=WPCOMSharing.update_facebook_count&ids=https%3A%2F%2Fblog.yoroi.company%2Fresearch%2Fcommodity-malware-reborn-the-agenttesla-total-oil-themed-campaign%2F&_=1571068763168
Requested by
Host: blog.yoroi.company
URL: https://blog.yoroi.company/wordpress/wp-content/themes/start-magazine/js/yoroi-min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f01c:20e:face:b00c:0:2 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),
Reverse DNS
Software
/
Resource Hash
e7afaf16184f94a405c86f580675e4605cb23da14b0b8124d067e0a33d9d24f9
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
content-encoding
br
etag
"2b05fe283482629aa3da56f38a09937cd2edeeb8"
x-app-usage
{"call_count":0,"total_cputime":0,"total_time":0}
status
200
x-fb-rev
1001289578
content-length
134
pragma
no-cache
x-fb-debug
EdVeMK/SR+Bmr5XCFHxIhn1+Rl+1kmugQnriVhYrsd8wmqD6axUM5OtVVWnK/ecssR7Fr+6mpUb4LhlFtz8cWg==
x-fb-trace-id
BaGfayRlAlz
date
Mon, 14 Oct 2019 15:59:23 GMT
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
x-fb-request-id
AoN60fAHVII2CoXwAOFBtbd
cache-control
private, no-cache, no-store, must-revalidate
facebook-api-version
v2.10
expires
Sat, 01 Jan 2000 00:00:00 GMT
g.gif
pixel.wp.com/ 		50 B
97 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.wp.com/g.gif?v=wpcom-no-pv&x_sharing-count-request=facebook&r=0.9637808588523911
Requested by
Host: blog.yoroi.company
URL: https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
Software
nginx /
Resource Hash
f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status
200
date
Mon, 14 Oct 2019 15:59:23 GMT
cache-control
no-cache
server
nginx
content-length
50
content-type
image/gif
widget_iframe.e3a0e1b01ae601b6c9cf798a93ab7e69.html
platform.twitter.com/widgets/ Frame D66A 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://platform.twitter.com/widgets/widget_iframe.e3a0e1b01ae601b6c9cf798a93ab7e69.html?origin=https%3A%2F%2Fblog.yoroi.company
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECS (fcn/40EB) /
Resource Hash

Request headers

Host
platform.twitter.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site
cross-site
Referer
https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/
Accept-Encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/

Response headers

Content-Encoding
gzip
Access-Control-Allow-Methods
GET
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=315360000
Content-Type
text/html; charset=utf-8
Date
Mon, 14 Oct 2019 16:00:03 GMT
Etag
"7d3f6ed140174a20e7c8be261a70a863+gzip"
Last-Modified
Wed, 02 Oct 2019 20:21:47 GMT
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server
ECS (fcn/40EB)
Vary
Accept-Encoding
X-Cache
HIT
Content-Length
5816
g.gif
pixel.wp.com/ 		50 B
74 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.wp.com/g.gif?v=ext&j=1%3A7.8&blog=151656741&post=3819&tz=1&srv=blog.yoroi.company&host=blog.yoroi.company&ref=&fcp=1025&rand=0.580784012498279
Requested by
Host: blog.yoroi.company
URL: https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
Software
nginx /
Resource Hash
f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status
200
date
Mon, 14 Oct 2019 15:59:23 GMT
cache-control
no-cache
server
nginx
content-length
50
content-type
image/gif
moment~timeline~tweet.ec04a6cb5ba879d0e0db41f211639fdf.js
platform.twitter.com/js/ 		24 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://platform.twitter.com/js/moment~timeline~tweet.ec04a6cb5ba879d0e0db41f211639fdf.js
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECS (fcn/41AF) /
Resource Hash
57811344d04a892ddcd3623c551ce97f268cdf0b300e2396cac5168dbc49d425

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 14 Oct 2019 15:59:23 GMT
Content-Encoding
gzip
Last-Modified
Wed, 02 Oct 2019 20:21:39 GMT
Server
ECS (fcn/41AF)
Etag
"193d41dde5636e7f143422dcf5051b6d+gzip"
Vary
Accept-Encoding
Access-Control-Allow-Methods
GET
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=315360000
X-Cache
HIT
Content-Type
application/javascript; charset=utf-8
Content-Length
7914
timeline.0a7b4db67eacd23e35c5ce02e6ea3470.js
platform.twitter.com/js/ 		23 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://platform.twitter.com/js/timeline.0a7b4db67eacd23e35c5ce02e6ea3470.js
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECS (fcn/40FA) /
Resource Hash
f452b1e5c1cae40dc81a9da7605dd6b98d0a06253d9b363e11c99ec4081ace4c

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 14 Oct 2019 15:59:23 GMT
Content-Encoding
gzip
Last-Modified
Wed, 02 Oct 2019 20:21:39 GMT
Server
ECS (fcn/40FA)
Etag
"37399cf03250c85f4a77916c06810b4c+gzip"
Vary
Accept-Encoding
Access-Control-Allow-Methods
GET
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=315360000
X-Cache
HIT
Content-Type
application/javascript; charset=utf-8
Content-Length
7038
profile
cdn.syndication.twimg.com/timeline/ 		18 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.syndication.twimg.com/timeline/profile?callback=__twttr.callbacks.tl_i0_profile_yoroisecurity_old&dnt=false&domain=blog.yoroi.company&lang=en&screen_name=yoroisecurity&suppress_response_codes=true&t=1745631&tweet_limit=2&tz=GMT%2B0200&with_replies=false
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:134:fa2:1627:1fe:edb:1665 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECS (fcn/41AE) /
Resource Hash
a061d0102de424836a2e3d18d5e1adc3b3f77ce86e67fa740f66cce5abce1961
Security Headers
Name Value
Strict-Transport-Security max-age=631138519
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 14 Oct 2019 15:59:23 GMT
content-encoding
gzip
x-content-type-options
nosniff
x-cache
HIT
status
200
content-disposition
attachment; filename=jsonp.jsonp
vary
Accept-Encoding
content-length
3914
x-xss-protection
0
x-response-time
131
last-modified
Mon, 14 Oct 2019 15:59:21 GMT
server
ECS (fcn/41AE)
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=631138519
content-type
application/javascript;charset=utf-8
cache-control
must-revalidate, max-age=300
x-connection-hash
2be306d9bcb224309912247205da2d0e
accept-ranges
bytes
timing-allow-origin
*
x-transaction
00cee5f60070165e
expires
Mon, 14 Oct 2019 16:04:23 GMT
syndication
syndication.twitter.com/i/jot/ 		43 B
320 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://syndication.twitter.com/i/jot/syndication?l=%7B%22_category_%22%3A%22syndicated_impression%22%2C%22triggered_on%22%3A1571068763636%2C%22dnt%22%3Afalse%2C%22event_namespace%22%3A%7B%22client%22%3A%22tfw%22%2C%22page%22%3A%22timeline%22%2C%22action%22%3A%22impression%22%7D%7D
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.244.42.136 , United States, ASN13414 (TWITTER - Twitter Inc., US),
Reverse DNS
Software
tsa_o /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=631138519
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 14 Oct 2019 15:59:23 GMT
content-encoding
gzip
x-content-type-options
nosniff
status
200, 200 OK
x-twitter-response-tags
BouncerCompliant
content-length
65
x-xss-protection
0
x-response-time
122
pragma
no-cache
last-modified
Mon, 14 Oct 2019 15:59:23 GMT
server
tsa_o
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=631138519
content-type
image/gif;charset=utf-8
cache-control
no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash
661b1c9e2b3c83c59c26edeb7ce0384e
x-transaction
0082e58d00c3e82c
expires
Tue, 31 Mar 1981 05:00:00 GMT
ddRTiw-V
pbs.twimg.com/card_img/1181318305199591424/ Frame A758 		5 KB
5 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pbs.twimg.com/card_img/1181318305199591424/ddRTiw-V?format=jpg&name=144x144_2
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:134:1a0d:1429:742:782:b6 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECS (fcn/40AD) /
Resource Hash
91f1aa5874dd6334afd1182c4949cda95e6e7aa870be5500d4d9edf953fd1aec
Security Headers
Name Value
Strict-Transport-Security max-age=631138519
X-Content-Type-Options nosniff

Request headers

Sec-Fetch-Mode
no-cors
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 14 Oct 2019 15:59:23 GMT
x-content-type-options
nosniff
x-cache
HIT
status
200
content-length
4902
x-response-time
144
surrogate-key
card_img card_img/bucket/3 card_img/1181318305199591424
last-modified
Mon, 07 Oct 2019 21:18:06 GMT
server
ECS (fcn/40AD)
strict-transport-security
max-age=631138519
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Content-Length
cache-control
max-age=604800, must-revalidate
x-connection-hash
5439044044f83595cfe8d740295a0496
accept-ranges
bytes
timeline.9bf5093a19cec463852b31b784bf047a.light.ltr.css
platform.twitter.com/css/ Frame A758 		53 KB
12 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://platform.twitter.com/css/timeline.9bf5093a19cec463852b31b784bf047a.light.ltr.css
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECS (fcn/41A0) /
Resource Hash
e3ceb417f143f3da5e489b62778609a256365a98f483bed272d97e4891fdb36b

Request headers

Sec-Fetch-Mode
no-cors
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 14 Oct 2019 15:59:23 GMT
Content-Encoding
gzip
Last-Modified
Wed, 02 Oct 2019 20:21:36 GMT
Server
ECS (fcn/41A0)
Etag
"07ca66dad14d0d26b03a02f7f31a1d7b+gzip"
Vary
Accept-Encoding
Access-Control-Allow-Methods
GET
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=315360000
X-Cache
HIT
Content-Type
text/css; charset=utf-8
Content-Length
12281
timeline.9bf5093a19cec463852b31b784bf047a.light.ltr.css
platform.twitter.com/css/ 		53 KB
53 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://platform.twitter.com/css/timeline.9bf5093a19cec463852b31b784bf047a.light.ltr.css
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECS (fcn/41A0) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 14 Oct 2019 15:59:23 GMT
Content-Encoding
gzip
Last-Modified
Wed, 02 Oct 2019 20:21:36 GMT
Server
ECS (fcn/41A0)
Etag
"07ca66dad14d0d26b03a02f7f31a1d7b+gzip"
Vary
Accept-Encoding
Access-Control-Allow-Methods
GET
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=315360000
X-Cache
HIT
Content-Type
text/css; charset=utf-8
Content-Length
12281
ddRTiw-V
pbs.twimg.com/card_img/1181318305199591424/ Frame A758 		5 KB
5 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pbs.twimg.com/card_img/1181318305199591424/ddRTiw-V?format=jpg&name=144x144_2
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/js/moment~timeline~tweet.ec04a6cb5ba879d0e0db41f211639fdf.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:134:1a0d:1429:742:782:b6 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECS (fcn/40AD) /
Resource Hash
91f1aa5874dd6334afd1182c4949cda95e6e7aa870be5500d4d9edf953fd1aec
Security Headers
Name Value
Strict-Transport-Security max-age=631138519
X-Content-Type-Options nosniff

Request headers

Sec-Fetch-Mode
no-cors
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 14 Oct 2019 15:59:23 GMT
x-content-type-options
nosniff
x-cache
HIT
status
200
content-length
4902
x-response-time
144
surrogate-key
card_img card_img/bucket/3 card_img/1181318305199591424
last-modified
Mon, 07 Oct 2019 21:18:06 GMT
server
ECS (fcn/40AD)
strict-transport-security
max-age=631138519
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Content-Length
cache-control
max-age=604800, must-revalidate
x-connection-hash
5439044044f83595cfe8d740295a0496
accept-ranges
bytes
J_FErLYl_normal.jpg
pbs.twimg.com/profile_images/1126913135019986945/ Frame A758 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pbs.twimg.com/profile_images/1126913135019986945/J_FErLYl_normal.jpg
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:134:1a0d:1429:742:782:b6 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECS (fcn/41D8) /
Resource Hash
5e73894cabade36cde8c86e1ca28c3e081b109459f6882e6ef6e729be7614195
Security Headers
Name Value
Strict-Transport-Security max-age=631138519
X-Content-Type-Options nosniff

Request headers

Sec-Fetch-Mode
no-cors
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 14 Oct 2019 15:59:23 GMT
x-content-type-options
nosniff
x-cache
HIT
status
200
content-length
2035
x-response-time
219
surrogate-key
profile_images profile_images/bucket/3 profile_images/1126913135019986945
last-modified
Fri, 10 May 2019 18:11:23 GMT
server
ECS (fcn/41D8)
strict-transport-security
max-age=631138519
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Content-Length
cache-control
max-age=604800, must-revalidate
x-connection-hash
5373a17b3af1c48df50b35030d87669a
accept-ranges
bytes
wtANzwYI_normal.jpeg
pbs.twimg.com/profile_images/534689469253701632/ Frame A758 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pbs.twimg.com/profile_images/534689469253701632/wtANzwYI_normal.jpeg
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:134:1a0d:1429:742:782:b6 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECS (fcn/40E9) /
Resource Hash
a78e816fad93bab829c882b85bf1aafb5ae0cb7523b8d6de5457651fed1caeca
Security Headers
Name Value
Strict-Transport-Security max-age=631138519
X-Content-Type-Options nosniff

Request headers

Sec-Fetch-Mode
no-cors
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 14 Oct 2019 15:59:23 GMT
x-content-type-options
nosniff
x-cache
HIT
status
200
content-length
2187
x-response-time
114
surrogate-key
profile_images profile_images/bucket/3 profile_images/534689469253701632
last-modified
Tue, 18 Nov 2014 12:45:58 GMT
server
ECS (fcn/40E9)
strict-transport-security
max-age=631138519
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Content-Length
cache-control
max-age=604800, must-revalidate
x-connection-hash
a56e15ee71d4112e6cc533f2e7f1dbca
accept-ranges
bytes
EGbHj8PXkAAzyc_
pbs.twimg.com/media/ Frame A758 		52 KB
53 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pbs.twimg.com/media/EGbHj8PXkAAzyc_?format=png&name=360x360
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:134:1a0d:1429:742:782:b6 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECS (fcn/419D) /
Resource Hash
f3c74b1979e62da4336cfb3a228ebcf675e559d744c5d4535f5ae3bc9f7368a2
Security Headers
Name Value
Strict-Transport-Security max-age=631138519
X-Content-Type-Options nosniff

Request headers

Sec-Fetch-Mode
no-cors
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 14 Oct 2019 15:59:23 GMT
x-content-type-options
nosniff
x-cache
MISS
status
200
content-length
53697
x-response-time
187
surrogate-key
media media/bucket/0 media/1181851372511268864
last-modified
Wed, 09 Oct 2019 08:36:19 GMT
server
ECS (fcn/419D)
strict-transport-security
max-age=631138519
content-type
image/png
access-control-allow-origin
*
access-control-expose-headers
Content-Length
cache-control
max-age=604800, must-revalidate
x-connection-hash
b0f57a2c6bb9c29db653ef573897d88e
accept-ranges
bytes
syndication_bundle_v1_73385286cca9d2256f6bf3993470820d4827b058.css
ton.twimg.com/tfw/css/ Frame A758 		44 KB
7 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://ton.twimg.com/tfw/css/syndication_bundle_v1_73385286cca9d2256f6bf3993470820d4827b058.css
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:134:fa2:1627:1fe:edb:1665 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECS (fcn/418C) /
Resource Hash
a549034009f79ead18a2154a8b730d8acb61e2f36c0434c0f9cff0f73df5d8cf
Security Headers
Name Value
Strict-Transport-Security max-age=631138519
X-Content-Type-Options nosniff

Request headers

Sec-Fetch-Mode
no-cors
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 14 Oct 2019 15:59:23 GMT
content-encoding
gzip
x-content-type-options
nosniff
x-ton-expected-size
45170
x-cache
HIT
status
200
vary
Accept-Encoding
content-length
6839
x-response-time
88
surrogate-key
tfw
last-modified
Tue, 14 May 2019 18:53:54 GMT
server
ECS (fcn/418C)
etag
"4mhImCFS9rptiUICNnLD1g=="
strict-transport-security
max-age=631138519
content-type
text/css
access-control-allow-origin
*
x-connection-hash
1eec6b09bc6b1ea69d23f6f606867d6d
accept-ranges
bytes
expires
Mon, 21 Oct 2019 15:59:23 GMT
syndication_bundle_v1_73385286cca9d2256f6bf3993470820d4827b058.css
ton.twimg.com/tfw/css/ 		44 KB
44 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ton.twimg.com/tfw/css/syndication_bundle_v1_73385286cca9d2256f6bf3993470820d4827b058.css
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:134:fa2:1627:1fe:edb:1665 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECS (fcn/418C) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=631138519
X-Content-Type-Options nosniff

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 14 Oct 2019 15:59:23 GMT
content-encoding
gzip
x-content-type-options
nosniff
x-ton-expected-size
45170
x-cache
HIT
status
200
vary
Accept-Encoding
content-length
6839
x-response-time
88
surrogate-key
tfw
last-modified
Tue, 14 May 2019 18:53:54 GMT
server
ECS (fcn/418C)
etag
"4mhImCFS9rptiUICNnLD1g=="
strict-transport-security
max-age=631138519
content-type
text/css
access-control-allow-origin
*
x-connection-hash
1eec6b09bc6b1ea69d23f6f606867d6d
accept-ranges
bytes
expires
Mon, 21 Oct 2019 15:59:23 GMT
truncated
/ Frame A758 		707 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
338e5578a7b3021caec1db415b93b214c378029d3cd8d19adc833d8b85ea7d29

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/svg+xml;charset=utf-8
truncated
/ Frame A758 		825 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
45055babdbc02ea34c7baa53f33fc68389c4c5f73afe0bfafd6c9bc5733399bc

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/svg+xml;charset=utf-8
truncated
/ Frame A758 		739 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
4ed07f590bdfa9aa775dbfdef617d98e1e972d102d4289c7a68d3bd9118c280b

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/svg+xml;charset=utf-8
truncated
/ Frame A758 		572 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
abd2a457215e60ab60b2a6b4f25a17583c5d80e13935f76e097236f729c5dcd6

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/svg+xml;charset=utf-8
truncated
/ Frame A758 		644 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
a87f4fd815fc95288f2da6efc536c950ef940bd9eb52176fd9e8e56107cc65e2

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/svg+xml;charset=utf-8
ddRTiw-V
pbs.twimg.com/card_img/1181318305199591424/ Frame A758 		5 KB
5 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pbs.twimg.com/card_img/1181318305199591424/ddRTiw-V?format=jpg&name=144x144_2
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:134:1a0d:1429:742:782:b6 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECS (fcn/40AD) /
Resource Hash
91f1aa5874dd6334afd1182c4949cda95e6e7aa870be5500d4d9edf953fd1aec
Security Headers
Name Value
Strict-Transport-Security max-age=631138519
X-Content-Type-Options nosniff

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://blog.yoroi.company/research/commodity-malware-reborn-the-agenttesla-total-oil-themed-campaign/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 14 Oct 2019 15:59:23 GMT
x-content-type-options
nosniff
x-cache
HIT
status
200
content-length
4902
x-response-time
144
surrogate-key
card_img card_img/bucket/3 card_img/1181318305199591424
last-modified
Mon, 07 Oct 2019 21:18:06 GMT
server
ECS (fcn/40AD)
strict-transport-security
max-age=631138519
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Content-Length
cache-control
max-age=604800, must-revalidate
x-connection-hash
5439044044f83595cfe8d740295a0496
accept-ranges
bytes
jot.html
platform.twitter.com/ Frame A568
Redirect Chain
  • https://syndication.twitter.com/i/jot
  • https://platform.twitter.com/jot.html
0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://platform.twitter.com/jot.html
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECS (fcn/40B5) /
Resource Hash

Request headers

Host
platform.twitter.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site
cross-site
Accept-Encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
Origin
https://blog.yoroi.company
Content-Type
application/x-www-form-urlencoded
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate

Response headers

Accept-Ranges
bytes
Access-Control-Allow-Methods
GET
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=315360000
Content-Type
text/html; charset=utf-8
Date
Mon, 14 Oct 2019 15:59:24 GMT
Etag
"d9592a6c704736fa4da218d4357976dd"
Last-Modified
Wed, 02 Oct 2019 20:25:42 GMT
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server
ECS (fcn/40B5)
X-Cache
HIT
Content-Length
80

Redirect headers

status
302 302 Found
cache-control
no-cache, no-store, must-revalidate, pre-check=0, post-check=0
content-length
0
content-type
text/html;charset=utf-8
date
Mon, 14 Oct 2019 15:59:24 GMT
expires
Tue, 31 Mar 1981 05:00:00 GMT
last-modified
Mon, 14 Oct 2019 15:59:24 GMT
location
https://platform.twitter.com/jot.html
pragma
no-cache
server
tsa_o
strict-transport-security
max-age=631138519
x-connection-hash
b79d4a5481c01f99a16f3ceff604cd73
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN
x-response-time
123
x-transaction
00c535ef00570844
x-tsa-request-body-time
2
x-twitter-response-tags
BouncerCompliant
x-xss-protection
0

Verdicts & Comments Add Verdict or Comment

129 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate object| _wpemojiSettings function| $ function| jQuery object| NO_JQUERY function| pm object| Jetpack string| GoogleAnalyticsObject function| ga object| WPCOM_sharing_counts object| core object| __core-js_shared__ function| setImmediate function| clearImmediate object| regeneratorRuntime boolean| _babelPolyfill object| wp object| google_tag_data object| gaplugins object| gaGlobal object| gaData object| twemoji object| wpcom_img_zoomer object| detectZoom function| hex_md5 function| b64_md5 function| str_md5 function| hex_hmac_md5 function| b64_hmac_md5 function| str_hmac_md5 function| md5_vm_test function| core_md5 function| md5_cmn function| md5_ff function| md5_gg function| md5_hh function| md5_ii function| core_hmac_md5 function| safe_add function| bit_rol function| str2binl function| binl2str function| binl2hex function| binl2b64 object| Gravatar object| GProfile number| hexcase string| b64pad number| chrsz object| WPGroHo object| jetpackLikesWidgetBatch boolean| jetpackLikesMasterReady number| jetpackLikesLookAhead object| jetpackCommentLikesLoadedWidgets function| JetpackLikesPostMessage function| JetpackLikesBatchHandler function| JetpackLikesMessageListener function| JetpackLikesWidgetQueueHandler function| jetpackLoadLikeWidgetIframe function| jetpackGetUnloadedWidgetsInView function| jetpackIsScrolledIntoView function| jetpackUnloadScrolledOutWidgets function| jetpackWidgetsDelayedExec function| jetpackOnScrollStopped object| __twttrll object| twttr object| __twttr function| IFrame function| Elements function| Cookie object| MooTools function| typeOf function| instanceOf function| Type object| Browser function| $constructor function| $family function| Class function| Chain function| Events function| Options object| Slick number| uniqueNumber function| getDocument function| getWindow function| $$ function| addListener function| removeListener function| retrieve function| store function| eliminate function| DOMEvent function| addEvent function| removeEvent function| addEvents function| removeEvents function| fireEvent function| cloneEvents function| getSize function| getScroll function| getScrollSize function| getPosition function| getCoordinates function| getHeight function| getWidth function| getScrollTop function| getScrollLeft function| getScrollHeight function| getScrollWidth function| getTop function| getLeft function| Fx function| EnlighterJS object| sharing_js_options object| WPCOMSharing undefined| windowOpen object| EnlighterJS_Config object| _stq object| Pace function| moment function| Tether object| AmCharts object| jQuery1101004602496696590319 string| new_css object| jQuery112407602920356373217 function| st_go function| linktracker_init object| wpcom

3 Cookies

Domain/Path Name / Value
.yoroi.company/ Name: _gid
Value: GA1.2.946334903.1571068763
.yoroi.company/ Name: _gat
Value: 1
.yoroi.company/ Name: _ga
Value: GA1.2.1210254361.1571068763

1 Console Messages

Source Level URL
Text
console-api log URL: https://c0.wp.com/c/5.2.3/wp-includes/js/jquery/jquery-migrate.min.js(Line 2)
Message:
JQMIGRATE: Migrate is installed, version 1.4.1

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=86400

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

blog.yoroi.company
c0.wp.com
cdn.syndication.twimg.com
fonts.googleapis.com
fonts.gstatic.com
graph.facebook.com
i0.wp.com
i1.wp.com
i2.wp.com
lh3.googleusercontent.com
lh4.googleusercontent.com
lh5.googleusercontent.com
lh6.googleusercontent.com
pbs.twimg.com
pixel.wp.com
platform.twitter.com
s0.wp.com
secure.gravatar.com
stats.wp.com
syndication.twitter.com
ton.twimg.com
widgets.wp.com
www.google-analytics.com
www.yoroi.company
104.244.42.136
104.244.42.200
192.0.76.3
192.0.77.2
192.0.77.32
192.0.77.37
192.0.78.217
2606:2800:134:1a0d:1429:742:782:b6
2606:2800:134:fa2:1627:1fe:edb:1665
2606:2800:234:59:254c:406:2366:268c
2a00:1450:4001:806::2001
2a00:1450:4001:80b::2003
2a00:1450:4001:817::200a
2a00:1450:4001:818::200a
2a00:1450:4001:820::2001
2a00:1450:4001:825::200e
2a03:2880:f01c:20e:face:b00c:0:2
2a04:fa87:fffe::c000:4902
62.149.144.20
016b1417f09b36b5feb9ec8acdfccbc92ee2be9786d7b24572fed66f1844cbfe
066e006e482ee3cfd76f37618f99ecad50eed1c9df36841d177f6218cfb38874
069121a173bd936c85eceee0a301bbb32b8d5e8bf224ed9c3fcb7d8b86e79a4c
09e43ac05f0a03833c38211a04458cd925c4d9d3ee979a468822025fe87648c6
0ebbc7fba9a50d36ef5422345f624431710db4528f25749d1d438c2c10bb69f2
0fefffa15777b279ce61a06932e05bade8fcb729dd9bee04e93fcdd21e8f4552
1db21d816296e6939ba1f42962496e4134ae2b0081e26970864c40c6d02bb1df
1e588dccca85e2bc6502337ac3c4009b0672b08f1e5847d5d5a0fe3d5d475ab5
1e99034e4b75a1fb7ba372a3a950fa19ff4688d8561479b1a34dfcbde83ff3d8
1ee4cfe6a384063358c337aa4d3394cb33ab48becbedb3351c6d1ddf701320a0
2152557cac69e2bd7d6debef5037a9f554f9209cc305b8141b3329acb10c42b7
265c34f4c62e6423e270cecb0c422b735dfb0f18cea04c2ac343b6f22106661e
291b553dee180f838e513bf2580c9af27f8312320581e3c91029a7c4d5eb2fbc
2e1ced1bd0736a56a0c44fd7b3bf8134850398ecddd52a0f5e6e437c5d527999
338e5578a7b3021caec1db415b93b214c378029d3cd8d19adc833d8b85ea7d29
3a5a197947223babcd9e0e759e9284202d70ce33b9f8d7e6ffd3f5bce5fec649
3b7c5042a783cafa6210a4bff4f8c7821c55dd52f1e962874be48ed78c7a35ed
3d0fe6a075b83a572735c50bb54e129b8067757fef04356d91599681e048e492
3e7a865c8b50bd82db738bff39cedf40d887afc1f5bf8c9ea4c519b6826e5cdd
41e7c6de1addd5d7f787b6edbcf89d9aa47ab057c3a84165574a8418f16f91fc
45055babdbc02ea34c7baa53f33fc68389c4c5f73afe0bfafd6c9bc5733399bc
4780f6c640495984cecf3e76a7e486f1cf585e2c859a3c96ee3b9f81d5ae44fd
48eb8b500ae6a38617b5738d2b3faec481922a7782246e31d2755c034a45cd5d
4b8fe5c3d0e5ef7a6582185cbf5c535b5d369c8df1da98c03ed69833e55f474d
4ed07f590bdfa9aa775dbfdef617d98e1e972d102d4289c7a68d3bd9118c280b
4fc7a9c6dd1051ab261a550db0b16147da4236dedfb2efc6311ebff48a045350
53e307bde6eede54adc578d874649ad0ed56bd8ff060a3844e4893328616ed07
54c64f3c66372027154f01fc9f24b4e25fdfe405b70d1994c79abbc2576ff775
55ad8df5e3a4303c16d4653830c1940907420b40d902397815b1916446dff72c
57811344d04a892ddcd3623c551ce97f268cdf0b300e2396cac5168dbc49d425
5e73894cabade36cde8c86e1ca28c3e081b109459f6882e6ef6e729be7614195
5e87ec533498567dd2f14bede6a99ae1d5f5b2fd769f409db6f2f30ee2e961b7
643eea461ad5343f0cf00e3f797828c04b83d4cbaa313255b28c588c9694096f
690606d96d5142a28d2117f2c89ed92fdb1994e8075eb312f390c894b0fe501d
7a7edf370b4f18e06ad355ed845474020b6198b902398ac93b0b2ae8937711d5
7b5e32cb325e9aaef357a421cd16ddf6d6ddb70fec74b6c35a73eccc6817664c
818266fe4b7bbf0fe187b6190933c99af05829f70c2d6023acab03f8af5a59b0
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
87a1a7e65f6ceed57d27b07cac22836a7682617932fc9d4376887b0ae1754a35
895964971ebdb56ee76d08850bcb4c5a88ec4c65e6a235882304e8ff6767cd7c
90476f48e0b8a9f9c5c11fd16f13fc6a8772fe281d12c8e63153a6f948cdd348
91f1aa5874dd6334afd1182c4949cda95e6e7aa870be5500d4d9edf953fd1aec
96cae96a73c65ceed190aa0b4a9a86f0233798e9a17f27ca57855f4f79ebf678
9c42615b9f87888a452f177c5ea19899fb8a835b8f6d0b458824e6c332a0adce
a061d0102de424836a2e3d18d5e1adc3b3f77ce86e67fa740f66cce5abce1961
a48a6e4b14fe55f750c0a3dfb5a6f4941bdc06af0aa542b90de25c30c2b4625c
a549034009f79ead18a2154a8b730d8acb61e2f36c0434c0f9cff0f73df5d8cf
a5628490d00dc398d7872a1fbcbe546f1a8807bacf0b08c673d51176c69820cb
a78e816fad93bab829c882b85bf1aafb5ae0cb7523b8d6de5457651fed1caeca
a7b235b1ad885172645a5bb306b2da1475267f3aab0d94c3aadf38827082c75b
a87f4fd815fc95288f2da6efc536c950ef940bd9eb52176fd9e8e56107cc65e2
abd2a457215e60ab60b2a6b4f25a17583c5d80e13935f76e097236f729c5dcd6
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
b42989a0f2a1fb6d69e72c4f548ef2e73c4d3089d53649f5ed75e45c7b91cffb
b82ad8fbcf9bf844726f648ef268b74f8c2f668f56eafd98b05703e086ff1d5b
b865b1cd6e9944b158d3df5009c46279d97395858681c5f4fd40c2b2d0c76b7a
ba248c9f36442fceef93b25bc4577993797ab7255b16ec87be25d8cec31d559d
bc45aae9868fd7a525eae60723b650c9be9235fa4c2cd2a7c9e2b20523932635
bcada3fb8ba74f6737ee9e798c50512e274a4227ef0a165b84d6ef3f2f0f5c1f
bcb75a8eacd23afcc7eb63ba5e5be68a5916d1211a9cd192dcd5e15cafe1e50a
bd8b0c2e9c07473382c21f9f245c7a24433c3a100eed41e6e0695d23942b0e4a
c1cfa5c2bce904bfc524754a954d2e062c703777ab704134dc5f619dca1e40af
c204ed0bcb4aad749f3f2afb5f8dd316bd5327f6c303dcd70ecafdfde3a6b7fe
d0bfcc98828a74351fe3ddb1c750850257c41ae0a6905e4cba599716ec849bc0
d98121a51ed3f911f519cf42be28225dc26b4c9d61cfab0a580118e5c3447463
dbb67c620eaabf6679a314db18d3ae43037aef71ab27422e6feec08ee987cc0a
e298081ec7ee49f98470a1421535423de2ff5f539adfc14d1ba07d8c9e2c6c93
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e3ceb417f143f3da5e489b62778609a256365a98f483bed272d97e4891fdb36b
e4c68f0b34a79813171f4674c1d17411378987dccdfa9b1d67ae3582a7b8010a
e7afaf16184f94a405c86f580675e4605cb23da14b0b8124d067e0a33d9d24f9
e9fc9b1878db1b13b973252b048d19a17abb34a8da464a552c6d401728ed1e86
ed9451e768c2d762d3d158e05ebed9bd87cdbf6aeb885b3c55e25e8c909ec6da
f1cfa68361e300705524ba44db2726c59ec935837fb52ac3dc6b5626f74cfb9c
f32d41f2099a0be20e6b57c5e0d1b71c079d3e1345827b0f5c5b97c6e5e3f78d
f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1
f3b447e44d5d901f9e077efb1a55665a02fe837f9085ea5de9c102b0dc08f05f
f3c74b1979e62da4336cfb3a228ebcf675e559d744c5d4535f5ae3bc9f7368a2
f452b1e5c1cae40dc81a9da7605dd6b98d0a06253d9b363e11c99ec4081ace4c
f4799ef2939b8377cf33f07b07b6d90a4a245adbf1c6eaf47ee3b0fcefcc07fe
f4e8c8dbefc2cd77738662930dff811a9608ddae5a042a29737bc6f1921c9b82
f545217f8912933314f69fc06fc2e4faa6e837b3abdd8e53a6f321693da95784
fd57ae7228574a83527cb8917ec5a0ff944aa787934ee5b85a7976f259b7ae31