urlscan.io logo urlscan.io
SecurityTrails logo

blog.malwarebytes.com Open in urlscan Pro
130.211.198.3  Public Scan

Go To Rescan Add Verdict Report
URL: https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
Submission: On June 23 via api from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 43 IPs in 7 countries across 36 domains to perform 160 HTTP transactions. The main IP is 130.211.198.3, located in Mountain View, United States and belongs to GOOGLE, US. The main domain is blog.malwarebytes.com.
TLS certificate: Issued by DigiCert SHA2 High Assurance Server CA on April 2nd 2019. Valid for: 2 years.
This is the only time blog.malwarebytes.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
83 130.211.198.3 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
10 2600:9000:20e... 16509 (AMAZON-02)
2 52.239.137.4 8075 (MICROSOFT...)
1 2a04:fa87:fff... 2635 (AUTOMATTIC)
1 192.0.77.32 2635 (AUTOMATTIC)
2 2a00:1450:400... 15169 (GOOGLE)
1 3 2a00:1450:400... 15169 (GOOGLE)
1 2 172.217.18.6 15169 (GOOGLE)
2 2620:1ec:c11:... 8068 (MICROSOFT...)
1 151.101.112.157 54113 (FASTLY)
2 2606:4700::68... 13335 (CLOUDFLAR...)
1 143.204.241.15 16509 (AMAZON-02)
5 151.101.12.134 54113 (FASTLY)
1 2600:1f18:21a... 14618 (AMAZON-AES)
4 140.82.118.3 36459 (GITHUB)
1 1 2a00:1450:400... 15169 (GOOGLE)
1 2 2a00:1450:400... 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
1 172.217.23.98 15169 (GOOGLE)
1 104.244.42.133 13414 (TWITTER)
1 13.224.198.86 16509 (AMAZON-02)
1 2a02:26f0:10c... 20940 (AKAMAI-ASN1)
6 2606:4700::68... 13335 (CLOUDFLAR...)
4 151.101.0.134 54113 (FASTLY)
1 2 2a05:f500:10:... 14413 (LINKEDIN)
1 1 2620:1ec:21::14 8068 (MICROSOFT...)
1 2a00:1450:400... 15169 (GOOGLE)
1 143.204.94.67 16509 (AMAZON-02)
2 2 52.210.50.2 16509 (AMAZON-02)
1 2 13.225.87.70 16509 (AMAZON-02)
1 185.199.108.154 54113 (FASTLY)
1 192.0.77.48 2635 (AUTOMATTIC)
1 2 172.217.23.102 15169 (GOOGLE)
2 2a03:2880:f02... 32934 (FACEBOOK)
1 151.101.113.2 54113 (FASTLY)
2 3 3.250.202.183 16509 (AMAZON-02)
2 2a00:1288:f03... 10310 (YAHOO-1)
2 88.221.60.75 16625 (AKAMAI-AS)
1 104.244.42.131 13414 (TWITTER)
2 99.81.228.121 16509 (AMAZON-02)
2 2a03:2880:f12... 32934 (FACEBOOK)
1 34.193.47.47 14618 (AMAZON-AES)
1 192.28.144.124 15224 (OMNITURE)
1 212.82.100.181 34010 (YAHOO-IRD)
160 43
83    130.211.198.3 (Mountain View, United States)

ASN15169 (GOOGLE, US)
PTR: 3.198.211.130.bc.googleusercontent.com
blog.malwarebytes.com
1    2a00:1450:4001:808::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.googleapis.com
10    2600:9000:20eb:5000:8:d3fb:39c0:93a1 (United States)

ASN16509 (AMAZON-02, US)
www.malwarebytes.com
2    52.239.137.4 (Dublin, Ireland)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
optanon.blob.core.windows.net
1    2a04:fa87:fffe::c000:4902 (Ireland)

ASN2635 (AUTOMATTIC, US)
secure.gravatar.com
1    192.0.77.32 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)
PTR: wordpress.com
s0.wp.com
2    2a00:1450:4001:802::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.googletagmanager.com
3    2a00:1450:4001:817::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google-analytics.com
2    172.217.18.6 (United States)

ASN15169 (GOOGLE, US)
PTR: fra15s28-in-f6.1e100.net
9812475.fls.doubleclick.net
2    2620:1ec:c11::200 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
bat.bing.com
1    151.101.112.157 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)
static.ads-twitter.com
2    2606:4700::6813:9408 (United States)

ASN13335 (CLOUDFLARENET, US)
script.crazyegg.com
1    143.204.241.15 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-241-15.cph50.r.cloudfront.net
js.adsrvr.org
5    151.101.12.134 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)
malwarebytesunpacked.disqus.com
1    2600:1f18:21ae:6700:a732:5aa:237:e3cd (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
genesis.malwarebytes.com
4    140.82.118.3 (United States)

ASN36459 (GITHUB, US)
PTR: lb-140-82-118-3-ams.github.com
gist.github.com
1    2a00:1450:400c:c04::9c (Brussels, Belgium)

ASN15169 (GOOGLE, US)
stats.g.doubleclick.net
2    2a00:1450:4001:81a::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google.com
2    2a00:1450:4001:809::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google.de
1    172.217.23.98 (United States)

ASN15169 (GOOGLE, US)
PTR: mil04s23-in-f98.1e100.net
www.googleadservices.com
1    104.244.42.133 (United States)

ASN13414 (TWITTER, US)
t.co
1    13.224.198.86 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-224-198-86.fra2.r.cloudfront.net
scripts.demandbase.com
1    2a02:26f0:10c:39e::25ea (Ascension Island)

ASN20940 (AKAMAI-ASN1, EU)
snap.licdn.com
6    2606:4700::6812:a913 (United States)

ASN13335 (CLOUDFLARENET, US)
c.disquscdn.com
4    151.101.0.134 (United States)

ASN54113 (FASTLY, US)
disqus.com
2    2a05:f500:10:101::b93f:9105 (Ireland)

ASN14413 (LINKEDIN, US)
px.ads.linkedin.com
1    2620:1ec:21::14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
www.linkedin.com
1    2a00:1450:4001:808::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
googleads.g.doubleclick.net
1    143.204.94.67 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-94-67.fra50.r.cloudfront.net
api.company-target.com
2    52.210.50.2 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-210-50-2.eu-west-1.compute.amazonaws.com
match.prod.bidr.io
2    13.225.87.70 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-225-87-70.fra2.r.cloudfront.net
segments.company-target.com
1    185.199.108.154 (Hoover, United States)

ASN54113 (FASTLY, US)
github.githubassets.com
1    192.0.77.48 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)
PTR: s.w.org
s.w.org
2    172.217.23.102 (United States)

ASN15169 (GOOGLE, US)
PTR: mil04s23-in-f102.1e100.net
5118230.fls.doubleclick.net
2    2a03:2880:f02d:12:face:b00c:0:3 (Ireland)

ASN32934 (FACEBOOK, US)
connect.facebook.net
1    151.101.113.2 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)
a.quora.com
3    3.250.202.183 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-250-202-183.eu-west-1.compute.amazonaws.com
ads.avocet.io
ads.avct.cloud
2    2a00:1288:f03d:1fa::4000 (United Kingdom)

ASN10310 (YAHOO-1, US)
s.yimg.com
2    88.221.60.75 (Ascension Island)

ASN16625 (AKAMAI-AS, US)
PTR: a88-221-60-75.deploy.static.akamaitechnologies.com
munchkin.marketo.net
1    104.244.42.131 (United States)

ASN13414 (TWITTER, US)
analytics.twitter.com
2    99.81.228.121 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-99-81-228-121.eu-west-1.compute.amazonaws.com
insight.adsrvr.org
2    2a03:2880:f12d:83:face:b00c:0:25de (Ireland)

ASN32934 (FACEBOOK, US)
www.facebook.com
1    34.193.47.47 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-193-47-47.compute-1.amazonaws.com
q.quora.com
1    192.28.144.124 (United States)

ASN15224 (OMNITURE, US)
805-usg-300.mktoresp.com
1    212.82.100.181 (Switzerland)

ASN34010 (YAHOO-IRD, GB)
PTR: spdc.pbp.vip.ir2.yahoo.com
sp.analytics.yahoo.com
Apex Domain
Subdomains		 Transfer
94 malwarebytes.com
blog.malwarebytes.com
www.malwarebytes.com
genesis.malwarebytes.com
2 MB
9 disqus.com
malwarebytesunpacked.disqus.com
disqus.com
83 KB
6 disquscdn.com
c.disquscdn.com
439 KB
6 doubleclick.net
9812475.fls.doubleclick.net
stats.g.doubleclick.net
googleads.g.doubleclick.net
5118230.fls.doubleclick.net
3 KB
4 github.com
gist.github.com
14 KB
3 company-target.com
api.company-target.com
segments.company-target.com
2 KB
3 linkedin.com
px.ads.linkedin.com
www.linkedin.com
3 KB
3 adsrvr.org
js.adsrvr.org
insight.adsrvr.org
2 KB
3 google-analytics.com
www.google-analytics.com
18 KB
2 facebook.com
www.facebook.com
488 B
2 marketo.net
munchkin.marketo.net
6 KB
2 yimg.com
s.yimg.com
7 KB
2 avct.cloud
ads.avct.cloud
750 B
2 quora.com
a.quora.com
q.quora.com
14 KB
2 facebook.net
connect.facebook.net
166 KB
2 bidr.io
match.prod.bidr.io
1019 B
2 google.de
www.google.de
213 B
2 google.com
www.google.com
288 B
2 crazyegg.com
script.crazyegg.com
21 KB
2 bing.com
bat.bing.com
8 KB
2 googletagmanager.com
www.googletagmanager.com
78 KB
2 windows.net
optanon.blob.core.windows.net
27 KB
1 yahoo.com
sp.analytics.yahoo.com
528 B
1 mktoresp.com
805-usg-300.mktoresp.com
304 B
1 twitter.com
analytics.twitter.com
650 B
1 avocet.io
ads.avocet.io
156 B
1 w.org
s.w.org
567 B
1 githubassets.com
github.githubassets.com
5 KB
1 licdn.com
snap.licdn.com
2 KB
1 demandbase.com
scripts.demandbase.com
16 KB
1 t.co
t.co
449 B
1 googleadservices.com
www.googleadservices.com
12 KB
1 ads-twitter.com
static.ads-twitter.com
2 KB
1 wp.com
s0.wp.com
3 KB
1 gravatar.com
secure.gravatar.com
3 KB
1 googleapis.com
fonts.googleapis.com
1 KB
160 36
Domain Requested by
83 blog.malwarebytes.com blog.malwarebytes.com
www.malwarebytes.com
10 www.malwarebytes.com blog.malwarebytes.com
www.googletagmanager.com
6 c.disquscdn.com malwarebytesunpacked.disqus.com
5 malwarebytesunpacked.disqus.com blog.malwarebytes.com
malwarebytesunpacked.disqus.com
www.malwarebytes.com
4 disqus.com malwarebytesunpacked.disqus.com
4 gist.github.com www.malwarebytes.com
3 www.google-analytics.com 1 redirects blog.malwarebytes.com
2 www.facebook.com connect.facebook.net
2 insight.adsrvr.org js.adsrvr.org
2 munchkin.marketo.net blog.malwarebytes.com
munchkin.marketo.net
2 s.yimg.com blog.malwarebytes.com
s.yimg.com
2 ads.avct.cloud 1 redirects
2 connect.facebook.net blog.malwarebytes.com
connect.facebook.net
2 5118230.fls.doubleclick.net 1 redirects www.malwarebytes.com
2 segments.company-target.com 1 redirects blog.malwarebytes.com
2 match.prod.bidr.io 2 redirects
2 px.ads.linkedin.com 1 redirects blog.malwarebytes.com
2 www.google.de blog.malwarebytes.com
2 www.google.com 1 redirects blog.malwarebytes.com
2 script.crazyegg.com www.googletagmanager.com
script.crazyegg.com
2 bat.bing.com blog.malwarebytes.com
2 9812475.fls.doubleclick.net 1 redirects www.googletagmanager.com
2 www.googletagmanager.com blog.malwarebytes.com
www.googletagmanager.com
2 optanon.blob.core.windows.net blog.malwarebytes.com
optanon.blob.core.windows.net
1 sp.analytics.yahoo.com s.yimg.com
1 805-usg-300.mktoresp.com munchkin.marketo.net
1 q.quora.com
1 analytics.twitter.com static.ads-twitter.com
1 ads.avocet.io 1 redirects
1 a.quora.com blog.malwarebytes.com
1 s.w.org blog.malwarebytes.com
1 github.githubassets.com www.malwarebytes.com
1 api.company-target.com scripts.demandbase.com
1 googleads.g.doubleclick.net www.googleadservices.com
1 www.linkedin.com 1 redirects
1 snap.licdn.com blog.malwarebytes.com
1 scripts.demandbase.com blog.malwarebytes.com
1 t.co blog.malwarebytes.com
1 www.googleadservices.com www.googletagmanager.com
1 stats.g.doubleclick.net 1 redirects
1 genesis.malwarebytes.com www.malwarebytes.com
1 js.adsrvr.org www.googletagmanager.com
1 static.ads-twitter.com blog.malwarebytes.com
1 s0.wp.com blog.malwarebytes.com
1 secure.gravatar.com blog.malwarebytes.com
1 fonts.googleapis.com blog.malwarebytes.com
160 46
Subject Issuer Validity Valid
blog.malwarebytes.com
DigiCert SHA2 High Assurance Server CA		 2019-04-02 -
2021-07-05		 2 years crt.sh
upload.video.google.com
GTS CA 1O1		 2020-05-26 -
2020-08-18		 3 months crt.sh
*.malwarebytes.com
DigiCert SHA2 High Assurance Server CA		 2018-12-06 -
2020-12-09		 2 years crt.sh
*.blob.core.windows.net
Microsoft IT TLS CA 5		 2020-04-17 -
2022-04-17		 2 years crt.sh
*.gravatar.com
COMODO RSA Domain Validation Secure Server CA		 2018-09-06 -
2020-09-05		 2 years crt.sh
*.wp.com
Sectigo RSA Domain Validation Secure Server CA		 2020-04-02 -
2022-07-05		 2 years crt.sh
*.google-analytics.com
GTS CA 1O1		 2020-05-26 -
2020-08-18		 3 months crt.sh
*.doubleclick.net
GTS CA 1O1		 2020-05-26 -
2020-08-18		 3 months crt.sh
www.bing.com
Microsoft IT TLS CA 2		 2019-04-30 -
2021-04-30		 2 years crt.sh
ads-twitter.com
DigiCert SHA2 High Assurance Server CA		 2019-08-14 -
2020-08-18		 a year crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2020-06-09 -
2021-06-09		 a year crt.sh
*.adsrvr.org
Trustwave Organization Validation SHA256 CA, Level 1		 2019-03-07 -
2021-04-19		 2 years crt.sh
*.disqus.com
DigiCert SHA2 Secure Server CA		 2020-04-20 -
2022-05-09		 2 years crt.sh
*.github.com
DigiCert SHA2 High Assurance Server CA		 2020-06-22 -
2022-08-17		 2 years crt.sh
www.google.de
GTS CA 1O1		 2020-05-26 -
2020-08-18		 3 months crt.sh
www.googleadservices.com
GTS CA 1O1		 2020-05-26 -
2020-08-18		 3 months crt.sh
t.co
DigiCert SHA2 High Assurance Server CA		 2020-03-05 -
2021-03-02		 a year crt.sh
*.demandbase.com
Go Daddy Secure Certificate Authority - G2		 2018-09-20 -
2020-11-19		 2 years crt.sh
*.licdn.com
DigiCert SHA2 Secure Server CA		 2019-04-01 -
2021-05-07		 2 years crt.sh
px.ads.linkedin.com
DigiCert SHA2 Secure Server CA		 2020-03-04 -
2020-09-04		 6 months crt.sh
*.g.doubleclick.net
GTS CA 1O1		 2020-05-26 -
2020-08-18		 3 months crt.sh
*.company-target.com
Go Daddy Secure Certificate Authority - G2		 2019-06-19 -
2021-08-18		 2 years crt.sh
www.google.com
GTS CA 1O1		 2020-05-26 -
2020-08-18		 3 months crt.sh
*.githubassets.com
DigiCert SHA2 High Assurance Server CA		 2018-10-29 -
2020-11-02		 2 years crt.sh
*.w.org
Sectigo RSA Domain Validation Secure Server CA		 2019-12-19 -
2021-12-18		 2 years crt.sh
*.facebook.com
DigiCert SHA2 High Assurance Server CA		 2020-05-14 -
2020-08-05		 3 months crt.sh
quora.com
Let's Encrypt Authority X3		 2020-06-21 -
2020-09-19		 3 months crt.sh
*.avct.cloud
Let's Encrypt Authority X3		 2020-06-04 -
2020-09-02		 3 months crt.sh
*.yahoo.com
DigiCert SHA2 High Assurance Server CA		 2020-05-19 -
2020-07-03		 a month crt.sh
*.marketo.net
DigiCert SHA2 Secure Server CA		 2020-03-14 -
2021-04-13		 a year crt.sh
*.twitter.com
DigiCert SHA2 High Assurance Server CA		 2020-03-05 -
2021-03-02		 a year crt.sh
*.quora.com
Let's Encrypt Authority X3		 2020-05-31 -
2020-08-29		 3 months crt.sh
*.mktoresp.com
DigiCert SHA2 Secure Server CA		 2020-01-17 -
2022-01-21		 2 years crt.sh
*.analytics.yahoo.com
DigiCert SHA2 High Assurance Server CA		 2020-03-04 -
2020-08-31		 6 months crt.sh

This page contains 8 frames:

Primary Page: https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
Frame ID: F5CD02DA8C6389455598A3C92F03DAEE
Requests: 153 HTTP requests in this frame

Frame: https://9812475.fls.doubleclick.net/activityi;dc_pre=CJfb9_rlmOoCFfnBuwgdyA8CXQ;src=9812475;type=conve0;cat=forms000;ord=1;num=2821492876249;gtm=2wg6a0;auiddc=1321793998.1592944840;~oref=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-analysis%2F2016%2F10%2Ftrick-bot-dyrezas-successor%2F
Frame ID: D339C908021D938A2BFDAB38202C027F
Requests: 1 HTTP requests in this frame

Frame: https://disqus.com/embed/comments/?base=default&f=malwarebytesunpacked&t_i=14942%20https%3A%2F%2Fblog.malwarebytes.com%2F%3Fp%3D14942&t_u=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-analysis%2F2016%2F10%2Ftrick-bot-dyrezas-successor%2F&t_e=Introducing%20TrickBot%2C%20Dyreza%E2%80%99s%20successor&t_d=Introducing%20TrickBot%2C%20Dyreza%27s%20successor%20-%20Malwarebytes%20Labs%20%7C%20Malwarebytes%20Labs&t_t=Introducing%20TrickBot%2C%20Dyreza%E2%80%99s%20successor&s_o=default
Frame ID: 8964FC1AD512033971132FA5F6624CC4
Requests: 1 HTTP requests in this frame

Frame: https://5118230.fls.doubleclick.net/activityi;dc_pre=CLfmyfvlmOoCFc_3dwodtIIGDw;src=5118230;type=count0;cat=secur00;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=1;num=1106850559293.18
Frame ID: 56DE1940095802A01E079EB3F3E85B3E
Requests: 1 HTTP requests in this frame

Frame: https://insight.adsrvr.org/track/up?adv=8mirph5&ref=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-analysis%2F2016%2F10%2Ftrick-bot-dyrezas-successor%2F&upid=r8yigtp&upv=1.1.0
Frame ID: CC3CA87B16B98BF0E44B78A193034A92
Requests: 1 HTTP requests in this frame

Frame: https://insight.adsrvr.org/track/up?adv=8mirph5&ref=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-analysis%2F2016%2F10%2Ftrick-bot-dyrezas-successor%2F&upid=r8yigtp&upv=1.1.0
Frame ID: 3C96EBEC6A2734FDE2AC18043A3664F6
Requests: 1 HTTP requests in this frame

Frame: https://disqus.com/embed/comments/?base=default&f=malwarebytesunpacked&t_i=14942%20https%3A%2F%2Fblog.malwarebytes.com%2F%3Fp%3D14942&t_u=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-analysis%2F2016%2F10%2Ftrick-bot-dyrezas-successor%2F&t_e=Introducing%20TrickBot%2C%20Dyreza%E2%80%99s%20successor&t_d=Introducing%20TrickBot%2C%20Dyreza%27s%20successor%20-%20Malwarebytes%20Labs%20%7C%20Malwarebytes%20Labs&t_t=Introducing%20TrickBot%2C%20Dyreza%E2%80%99s%20successor&s_o=default
Frame ID: 737E43E1896BE1BF9FFBFDB8EDBD8481
Requests: 1 HTTP requests in this frame

Frame: https://disqus.com/embed/comments/?base=default&f=malwarebytesunpacked&t_i=14942%20https%3A%2F%2Fblog.malwarebytes.com%2F%3Fp%3D14942&t_u=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-analysis%2F2016%2F10%2Ftrick-bot-dyrezas-successor%2F&t_e=Introducing%20TrickBot%2C%20Dyreza%E2%80%99s%20successor&t_d=Introducing%20TrickBot%2C%20Dyreza%27s%20successor%20-%20Malwarebytes%20Labs%20%7C%20Malwarebytes%20Labs&t_t=Introducing%20TrickBot%2C%20Dyreza%E2%80%99s%20successor&s_o=default
Frame ID: F911A6853CE9D7631A01CEB961F8B591
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Detected technologies

Overall confidence: 100%
Detected patterns
  • html /<link[^>]+s\d+\.wp\.com/i
  • script /\/wp-(?:content|includes)\//i
  • headers link /rel="https:\/\/api\.w\.org\/"/i
  • html /<!-- This site is optimized with the Yoast (?:WordPress )?SEO plugin v([\d.]+) -/i
Overall confidence: 100%
Detected patterns
  • html /<link[^>]+s\d+\.wp\.com/i
  • script /\/wp-(?:content|includes)\//i
  • headers link /rel="https:\/\/api\.w\.org\/"/i
  • html /<!-- This site is optimized with the Yoast (?:WordPress )?SEO plugin v([\d.]+) -/i
Overall confidence: 100%
Detected patterns
  • html /<link[^>]+s\d+\.wp\.com/i
  • script /\/wp-(?:content|includes)\//i
  • headers link /rel="https:\/\/api\.w\.org\/"/i
  • html /<!-- This site is optimized with the Yoast (?:WordPress )?SEO plugin v([\d.]+) -/i
Overall confidence: 100%
Detected patterns
  • headers server /nginx(?:\/([\d.]+))?/i
Overall confidence: 100%
Detected patterns
  • html /<!-- This site is optimized with the Yoast (?:WordPress )?SEO plugin v([\d.]+) -/i
Overall confidence: 100%
Detected patterns
  • script /\/\/connect\.facebook\.net\/[^/]*\/[a-z]*\.js/i
Overall confidence: 100%
Detected patterns
  • script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i
Overall confidence: 100%
Detected patterns
  • html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i

Page Statistics

160
Requests

99 %
HTTPS

42 %
IPv6

36
Domains

46
Subdomains

43
IPs

7
Countries

2861 kB
Transfer

4509 kB
Size

1
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 97
  • https://9812475.fls.doubleclick.net/activityi;src=9812475;type=conve0;cat=forms000;ord=1;num=2821492876249;gtm=2wg6a0;auiddc=1321793998.1592944840;~oref=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-analysis%2F2016%2F10%2Ftrick-bot-dyrezas-successor%2F HTTP 302
  • https://9812475.fls.doubleclick.net/activityi;dc_pre=CJfb9_rlmOoCFfnBuwgdyA8CXQ;src=9812475;type=conve0;cat=forms000;ord=1;num=2821492876249;gtm=2wg6a0;auiddc=1321793998.1592944840;~oref=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-analysis%2F2016%2F10%2Ftrick-bot-dyrezas-successor%2F
Request Chain 112
  • https://www.google-analytics.com/r/collect?v=1&_v=j83&a=739632739&t=pageview&_s=1&dl=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-analysis%2F2016%2F10%2Ftrick-bot-dyrezas-successor%2F&ul=en-us&de=UTF-8&dt=Introducing%20TrickBot%2C%20Dyreza%27s%20successor%20-%20Malwarebytes%20Labs%20%7C%20Malwarebytes%20Labs&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAEAB~&jid=212980586&gjid=1713856140&cid=63000543.1592944841&tid=UA-3347303-10&_gid=507961266.1592944841&_r=1&z=444867229 HTTP 302
  • https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-3347303-10&cid=63000543.1592944841&jid=212980586&_gid=507961266.1592944841&gjid=1713856140&_v=j83&z=444867229 HTTP 302
  • https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-3347303-10&cid=63000543.1592944841&jid=212980586&_v=j83&z=444867229 HTTP 302
  • https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-3347303-10&cid=63000543.1592944841&jid=212980586&_v=j83&z=444867229&slf_rd=1&random=2734364629
Request Chain 124
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1056361&url=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-analysis%2F2016%2F10%2Ftrick-bot-dyrezas-successor%2F&time=1592944840982 HTTP 302
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D1056361%26url%3Dhttps%253A%252F%252Fblog.malwarebytes.com%252Fthreat-analysis%252F2016%252F10%252Ftrick-bot-dyrezas-successor%252F%26time%3D1592944840982%26liSync%3Dtrue HTTP 302
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1056361&url=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-analysis%2F2016%2F10%2Ftrick-bot-dyrezas-successor%2F&time=1592944840982&liSync=true
Request Chain 127
  • https://match.prod.bidr.io/cookie-sync/demandbase HTTP 303
  • https://match.prod.bidr.io/cookie-sync/demandbase?_bee_ppp=1 HTTP 303
  • https://segments.company-target.com/log?vendor=choca&user_id=AAS-IE695NIAABCLaFaWOQ HTTP 303
  • https://segments.company-target.com/validateCookie?vendor=choca&user_id=AAS-IE695NIAABCLaFaWOQ&verifyHash=d4ad2ae5c272ff1003b5582957dc6b75dfde2045
Request Chain 134
  • https://5118230.fls.doubleclick.net/activityi;src=5118230;type=count0;cat=secur00;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=1;num=1106850559293.18 HTTP 302
  • https://5118230.fls.doubleclick.net/activityi;dc_pre=CLfmyfvlmOoCFc_3dwodtIIGDw;src=5118230;type=count0;cat=secur00;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=1;num=1106850559293.18
Request Chain 138
  • https://ads.avocet.io/s?add=5b8e9b462be173e55d6569fc&ty=j&_=1592944840182 HTTP 301
  • https://ads.avct.cloud/s?r=1&add=5b8e9b462be173e55d6569fc&ty=j&_=1592944840182 HTTP 302
  • https://ads.avct.cloud/s?bounce=true&r=1&add=5b8e9b462be173e55d6569fc&ty=j&_=1592944840182

160 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/ 		169 KB
32 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
3.198.211.130.bc.googleusercontent.com
Software
nginx / WP Engine
Resource Hash
383b99377cffb13c340c9ca9069826b500dd30aa01312572d659cfb9ad814389
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

:method
GET
:authority
blog.malwarebytes.com
:scheme
https
:path
/threat-analysis/2016/10/trick-bot-dyrezas-successor/
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status
200
server
nginx
date
Tue, 23 Jun 2020 20:40:39 GMT
content-type
text/html; charset=UTF-8
vary
Accept-Encoding Accept-Encoding Accept-Encoding,Cookie
x-pingback
https://blog.malwarebytes.com/xmlrpc.php
link
<https://blog.malwarebytes.com/wp-json/>; rel="https://api.w.org/" <https://blog.malwarebytes.com/?p=14942>; rel=shortlink
x-powered-by
WP Engine
x-cacheable
SHORT
cache-control
max-age=600, must-revalidate
x-cache
HIT: 4
x-cache-group
normal
x-frame-options
SAMEORIGIN
content-encoding
br
style.min.css
blog.malwarebytes.com/wp-includes/css/dist/block-library/ 		52 KB
8 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://blog.malwarebytes.com/wp-includes/css/dist/block-library/style.min.css?ver=5.4.2
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
3.198.211.130.bc.googleusercontent.com
Software
nginx /
Resource Hash
bca7af0b45b6fc6a2064e8e7a34f2041f3e77261e63f0257209bcde6bc40545d

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 23 Jun 2020 20:40:39 GMT
content-encoding
br
last-modified
Fri, 24 Apr 2020 15:32:14 GMT
server
nginx
status
200
etag
W/"5ea3067e-d159"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
prettyPhoto.css
blog.malwarebytes.com/wp-content/plugins/responsive-lightbox/assets/prettyphoto/css/ 		19 KB
3 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://blog.malwarebytes.com/wp-content/plugins/responsive-lightbox/assets/prettyphoto/css/prettyPhoto.css?ver=1.7.2
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
3.198.211.130.bc.googleusercontent.com
Software
nginx /
Resource Hash
1f504f86bc8f301e4041e744f681cce164e9ac5e8e5dfacc984a012e95e1a7cd

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 23 Jun 2020 20:40:39 GMT
content-encoding
br
last-modified
Wed, 28 Feb 2018 21:17:34 GMT
server
nginx
status
200
etag
W/"5a971c6e-4db5"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
css
fonts.googleapis.com/ 		17 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Source+Sans+Pro%3A300%2C400%2C700%2C300italic%2C400italic%2C700italic%7CBitter%3A400%2C700&subset=latin%2Clatin-ext
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
edda03990c5d77149008225a15938e07aa1998d2cdff56f693273a498214d600
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
status
200
alt-svc
h3-28=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Tue, 23 Jun 2020 19:44:36 GMT
server
ESF
date
Tue, 23 Jun 2020 20:40:39 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Tue, 23 Jun 2020 20:40:39 GMT
genericons.css
blog.malwarebytes.com/wp-content/plugins/jetpack/_inc/genericons/genericons/ 		28 KB
16 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://blog.malwarebytes.com/wp-content/plugins/jetpack/_inc/genericons/genericons/genericons.css?ver=3.1
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
3.198.211.130.bc.googleusercontent.com
Software
nginx /
Resource Hash
4ed10d0d64bb1515397e8666a63f484d640dbc5678fa62574e077b7aef1c3af2

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 23 Jun 2020 20:40:39 GMT
content-encoding
br
last-modified
Wed, 28 Feb 2018 21:17:31 GMT
server
nginx
status
200
etag
W/"5a971c6b-6e6a"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
style.css
blog.malwarebytes.com/wp-content/themes/labs.malwarebytes.org-3.4.1.6/ 		92 KB
16 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://blog.malwarebytes.com/wp-content/themes/labs.malwarebytes.org-3.4.1.6/style.css?ver=2013-07-18
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
3.198.211.130.bc.googleusercontent.com
Software
nginx /
Resource Hash
21566c5bf140021872a218e16bd8d32d6ee52869d918d75fca0e3f396319fa9a

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 23 Jun 2020 20:40:39 GMT
content-encoding
br
last-modified
Tue, 12 May 2020 20:50:39 GMT
server
nginx
status
200
etag
W/"5ebb0c1f-16f4e"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
jquery.js
blog.malwarebytes.com/wp-includes/js/jquery/ 		95 KB
34 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://blog.malwarebytes.com/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
3.198.211.130.bc.googleusercontent.com
Software
nginx /
Resource Hash
1db21d816296e6939ba1f42962496e4134ae2b0081e26970864c40c6d02bb1df

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 23 Jun 2020 20:40:39 GMT
content-encoding
br
last-modified
Fri, 17 May 2019 04:25:54 GMT
server
nginx
status
200
etag
W/"5cde37d2-17a69"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
jquery-migrate.min.js
blog.malwarebytes.com/wp-includes/js/jquery/ 		10 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://blog.malwarebytes.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=1.4.1
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
3.198.211.130.bc.googleusercontent.com
Software
nginx /
Resource Hash
48eb8b500ae6a38617b5738d2b3faec481922a7782246e31d2755c034a45cd5d

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 23 Jun 2020 20:40:39 GMT
content-encoding
br
last-modified
Fri, 20 May 2016 06:11:28 GMT
server
nginx
status
200
etag
W/"573eaa90-2748"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
jquery.prettyPhoto.js
blog.malwarebytes.com/wp-content/plugins/responsive-lightbox/assets/prettyphoto/js/ 		37 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://blog.malwarebytes.com/wp-content/plugins/responsive-lightbox/assets/prettyphoto/js/jquery.prettyPhoto.js?ver=1.7.2
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
3.198.211.130.bc.googleusercontent.com
Software
nginx /
Resource Hash
e5087adff56cd9077a7b21a01d78e2a97177cbf4872935bbf3049d06ee884826

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 23 Jun 2020 20:40:39 GMT
content-encoding
br
last-modified
Wed, 28 Feb 2018 21:17:34 GMT
server
nginx
status
200
etag
W/"5a971c6e-94b4"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
front.js
blog.malwarebytes.com/wp-content/plugins/responsive-lightbox/js/ 		18 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://blog.malwarebytes.com/wp-content/plugins/responsive-lightbox/js/front.js?ver=1.7.2
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
3.198.211.130.bc.googleusercontent.com
Software
nginx /
Resource Hash
95a2c350aabb2955eaaf7a8bbfb494c2533cc20207ac4a026a0100dbac0a554a

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 23 Jun 2020 20:40:39 GMT
content-encoding
br
last-modified
Wed, 28 Feb 2018 21:17:34 GMT
server
nginx
status
200
etag
W/"5a971c6e-4711"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
style.css
www.malwarebytes.com/css/ 		220 KB
33 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.malwarebytes.com/css/style.css?12-20-2016
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:20eb:5000:8:d3fb:39c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
cf4f7af10cd2676b0cff793e9525301fa24cc2de65bad0658380a4f6661dc3d2

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 23 Jun 2020 20:40:41 GMT
content-encoding
gzip
last-modified
Fri, 29 May 2020 15:15:55 GMT
server
AmazonS3
x-amz-cf-pop
FRA2-C1
vary
Accept-Encoding
x-cache
RefreshHit from cloudfront
content-type
text/css
status
200
x-amz-cf-id
8fM-MialkIMgxwO0gt3BmY3CpjgNbV42QSr-2uAnMQ4szX2tQ0VCPQ==
via
1.1 41f60102fc29156bc5001d6646f75c02.cloudfront.net (CloudFront)
style.css
blog.malwarebytes.com/wp-content/themes/labs.malwarebytes.org-3.4.1.6/ 		92 KB
16 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://blog.malwarebytes.com/wp-content/themes/labs.malwarebytes.org-3.4.1.6/style.css
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
3.198.211.130.bc.googleusercontent.com
Software
nginx /
Resource Hash
21566c5bf140021872a218e16bd8d32d6ee52869d918d75fca0e3f396319fa9a

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 23 Jun 2020 20:40:39 GMT
content-encoding
br
last-modified
Tue, 12 May 2020 20:50:39 GMT
server
nginx
status
200
etag
W/"5ebb0c1f-16f4e"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
jquery-1.11.3.min.js
www.malwarebytes.com/js/ 		94 KB
33 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.malwarebytes.com/js/jquery-1.11.3.min.js
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:20eb:5000:8:d3fb:39c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
ecb916133a9376911f10bc5c659952eb0031e457f5df367cde560edbfba38fb8

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 23 Jun 2020 20:40:39 GMT
content-encoding
gzip
last-modified
Thu, 18 Jun 2020 21:11:55 GMT
server
AmazonS3
x-amz-cf-pop
FRA2-C1
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
status
200
x-amz-cf-id
DC-hzjnS6gS8nkx2147_pvKZjUHGe0ZMq69CFf01PIGl16V2JnFBzg==
via
1.1 41f60102fc29156bc5001d6646f75c02.cloudfront.net (CloudFront)
9530a107-0af8-4204-a2c2-217efb78222b.js
optanon.blob.core.windows.net/consent/ 		140 KB
21 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://optanon.blob.core.windows.net/consent/9530a107-0af8-4204-a2c2-217efb78222b.js
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.239.137.4 Dublin, Ireland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
b28678c51b4397abc7951fe8a69a8aec0fa299159d5eb4ced487aabbb89f44b5

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-ms-lease-status
unlocked
x-ms-blob-type
BlockBlob
Date
Tue, 23 Jun 2020 20:40:39 GMT
Content-Encoding
GZIP
Last-Modified
Thu, 27 Feb 2020 21:48:10 GMT
Server
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
Content-MD5
ufyNfC1IAg9j/Ir1yJGMGA==
ETag
0x8D7BBCEBD00AC67
Content-Type
application/x-javascript
Access-Control-Allow-Origin
*
x-ms-request-id
cac7c11d-001e-011d-409e-494759000000
Access-Control-Expose-Headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
Cache-Control
public, max-age=14400
x-ms-version
2009-09-19
Content-Length
20612
bootstrap.js
www.malwarebytes.com/js/ 		67 KB
14 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.malwarebytes.com/js/bootstrap.js
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:20eb:5000:8:d3fb:39c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
425328ed7a60e35938fa92fc7ba5f5af96b53f9608bb41b8a07c0f91e8bdefcd

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 23 Jun 2020 20:40:41 GMT
content-encoding
gzip
last-modified
Thu, 18 Jun 2020 21:11:54 GMT
server
AmazonS3
x-amz-cf-pop
FRA2-C1
vary
Accept-Encoding
x-cache
RefreshHit from cloudfront
content-type
application/javascript
status
200
x-amz-cf-id
fwZytbX1K71agy2wh_YWrk_1NK01YIHVmfYSWt3A60s4sgD7ynXAag==
via
1.1 41f60102fc29156bc5001d6646f75c02.cloudfront.net (CloudFront)
respond.min.js
www.malwarebytes.com/js/ie-fixes/ 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.malwarebytes.com/js/ie-fixes/respond.min.js
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:20eb:5000:8:d3fb:39c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
75f9768f79e42df5aa6183372a4b067f02682606cca5f242e06d1e07f3614c94

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 23 Jun 2020 20:40:41 GMT
content-encoding
gzip
last-modified
Thu, 18 Jun 2020 21:11:55 GMT
server
AmazonS3
x-amz-cf-pop
FRA2-C1
vary
Accept-Encoding
x-cache
RefreshHit from cloudfront
content-type
application/javascript
status
200
x-amz-cf-id
O_yfEs1KUbhjdYoSUhAKGOJxbA7Xh0PP_69Qw7UxvWlJ7vf0iZJxDA==
via
1.1 41f60102fc29156bc5001d6646f75c02.cloudfront.net (CloudFront)
modernizr.js
blog.malwarebytes.com/wp-content/themes/labs.malwarebytes.org-3.4.1.6/ 		17 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://blog.malwarebytes.com/wp-content/themes/labs.malwarebytes.org-3.4.1.6/modernizr.js
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
3.198.211.130.bc.googleusercontent.com
Software
nginx /
Resource Hash
da819542692b3f1c2a667ba34eff3465a82d9756953a1446ab7d0772f9b1edd5

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 23 Jun 2020 20:40:39 GMT
content-encoding
br
last-modified
Tue, 12 May 2020 20:50:39 GMT
server
nginx
status
200
etag
W/"5ebb0c1f-434b"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
nav-resize.js
www.malwarebytes.com/js/ 		11 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.malwarebytes.com/js/nav-resize.js
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:20eb:5000:8:d3fb:39c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
527f5743db62b7f9d19fb4b1910eb56d63f76f50b0e0180b63eb67d374642099

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 23 Jun 2020 20:40:41 GMT
content-encoding
gzip
last-modified
Thu, 18 Jun 2020 21:11:55 GMT
server
AmazonS3
x-amz-cf-pop
FRA2-C1
vary
Accept-Encoding
x-cache
RefreshHit from cloudfront
content-type
application/javascript
status
200
x-amz-cf-id
BlDm0yx0zc-Mfy53f2RmK3UI-1CoEQ1_ui0ghKoFWUrH1PMxfcnxtg==
via
1.1 41f60102fc29156bc5001d6646f75c02.cloudfront.net (CloudFront)
flexibility.js
www.malwarebytes.com/js/ 		17 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.malwarebytes.com/js/flexibility.js
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:20eb:5000:8:d3fb:39c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
58c13e24cdfb6384c26836e3eac52d17701cd9d686c56ebf93efbbe9426f8cd6

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 23 Jun 2020 20:40:39 GMT
content-encoding
gzip
last-modified
Thu, 18 Jun 2020 21:11:54 GMT
server
AmazonS3
x-amz-cf-pop
FRA2-C1
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
status
200
x-amz-cf-id
zVV7_17kcukyukOLOuBhSvf07Yio9fJDZBM8yJOkJzOUxBOehEe5YA==
via
1.1 41f60102fc29156bc5001d6646f75c02.cloudfront.net (CloudFront)
global.js
www.malwarebytes.com/js/ 		19 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.malwarebytes.com/js/global.js
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:20eb:5000:8:d3fb:39c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
84415c35f6869b6b17590d6ba8f3115751f14d54adecbb27123008c416e4556d

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 23 Jun 2020 20:40:41 GMT
content-encoding
gzip
last-modified
Thu, 18 Jun 2020 21:11:55 GMT
server
AmazonS3
x-amz-cf-pop
FRA2-C1
vary
Accept-Encoding
x-cache
RefreshHit from cloudfront
content-type
application/javascript
status
200
x-amz-cf-id
Wrx2LtzlxS2UfjEicjHZE5Tt3wcXghgXfYx5AUf25wDWPE7SISpPuA==
via
1.1 41f60102fc29156bc5001d6646f75c02.cloudfront.net (CloudFront)
xs.js
www.malwarebytes.com/js/ 		9 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.malwarebytes.com/js/xs.js
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:20eb:5000:8:d3fb:39c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
a182e45f051c3b540f4e10ea2b38b08db2ba43d38ff33686de11b23e56df7a1b

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 23 Jun 2020 20:40:41 GMT
content-encoding
gzip
last-modified
Fri, 29 May 2020 15:17:42 GMT
server
AmazonS3
x-amz-cf-pop
FRA2-C1
vary
Accept-Encoding
x-cache
RefreshHit from cloudfront
content-type
application/javascript
status
200
x-amz-cf-id
EhiYJB5Ai9pDmYFwuY_JExKVCK2f7-77jQiJR3XSQt84JbWYLPvJZg==
via
1.1 41f60102fc29156bc5001d6646f75c02.cloudfront.net (CloudFront)
search.js
blog.malwarebytes.com/wp-content/themes/labs.malwarebytes.org-3.4.1.6/js/ 		1 KB
712 B 		Script
General
Check archive.org
Download Go to
Full URL
https://blog.malwarebytes.com/wp-content/themes/labs.malwarebytes.org-3.4.1.6/js/search.js
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
3.198.211.130.bc.googleusercontent.com
Software
nginx /
Resource Hash
1dc2b8fb26c1a74260a66519a2a5fdf37a938d1b43bbe4d8da7fcd652acc61b9

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 23 Jun 2020 20:40:39 GMT
content-encoding
br
last-modified
Tue, 12 May 2020 20:50:39 GMT
server
nginx
status
200
etag
W/"5ebb0c1f-55e"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
NEW-NAV.css
www.malwarebytes.com/css/ 		22 KB
4 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.malwarebytes.com/css/NEW-NAV.css
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:20eb:5000:8:d3fb:39c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
72622641b79819e5c8b5c0543d105a45e30f13b1a6c0b5c3701e72de5b57e427

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 23 Jun 2020 20:40:39 GMT
content-encoding
gzip
last-modified
Thu, 18 Jun 2020 21:09:57 GMT
server
AmazonS3
x-amz-cf-pop
FRA2-C1
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
text/css
status
200
x-amz-cf-id
oMQzahDWvFpd0JOPzcNlhW_DnU-o_je4JbBCIqRtImzwf61O5-x8kQ==
via
1.1 41f60102fc29156bc5001d6646f75c02.cloudfront.net (CloudFront)
new-nav.js
blog.malwarebytes.com/wp-content/themes/labs.malwarebytes.org-3.4.1.6/js/ 		6 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://blog.malwarebytes.com/wp-content/themes/labs.malwarebytes.org-3.4.1.6/js/new-nav.js
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
3.198.211.130.bc.googleusercontent.com
Software
nginx /
Resource Hash
a2b3f57762f2932505c6fa9b43932cb13856966074febc5bb048052f17100bf6

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 23 Jun 2020 20:40:39 GMT
content-encoding
br
last-modified
Tue, 12 May 2020 20:50:39 GMT
server
nginx
status
200
etag
W/"5ebb0c1f-1703"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
search.svg
blog.malwarebytes.com/wp-content/themes/labs.malwarebytes.org-3.4.1.6/images/ 		296 B
438 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blog.malwarebytes.com/wp-content/themes/labs.malwarebytes.org-3.4.1.6/images/search.svg
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
3.198.211.130.bc.googleusercontent.com
Software
nginx /
Resource Hash
8f796d398e512c5d19a2fecc943d19a204927ff3cf9ec2cb3f75a025535268cd

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 23 Jun 2020 20:40:40 GMT
content-encoding
br
last-modified
Tue, 12 May 2020 20:50:39 GMT
server
nginx
status
200
etag
W/"5ebb0c1f-128"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
public, max-age=31536000
photodune-6506897-online-theft-s-900x506.jpg
blog.malwarebytes.com/wp-content/uploads/2014/05/ 		63 KB
64 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blog.malwarebytes.com/wp-content/uploads/2014/05/photodune-6506897-online-theft-s-900x506.jpg
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
3.198.211.130.bc.googleusercontent.com
Software
nginx /
Resource Hash
23a25280a35e9e4a84b3c894f542b6f848e6c26c657c2edcade33164a3322fee

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 23 Jun 2020 20:40:40 GMT
last-modified
Thu, 26 Jan 2017 03:06:39 GMT
server
nginx
status
200
etag
"588967bf-fde5"
vary
Accept-Encoding
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
64997
malvertising_chain.png
blog.malwarebytes.com/wp-content/uploads/2016/10/ 		244 KB
244 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blog.malwarebytes.com/wp-content/uploads/2016/10/malvertising_chain.png
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
3.198.211.130.bc.googleusercontent.com
Software
nginx /
Resource Hash
d1459acec6ea83b5908eff2f351da55ceedecdea59cee3fdf785d9e15fe1629b

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 23 Jun 2020 20:40:40 GMT
last-modified
Thu, 26 Jan 2017 03:05:36 GMT
server
nginx
status
200
etag
"58896780-3d000"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
249856
wp-emoji-release.min.js
blog.malwarebytes.com/wp-includes/js/ 		14 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://blog.malwarebytes.com/wp-includes/js/wp-emoji-release.min.js?ver=5.4.2
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
3.198.211.130.bc.googleusercontent.com
Software
nginx /
Resource Hash
96d33f532112177ede6bf262dcf6d0140dbe29f05a4595d17b0be4743205b5ea

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 23 Jun 2020 20:40:40 GMT
content-encoding
br
last-modified
Tue, 05 Nov 2019 22:04:02 GMT
server
nginx
status
200
etag
W/"5dc1f1d2-364d"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
installed.png
blog.malwarebytes.com/wp-content/uploads/2016/10/ 		23 KB
24 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blog.malwarebytes.com/wp-content/uploads/2016/10/installed.png
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
3.198.211.130.bc.googleusercontent.com
Software
nginx /
Resource Hash
cb1ab3021b66ae828f0da4d8eb6470e5dad1a004b82b644dd2aeec20d2d28861

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 23 Jun 2020 20:40:40 GMT
last-modified
Thu, 26 Jan 2017 03:05:36 GMT
server
nginx
status
200
etag
"58896780-5ddd"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
24029
client_id.png
blog.malwarebytes.com/wp-content/uploads/2016/10/ 		6 KB
6 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blog.malwarebytes.com/wp-content/uploads/2016/10/client_id.png
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
3.198.211.130.bc.googleusercontent.com
Software
nginx /
Resource Hash
7102ea65a4f1546a7b0227a53cc9058a211ba97d34d563c4f0d7f99b03e79c70

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 23 Jun 2020 20:40:40 GMT
last-modified
Thu, 26 Jan 2017 03:05:35 GMT
server
nginx
status
200
etag
"5889677f-16fb"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
5883
gtag.png
blog.malwarebytes.com/wp-content/uploads/2016/10/ 		4 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blog.malwarebytes.com/wp-content/uploads/2016/10/gtag.png
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
3.198.211.130.bc.googleusercontent.com
Software
nginx /
Resource Hash
a3d902fafe16ae4bed4e1b9054090d7e6e93f5fbc14bffdfc470fad8c536775e

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 23 Jun 2020 20:40:40 GMT
last-modified
Thu, 26 Jan 2017 03:05:36 GMT
server
nginx
status
200
etag
"58896780-106c"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
4204
config_fragment.png
blog.malwarebytes.com/wp-content/uploads/2016/10/ 		13 KB
13 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blog.malwarebytes.com/wp-content/uploads/2016/10/config_fragment.png
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
3.198.211.130.bc.googleusercontent.com
Software
nginx /
Resource Hash
dc568bb8616eed9a8c3c3c94834cfa2260743720fd2af3ffb6edf7fa1e32ebb5

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 23 Jun 2020 20:40:40 GMT
last-modified
Thu, 26 Jan 2017 03:05:35 GMT
server
nginx
status
200
etag
"5889677f-34c9"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
13513
modules_folder.png
blog.malwarebytes.com/wp-content/uploads/2016/10/ 		11 KB
11 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blog.malwarebytes.com/wp-content/uploads/2016/10/modules_folder.png
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
3.198.211.130.bc.googleusercontent.com
Software
nginx /
Resource Hash
36f9c1e2ccdb008580e07af17424a8fe7a6fddeadcfdf9c0fa5ceba8d69f131b

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 23 Jun 2020 20:40:40 GMT
last-modified
Thu, 26 Jan 2017 03:05:36 GMT
server
nginx
status
200
etag
"58896780-2c40"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
11328
modules_configs.png
blog.malwarebytes.com/wp-content/uploads/2016/10/ 		9 KB
9 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blog.malwarebytes.com/wp-content/uploads/2016/10/modules_configs.png
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
3.198.211.130.bc.googleusercontent.com
Software
nginx /
Resource Hash
05ee3e141d98baa40fc2ba5f9962baf10ed5bfa702281ea07e1a8b95a24ff7d0

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 23 Jun 2020 20:40:40 GMT
last-modified
Thu, 26 Jan 2017 03:05:36 GMT
server
nginx
status
200
etag
"58896780-2360"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
9056
svchost_deployes.png
blog.malwarebytes.com/wp-content/uploads/2016/10/ 		9 KB
9 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blog.malwarebytes.com/wp-content/uploads/2016/10/svchost_deployes.png
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
3.198.211.130.bc.googleusercontent.com
Software
nginx /
Resource Hash
a50adbd525500a60b4ac0f23ab7a13471bfb3ef5739892e22c46301879115feb

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 23 Jun 2020 20:40:40 GMT
last-modified
Thu, 26 Jan 2017 03:05:37 GMT
server
nginx
status
200
etag
"58896781-24fd"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
9469
bot_task-1.png
blog.malwarebytes.com/wp-content/uploads/2016/10/ 		14 KB
14 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blog.malwarebytes.com/wp-content/uploads/2016/10/bot_task-1.png
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
3.198.211.130.bc.googleusercontent.com
Software
nginx /
Resource Hash
95cb7d08e289a0501243c287e90223acfd72b6e4adb60a7d34a2c8fb6abc07ab

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 23 Jun 2020 20:40:40 GMT
last-modified
Thu, 26 Jan 2017 03:05:35 GMT
server
nginx
status
200
etag
"5889677f-381c"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
14364
restarted-1.png
blog.malwarebytes.com/wp-content/uploads/2016/10/ 		15 KB
15 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blog.malwarebytes.com/wp-content/uploads/2016/10/restarted-1.png
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
3.198.211.130.bc.googleusercontent.com
Software
nginx /
Resource Hash
8640d0e61015cd2786a76e6317fad368852aa017a9333c187a5053b7a192f758

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 23 Jun 2020 20:40:40 GMT
last-modified
Thu, 26 Jan 2017 03:05:37 GMT
server
nginx
status
200
etag
"58896781-3ce5"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
15589
traffic1.png
blog.malwarebytes.com/wp-content/uploads/2016/10/ 		25 KB
25 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blog.malwarebytes.com/wp-content/uploads/2016/10/traffic1.png
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
3.198.211.130.bc.googleusercontent.com
Software
nginx /
Resource Hash
c2a416d323532adec9aa1ad3a8b35a3bf2e01449fa2bba9a28a7547b8ef8d36e

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 23 Jun 2020 20:40:40 GMT
last-modified
Thu, 26 Jan 2017 03:05:37 GMT
server
nginx
status
200
etag
"58896781-643c"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
25660
net_cmd60.png
blog.malwarebytes.com/wp-content/uploads/2016/10/ 		103 KB
103 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blog.malwarebytes.com/wp-content/uploads/2016/10/net_cmd60.png
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
3.198.211.130.bc.googleusercontent.com
Software
nginx /
Resource Hash
ece8b895d39bc9c6fbcb407610bfca4900ef6e99cee5bac71f2bb5512bd13603

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 23 Jun 2020 20:40:40 GMT
last-modified
Thu, 26 Jan 2017 03:05:37 GMT
server
nginx
status
200
etag
"58896781-19ac5"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
105157
download_exe.png
blog.malwarebytes.com/wp-content/uploads/2016/10/ 		45 KB
45 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blog.malwarebytes.com/wp-content/uploads/2016/10/download_exe.png
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
3.198.211.130.bc.googleusercontent.com
Software
nginx /
Resource Hash
3ded49ec357474ead2928b3fd9523df804b1fea51dd278f988a3ca74a8fc3c95

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 23 Jun 2020 20:40:40 GMT
last-modified
Thu, 26 Jan 2017 03:05:36 GMT
server
nginx
status
200
etag
"58896780-b492"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
46226
router1.png
blog.malwarebytes.com/wp-content/uploads/2016/10/ 		41 KB
41 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blog.malwarebytes.com/wp-content/uploads/2016/10/router1.png
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
3.198.211.130.bc.googleusercontent.com
Software
nginx /
Resource Hash
623f80af82697dd496db7e760a88ca69b855018b8e30182fe382334ad7614b99

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 23 Jun 2020 20:40:40 GMT
last-modified
Thu, 26 Jan 2017 03:05:37 GMT
server
nginx
status
200
etag
"58896781-a3f1"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
41969
cert_unk.png
blog.malwarebytes.com/wp-content/uploads/2016/10/ 		66 KB
67 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blog.malwarebytes.com/wp-content/uploads/2016/10/cert_unk.png
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
3.198.211.130.bc.googleusercontent.com
Software
nginx /
Resource Hash
77ba68609568d437390cbb65544587932427e90e34ca01b3b083147f4a5f66a3

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 23 Jun 2020 20:40:40 GMT
last-modified
Thu, 26 Jan 2017 03:05:36 GMT
server
nginx
status
200
etag
"58896780-108e2"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
67810
schema-1.png
blog.malwarebytes.com/wp-content/uploads/2016/10/ 		16 KB
16 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blog.malwarebytes.com/wp-content/uploads/2016/10/schema-1.png
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
3.198.211.130.bc.googleusercontent.com
Software
nginx /
Resource Hash
08d8022edab174bafc3adecf2515c27de78e9894b30b8cd1f76748577a350cb4

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 23 Jun 2020 20:40:40 GMT
last-modified
Thu, 26 Jan 2017 03:05:37 GMT
server
nginx
status
200
etag
"58896781-3f5b"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
16219
res_names.png
blog.malwarebytes.com/wp-content/uploads/2016/10/ 		4 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blog.malwarebytes.com/wp-content/uploads/2016/10/res_names.png
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
3.198.211.130.bc.googleusercontent.com
Software
nginx /
Resource Hash
32bead89f8c7b43b3b2c3208cc570192e99b1042a151cde913074a71ba44a557

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 23 Jun 2020 20:40:40 GMT
last-modified
Thu, 26 Jan 2017 03:05:37 GMT
server
nginx
status
200
etag
"58896781-104d"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
4173
loader_path.png
blog.malwarebytes.com/wp-content/uploads/2016/10/ 		21 KB
21 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blog.malwarebytes.com/wp-content/uploads/2016/10/loader_path.png
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
3.198.211.130.bc.googleusercontent.com
Software
nginx /
Resource Hash
c21ce2ab751ba8a0d5c983b35899437f95e4a60833b6aa1d13bc15ff038e8764

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 23 Jun 2020 20:40:40 GMT
last-modified
Thu, 26 Jan 2017 03:05:36 GMT
server
nginx
status
200
etag
"58896780-5398"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
21400
decypting_pe.png
blog.malwarebytes.com/wp-content/uploads/2016/10/ 		15 KB
16 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blog.malwarebytes.com/wp-content/uploads/2016/10/decypting_pe.png
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
3.198.211.130.bc.googleusercontent.com
Software
nginx /
Resource Hash
ee296f5bdbfc73c788b0f1e9c8900bc288f08203ce9959ca85faad545d426041

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 23 Jun 2020 20:40:40 GMT
last-modified
Thu, 26 Jan 2017 03:05:36 GMT
server
nginx
status
200
etag
"58896780-3df6"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
15862
map_in_itself.png
blog.malwarebytes.com/wp-content/uploads/2016/10/ 		21 KB
21 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blog.malwarebytes.com/wp-content/uploads/2016/10/map_in_itself.png
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
3.198.211.130.bc.googleusercontent.com
Software
nginx /
Resource Hash
03afa9b19fbd3f3040b89da3c264830752a3d08f6d89225444c3f7307570ba4f

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 23 Jun 2020 20:40:40 GMT
last-modified
Thu, 26 Jan 2017 03:05:36 GMT
server
nginx
status
200
etag
"58896780-54f4"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
21748
call_loaded.png
blog.malwarebytes.com/wp-content/uploads/2016/10/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blog.malwarebytes.com/wp-content/uploads/2016/10/call_loaded.png
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
3.198.211.130.bc.googleusercontent.com
Software
nginx /
Resource Hash
a2e87f86272d2eded76241950ce4fde80728352b3a8b69321a8cf961b0080489

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 23 Jun 2020 20:40:40 GMT
last-modified
Thu, 26 Jan 2017 03:05:35 GMT
server
nginx
status
200
etag
"5889677f-a0b"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
2571
trick_bot_main.png
blog.malwarebytes.com/wp-content/uploads/2016/10/ 		5 KB
5 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blog.malwarebytes.com/wp-content/uploads/2016/10/trick_bot_main.png
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
3.198.211.130.bc.googleusercontent.com
Software
nginx /
Resource Hash
03283b688bd5362e989c6efc0c3f31c21e06391dd8a5df3883ad8f85cb016bbc

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 23 Jun 2020 20:40:40 GMT
last-modified
Thu, 26 Jan 2017 03:05:37 GMT
server
nginx
status
200
etag
"58896781-1393"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
5011
bot_resources.png
blog.malwarebytes.com/wp-content/uploads/2016/10/ 		18 KB
18 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blog.malwarebytes.com/wp-content/uploads/2016/10/bot_resources.png
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
3.198.211.130.bc.googleusercontent.com
Software
nginx /
Resource Hash
4b35d53624a7e2b5195860f5c9695511a277d581e45befad43b02d8913aadef2

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 23 Jun 2020 20:40:40 GMT
last-modified
Thu, 26 Jan 2017 03:05:35 GMT
server
nginx
status
200
etag
"5889677f-4899"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
18585
checking_mutex_trickbot.png
blog.malwarebytes.com/wp-content/uploads/2016/10/ 		10 KB
10 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blog.malwarebytes.com/wp-content/uploads/2016/10/checking_mutex_trickbot.png
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
3.198.211.130.bc.googleusercontent.com
Software
nginx /
Resource Hash
2117cb706513f910b22546f67048c21f21257037d9ab55a885348809f4ca26a1

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 23 Jun 2020 20:40:40 GMT
last-modified
Thu, 26 Jan 2017 03:05:36 GMT
server
nginx
status
200
etag
"58896780-276a"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
10090
deploy_dropped.png
blog.malwarebytes.com/wp-content/uploads/2016/10/ 		10 KB
10 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blog.malwarebytes.com/wp-content/uploads/2016/10/deploy_dropped.png
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
3.198.211.130.bc.googleusercontent.com
Software
nginx /
Resource Hash
964cdc4bf872d0a1efede6b1fd8485d7427e6f867976c90de730a1c262ed260f

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 23 Jun 2020 20:40:40 GMT
last-modified
Thu, 26 Jan 2017 03:05:36 GMT
server
nginx
status
200
etag
"58896780-268d"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
9869
adding_to_taskschd.png
blog.malwarebytes.com/wp-content/uploads/2016/10/ 		8 KB
8 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blog.malwarebytes.com/wp-content/uploads/2016/10/adding_to_taskschd.png
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
3.198.211.130.bc.googleusercontent.com
Software
nginx /
Resource Hash
31c764e147f820cc44d536562bddf519a1ba783998328390507401697e09188b

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 23 Jun 2020 20:40:40 GMT
last-modified
Thu, 26 Jan 2017 03:05:35 GMT
server
nginx
status
200
etag
"5889677f-2038"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
8248
setting_trigger.png
blog.malwarebytes.com/wp-content/uploads/2016/10/ 		9 KB
9 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blog.malwarebytes.com/wp-content/uploads/2016/10/setting_trigger.png
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
3.198.211.130.bc.googleusercontent.com
Software
nginx /
Resource Hash
9bdc657519dc292a54f52b72302d19cb007eb8a091617559a1fac2628eac8c1f

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 23 Jun 2020 20:40:40 GMT
last-modified
Thu, 26 Jan 2017 03:05:37 GMT
server
nginx
status
200
etag
"58896781-2462"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
9314
commands.png
blog.malwarebytes.com/wp-content/uploads/2016/10/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blog.malwarebytes.com/wp-content/uploads/2016/10/commands.png
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
3.198.211.130.bc.googleusercontent.com
Software
nginx /
Resource Hash
f6c0eb9904255cc5ab53dd2c0b8207caff3ce91bb212f36ff8d84514a1f9ed8e

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 23 Jun 2020 20:40:40 GMT
last-modified
Thu, 26 Jan 2017 03:05:36 GMT
server
nginx
status
200
etag
"58896780-a6a"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
2666
dyre_commands.png
blog.malwarebytes.com/wp-content/uploads/2016/10/ 		4 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blog.malwarebytes.com/wp-content/uploads/2016/10/dyre_commands.png
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
3.198.211.130.bc.googleusercontent.com
Software
nginx /
Resource Hash
e9b576dd8344739f0371e137b8d6ca523ada54634d19e9c3826a432c9845df38

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 23 Jun 2020 20:40:40 GMT
last-modified
Thu, 26 Jan 2017 03:05:36 GMT
server
nginx
status
200
etag
"58896780-1007"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
4103
command_14.png
blog.malwarebytes.com/wp-content/uploads/2016/10/ 		4 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blog.malwarebytes.com/wp-content/uploads/2016/10/command_14.png
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
3.198.211.130.bc.googleusercontent.com
Software
nginx /
Resource Hash
c2e823886bd708e2443ba3dd64630cd064e15e2eaa7580c03fea9fdd5cd2838d

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 23 Jun 2020 20:40:40 GMT
last-modified
Thu, 26 Jan 2017 03:05:35 GMT
server
nginx
status
200
etag
"5889677f-eb2"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
3762
check_resp.png
blog.malwarebytes.com/wp-content/uploads/2016/10/ 		17 KB
17 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blog.malwarebytes.com/wp-content/uploads/2016/10/check_resp.png
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
3.198.211.130.bc.googleusercontent.com
Software
nginx /
Resource Hash
bde19b29400b82f718bd8499b76d048496c30ad0959412749c36d36dec875ad1

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 23 Jun 2020 20:40:40 GMT
last-modified
Thu, 26 Jan 2017 03:05:35 GMT
server
nginx
status
200
etag
"5889677f-42e2"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
17122
decrypt_chain.png
blog.malwarebytes.com/wp-content/uploads/2016/10/ 		70 KB
71 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blog.malwarebytes.com/wp-content/uploads/2016/10/decrypt_chain.png
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
3.198.211.130.bc.googleusercontent.com
Software
nginx /
Resource Hash
0ce295b662f2bc24b7bb2bb7bf86b4653d63f89424b7de82ded4090b0c7d52f6

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 23 Jun 2020 20:40:40 GMT
last-modified
Thu, 26 Jan 2017 03:05:36 GMT
server
nginx
status
200
etag
"58896780-1196a"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
72042
hashing_rounds-600x481.png
blog.malwarebytes.com/wp-content/uploads/2016/10/ 		117 KB
117 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blog.malwarebytes.com/wp-content/uploads/2016/10/hashing_rounds-600x481.png
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
3.198.211.130.bc.googleusercontent.com
Software
nginx /
Resource Hash
99565415652f9f00b619d24f960c902563e1003ab9ae1d36c3cb057d8b657f61

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 23 Jun 2020 20:40:40 GMT
last-modified
Thu, 26 Jan 2017 03:05:36 GMT
server
nginx
status
200
etag
"58896780-1d3b7"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
119735
hash_first_chunk.png
blog.malwarebytes.com/wp-content/uploads/2016/10/ 		9 KB
9 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blog.malwarebytes.com/wp-content/uploads/2016/10/hash_first_chunk.png
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
3.198.211.130.bc.googleusercontent.com
Software
nginx /
Resource Hash
7357caa8cc46347f866ef2e577458981a95dbe61dd8818ac68d16c2bf824c887

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 23 Jun 2020 20:40:40 GMT
last-modified
Thu, 26 Jan 2017 03:05:36 GMT
server
nginx
status
200
etag
"58896780-24d0"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
9424
iv_chunk1.png
blog.malwarebytes.com/wp-content/uploads/2016/10/ 		7 KB
7 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blog.malwarebytes.com/wp-content/uploads/2016/10/iv_chunk1.png
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
3.198.211.130.bc.googleusercontent.com
Software
nginx /
Resource Hash
1935d3f09e51b4e24027a7368ea9ecdaaab2b88f002f177647c2af81926263b7

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 23 Jun 2020 20:40:40 GMT
last-modified
Thu, 26 Jan 2017 03:05:36 GMT
server
nginx
status
200
etag
"58896780-1add"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
6877
iv_chunk_dump.png
blog.malwarebytes.com/wp-content/uploads/2016/10/ 		16 KB
17 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blog.malwarebytes.com/wp-content/uploads/2016/10/iv_chunk_dump.png
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
3.198.211.130.bc.googleusercontent.com
Software
nginx /
Resource Hash
6a632fa951c4c290e7ff6c4890ab780cd804e2d29144181dbc79eae308aa8248

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 23 Jun 2020 20:40:40 GMT
last-modified
Thu, 26 Jan 2017 03:05:36 GMT
server
nginx
status
200
etag
"58896780-412b"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
16683
decrypr_stored_config.png
blog.malwarebytes.com/wp-content/uploads/2016/10/ 		24 KB
24 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blog.malwarebytes.com/wp-content/uploads/2016/10/decrypr_stored_config.png
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
3.198.211.130.bc.googleusercontent.com
Software
nginx /
Resource Hash
bf9c8e4fb4633bc4ac3c201cc118c1501d7a688813ad0e229f098476b0f82824

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 23 Jun 2020 20:40:40 GMT
last-modified
Thu, 26 Jan 2017 03:05:36 GMT
server
nginx
status
200
etag
"58896780-5f03"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
24323
ecc_decrypt.png
blog.malwarebytes.com/wp-content/uploads/2016/10/ 		81 KB
81 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blog.malwarebytes.com/wp-content/uploads/2016/10/ecc_decrypt.png
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
3.198.211.130.bc.googleusercontent.com
Software
nginx /
Resource Hash
5b3d9b7563aa18f4c7ac58b6339e90e8cff1b87dca873edc15e43903deb7ed73

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 23 Jun 2020 20:40:40 GMT
last-modified
Thu, 26 Jan 2017 03:05:36 GMT
server
nginx
status
200
etag
"58896780-14303"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
82691
attecked_browsers.png
blog.malwarebytes.com/wp-content/uploads/2016/10/ 		14 KB
15 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blog.malwarebytes.com/wp-content/uploads/2016/10/attecked_browsers.png
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
3.198.211.130.bc.googleusercontent.com
Software
nginx /
Resource Hash
40112a548d4b086ce9cda90604f60ebeaa85db367107e727edf8eafecae04106

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 23 Jun 2020 20:40:40 GMT
last-modified
Thu, 26 Jan 2017 03:05:35 GMT
server
nginx
status
200
etag
"5889677f-3966"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
14694
enc_svchost_inject_sinj.png
blog.malwarebytes.com/wp-content/uploads/2016/10/ 		29 KB
29 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blog.malwarebytes.com/wp-content/uploads/2016/10/enc_svchost_inject_sinj.png
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
3.198.211.130.bc.googleusercontent.com
Software
nginx /
Resource Hash
0ed990c104caa18e9fb262ce1c52ce81e03a7479cbb68dcf0a3d5760c1864acc

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 23 Jun 2020 20:40:40 GMT
last-modified
Thu, 26 Jan 2017 03:05:36 GMT
server
nginx
status
200
etag
"58896780-72fc"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
29436
inected_in_svchost1.png
blog.malwarebytes.com/wp-content/uploads/2016/10/ 		24 KB
24 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blog.malwarebytes.com/wp-content/uploads/2016/10/inected_in_svchost1.png
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
3.198.211.130.bc.googleusercontent.com
Software
nginx /
Resource Hash
eef6488d5a9ff6366ce09960198bf3b2d23df800b0b4f250a6ca87d3c786a304

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 23 Jun 2020 20:40:40 GMT
last-modified
Thu, 26 Jan 2017 03:05:36 GMT
server
nginx
status
200
etag
"58896780-6013"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
24595
shutterstock_248842327-604x270.jpg
blog.malwarebytes.com/wp-content/uploads/2017/11/ 		28 KB
28 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blog.malwarebytes.com/wp-content/uploads/2017/11/shutterstock_248842327-604x270.jpg
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
3.198.211.130.bc.googleusercontent.com
Software
nginx /
Resource Hash
e1cb886dfcdd5fe6412e646b3e1ce78d59c847844dc51c13597e549e6ea8ea4d

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 23 Jun 2020 20:40:40 GMT
last-modified
Tue, 21 Nov 2017 11:28:35 GMT
server
nginx
status
200
etag
"5a140de3-6e5f"
vary
Accept-Encoding
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
28255
security-threat-category-hacked-unpaced-604x270.jpg
blog.malwarebytes.com/wp-content/uploads/2013/11/ 		78 KB
79 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blog.malwarebytes.com/wp-content/uploads/2013/11/security-threat-category-hacked-unpaced-604x270.jpg
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
3.198.211.130.bc.googleusercontent.com
Software
nginx /
Resource Hash
0a98a1800f0819cbb062ff6b62c8bd3ffe1d5e3789bc9c4563ba15f706b04832

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 23 Jun 2020 20:40:40 GMT
last-modified
Thu, 26 Jan 2017 03:06:51 GMT
server
nginx
status
200
etag
"588967cb-13960"
vary
Accept-Encoding
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
80224
photodune-2679907-http-s-604x270.jpg
blog.malwarebytes.com/wp-content/uploads/2015/05/ 		65 KB
66 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blog.malwarebytes.com/wp-content/uploads/2015/05/photodune-2679907-http-s-604x270.jpg
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
3.198.211.130.bc.googleusercontent.com
Software
nginx /
Resource Hash
4823fc995bed6c3bbd18a1d9c4184b9cfd7832a277729c501331815aef6dfd02

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 23 Jun 2020 20:40:40 GMT
last-modified
Thu, 26 Jan 2017 03:06:19 GMT
server
nginx
status
200
etag
"588967ab-10554"
vary
Accept-Encoding
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
66900
photodune-5114174-internet-security-s-604x270.jpg
blog.malwarebytes.com/wp-content/uploads/2015/08/ 		84 KB
85 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blog.malwarebytes.com/wp-content/uploads/2015/08/photodune-5114174-internet-security-s-604x270.jpg
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
3.198.211.130.bc.googleusercontent.com
Software
nginx /
Resource Hash
ee990b34a0d12a9e15b74e02a2d90385e9c5ccb3fd45b4f40de9e7cbd44f0357

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 23 Jun 2020 20:40:40 GMT
last-modified
Thu, 26 Jan 2017 03:06:11 GMT
server
nginx
status
200
etag
"588967a3-151d3"
vary
Accept-Encoding
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
86483
08d5edde926eb9c13cb36804ee5e5316
secure.gravatar.com/avatar/ 		2 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://secure.gravatar.com/avatar/08d5edde926eb9c13cb36804ee5e5316?s=96&d=identicon&r=g
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
13253fa3b3061ad717460274d9aaa0d2bb6ce497349cf44cdc83199e12278a69

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc
HIT fra 2
date
Tue, 23 Jun 2020 20:40:40 GMT
last-modified
Tue, 14 Jun 2016 22:00:20 GMT
server
nginx
status
200
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=300
content-disposition
inline; filename="08d5edde926eb9c13cb36804ee5e5316.png"
accept-ranges
bytes
link
<https://www.gravatar.com/avatar/08d5edde926eb9c13cb36804ee5e5316?s=96&d=identicon&r=g>; rel="canonical"
content-length
2522
expires
Tue, 23 Jun 2020 20:45:40 GMT
labs-nav.js
blog.malwarebytes.com/wp-content/themes/labs.malwarebytes.org-3.4.1.6/js/ 		493 B
413 B 		Script
General
Check archive.org
Download Go to
Full URL
https://blog.malwarebytes.com/wp-content/themes/labs.malwarebytes.org-3.4.1.6/js/labs-nav.js
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
3.198.211.130.bc.googleusercontent.com
Software
nginx /
Resource Hash
19333622f176d68bc17e307d8df96b15447864fbb0bbaac495e507fa64d96077

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 23 Jun 2020 20:40:40 GMT
content-encoding
br
last-modified
Tue, 12 May 2020 20:50:39 GMT
server
nginx
status
200
etag
W/"5ebb0c1f-1ed"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
contributors.svg
blog.malwarebytes.com/wp-content/themes/labs.malwarebytes.org-3.4.1.6/images/footer/ 		910 B
743 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blog.malwarebytes.com/wp-content/themes/labs.malwarebytes.org-3.4.1.6/images/footer/contributors.svg
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
3.198.211.130.bc.googleusercontent.com
Software
nginx /
Resource Hash
6429fe0ed81fca5f6bb18cb0a0aacae3bd9de79192635aeed4cbda438139d75d

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 23 Jun 2020 20:40:40 GMT
content-encoding
br
last-modified
Tue, 12 May 2020 20:50:39 GMT
server
nginx
status
200
etag
W/"5ebb0c1f-38e"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
public, max-age=31536000
threat-center.svg
blog.malwarebytes.com/wp-content/themes/labs.malwarebytes.org-3.4.1.6/images/footer/ 		2 KB
852 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blog.malwarebytes.com/wp-content/themes/labs.malwarebytes.org-3.4.1.6/images/footer/threat-center.svg
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
3.198.211.130.bc.googleusercontent.com
Software
nginx /
Resource Hash
32d4b293bb7f25a21cc44e81184d4bbcb3bdd1837e026b98ed0ad85b3b1a5292

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 23 Jun 2020 20:40:40 GMT
content-encoding
br
last-modified
Tue, 12 May 2020 20:50:39 GMT
server
nginx
status
200
etag
W/"5ebb0c1f-812"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
public, max-age=31536000
glossary.svg
blog.malwarebytes.com/wp-content/themes/labs.malwarebytes.org-3.4.1.6/images/footer/ 		760 B
654 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blog.malwarebytes.com/wp-content/themes/labs.malwarebytes.org-3.4.1.6/images/footer/glossary.svg
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
3.198.211.130.bc.googleusercontent.com
Software
nginx /
Resource Hash
b4e6efb587f3fdfb8155148201d0c51ac95d249a6727e8256acdfe624ade69af

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 23 Jun 2020 20:40:40 GMT
content-encoding
br
last-modified
Tue, 12 May 2020 20:50:39 GMT
server
nginx
status
200
etag
W/"5ebb0c1f-2f8"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
public, max-age=31536000
scams.svg
blog.malwarebytes.com/wp-content/themes/labs.malwarebytes.org-3.4.1.6/images/footer/ 		842 B
698 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blog.malwarebytes.com/wp-content/themes/labs.malwarebytes.org-3.4.1.6/images/footer/scams.svg
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
3.198.211.130.bc.googleusercontent.com
Software
nginx /
Resource Hash
05a173cb58022e81eb499529ac56df6ad7bafe1c61b8128dca8b76f300b5b60e

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 23 Jun 2020 20:40:40 GMT
content-encoding
br
last-modified
Tue, 12 May 2020 20:50:39 GMT
server
nginx
status
200
etag
W/"5ebb0c1f-34a"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
public, max-age=31536000
write.svg
blog.malwarebytes.com/wp-content/themes/labs.malwarebytes.org-3.4.1.6/images/footer/ 		615 B
585 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blog.malwarebytes.com/wp-content/themes/labs.malwarebytes.org-3.4.1.6/images/footer/write.svg
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
3.198.211.130.bc.googleusercontent.com
Software
nginx /
Resource Hash
a6a97c4046257c7e4e063c9f76434c7ce2c1f105e46b07424fabfc054f2d4d24

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 23 Jun 2020 20:40:40 GMT
content-encoding
br
last-modified
Tue, 12 May 2020 20:50:39 GMT
server
nginx
status
200
etag
W/"5ebb0c1f-267"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
public, max-age=31536000
jetpack-carousel.css
blog.malwarebytes.com/wp-content/plugins/jetpack/modules/carousel/ 		25 KB
5 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://blog.malwarebytes.com/wp-content/plugins/jetpack/modules/carousel/jetpack-carousel.css?ver=20120629
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
3.198.211.130.bc.googleusercontent.com
Software
nginx /
Resource Hash
886f70c3e30343eb48a987ba13f995c122f17d8cd5b90094369cbe42924c3e91

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 23 Jun 2020 20:40:40 GMT
content-encoding
br
last-modified
Wed, 28 Feb 2018 21:17:32 GMT
server
nginx
status
200
etag
W/"5a971c6c-6483"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
comment_count.js
blog.malwarebytes.com/wp-content/plugins/disqus-comment-system/public/js/ 		889 B
620 B 		Script
General
Check archive.org
Download Go to
Full URL
https://blog.malwarebytes.com/wp-content/plugins/disqus-comment-system/public/js/comment_count.js?ver=3.0.12
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
3.198.211.130.bc.googleusercontent.com
Software
nginx /
Resource Hash
cea0a05c5af6e21a409875328ed2e3dba79131b7c41f8ea07d0e0e02c7b7b59e

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 23 Jun 2020 20:40:40 GMT
content-encoding
br
last-modified
Wed, 28 Feb 2018 21:17:30 GMT
server
nginx
status
200
etag
W/"5a971c6a-379"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
comment_embed.js
blog.malwarebytes.com/wp-content/plugins/disqus-comment-system/public/js/ 		1 KB
686 B 		Script
General
Check archive.org
Download Go to
Full URL
https://blog.malwarebytes.com/wp-content/plugins/disqus-comment-system/public/js/comment_embed.js?ver=3.0.12
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
3.198.211.130.bc.googleusercontent.com
Software
nginx /
Resource Hash
f055e217bde76d711bd8b42af773f9f99b8a29d81ad9ed10b6379cc7e6c60452

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 23 Jun 2020 20:40:40 GMT
content-encoding
br
last-modified
Wed, 28 Feb 2018 21:17:30 GMT
server
nginx
status
200
etag
W/"5a971c6a-47e"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
devicepx-jetpack.js
s0.wp.com/wp-content/js/ 		10 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s0.wp.com/wp-content/js/devicepx-jetpack.js?ver=202026
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
f32d41f2099a0be20e6b57c5e0d1b71c079d3e1345827b0f5c5b97c6e5e3f78d

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc
HIT fra 2
date
Tue, 23 Jun 2020 20:40:40 GMT
content-encoding
gzip
server
nginx
etag
W/"5867460b-52b6"
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
max-age=31536000
x-ac
4.fra _dfw
expires
Mon, 21 Jun 2021 13:21:18 GMT
functions.js
blog.malwarebytes.com/wp-content/themes/labs.malwarebytes.org-3.4.1.6/js/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://blog.malwarebytes.com/wp-content/themes/labs.malwarebytes.org-3.4.1.6/js/functions.js?ver=2013-07-18
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
3.198.211.130.bc.googleusercontent.com
Software
nginx /
Resource Hash
9fcb181721162ce0d395b7b9b1e5bb5ca82c5f79bde749d4d0467ec2e65fcb4a

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 23 Jun 2020 20:40:40 GMT
content-encoding
br
last-modified
Tue, 12 May 2020 20:50:39 GMT
server
nginx
status
200
etag
W/"5ebb0c1f-8f9"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
wp-embed.min.js
blog.malwarebytes.com/wp-includes/js/ 		1 KB
951 B 		Script
General
Check archive.org
Download Go to
Full URL
https://blog.malwarebytes.com/wp-includes/js/wp-embed.min.js?ver=5.4.2
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
3.198.211.130.bc.googleusercontent.com
Software
nginx /
Resource Hash
6ebcda7a3a41ef97f0b4071160ceb1020e540fdc0f790079a5c2ef01ab654fe0

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 23 Jun 2020 20:40:40 GMT
content-encoding
br
last-modified
Sat, 26 Oct 2019 00:17:07 GMT
server
nginx
status
200
etag
W/"5db39083-59a"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
gist.min.js
blog.malwarebytes.com/wp-content/plugins/jetpack/_inc/build/shortcodes/js/ 		442 B
527 B 		Script
General
Check archive.org
Download Go to
Full URL
https://blog.malwarebytes.com/wp-content/plugins/jetpack/_inc/build/shortcodes/js/gist.min.js?ver=5.4.2
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
3.198.211.130.bc.googleusercontent.com
Software
nginx /
Resource Hash
42044d2f67a563820783809582b367cf2195586acffb544fbc01d9c58787d435

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 23 Jun 2020 20:40:40 GMT
content-encoding
br
last-modified
Wed, 28 Feb 2018 21:17:31 GMT
server
nginx
status
200
etag
W/"5a971c6b-1ba"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
spin.min.js
blog.malwarebytes.com/wp-content/plugins/jetpack/_inc/build/ 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://blog.malwarebytes.com/wp-content/plugins/jetpack/_inc/build/spin.min.js?ver=1.3
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
3.198.211.130.bc.googleusercontent.com
Software
nginx /
Resource Hash
36e3052355fd8aa03431efa1940b95f1424f6ff56a06d660a1add952c9339861

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 23 Jun 2020 20:40:40 GMT
content-encoding
br
last-modified
Wed, 28 Feb 2018 21:17:31 GMT
server
nginx
status
200
etag
W/"5a971c6b-11aa"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
jquery.spin.min.js
blog.malwarebytes.com/wp-content/plugins/jetpack/_inc/build/ 		2 KB
916 B 		Script
General
Check archive.org
Download Go to
Full URL
https://blog.malwarebytes.com/wp-content/plugins/jetpack/_inc/build/jquery.spin.min.js?ver=1.3
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
3.198.211.130.bc.googleusercontent.com
Software
nginx /
Resource Hash
b10a8b01476da3fc060041be45e92a42f65c24115f1c64eff444735de47f2a54

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 23 Jun 2020 20:40:40 GMT
content-encoding
br
last-modified
Wed, 28 Feb 2018 21:17:31 GMT
server
nginx
status
200
etag
W/"5a971c6b-70e"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
jetpack-carousel.min.js
blog.malwarebytes.com/wp-content/plugins/jetpack/_inc/build/carousel/ 		27 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://blog.malwarebytes.com/wp-content/plugins/jetpack/_inc/build/carousel/jetpack-carousel.min.js?ver=20170209
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
3.198.211.130.bc.googleusercontent.com
Software
nginx /
Resource Hash
df73bd6bed3e91e18f6100fbfbf4324ec49aadfc49681facb35d700f0f5bb893

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 23 Jun 2020 20:40:40 GMT
content-encoding
br
last-modified
Wed, 28 Feb 2018 21:17:31 GMT
server
nginx
status
200
etag
W/"5a971c6b-6da9"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
standard-search-results-footer.js
blog.malwarebytes.com/wp-content/themes/labs.malwarebytes.org-3.4.1.6/js/ 		2 KB
772 B 		Script
General
Check archive.org
Download Go to
Full URL
https://blog.malwarebytes.com/wp-content/themes/labs.malwarebytes.org-3.4.1.6/js/standard-search-results-footer.js
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
3.198.211.130.bc.googleusercontent.com
Software
nginx /
Resource Hash
1532b16aa9cd1fef51c097aaf1abeac6cb6f239b026660e7105e49f4ae6549ff

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 23 Jun 2020 20:40:40 GMT
content-encoding
br
last-modified
Tue, 12 May 2020 20:50:39 GMT
server
nginx
status
200
etag
W/"5ebb0c1f-704"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
optanon.css
optanon.blob.core.windows.net/skins/5.12.0/default_flat_bottom_two_button_white/v2/css/ 		23 KB
6 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://optanon.blob.core.windows.net/skins/5.12.0/default_flat_bottom_two_button_white/v2/css/optanon.css
Requested by
Host: optanon.blob.core.windows.net
URL: https://optanon.blob.core.windows.net/consent/9530a107-0af8-4204-a2c2-217efb78222b.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.239.137.4 Dublin, Ireland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
8c20518cd7e51066b82e8a8a1e8035210741cf808c02268915747960f531061c

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-ms-lease-status
unlocked
x-ms-blob-type
BlockBlob
Date
Tue, 23 Jun 2020 20:40:39 GMT
Content-Encoding
gzip
Last-Modified
Fri, 21 Feb 2020 20:12:28 GMT
Server
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
Content-MD5
Z4rsumi9rT/2HntFCbwLpA==
ETag
0x8D7B70A5FCD741F
Content-Type
text/css
Access-Control-Allow-Origin
*
x-ms-request-id
cac7c181-001e-011d-119e-494759000000
Access-Control-Expose-Headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
x-ms-version
2009-09-19
Content-Length
5561
Locator-Light.woff
blog.malwarebytes.com/wp-content/themes/labs.malwarebytes.org-3.4.1.6/css/fonts/ 		29 KB
29 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://blog.malwarebytes.com/wp-content/themes/labs.malwarebytes.org-3.4.1.6/css/fonts/Locator-Light.woff
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/wp-content/themes/labs.malwarebytes.org-3.4.1.6/modernizr.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
3.198.211.130.bc.googleusercontent.com
Software
nginx /
Resource Hash
ed2491fc7526ff0b5cfec3fe6f4cf8153796520fc845b735286b0f42183da98a

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://blog.malwarebytes.com/wp-content/themes/labs.malwarebytes.org-3.4.1.6/style.css?ver=2013-07-18
Origin
https://blog.malwarebytes.com

Response headers

date
Tue, 23 Jun 2020 20:40:40 GMT
last-modified
Tue, 12 May 2020 20:50:39 GMT
server
nginx
status
200
etag
"5ebb0c1f-7330"
vary
Accept-Encoding
content-type
font/woff
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
29488
gtm.js
www.googletagmanager.com/ 		185 KB
46 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-MKSKW3
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:802::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
891a15df4ca8bfbd1ed08a7af08e5677fbf0b82c6163eb3f19f0506721f791de
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 23 Jun 2020 20:40:40 GMT
content-encoding
br
vary
Accept-Encoding
status
200
alt-svc
h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
46562
x-xss-protection
0
last-modified
Tue, 23 Jun 2020 19:18:10 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Tue, 23 Jun 2020 20:40:40 GMT
Locator-Medium.woff
blog.malwarebytes.com/wp-content/themes/labs.malwarebytes.org-3.4.1.6/css/fonts/ 		29 KB
29 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://blog.malwarebytes.com/wp-content/themes/labs.malwarebytes.org-3.4.1.6/css/fonts/Locator-Medium.woff
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
3.198.211.130.bc.googleusercontent.com
Software
nginx /
Resource Hash
a52bbdb7b132e850fdaf5740012fcc0bc3f6ef0be520bc4b987d8761d40d015a

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://blog.malwarebytes.com/wp-content/themes/labs.malwarebytes.org-3.4.1.6/style.css?ver=2013-07-18
Origin
https://blog.malwarebytes.com

Response headers

date
Tue, 23 Jun 2020 20:40:40 GMT
last-modified
Tue, 12 May 2020 20:50:39 GMT
server
nginx
status
200
etag
"5ebb0c1f-734c"
vary
Accept-Encoding
content-type
font/woff
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
29516
socicon.woff
blog.malwarebytes.com/wp-content/themes/labs.malwarebytes.org-3.4.1.6/css/fonts/ 		20 KB
20 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://blog.malwarebytes.com/wp-content/themes/labs.malwarebytes.org-3.4.1.6/css/fonts/socicon.woff
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
3.198.211.130.bc.googleusercontent.com
Software
nginx /
Resource Hash
0ed37960a59a6ec6b443f9ef043864d09a51db6fd276ae578d9166467bf986d1

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://blog.malwarebytes.com/wp-content/themes/labs.malwarebytes.org-3.4.1.6/style.css?ver=2013-07-18
Origin
https://blog.malwarebytes.com

Response headers

date
Tue, 23 Jun 2020 20:40:40 GMT
last-modified
Tue, 12 May 2020 20:50:39 GMT
server
nginx
status
200
etag
"5ebb0c1f-4ff8"
vary
Accept-Encoding
content-type
font/woff
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
20472
num-comments.svg
blog.malwarebytes.com/wp-content/themes/labs.malwarebytes.org-3.4.1.6/images/ 		1 KB
810 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blog.malwarebytes.com/wp-content/themes/labs.malwarebytes.org-3.4.1.6/images/num-comments.svg
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
3.198.211.130.bc.googleusercontent.com
Software
nginx /
Resource Hash
da1c1ad273854673c3a3f7e8f76aae5d7c9c73f3ebd224c2be1f93106680b1d4

Request headers

Referer
https://blog.malwarebytes.com/wp-content/themes/labs.malwarebytes.org-3.4.1.6/style.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 23 Jun 2020 20:40:40 GMT
content-encoding
br
last-modified
Tue, 12 May 2020 20:50:39 GMT
server
nginx
status
200
etag
W/"5ebb0c1f-4d3"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
public, max-age=31536000
Locator-LightItalic.woff
blog.malwarebytes.com/wp-content/themes/labs.malwarebytes.org-3.4.1.6/css/fonts/ 		30 KB
30 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://blog.malwarebytes.com/wp-content/themes/labs.malwarebytes.org-3.4.1.6/css/fonts/Locator-LightItalic.woff
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
3.198.211.130.bc.googleusercontent.com
Software
nginx /
Resource Hash
ad2cc26b0fdde8f4eb637ed12b25364e85af0bfba227dad42cb997ff4ad23eeb

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://blog.malwarebytes.com/wp-content/themes/labs.malwarebytes.org-3.4.1.6/style.css?ver=2013-07-18
Origin
https://blog.malwarebytes.com

Response headers

date
Tue, 23 Jun 2020 20:40:40 GMT
last-modified
Tue, 12 May 2020 20:50:39 GMT
server
nginx
status
200
etag
"5ebb0c1f-7888"
vary
Accept-Encoding
content-type
font/woff
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
30856
analytics.js
www.google-analytics.com/ 		45 KB
18 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:817::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
fd361b57998c76f86335afa28b8a62527d88a8200fb5c428d6f0fff73383e955
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 04 Jun 2020 23:38:14 GMT
server
Golfe2
age
62
date
Tue, 23 Jun 2020 20:39:38 GMT
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=7200
alt-svc
h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
18469
expires
Tue, 23 Jun 2020 22:39:38 GMT
activityi;dc_pre=CJfb9_rlmOoCFfnBuwgdyA8CXQ;src=9812475;type=conve0;cat=forms000;ord=1;num=2821492876249;gtm=2wg6a0;auiddc=1321793998.1592944840;~oref=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-a...
9812475.fls.doubleclick.net/ Frame D339
Redirect Chain
  • https://9812475.fls.doubleclick.net/activityi;src=9812475;type=conve0;cat=forms000;ord=1;num=2821492876249;gtm=2wg6a0;auiddc=1321793998.1592944840;~oref=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat...
  • https://9812475.fls.doubleclick.net/activityi;dc_pre=CJfb9_rlmOoCFfnBuwgdyA8CXQ;src=9812475;type=conve0;cat=forms000;ord=1;num=2821492876249;gtm=2wg6a0;auiddc=1321793998.1592944840;~oref=https%3A%2...
0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://9812475.fls.doubleclick.net/activityi;dc_pre=CJfb9_rlmOoCFfnBuwgdyA8CXQ;src=9812475;type=conve0;cat=forms000;ord=1;num=2821492876249;gtm=2wg6a0;auiddc=1321793998.1592944840;~oref=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-analysis%2F2016%2F10%2Ftrick-bot-dyrezas-successor%2F?
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MKSKW3
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.18.6 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra15s28-in-f6.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=21600
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
9812475.fls.doubleclick.net
:scheme
https
:path
/activityi;dc_pre=CJfb9_rlmOoCFfnBuwgdyA8CXQ;src=9812475;type=conve0;cat=forms000;ord=1;num=2821492876249;gtm=2wg6a0;auiddc=1321793998.1592944840;~oref=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-analysis%2F2016%2F10%2Ftrick-bot-dyrezas-successor%2F?
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
about:blank

Response headers

status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
date
Tue, 23 Jun 2020 20:40:40 GMT
expires
Fri, 01 Jan 1990 00:00:00 GMT
cache-control
no-cache, must-revalidate
strict-transport-security
max-age=21600
content-type
text/html; charset=UTF-8
pragma
no-cache
x-content-type-options
nosniff
content-encoding
gzip
server
cafe
content-length
431
x-xss-protection
0
set-cookie
test_cookie=CheckForPermission; expires=Tue, 23-Jun-2020 20:55:40 GMT; path=/; domain=.doubleclick.net; Secure; SameSite=none
alt-svc
h3-28=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

Redirect headers

status
302
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
date
Tue, 23 Jun 2020 20:40:40 GMT
pragma
no-cache
expires
Fri, 01 Jan 1990 00:00:00 GMT
cache-control
no-cache, must-revalidate
follow-only-when-prerender-shown
1
strict-transport-security
max-age=21600
location
https://9812475.fls.doubleclick.net/activityi;dc_pre=CJfb9_rlmOoCFfnBuwgdyA8CXQ;src=9812475;type=conve0;cat=forms000;ord=1;num=2821492876249;gtm=2wg6a0;auiddc=1321793998.1592944840;~oref=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-analysis%2F2016%2F10%2Ftrick-bot-dyrezas-successor%2F?
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
server
cafe
content-length
0
x-xss-protection
0
alt-svc
h3-28=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
bat.js
bat.bing.com/ 		25 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://bat.bing.com/bat.js
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
b6f7b31210a709daca9760b215660b2cbe719757df3059364beeda005fca2dbe

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 23 Jun 2020 20:40:40 GMT
content-encoding
gzip
last-modified
Wed, 10 Jun 2020 19:59:59 GMT
x-msedge-ref
Ref A: FCC5E37834954C889CE1CF9EF1EFDB50 Ref B: FRAEDGE1216 Ref C: 2020-06-23T20:40:40Z
status
200
etag
"804946b8613fd61:0"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
private,max-age=1800
accept-ranges
bytes
content-length
7791
uwt.js
static.ads-twitter.com/ 		5 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.ads-twitter.com/uwt.js
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.112.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
319949c8c08b86e9c35ea542c0dc0c30cedaa9b8d3d3c3327a36c91aefbd8af5

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 23 Jun 2020 20:40:40 GMT
content-encoding
gzip
age
83336
x-cache
HIT
p3p
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status
200
content-length
1954
x-served-by
cache-hhn4056-HHN
last-modified
Tue, 23 Jan 2018 20:09:00 GMT
x-timer
S1592944841.524146,VS0,VE0
etag
"b7b33882a4f3ffd5cbf07434f3137166+gzip"
vary
Accept-Encoding,Host
content-type
application/javascript; charset=utf-8
via
1.1 varnish
cache-control
no-cache
accept-ranges
bytes
js
www.googletagmanager.com/gtag/ 		83 KB
33 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=AW-930356311
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MKSKW3
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:802::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
1227293c9bd829507a1fadf6256dbc90e57f4b5d17fb5c3b33404c2dbfc76ef2
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 23 Jun 2020 20:40:40 GMT
content-encoding
br
vary
Accept-Encoding
status
200
alt-svc
h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
33248
x-xss-protection
0
last-modified
Tue, 23 Jun 2020 19:18:10 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Tue, 23 Jun 2020 20:40:40 GMT
2893.js
script.crazyegg.com/pages/scripts/0081/ 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://script.crazyegg.com/pages/scripts/0081/2893.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MKSKW3
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:9408 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
22b99779db19469478b0d70ca7d04e43e0b06aedcdaea1ecdec8888b628b7f18

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 23 Jun 2020 20:40:40 GMT
content-encoding
gzip
cf-cache-status
HIT
age
110813
cf-polished
origSize=4096
status
200
cf-request-id
0384826701000097166a934200000001
last-modified
Mon, 22 Jun 2020 13:53:47 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/javascript
access-control-allow-origin
*
cache-control
max-age=300
cf-ray
5a810684cb499716-FRA
cf-bgj
minify
up_loader.1.1.0.js
js.adsrvr.org/ 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://js.adsrvr.org/up_loader.1.1.0.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MKSKW3
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
143.204.241.15 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-241-15.cph50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
0615974c40d602afdbf9759533e352bc17b0458c85aad6694b1a1ad20659625b

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Tue, 23 Jun 2020 03:15:02 GMT
Content-Encoding
gzip
Last-Modified
Mon, 13 Jan 2020 19:16:48 GMT
Server
AmazonS3
Age
62739
Vary
Accept-Encoding
X-Cache
Hit from cloudfront
Content-Type
application/x-javascript
Via
1.1 955dd6709359125ce043ededf19b3991.cloudfront.net (CloudFront)
Connection
keep-alive
Transfer-Encoding
chunked
X-Amz-Cf-Pop
CPH50-C1
X-Amz-Cf-Id
DraWwjb8bUWaFkAIKN89v4t8wCJh4p0PMMQ6cnSMXwpcS7w8-28TMA==
count.js
malwarebytesunpacked.disqus.com/ 		1 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://malwarebytesunpacked.disqus.com/count.js
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/wp-content/plugins/disqus-comment-system/public/js/comment_count.js?ver=3.0.12
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.12.134 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
3487ef2baf0c08ba660a8a143cdeb8ebeec961eea04bccd7c49096b4eb26b875
Security Headers
Name Value
Strict-Transport-Security max-age=300; includeSubdomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Tue, 23 Jun 2020 20:40:40 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Age
687584
P3P
CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
Connection
keep-alive
Vary
Accept-Encoding
Content-Length
871
X-XSS-Protection
1; mode=block
Last-Modified
Mon, 01 Jun 2020 21:17:22 GMT
Server
nginx
ETag
"5ed57062-367"
Strict-Transport-Security
max-age=300; includeSubdomains
Content-Type
application/javascript; charset=utf-8
Cache-Control
public, max-age=300
Link
<https://disqus.com>; rel=preconnect, <https://c.disquscdn.com>; rel=preconnect
embed.js
malwarebytesunpacked.disqus.com/ 		69 KB
23 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://malwarebytesunpacked.disqus.com/embed.js
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/wp-content/plugins/disqus-comment-system/public/js/comment_embed.js?ver=3.0.12
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.12.134 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
openresty /
Resource Hash
1968ea0336742688eab80f729e2c91515b1994d8b596afe464cf51878f717fa1
Security Headers
Name Value
Strict-Transport-Security max-age=300; includeSubdomains

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Tue, 23 Jun 2020 20:40:40 GMT
Content-Encoding
gzip
Server
openresty
Age
0
Vary
Accept-Encoding
Connection
keep-alive
Content-Type
application/javascript; charset=utf-8
Cache-Control
private, max-age=60
X-Service
router
Strict-Transport-Security
max-age=300; includeSubdomains
Link
<https://disqus.com>; rel=preconnect, <https://c.disquscdn.com>; rel=preconnect
Content-Length
22632
wai.gif
genesis.malwarebytes.com/api/v1/ 		338 B
559 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://genesis.malwarebytes.com/api/v1/wai.gif
Requested by
Host: www.malwarebytes.com
URL: https://www.malwarebytes.com/js/jquery-1.11.3.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:1f18:21ae:6700:a732:5aa:237:e3cd Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
Apache-Coyote/1.1 /
Resource Hash
0b1e3ca440f9c4ef9b1d4c83d77ffb34c977cc98765770f6e5ee608512ddea03

Request headers

Accept
application/json, text/javascript, */*; q=0.01
Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 23 Jun 2020 20:40:40 GMT
server
Apache-Coyote/1.1
status
200
access-control-allow-methods
GET, POST
content-type
application/json
access-control-allow-origin
*
access-control-allow-credentials
true
access-control-allow-headers
origin, content-type, accept, authorization
0c464f970018f509444243b67a0c5447.json
gist.github.com/hasherezade/ 		8 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://gist.github.com/hasherezade/0c464f970018f509444243b67a0c5447.json?file=mcconf.xml&callback=jQuery1113015284271912254077_1592944840173&_=1592944840174
Requested by
Host: www.malwarebytes.com
URL: https://www.malwarebytes.com/js/jquery-1.11.3.min.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
140.82.118.3 , United States, ASN36459 (GITHUB, US),
Reverse DNS
lb-140-82-118-3-ams.github.com
Software
GitHub.com /
Resource Hash
c9f307444a42dfd6133d57be12bdecfe1849abff813efeeb206652264b22c266
Security Headers
Name Value
Content-Security-Policy default-src 'none'; base-uri 'self'; block-all-mixed-content; connect-src 'self' uploads.github.com www.githubstatus.com collector.githubapp.com api.github.com www.google-analytics.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com cdn.optimizely.com logx.optimizely.com/v1/events wss://live.github.com; font-src github.githubassets.com; form-action 'self' github.com gist.github.com; frame-ancestors 'none'; frame-src render.githubusercontent.com; img-src 'self' data: github.githubassets.com identicons.github.com collector.githubapp.com github-cloud.s3.amazonaws.com *.githubusercontent.com; manifest-src 'self'; media-src 'none'; script-src github.githubassets.com; style-src 'unsafe-inline' github.githubassets.com; worker-src github.com/socket-worker.js gist.github.com/socket-worker.js
Strict-Transport-Security max-age=31536000; includeSubdomains; preload
X-Content-Type-Options nosniff
X-Frame-Options deny
X-Xss-Protection 1; mode=block

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 23 Jun 2020 20:40:41 GMT
Content-Encoding
gzip
x-content-type-options
nosniff
status
200 OK
vary
X-PJAX, Accept-Encoding, Accept, X-Requested-With, Accept-Encoding
Content-Length
1245
x-xss-protection
1; mode=block
referrer-policy
origin-when-cross-origin, strict-origin-when-cross-origin
server
GitHub.com
X-GitHub-Request-Id
2B88:36F0:6A977:96ABC:5EF268C8
x-frame-options
deny
etag
W/"c9f307444a42dfd6133d57be12bdecfe"
expect-ct
max-age=2592000, report-uri="https://api.github.com/_private/browser/errors"
strict-transport-security
max-age=31536000; includeSubdomains; preload
content-type
application/javascript; charset=utf-8
cache-control
max-age=0, private, must-revalidate
content-security-policy
default-src 'none'; base-uri 'self'; block-all-mixed-content; connect-src 'self' uploads.github.com www.githubstatus.com collector.githubapp.com api.github.com www.google-analytics.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com cdn.optimizely.com logx.optimizely.com/v1/events wss://live.github.com; font-src github.githubassets.com; form-action 'self' github.com gist.github.com; frame-ancestors 'none'; frame-src render.githubusercontent.com; img-src 'self' data: github.githubassets.com identicons.github.com collector.githubapp.com github-cloud.s3.amazonaws.com *.githubusercontent.com; manifest-src 'self'; media-src 'none'; script-src github.githubassets.com; style-src 'unsafe-inline' github.githubassets.com; worker-src github.com/socket-worker.js gist.github.com/socket-worker.js
Accept-Ranges
bytes
0c464f970018f509444243b67a0c5447.json
gist.github.com/hasherezade/ 		8 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://gist.github.com/hasherezade/0c464f970018f509444243b67a0c5447.json?file=mcconf2.xml&callback=jQuery1113015284271912254077_1592944840175&_=1592944840176
Requested by
Host: www.malwarebytes.com
URL: https://www.malwarebytes.com/js/jquery-1.11.3.min.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
140.82.118.3 , United States, ASN36459 (GITHUB, US),
Reverse DNS
lb-140-82-118-3-ams.github.com
Software
GitHub.com /
Resource Hash
3488532b30e5c335b871bb769212a6a09c7f1028920b88bfccc85236d5064c8d
Security Headers
Name Value
Content-Security-Policy default-src 'none'; base-uri 'self'; block-all-mixed-content; connect-src 'self' uploads.github.com www.githubstatus.com collector.githubapp.com api.github.com www.google-analytics.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com cdn.optimizely.com logx.optimizely.com/v1/events wss://live.github.com; font-src github.githubassets.com; form-action 'self' github.com gist.github.com; frame-ancestors 'none'; frame-src render.githubusercontent.com; img-src 'self' data: github.githubassets.com identicons.github.com collector.githubapp.com github-cloud.s3.amazonaws.com *.githubusercontent.com; manifest-src 'self'; media-src 'none'; script-src github.githubassets.com; style-src 'unsafe-inline' github.githubassets.com; worker-src github.com/socket-worker.js gist.github.com/socket-worker.js
Strict-Transport-Security max-age=31536000; includeSubdomains; preload
X-Content-Type-Options nosniff
X-Frame-Options deny
X-Xss-Protection 1; mode=block

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 23 Jun 2020 20:40:41 GMT
Content-Encoding
gzip
x-content-type-options
nosniff
status
200 OK
vary
X-PJAX, Accept-Encoding, Accept, X-Requested-With, Accept-Encoding
Content-Length
1246
x-xss-protection
1; mode=block
referrer-policy
origin-when-cross-origin, strict-origin-when-cross-origin
server
GitHub.com
X-GitHub-Request-Id
2B84:438D:7440B:A8C0E:5EF268C8
x-frame-options
deny
etag
W/"3488532b30e5c335b871bb769212a6a0"
expect-ct
max-age=2592000, report-uri="https://api.github.com/_private/browser/errors"
strict-transport-security
max-age=31536000; includeSubdomains; preload
content-type
application/javascript; charset=utf-8
cache-control
max-age=0, private, must-revalidate
content-security-policy
default-src 'none'; base-uri 'self'; block-all-mixed-content; connect-src 'self' uploads.github.com www.githubstatus.com collector.githubapp.com api.github.com www.google-analytics.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com cdn.optimizely.com logx.optimizely.com/v1/events wss://live.github.com; font-src github.githubassets.com; form-action 'self' github.com gist.github.com; frame-ancestors 'none'; frame-src render.githubusercontent.com; img-src 'self' data: github.githubassets.com identicons.github.com collector.githubapp.com github-cloud.s3.amazonaws.com *.githubusercontent.com; manifest-src 'self'; media-src 'none'; script-src github.githubassets.com; style-src 'unsafe-inline' github.githubassets.com; worker-src github.com/socket-worker.js gist.github.com/socket-worker.js
Accept-Ranges
bytes
0c464f970018f509444243b67a0c5447.json
gist.github.com/hasherezade/ 		3 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://gist.github.com/hasherezade/0c464f970018f509444243b67a0c5447.json?file=servconf.xml&callback=jQuery1113015284271912254077_1592944840177&_=1592944840178
Requested by
Host: www.malwarebytes.com
URL: https://www.malwarebytes.com/js/jquery-1.11.3.min.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
140.82.118.3 , United States, ASN36459 (GITHUB, US),
Reverse DNS
lb-140-82-118-3-ams.github.com
Software
GitHub.com /
Resource Hash
1dac9f3d73870ec06135870a6aacd82b0e48a501b95442e7f49c7fcc000f4274
Security Headers
Name Value
Content-Security-Policy default-src 'none'; base-uri 'self'; block-all-mixed-content; connect-src 'self' uploads.github.com www.githubstatus.com collector.githubapp.com api.github.com www.google-analytics.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com cdn.optimizely.com logx.optimizely.com/v1/events wss://live.github.com; font-src github.githubassets.com; form-action 'self' github.com gist.github.com; frame-ancestors 'none'; frame-src render.githubusercontent.com; img-src 'self' data: github.githubassets.com identicons.github.com collector.githubapp.com github-cloud.s3.amazonaws.com *.githubusercontent.com; manifest-src 'self'; media-src 'none'; script-src github.githubassets.com; style-src 'unsafe-inline' github.githubassets.com; worker-src github.com/socket-worker.js gist.github.com/socket-worker.js
Strict-Transport-Security max-age=31536000; includeSubdomains; preload
X-Content-Type-Options nosniff
X-Frame-Options deny
X-Xss-Protection 1; mode=block

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 23 Jun 2020 20:40:41 GMT
Content-Encoding
gzip
x-content-type-options
nosniff
status
200 OK
vary
X-PJAX, Accept-Encoding, Accept, X-Requested-With, Accept-Encoding
Content-Length
849
x-xss-protection
1; mode=block
referrer-policy
origin-when-cross-origin, strict-origin-when-cross-origin
server
GitHub.com
X-GitHub-Request-Id
2B86:280F:93E3:D3DE:5EF268C8
x-frame-options
deny
etag
W/"1dac9f3d73870ec06135870a6aacd82b"
expect-ct
max-age=2592000, report-uri="https://api.github.com/_private/browser/errors"
strict-transport-security
max-age=31536000; includeSubdomains; preload
content-type
application/javascript; charset=utf-8
cache-control
max-age=0, private, must-revalidate
content-security-policy
default-src 'none'; base-uri 'self'; block-all-mixed-content; connect-src 'self' uploads.github.com www.githubstatus.com collector.githubapp.com api.github.com www.google-analytics.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com cdn.optimizely.com logx.optimizely.com/v1/events wss://live.github.com; font-src github.githubassets.com; form-action 'self' github.com gist.github.com; frame-ancestors 'none'; frame-src render.githubusercontent.com; img-src 'self' data: github.githubassets.com identicons.github.com collector.githubapp.com github-cloud.s3.amazonaws.com *.githubusercontent.com; manifest-src 'self'; media-src 'none'; script-src github.githubassets.com; style-src 'unsafe-inline' github.githubassets.com; worker-src github.com/socket-worker.js gist.github.com/socket-worker.js
Accept-Ranges
bytes
0c464f970018f509444243b67a0c5447.json
gist.github.com/hasherezade/ 		17 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://gist.github.com/hasherezade/0c464f970018f509444243b67a0c5447.json?file=dinj.xml&callback=jQuery1113015284271912254077_1592944840179&_=1592944840180
Requested by
Host: www.malwarebytes.com
URL: https://www.malwarebytes.com/js/jquery-1.11.3.min.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
140.82.118.3 , United States, ASN36459 (GITHUB, US),
Reverse DNS
lb-140-82-118-3-ams.github.com
Software
GitHub.com /
Resource Hash
3893f5b258efd7ce19c00e149018c5d57974b30b939c0d14d34c89d767c8b081
Security Headers
Name Value
Content-Security-Policy default-src 'none'; base-uri 'self'; block-all-mixed-content; connect-src 'self' uploads.github.com www.githubstatus.com collector.githubapp.com api.github.com www.google-analytics.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com cdn.optimizely.com logx.optimizely.com/v1/events wss://live.github.com; font-src github.githubassets.com; form-action 'self' github.com gist.github.com; frame-ancestors 'none'; frame-src render.githubusercontent.com; img-src 'self' data: github.githubassets.com identicons.github.com collector.githubapp.com github-cloud.s3.amazonaws.com *.githubusercontent.com; manifest-src 'self'; media-src 'none'; script-src github.githubassets.com; style-src 'unsafe-inline' github.githubassets.com; worker-src github.com/socket-worker.js gist.github.com/socket-worker.js
Strict-Transport-Security max-age=31536000; includeSubdomains; preload
X-Content-Type-Options nosniff
X-Frame-Options deny
X-Xss-Protection 1; mode=block

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 23 Jun 2020 20:40:41 GMT
Content-Encoding
gzip
x-content-type-options
nosniff
status
200 OK
vary
X-PJAX, Accept-Encoding, Accept, X-Requested-With, Accept-Encoding
Content-Length
1597
x-xss-protection
1; mode=block
referrer-policy
origin-when-cross-origin, strict-origin-when-cross-origin
server
GitHub.com
X-GitHub-Request-Id
2B8A:61C0:69067:94BD8:5EF268C8
x-frame-options
deny
etag
W/"3893f5b258efd7ce19c00e149018c5d5"
expect-ct
max-age=2592000, report-uri="https://api.github.com/_private/browser/errors"
strict-transport-security
max-age=31536000; includeSubdomains; preload
content-type
application/javascript; charset=utf-8
cache-control
max-age=0, private, must-revalidate
content-security-policy
default-src 'none'; base-uri 'self'; block-all-mixed-content; connect-src 'self' uploads.github.com www.githubstatus.com collector.githubapp.com api.github.com www.google-analytics.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com cdn.optimizely.com logx.optimizely.com/v1/events wss://live.github.com; font-src github.githubassets.com; form-action 'self' github.com gist.github.com; frame-ancestors 'none'; frame-src render.githubusercontent.com; img-src 'self' data: github.githubassets.com identicons.github.com collector.githubapp.com github-cloud.s3.amazonaws.com *.githubusercontent.com; manifest-src 'self'; media-src 'none'; script-src github.githubassets.com; style-src 'unsafe-inline' github.githubassets.com; worker-src github.com/socket-worker.js gist.github.com/socket-worker.js
Accept-Ranges
bytes
pillarpages.json
blog.malwarebytes.com/wp-content/themes/labs.malwarebytes.org-3.4.1.6/ 		22 KB
6 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://blog.malwarebytes.com/wp-content/themes/labs.malwarebytes.org-3.4.1.6/pillarpages.json
Requested by
Host: www.malwarebytes.com
URL: https://www.malwarebytes.com/js/jquery-1.11.3.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
3.198.211.130.bc.googleusercontent.com
Software
nginx / WP Engine
Resource Hash
36e1de96ae4201e358c1316721e0dd4adc04e3ffadd82aa014fc50f25efdec86
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

Accept
application/json, text/javascript, */*; q=0.01
Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
X-Requested-With
XMLHttpRequest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 23 Jun 2020 20:40:40 GMT
content-encoding
gzip
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding,Cookie
last-modified
Tue, 23 Jun 2020 20:37:09 GMT
server
nginx
x-cacheable
SHORT
x-powered-by
WP Engine
etag
W/"56a4-5a8c652c536a0"
x-frame-options
SAMEORIGIN
x-cache
HIT: 62
content-type
application/json
status
200
cache-control
max-age=600, must-revalidate
x-cache-group
normal
demandbase-forms.js
www.malwarebytes.com/js/ 		3 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.malwarebytes.com/js/demandbase-forms.js?d=2020-02-04-15-03-08--0800
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MKSKW3
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:20eb:5000:8:d3fb:39c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
5576e25dd8a4d45e90da43e0f127c4efb4d16eebcb7a1bc55fbb66e7cf504f9d

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 23 Jun 2020 20:39:55 GMT
via
1.1 41f60102fc29156bc5001d6646f75c02.cloudfront.net (CloudFront)
last-modified
Thu, 18 Jun 2020 21:11:54 GMT
server
AmazonS3
age
46
etag
"cb45a71066aa90353febec3e66fe17d4"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
status
200
x-amz-cf-pop
FRA2-C1
accept-ranges
bytes
content-length
3572
x-amz-cf-id
86UaK2olOPFWWD0_c4jw5HcS4OFB6c5mEIpt5AT2rf5_UhqABxuHYg==
ga-audiences
www.google.de/ads/
Redirect Chain
  • https://www.google-analytics.com/r/collect?v=1&_v=j83&a=739632739&t=pageview&_s=1&dl=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-analysis%2F2016%2F10%2Ftrick-bot-dyrezas-successor%2F&ul=en-us&de=U...
  • https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-3347303-10&cid=63000543.1592944841&jid=212980586&_gid=507961266.1592944841&gjid=1713856140&_v=j83&z=444867229
  • https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-3347303-10&cid=63000543.1592944841&jid=212980586&_v=j83&z=444867229
  • https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-3347303-10&cid=63000543.1592944841&jid=212980586&_v=j83&z=444867229&slf_rd=1&random=2734364629
42 B
106 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-3347303-10&cid=63000543.1592944841&jid=212980586&_v=j83&z=444867229&slf_rd=1&random=2734364629
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 23 Jun 2020 20:40:40 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
no-cache, no-store, must-revalidate
content-type
image/gif
alt-svc
h3-28=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Tue, 23 Jun 2020 20:40:40 GMT
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
302
content-type
text/html; charset=UTF-8
location
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-3347303-10&cid=63000543.1592944841&jid=212980586&_v=j83&z=444867229&slf_rd=1&random=2734364629
cache-control
no-cache, no-store, must-revalidate
timing-allow-origin
*
alt-svc
h3-28=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
0
bat.bing.com/action/ 		0
148 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://bat.bing.com/action/0?ti=4072696&Ver=2&mid=66df298e-26eb-c205-8b45-7223c05543fe&sid=139a457d-3ea8-e3f8-8000-9eaf674f4486&vid=fee9315a-1acc-8212-880a-e65927d1fd87-1&pi=0&lg=en-US&sw=1600&sh=1200&sc=24&tl=Introducing%20TrickBot,%20Dyreza%27s%20successor%20-%20Malwarebytes%20Labs%20%7C%20Malwarebytes%20Labs&p=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-analysis%2F2016%2F10%2Ftrick-bot-dyrezas-successor%2F&r=&lt=1566&evt=pageLoad&msclkid=N&sv=1&rn=969915
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status
204
pragma
no-cache
date
Tue, 23 Jun 2020 20:40:40 GMT
cache-control
no-cache, must-revalidate
x-msedge-ref
Ref A: 9BA0FA3A2A644DE98B1BC4FB66405737 Ref B: FRAEDGE1216 Ref C: 2020-06-23T20:40:40Z
access-control-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
count-data.js
malwarebytesunpacked.disqus.com/ 		490 B
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://malwarebytesunpacked.disqus.com/count-data.js?1=11354%20https%3A%2F%2Fblog.malwarebytes.org%2F%3Fp%3D11354&1=15831%20https%3A%2F%2Fblog.malwarebytes.com%2F%3Fp%3D15831&1=19164%20https%3A%2F%2Fblog.malwarebytes.com%2F%3Fp%3D19164&1=20605%20https%3A%2F%2Fblog.malwarebytes.com%2F%3Fp%3D20605
Requested by
Host: malwarebytesunpacked.disqus.com
URL: https://malwarebytesunpacked.disqus.com/count.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.12.134 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
381ef0930befc411031fa4bace83c6603310cc340557e866ff4c0bcfaf68c707
Security Headers
Name Value
Strict-Transport-Security max-age=300; includeSubdomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Tue, 23 Jun 2020 20:40:41 GMT
X-Content-Type-Options
nosniff
Server
nginx
Age
0
X-Frame-Options
SAMEORIGIN
Strict-Transport-Security
max-age=300; includeSubdomains
p3p
CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
Vary
Accept-Encoding
Cache-Control
public, max-age=600
Connection
keep-alive
Content-Type
application/javascript; charset=UTF-8
Link
<https://disqus.com>; rel=preconnect, <https://c.disquscdn.com>; rel=preconnect
Content-Length
490
X-XSS-Protection
1; mode=block
conversion_async.js
www.googleadservices.com/pagead/ 		29 KB
12 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googleadservices.com/pagead/conversion_async.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-930356311
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.23.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
mil04s23-in-f98.1e100.net
Software
cafe /
Resource Hash
6d288b7ed6ae193e96db2be7be1bc12dbcea22a302eea8f4a1aa48d96a64d3dd
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 23 Jun 2020 20:40:41 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
11031
x-xss-protection
0
server
cafe
etag
16934500053338638956
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600
timing-allow-origin
*
expires
Tue, 23 Jun 2020 20:40:41 GMT
11.1.40.js
script.crazyegg.com/pages/versioned/common-scripts/ 		60 KB
20 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://script.crazyegg.com/pages/versioned/common-scripts/11.1.40.js
Requested by
Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/scripts/0081/2893.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:9408 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
eaf309f92dd9c3da7034bd1cdb83768c149fc93b21e284e8c4580924e5ffc813

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 23 Jun 2020 20:40:40 GMT
content-encoding
gzip
cf-cache-status
HIT
age
110825
cf-polished
origSize=61776
status
200
cf-request-id
03848268f0000097166a958200000001
last-modified
Thu, 18 Jun 2020 14:44:53 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
5a810687edc19716-FRA
cf-bgj
minify
adsct
t.co/i/ 		43 B
449 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://t.co/i/adsct?p_id=Twitter&p_user_id=0&txn_id=o1m5j&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.244.42.133 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=0
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 23 Jun 2020 20:40:41 GMT
content-encoding
gzip
x-content-type-options
nosniff
status
200, 200 OK
x-twitter-response-tags
BouncerCompliant
content-length
65
x-xss-protection
0
x-response-time
121
pragma
no-cache
last-modified
Tue, 23 Jun 2020 20:40:41 GMT
server
tsa_o
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=0
content-type
image/gif;charset=utf-8
cache-control
no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash
8d8966a8a5849ec89ba1a158210abd7d
x-transaction
0058744400c73f48
expires
Tue, 31 Mar 1981 05:00:00 GMT
HWyTnY16.min.js
scripts.demandbase.com/ 		59 KB
16 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://scripts.demandbase.com/HWyTnY16.min.js
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
13.224.198.86 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-224-198-86.fra2.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
013d85b536328a8a8e3cf2cbd2be9d4a8a6ca1fe005c757fb6431f8afa5bfe89

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id
yH2O.DCYk_WxHiZuzhN184wihhQ_HSxW
content-encoding
gzip
last-modified
Thu, 16 Jan 2020 17:44:00 GMT
server
AmazonS3
age
2154
date
Tue, 23 Jun 2020 20:04:47 GMT
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript; charset=utf-8
status
200
cache-control
public, max-age=3600
x-amz-cf-pop
FRA2-C1
x-amz-cf-id
CGo6TntCL_hUdfWtyeb8mokU8AweDZHhzD_LHWYG8X-ix2tmMNZvkA==
via
1.1 cb33a7a4640adbb55df3e0d143601559.cloudfront.net (CloudFront)
insight.min.js
snap.licdn.com/li.lms-analytics/ 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:10c:39e::25ea , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software
/
Resource Hash
41dd5e421fe221a7d2921d6fa2b36e8b01a9f2c054aaef5fad866fe896c1d1e0

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Tue, 23 Jun 2020 20:40:40 GMT
Content-Encoding
gzip
Last-Modified
Mon, 07 Oct 2019 16:41:31 GMT
X-CDN
AKAM
Vary
Accept-Encoding
Content-Type
application/x-javascript;charset=utf-8
Cache-Control
max-age=35732
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
1576
lounge.5c5dad4ae74bbb3422efd01116dc45e6.css
c.disquscdn.com/next/embed/styles/ 		0
22 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://c.disquscdn.com/next/embed/styles/lounge.5c5dad4ae74bbb3422efd01116dc45e6.css
Requested by
Host: malwarebytesunpacked.disqus.com
URL: https://malwarebytesunpacked.disqus.com/embed.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:a913 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=300; includeSubdomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 23 Jun 2020 20:40:41 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
2253021
status
200
strict-transport-security
max-age=300; includeSubdomains
content-length
22038
x-xss-protection
1; mode=block
timing-allow-origin
*
last-modified
Thu, 28 May 2020 18:36:12 GMT
server
cloudflare
etag
"5ed0049c-5616"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000, public, immutable, no-transform
cf-request-id
03848269220000d6bde4308200000001
accept-ranges
bytes
cf-ray
5a8106883ab2d6bd-FRA
expires
Fri, 28 May 2021 18:50:18 GMT
common.bundle.d1c2fbfd8acab46a487aabc1b327ec9e.js
c.disquscdn.com/next/embed/ 		0
89 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://c.disquscdn.com/next/embed/common.bundle.d1c2fbfd8acab46a487aabc1b327ec9e.js
Requested by
Host: malwarebytesunpacked.disqus.com
URL: https://malwarebytesunpacked.disqus.com/embed.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:a913 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=300; includeSubdomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 23 Jun 2020 20:40:41 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
83049
status
200
strict-transport-security
max-age=300; includeSubdomains
content-length
90368
x-xss-protection
1; mode=block
timing-allow-origin
*
last-modified
Mon, 22 Jun 2020 21:29:41 GMT
server
cloudflare
etag
"5ef122c5-16100"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000, public, immutable, no-transform
cf-request-id
03848269260000d6bde4309200000001
accept-ranges
bytes
cf-ray
5a8106883ac3d6bd-FRA
expires
Tue, 22 Jun 2021 21:36:31 GMT
lounge.bundle.c1bff69470c1c3db88f177e778afdc25.js
c.disquscdn.com/next/embed/ 		0
109 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://c.disquscdn.com/next/embed/lounge.bundle.c1bff69470c1c3db88f177e778afdc25.js
Requested by
Host: malwarebytesunpacked.disqus.com
URL: https://malwarebytesunpacked.disqus.com/embed.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:a913 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=300; includeSubdomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 23 Jun 2020 20:40:41 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
83049
status
200
strict-transport-security
max-age=300; includeSubdomains
content-length
111580
x-xss-protection
1; mode=block
timing-allow-origin
*
last-modified
Mon, 22 Jun 2020 21:29:41 GMT
server
cloudflare
etag
"5ef122c5-1b3dc"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000, public, immutable, no-transform
cf-request-id
03848269260000d6bde430a200000001
accept-ranges
bytes
cf-ray
5a8106883ac4d6bd-FRA
expires
Tue, 22 Jun 2021 21:36:31 GMT
config.js
disqus.com/next/ 		0
6 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://disqus.com/next/config.js
Requested by
Host: malwarebytesunpacked.disqus.com
URL: https://malwarebytesunpacked.disqus.com/embed.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.0.134 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=300; includeSubdomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Tue, 23 Jun 2020 20:40:41 GMT
X-Content-Type-Options
nosniff
Content-Type
application/javascript; charset=UTF-8
Server
nginx
Age
51
X-Frame-Options
SAMEORIGIN
Strict-Transport-Security
max-age=300; includeSubdomains
p3p
CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
Access-Control-Allow-Origin
*
Cache-Control
public, stale-while-revalidate=300, s-stalewhilerevalidate=3600, max-age=60
Connection
keep-alive
Timing-Allow-Origin
*
Content-Length
5961
X-XSS-Protection
1; mode=block
collect
px.ads.linkedin.com/
Redirect Chain
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1056361&url=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-analysis%2F2016%2F10%2Ftrick-bot-dyrezas-successor%2F&time=1592944840982
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D1056361%26url%3Dhttps%253A%252F%252Fblog.malwarebytes.com%252Fthreat-analysis%252...
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1056361&url=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-analysis%2F2016%2F10%2Ftrick-bot-dyrezas-successor%2F&time=1592944840982&liSync=true
0
57 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1056361&url=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-analysis%2F2016%2F10%2Ftrick-bot-dyrezas-successor%2F&time=1592944840982&liSync=true
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a05:f500:10:101::b93f:9105 , Ireland, ASN14413 (LINKEDIN, US),
Reverse DNS
Software
Play /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 23 Jun 2020 20:40:41 GMT
server
Play
linkedin-action
1
x-li-fabric
prod-lva1
status
200
x-li-proto
http/2
x-li-pop
prod-efr5
content-type
application/javascript
content-length
0
x-li-uuid
4094tORGGxbw7oFBuioAAA==

Redirect headers

strict-transport-security
max-age=2592000
x-content-type-options
nosniff
linkedin-action
1
status
302
content-length
0
x-li-uuid
HBo6r+RGGxYgr5JtoSsAAA==
pragma
no-cache
x-li-pop
afd-prod-lva1
x-msedge-ref
Ref A: 38FE86D682CF40A695AA100B50D6C1D9 Ref B: FRAEDGE1421 Ref C: 2020-06-23T20:40:41Z
date
Tue, 23 Jun 2020 20:40:40 GMT
expect-ct
max-age=86400, report-uri="https://www.linkedin.com/platform-telemetry/ct"
x-frame-options
sameorigin
x-li-fabric
prod-lva1
location
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1056361&url=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-analysis%2F2016%2F10%2Ftrick-bot-dyrezas-successor%2F&time=1592944840982&liSync=true
x-xss-protection
1; mode=block
cache-control
no-cache, no-store
content-security-policy
default-src *; connect-src 'self' https://media-src.linkedin.com/media/ www.linkedin.com s.c.lnkd.licdn.com m.c.lnkd.licdn.com s.c.exp1.licdn.com s.c.exp2.licdn.com m.c.exp1.licdn.com m.c.exp2.licdn.com wss://*.linkedin.com dms.licdn.com https://dpm.demdex.net/id https://lnkd.demdex.net/event blob: static.licdn.com static-exp1.licdn.com static-exp2.licdn.com static-exp3.licdn.com media.licdn.com media-exp1.licdn.com media-exp2.licdn.com media-exp3.licdn.com; img-src data: blob: *; font-src data: *; style-src 'unsafe-inline' 'self' static-src.linkedin.com *.licdn.com; script-src 'report-sample' 'unsafe-inline' 'unsafe-eval' 'self' spdy.linkedin.com static-src.linkedin.com *.ads.linkedin.com *.licdn.com static.chartbeat.com www.google-analytics.com ssl.google-analytics.com bcvipva02.rightnowtech.com www.bizographics.com sjs.bizographics.com js.bizographics.com d.la4-c1-was.salesforceliveagent.com slideshare.www.linkedin.com https://snap.licdn.com/li.lms-analytics/insight.min.js platform.linkedin.com platform-akam.linkedin.com platform-ecst.linkedin.com platform-azur.linkedin.com; object-src 'none'; media-src blob: *; child-src blob: lnkd-communities: voyager: *; frame-ancestors 'self'
x-li-proto
http/2
expires
Thu, 01 Jan 1970 00:00:00 GMT
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/930356311/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/930356311/?random=1592944841057&cv=9&fst=1592944841057&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa6a0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-analysis%2F2016%2F10%2Ftrick-bot-dyrezas-successor%2F&tiba=Introducing%20TrickBot%2C%20Dyreza%27s%20successor%20-%20Malwarebytes%20Labs%20%7C%20Malwarebytes%20Labs&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4
Requested by
Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
3ba7635dba1a7fff908feb378324a21b25bb7a401446fa948b1aed4f67e21681
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 23 Jun 2020 20:40:41 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
cache-control
no-cache, must-revalidate
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
alt-svc
h3-28="googleads.g.doubleclick.net:443"; ma=2592000,h3-28=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
1096
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ip.json
api.company-target.com/api/v2/ 		439 B
948 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://api.company-target.com/api/v2/ip.json?referrer=&page=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-analysis%2F2016%2F10%2Ftrick-bot-dyrezas-successor%2F&page_title=Introducing%20TrickBot%2C%20Dyreza%27s%20successor%20-%20Malwarebytes%20Labs%20%7C%20Malwarebytes%20Labs&key=5527c2aa519592df7d44a24d0105731b&src=tag
Requested by
Host: scripts.demandbase.com
URL: https://scripts.demandbase.com/HWyTnY16.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
143.204.94.67 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-94-67.fra50.r.cloudfront.net
Software
nginx /
Resource Hash
6647bef5797b46447dcbeb44a211929c28694200a7e6b83fb25f8df9ee67bb97

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 23 Jun 2020 20:40:41 GMT
identification-source
CENTRAL
vary
Accept-Encoding, Origin
x-amz-cf-pop
FRA50-C1
x-cache
Miss from cloudfront
status
200
request-id
46f7f7db-6f0b-4d89-a77b-4d5a2004a535
content-encoding
gzip
pragma
no-cache
access-control-allow-origin
https://blog.malwarebytes.com
server
nginx
access-control-max-age
7200
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/json;charset=utf-8
via
1.1 b912dc97777020eb19579888add26978.cloudfront.net (CloudFront)
access-control-expose-headers
cache-control
no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials
true
api-version
v2
access-control-allow-headers
DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
h0uP3h83l4F_-LJXFOBEk7pMBbpVe3tsjXa-7Agu5XL9Stu0fzJoiA==
expires
Mon, 22 Jun 2020 20:40:41 GMT
validateCookie
segments.company-target.com/
Redirect Chain
  • https://match.prod.bidr.io/cookie-sync/demandbase
  • https://match.prod.bidr.io/cookie-sync/demandbase?_bee_ppp=1
  • https://segments.company-target.com/log?vendor=choca&user_id=AAS-IE695NIAABCLaFaWOQ
  • https://segments.company-target.com/validateCookie?vendor=choca&user_id=AAS-IE695NIAABCLaFaWOQ&verifyHash=d4ad2ae5c272ff1003b5582957dc6b75dfde2045
26 B
408 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://segments.company-target.com/validateCookie?vendor=choca&user_id=AAS-IE695NIAABCLaFaWOQ&verifyHash=d4ad2ae5c272ff1003b5582957dc6b75dfde2045
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
13.225.87.70 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-225-87-70.fra2.r.cloudfront.net
Software
/
Resource Hash
3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Tue, 23 Jun 2020 20:40:41 GMT
Via
1.1 2afacc6ad96dbba3f0b477cd95f16459.cloudfront.net (CloudFront)
X-Amz-Cf-Pop
FRA2-C2
Vary
Origin
X-Cache
Miss from cloudfront
Content-Type
image/gif
Transfer-Encoding
chunked
Connection
keep-alive
trace-id
8534cab0b1e71c73
X-Amz-Cf-Id
m65BDNPK2yu8YY-Mc-n-A0nX4foz8yscNvyHWMUUBrVENyuXciCSHg==

Redirect headers

Date
Tue, 23 Jun 2020 20:40:41 GMT
Via
1.1 2afacc6ad96dbba3f0b477cd95f16459.cloudfront.net (CloudFront)
X-Amz-Cf-Pop
FRA2-C2
Vary
Origin
X-Cache
Miss from cloudfront
Location
/validateCookie?vendor=choca&user_id=AAS-IE695NIAABCLaFaWOQ&verifyHash=d4ad2ae5c272ff1003b5582957dc6b75dfde2045
Connection
keep-alive
trace-id
ae166e33c2e92246
Content-Length
0
X-Amz-Cf-Id
yrYG-Tz6RM7_bsKhGN-y2LSWfGzqN7p3ZMPUWEcxeI2Fj-dZ6dlcPQ==
/
disqus.com/embed/comments/ Frame 8964 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://disqus.com/embed/comments/?base=default&f=malwarebytesunpacked&t_i=14942%20https%3A%2F%2Fblog.malwarebytes.com%2F%3Fp%3D14942&t_u=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-analysis%2F2016%2F10%2Ftrick-bot-dyrezas-successor%2F&t_e=Introducing%20TrickBot%2C%20Dyreza%E2%80%99s%20successor&t_d=Introducing%20TrickBot%2C%20Dyreza%27s%20successor%20-%20Malwarebytes%20Labs%20%7C%20Malwarebytes%20Labs&t_t=Introducing%20TrickBot%2C%20Dyreza%E2%80%99s%20successor&s_o=default
Requested by
Host: malwarebytesunpacked.disqus.com
URL: https://malwarebytesunpacked.disqus.com/embed.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.0.134 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
Security Headers
Name Value
Content-Security-Policy script-src https://*.twitter.com:* https://www.gstatic.com/recaptcha/ https://a.disquscdn.com https://c.disquscdn.com c.disquscdn.com https://*.services.disqus.com:* https://cdn.boomtrain.com/p13n/ https://apis.google.com https://cdn.syndication.twimg.com/tweets.json https://connect.facebook.net/en_US/sdk.js https://referrer.disqus.com/juggler/ 'unsafe-inline' https://com-disqus.netmng.com:* https://www.google.com/recaptcha/ https://cf.ignitionone.com:* https://disqus.com
Strict-Transport-Security max-age=300; includeSubdomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Host
disqus.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
iframe
Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/

Response headers

Connection
keep-alive
Content-Length
3556
Server
nginx
Content-Type
text/html; charset=utf-8
Content-Security-Policy
script-src https://*.twitter.com:* https://www.gstatic.com/recaptcha/ https://a.disquscdn.com https://c.disquscdn.com c.disquscdn.com https://*.services.disqus.com:* https://cdn.boomtrain.com/p13n/ https://apis.google.com https://cdn.syndication.twimg.com/tweets.json https://connect.facebook.net/en_US/sdk.js https://referrer.disqus.com/juggler/ 'unsafe-inline' https://com-disqus.netmng.com:* https://www.google.com/recaptcha/ https://cf.ignitionone.com:* https://disqus.com
Last-Modified
Tue, 13 Aug 2019 02:00:31 GMT
ETag
W/"lounge:view:5248669117.8262d56f9b4092d30dbee7c65417762d.2"
Link
<https://c.disquscdn.com>;rel=preconnect,<https://c.disquscdn.com>;rel=dns-prefetch
Cache-Control
stale-if-error=3600, s-stalewhilerevalidate=3600, stale-while-revalidate=30, no-cache, must-revalidate, public, s-maxage=5
p3p
CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
Timing-Allow-Origin
*
X-Content-Type-Options
nosniff
X-XSS-Protection
1; mode=block
Content-Encoding
gzip
Date
Tue, 23 Jun 2020 20:40:41 GMT
Age
0
Vary
Accept-Encoding
Strict-Transport-Security
max-age=300; includeSubdomains
/
www.google.com/pagead/1p-user-list/930356311/ 		42 B
112 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/pagead/1p-user-list/930356311/?random=1592944841057&cv=9&fst=1592942400000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa6a0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-analysis%2F2016%2F10%2Ftrick-bot-dyrezas-successor%2F&tiba=Introducing%20TrickBot%2C%20Dyreza%27s%20successor%20-%20Malwarebytes%20Labs%20%7C%20Malwarebytes%20Labs&async=1&fmt=3&is_vtc=1&random=1771986667&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81a::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 23 Jun 2020 20:40:41 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
no-cache, no-store, must-revalidate
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3-28=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/930356311/ 		42 B
107 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.de/pagead/1p-user-list/930356311/?random=1592944841057&cv=9&fst=1592942400000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa6a0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-analysis%2F2016%2F10%2Ftrick-bot-dyrezas-successor%2F&tiba=Introducing%20TrickBot%2C%20Dyreza%27s%20successor%20-%20Malwarebytes%20Labs%20%7C%20Malwarebytes%20Labs&async=1&fmt=3&is_vtc=1&random=1771986667&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 23 Jun 2020 20:40:41 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
no-cache, no-store, must-revalidate
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3-28=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
gist-embed-31007ea0d3bd9f80540adfbc55afc7bd.css
github.githubassets.com/assets/ 		23 KB
5 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://github.githubassets.com/assets/gist-embed-31007ea0d3bd9f80540adfbc55afc7bd.css
Requested by
Host: www.malwarebytes.com
URL: https://www.malwarebytes.com/js/jquery-1.11.3.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.199.108.154 Hoover, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
aa06051b1c939145f22a163564c3b9d5a3e5b95151c11d675fee25a5ac272a18

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-fastly-request-id
294fb4c44cf598f08d1efab42356e0ba02ae0b1c
date
Tue, 23 Jun 2020 20:40:41 GMT
content-encoding
gzip
age
9483633
x-cache
HIT, HIT
status
200
access-control-max-age
3600
content-length
4953
via
1.1 varnish, 1.1 varnish
x-served-by
cache-iad2124-IAD, cache-hhn4033-HHN
last-modified
Fri, 06 Mar 2020 02:17:54 GMT
server
AmazonS3
x-timer
S1592944841.193256,VS0,VE0
etag
"251755a24392f37def7c7d714f49c2e4"
vary
Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
access-control-allow-methods
GET
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
x-cache-hits
1, 3580
2764.svg
s.w.org/images/core/emoji/12.0.0-1/svg/ 		368 B
567 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.w.org/images/core/emoji/12.0.0-1/svg/2764.svg
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.48 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
s.w.org
Software
nginx /
Resource Hash
09a743ee0c32ca57c9be64b13b29c396310d1dd309cb4d7d3be722e47db95f27
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc
HIT fra 2
date
Tue, 23 Jun 2020 20:40:41 GMT
x-content-type-options
nosniff
last-modified
Mon, 08 Apr 2019 05:13:21 GMT
server
nginx
x-frame-options
SAMEORIGIN
content-type
image/svg+xml
status
200
cache-control
max-age=315360000
accept-ranges
bytes
content-length
368
expires
Thu, 31 Dec 2037 23:55:55 GMT
collect
www.google-analytics.com/ 		35 B
96 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google-analytics.com/collect?v=1&_v=j83&a=739632739&t=event&ni=1&_s=2&dl=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-analysis%2F2016%2F10%2Ftrick-bot-dyrezas-successor%2F&ul=en-us&de=UTF-8&dt=Introducing%20TrickBot%2C%20Dyreza%27s%20successor%20-%20Malwarebytes%20Labs%20%7C%20Malwarebytes%20Labs&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Demandbase&ea=API%20Resolution&el=IP%20API&_u=aHBAAEAB~&jid=&gjid=&cid=63000543.1592944841&tid=UA-3347303-10&_gid=507961266.1592944841&cd2=(Non-Company%20Visitor)&cd3=Bot&cd4=(Non-Company%20Visitor)&cd5=(Non-Company%20Visitor)&cd6=(Non-Company%20Visitor)&cd7=(Non-Company%20Visitor)&cd8=(Non-Company%20Visitor)&cd9=(Non-Company%20Visitor)&cd10=(Non-Company%20Visitor)&cd11=Prague&cd12=10&cd13=(Non-Company%20Visitor)&cd14=(Non-Company%20Visitor)&cd15=(Non-Company%20Visitor)&cd16=(Non-Company%20Visitor)&cd17=CZ&cd18=(Non-Company%20Visitor)&z=1618542854
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:817::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 10 Jun 2020 18:40:06 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
1130435
status
200
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
alt-svc
h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
activityi;dc_pre=CLfmyfvlmOoCFc_3dwodtIIGDw;src=5118230;type=count0;cat=secur00;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=1;num=1106850559293.18
5118230.fls.doubleclick.net/ Frame 56DE
Redirect Chain
  • https://5118230.fls.doubleclick.net/activityi;src=5118230;type=count0;cat=secur00;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=1;num=1106850559293.18?
  • https://5118230.fls.doubleclick.net/activityi;dc_pre=CLfmyfvlmOoCFc_3dwodtIIGDw;src=5118230;type=count0;cat=secur00;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=1;num=1106850559293.18?
0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://5118230.fls.doubleclick.net/activityi;dc_pre=CLfmyfvlmOoCFc_3dwodtIIGDw;src=5118230;type=count0;cat=secur00;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=1;num=1106850559293.18?
Requested by
Host: www.malwarebytes.com
URL: https://www.malwarebytes.com/js/jquery-1.11.3.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.23.102 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
mil04s23-in-f102.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=21600
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
5118230.fls.doubleclick.net
:scheme
https
:path
/activityi;dc_pre=CLfmyfvlmOoCFc_3dwodtIIGDw;src=5118230;type=count0;cat=secur00;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=1;num=1106850559293.18?
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/

Response headers

status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
date
Tue, 23 Jun 2020 20:40:41 GMT
expires
Fri, 01 Jan 1990 00:00:00 GMT
cache-control
no-cache, must-revalidate
strict-transport-security
max-age=21600
content-type
text/html; charset=UTF-8
pragma
no-cache
x-content-type-options
nosniff
content-encoding
gzip
server
cafe
content-length
416
x-xss-protection
0
set-cookie
test_cookie=CheckForPermission; expires=Tue, 23-Jun-2020 20:55:41 GMT; path=/; domain=.doubleclick.net; Secure; SameSite=none
alt-svc
h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

Redirect headers

status
302
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
date
Tue, 23 Jun 2020 20:40:41 GMT
pragma
no-cache
expires
Fri, 01 Jan 1990 00:00:00 GMT
cache-control
no-cache, must-revalidate
follow-only-when-prerender-shown
1
strict-transport-security
max-age=21600
location
https://5118230.fls.doubleclick.net/activityi;dc_pre=CLfmyfvlmOoCFc_3dwodtIIGDw;src=5118230;type=count0;cat=secur00;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=1;num=1106850559293.18?
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
server
cafe
content-length
0
x-xss-protection
0
alt-svc
h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
embed.js
malwarebytesunpacked.disqus.com/ 		69 KB
23 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://malwarebytesunpacked.disqus.com/embed.js?_=1592944840181
Requested by
Host: www.malwarebytes.com
URL: https://www.malwarebytes.com/js/jquery-1.11.3.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.12.134 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
openresty /
Resource Hash
cc8c1e7c194419a2336183eabfca7a84ae7ffb9f371c27105809f8fbf9c1d7c7
Security Headers
Name Value
Strict-Transport-Security max-age=300; includeSubdomains

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Tue, 23 Jun 2020 20:40:42 GMT
Content-Encoding
gzip
Server
openresty
Age
0
Vary
Accept-Encoding
Connection
keep-alive
Content-Type
application/javascript; charset=utf-8
Cache-Control
private, max-age=60
X-Service
router
Strict-Transport-Security
max-age=300; includeSubdomains
Link
<https://disqus.com>; rel=preconnect, <https://c.disquscdn.com>; rel=preconnect
Content-Length
22633
fbevents.js
connect.facebook.net/en_US/ 		133 KB
34 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://connect.facebook.net/en_US/fbevents.js
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f02d:12:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
73d764e56e8727bfd3de86dbe1c52f5105b4d6d0c41dbf91565e719e7cd74aed
Security Headers
Name Value
Content-Security-Policy default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; preload; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
status
200
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length
34036
x-xss-protection
0
pragma
public
x-fb-debug
XZKTsDqN43BfAiEd1EcGgu0oHlJ92XDC5B6wLydgHflicuGAHnCQZ7j4hoDGAQ87O53G8aD3S5Hteq6Fz4XRLg==
x-fb-trip-id
2133530978
x-frame-options
DENY
date
Tue, 23 Jun 2020 20:40:41 GMT, Tue, 23 Jun 2020 20:40:41 GMT
vary
Accept-Encoding
content-type
application/x-javascript; charset=utf-8
cache-control
public, max-age=1200
content-security-policy
default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';
expires
Sat, 01 Jan 2000 00:00:00 GMT
qevents.js
a.quora.com/ 		39 KB
14 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://a.quora.com/qevents.js
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.113.2 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
ef6de6beb1cf5bf809eccfe10f99aea0e0969c71d4eab5446410fef72695679f

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id
s3LlaOWABX1LUjiLldBNr49lVAylKDRo
content-encoding
gzip
etag
"f32ebb1e93a72c0a57add6d07f688510"
age
4594
x-cache
HIT, HIT
status
200
content-length
13681
x-amz-id-2
K1SyPArjmmUuBYMBJZiEvS5oTKaKN2xLCNyyU4zd5povxmAzLyIs+46s5+HNLpJRiObgrD9RrZw=
x-served-by
cache-bwi5130-BWI, cache-hhn4049-HHN
last-modified
Fri, 25 Oct 2019 19:28:38 GMT
server
AmazonS3
x-amz-meta-s3cmd-attrs
atime:1572031715/ctime:1572031714/gid:1000000/gname:employee/md5:f32ebb1e93a72c0a57add6d07f688510/mode:33188/mtime:1149709104/uid:1000332/uname:tzhou
x-timer
S1592944842.830364,VS0,VE0
date
Tue, 23 Jun 2020 20:40:41 GMT
vary
Accept-Encoding
x-amz-request-id
8EC87ACA11A1B43A
via
1.1 varnish, 1.1 varnish
cache-control
max-age=7200
accept-ranges
bytes
content-type
text/plain
x-cache-hits
1, 1267
s
ads.avct.cloud/
Redirect Chain
  • https://ads.avocet.io/s?add=5b8e9b462be173e55d6569fc&ty=j&_=1592944840182
  • https://ads.avct.cloud/s?r=1&add=5b8e9b462be173e55d6569fc&ty=j&_=1592944840182
  • https://ads.avct.cloud/s?bounce=true&r=1&add=5b8e9b462be173e55d6569fc&ty=j&_=1592944840182
0
336 B 		Script
General
Check archive.org
Download Go to
Full URL
https://ads.avct.cloud/s?bounce=true&r=1&add=5b8e9b462be173e55d6569fc&ty=j&_=1592944840182
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
3.250.202.183 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-250-202-183.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status
200
date
Tue, 23 Jun 2020 20:40:42 GMT
p3p
policyref="http://cdn.avocet.io/w3c/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-length
0
content-type
application/javascript

Redirect headers

status
302
date
Tue, 23 Jun 2020 20:40:41 GMT
p3p
policyref="http://cdn.avocet.io/w3c/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-length
107
location
/s?bounce=true&r=1&add=5b8e9b462be173e55d6569fc&ty=j&_=1592944840182
content-type
text/html; charset=utf-8
ytc.js
s.yimg.com/wi/ 		14 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s.yimg.com/wi/ytc.js
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1288:f03d:1fa::4000 , United Kingdom, ASN10310 (YAHOO-1, US),
Reverse DNS
Software
ATS /
Resource Hash
5b54138a1228bb354b4d200ba40bca6e8bf05c3476b3013daf8fa8162a414582
Security Headers
Name Value
Strict-Transport-Security max-age=15552000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 23 Jun 2020 20:38:57 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
106
x-amz-server-side-encryption
AES256
status
200
vary
Origin, Accept-Encoding
x-amz-request-id
2F999B7B92AF4B90
x-amz-id-2
4RLPnHu2irxxJ9MfugUcwVXUMMXQ/9zu7H0JqMbmKwaL/8ElSaW0tQW/B187ILSxfQXwQOSkjx0=
accept-ranges
bytes
referrer-policy
no-referrer-when-downgrade
x-amz-expiration
expiry-date="Sun, 23 May 2021 00:00:00 GMT", rule-id="oath-standard-lifecycle"
last-modified
Fri, 17 Apr 2020 10:13:12 GMT
server
ATS
etag
"262ad28777cd04301eaf1ed832269103-df"
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security
max-age=15552000
x-amz-version-id
.3pslEVav9FDmkNX3peqHq9djDal2LXy
x-xss-protection
1; mode=block
cache-control
public,max-age=3600
content-length
5398
content-type
application/javascript
munchkin.js
munchkin.marketo.net/ 		1 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://munchkin.marketo.net/munchkin.js
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
88.221.60.75 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a88-221-60-75.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
c7d7214a0b940c1ffcbd64689a576c5847b42e886da3ad9ea45bc4cda214bac8

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Tue, 23 Jun 2020 20:40:41 GMT
Content-Encoding
gzip
Last-Modified
Fri, 03 Apr 2020 02:45:45 GMT
Server
Apache
ETag
"aa520b8aca3502dbdbf62462e6f4be67:1585881945"
Vary
Accept-Encoding
P3P
policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Connection
keep-alive
Accept-Ranges
bytes
Content-Type
application/x-javascript
Content-Length
751
embed.js
malwarebytesunpacked.disqus.com/ 		69 KB
23 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://malwarebytesunpacked.disqus.com/embed.js?_=1592944840183
Requested by
Host: www.malwarebytes.com
URL: https://www.malwarebytes.com/js/jquery-1.11.3.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.12.134 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
openresty /
Resource Hash
cc8c1e7c194419a2336183eabfca7a84ae7ffb9f371c27105809f8fbf9c1d7c7
Security Headers
Name Value
Strict-Transport-Security max-age=300; includeSubdomains

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Tue, 23 Jun 2020 20:40:42 GMT
Content-Encoding
gzip
Server
openresty
Age
0
Vary
Accept-Encoding
Connection
keep-alive
Content-Type
application/javascript; charset=utf-8
Cache-Control
private, max-age=60
X-Service
router
Strict-Transport-Security
max-age=300; includeSubdomains
Link
<https://disqus.com>; rel=preconnect, <https://c.disquscdn.com>; rel=preconnect
Content-Length
22633
adsct
analytics.twitter.com/i/ 		31 B
650 B 		Script
General
Check archive.org
Download Go to
Full URL
https://analytics.twitter.com/i/adsct?p_id=Twitter&p_user_id=0&txn_id=o1m5j&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&tpx_cb=twttr.conversion.loadPixels&tw_document_href=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-analysis%2F2016%2F10%2Ftrick-bot-dyrezas-successor%2F
Requested by
Host: static.ads-twitter.com
URL: https://static.ads-twitter.com/uwt.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.244.42.131 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf
Security Headers
Name Value
Strict-Transport-Security max-age=631138519
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 23 Jun 2020 20:40:42 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status
200, 200 OK
x-twitter-response-tags
BouncerCompliant
strict-transport-security
max-age=631138519
content-length
57
x-xss-protection
0
x-response-time
108
pragma
no-cache
last-modified
Tue, 23 Jun 2020 20:40:41 GMT
server
tsa_o
x-frame-options
SAMEORIGIN
content-type
application/javascript;charset=utf-8
cache-control
no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash
784fc95c25cea425b61a8e312b90ad06
x-transaction
008fe130008bca0a
expires
Tue, 31 Mar 1981 05:00:00 GMT
up
insight.adsrvr.org/track/ Frame CC3C 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://insight.adsrvr.org/track/up?adv=8mirph5&ref=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-analysis%2F2016%2F10%2Ftrick-bot-dyrezas-successor%2F&upid=r8yigtp&upv=1.1.0
Requested by
Host: js.adsrvr.org
URL: https://js.adsrvr.org/up_loader.1.1.0.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
99.81.228.121 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-99-81-228-121.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash

Request headers

:method
GET
:authority
insight.adsrvr.org
:scheme
https
:path
/track/up?adv=8mirph5&ref=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-analysis%2F2016%2F10%2Ftrick-bot-dyrezas-successor%2F&upid=r8yigtp&upv=1.1.0
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/

Response headers

status
200
date
Tue, 23 Jun 2020 20:40:41 GMT
content-type
text/html
cache-control
private,no-cache, must-revalidate
pragma
no-cache
x-aspnet-version
4.0.30319
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
up
insight.adsrvr.org/track/ Frame 3C96 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://insight.adsrvr.org/track/up?adv=8mirph5&ref=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-analysis%2F2016%2F10%2Ftrick-bot-dyrezas-successor%2F&upid=r8yigtp&upv=1.1.0
Requested by
Host: js.adsrvr.org
URL: https://js.adsrvr.org/up_loader.1.1.0.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
99.81.228.121 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-99-81-228-121.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash

Request headers

:method
GET
:authority
insight.adsrvr.org
:scheme
https
:path
/track/up?adv=8mirph5&ref=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-analysis%2F2016%2F10%2Ftrick-bot-dyrezas-successor%2F&upid=r8yigtp&upv=1.1.0
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/

Response headers

status
200
date
Tue, 23 Jun 2020 20:40:41 GMT
content-type
text/html
cache-control
private,no-cache, must-revalidate
pragma
no-cache
x-aspnet-version
4.0.30319
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
1480959392203028
connect.facebook.net/signals/config/ 		522 KB
132 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://connect.facebook.net/signals/config/1480959392203028?v=2.9.21&r=stable
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f02d:12:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
891984080706aacfab48441baf7388530c10ee60074f75f33646498ab7eaf1ce
Security Headers
Name Value
Content-Security-Policy default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; preload; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
status
200
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length
134482
x-xss-protection
0
pragma
public
x-fb-debug
1iGU1mcuoJ5akksADvzOaKXsbJQXcT6YEeMIPvCgR2y+JEUvjmJ/uwB+OoI7MZF772CAgf5fKBtjN1gPjipz9g==
x-fb-trip-id
2133530978
x-frame-options
DENY
date
Tue, 23 Jun 2020 20:40:41 GMT, Tue, 23 Jun 2020 20:40:41 GMT
vary
Accept-Encoding
content-type
application/x-javascript; charset=utf-8
cache-control
public, max-age=1200
content-security-policy
default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';
expires
Sat, 01 Jan 2000 00:00:00 GMT
10110317.json
s.yimg.com/wi/config/ 		46 B
689 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://s.yimg.com/wi/config/10110317.json
Requested by
Host: s.yimg.com
URL: https://s.yimg.com/wi/ytc.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1288:f03d:1fa::4000 , United Kingdom, ASN10310 (YAHOO-1, US),
Reverse DNS
Software
ATS /
Resource Hash
51f4cf88527819ae3950b1820aa534ebf6c2fcbc0894db427ba5ab59d9efd659
Security Headers
Name Value
Strict-Transport-Security max-age=15552000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 23 Jun 2020 20:40:42 GMT
x-content-type-options
nosniff
age
1
x-amz-server-side-encryption
AES256
status
200
vary
Origin, Access-Control-Request-Headers, Access-Control-Request-Method
x-amz-request-id
545795E104764A1C
x-amz-id-2
2KXqO3tGvApPi3E+M/pR4lOdsMZkYAH1NHTOvzh7ux8OlGMZBcTIRC9DkoBDot35XXD1b9FXSTY=
accept-ranges
bytes
referrer-policy
no-referrer-when-downgrade
x-amz-expiration
expiry-date="Thu, 29 Jul 2021 00:00:00 GMT", rule-id="oath-standard-lifecycle"
last-modified
Tue, 23 Jun 2020 16:15:29 GMT
server
ATS
etag
"cc3d0e0815ad7ef45a521c2a63b65393"
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security
max-age=15552000
access-control-allow-methods
GET
x-amz-version-id
wXZ_nu_nu9aA6v9PTivxO9CdOpSassoA
access-control-allow-origin
*
x-xss-protection
1; mode=block
content-length
46
content-type
application/octet-stream
munchkin.js
munchkin.marketo.net/158/ 		11 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://munchkin.marketo.net/158/munchkin.js
Requested by
Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/munchkin.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
88.221.60.75 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a88-221-60-75.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
5f967fd41346c0fc1b9b44fa69c52bf1e754420c59c8017cefb0a14a764cafa4

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Tue, 23 Jun 2020 20:40:41 GMT
Content-Encoding
gzip
Last-Modified
Tue, 28 Jan 2020 03:01:21 GMT
Server
AkamaiNetStorage
ETag
"67df7eb9e9e68638308f14367dddec10:1580180481"
Vary
Accept-Encoding
P3P
policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Cache-Control
max-age=8640000
Connection
keep-alive
Accept-Ranges
bytes
Content-Type
application/x-javascript
Content-Length
4686
Expires
Thu, 01 Oct 2020 20:40:41 GMT
/
www.facebook.com/tr/ 		44 B
378 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.facebook.com/tr/?id=1480959392203028&ev=ViewContent&dl=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-analysis%2F2016%2F10%2Ftrick-bot-dyrezas-successor%2F&rl=&if=false&ts=1592944841883&sw=1600&sh=1200&v=2.9.21&r=stable&ec=0&o=30&fbp=fb.1.1592944841882.2126844258&it=1592944841799&coo=false&rqm=GET
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f12d:83:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 23 Jun 2020 20:40:41 GMT, Tue, 23 Jun 2020 20:40:41 GMT
last-modified
Fri, 21 Dec 2012 00:00:01 GMT
server
proxygen-bolt
strict-transport-security
max-age=31536000; includeSubDomains
content-type
image/gif
status
200
cache-control
no-cache, must-revalidate, max-age=0
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length
44
expires
Tue, 23 Jun 2020 20:40:41 GMT
pixel
q.quora.com/_/ad/64fab857ca52427587d3bd14a8d437b7/ 		43 B
423 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://q.quora.com/_/ad/64fab857ca52427587d3bd14a8d437b7/pixel?j=1&u=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-analysis%2F2016%2F10%2Ftrick-bot-dyrezas-successor%2F&tag=ViewContent&ts=1592944841887
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.193.47.47 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-193-47-47.compute-1.amazonaws.com
Software
nginx /
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Tue, 23 Jun 2020 20:40:42 GMT
Server
nginx
Connection
keep-alive
Content-Length
43
Strict-Transport-Security
max-age=63072000; includeSubDomains; preload
X-Q-Stat
,2caefb42ab693b46883612b445d80350,10.0.0.121,24074,89.238.186.243,,18357449217,1,1592944842.323,0.003,,.,0,0,0.000,0.000,-,0,0,197,290,145,10,26847,,,,,,-,
Content-Type
image/gif
visitWebPage
805-usg-300.mktoresp.com/webevents/ 		2 B
304 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://805-usg-300.mktoresp.com/webevents/visitWebPage?_mchNc=1592944841955&_mchCn=&_mchId=805-USG-300&_mchTk=_mch-malwarebytes.com-1592944841954-85200&_mchHo=blog.malwarebytes.com&_mchPo=&_mchRu=%2Fthreat-analysis%2F2016%2F10%2Ftrick-bot-dyrezas-successor%2F&_mchPc=https%3A&_mchVr=158&_mchEcid=&_mchHa=&_mchRe=&_mchQp=
Requested by
Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/158/munchkin.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
192.28.144.124 , United States, ASN15224 (OMNITURE, US),
Reverse DNS
Software
akka-http/10.1.11 /
Resource Hash
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Access-Control-Allow-Origin
*
Date
Tue, 23 Jun 2020 20:40:42 GMT
Content-Encoding
gzip
Server
akka-http/10.1.11
Transfer-Encoding
chunked
X-Request-Id
94ca4127-9f53-45bc-849a-aa4a6d0b102c
Content-Type
text/plain; charset=UTF-8
sp.pl
sp.analytics.yahoo.com/ 		0
528 B 		Script
General
Check archive.org
Download Go to
Full URL
https://sp.analytics.yahoo.com/sp.pl?a=10000&d=Tue%2C%2023%20Jun%202020%2020%3A40%3A42%20GMT&n=-2d&b=Introducing%20TrickBot%2C%20Dyreza%27s%20successor%20-%20Malwarebytes%20Labs%20%7C%20Malwarebytes%20Labs&.yp=10110317&f=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-analysis%2F2016%2F10%2Ftrick-bot-dyrezas-successor%2F&enc=UTF-8
Requested by
Host: s.yimg.com
URL: https://s.yimg.com/wi/ytc.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
212.82.100.181 , Switzerland, ASN34010 (YAHOO-IRD, GB),
Reverse DNS
spdc.pbp.vip.ir2.yahoo.com
Software
ATS /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 23 Jun 2020 20:40:42 GMT
x-content-type-options
nosniff
age
0
status
200
content-length
0
x-xss-protection
1; mode=block
pragma
no-cache
referrer-policy
strict-origin-when-cross-origin
server
ATS
x-frame-options
DENY
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security
max-age=31536000
content-type
application/x-javascript
cache-control
no-cache, private, must-revalidate
accept-ranges
bytes
expires
Tue, 23 Jun 2020 20:40:42 GMT
lounge.5c5dad4ae74bbb3422efd01116dc45e6.css
c.disquscdn.com/next/embed/styles/ 		0
22 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://c.disquscdn.com/next/embed/styles/lounge.5c5dad4ae74bbb3422efd01116dc45e6.css
Requested by
Host: malwarebytesunpacked.disqus.com
URL: https://malwarebytesunpacked.disqus.com/embed.js?_=1592944840183
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:a913 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=300; includeSubdomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 23 Jun 2020 20:40:42 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
2253022
status
200
strict-transport-security
max-age=300; includeSubdomains
content-length
22038
x-xss-protection
1; mode=block
timing-allow-origin
*
last-modified
Thu, 28 May 2020 18:36:12 GMT
server
cloudflare
etag
"5ed0049c-5616"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000, public, immutable, no-transform
cf-request-id
0384826d620000d6bde4376200000001
accept-ranges
bytes
cf-ray
5a81068f0ca9d6bd-FRA
expires
Fri, 28 May 2021 18:50:18 GMT
common.bundle.d1c2fbfd8acab46a487aabc1b327ec9e.js
c.disquscdn.com/next/embed/ 		0
88 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://c.disquscdn.com/next/embed/common.bundle.d1c2fbfd8acab46a487aabc1b327ec9e.js
Requested by
Host: malwarebytesunpacked.disqus.com
URL: https://malwarebytesunpacked.disqus.com/embed.js?_=1592944840183
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:a913 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=300; includeSubdomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 23 Jun 2020 20:40:42 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
83050
status
200
strict-transport-security
max-age=300; includeSubdomains
content-length
90368
x-xss-protection
1; mode=block
timing-allow-origin
*
last-modified
Mon, 22 Jun 2020 21:29:41 GMT
server
cloudflare
etag
"5ef122c5-16100"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000, public, immutable, no-transform
cf-request-id
0384826d620000d6bde4377200000001
accept-ranges
bytes
cf-ray
5a81068f0cabd6bd-FRA
expires
Tue, 22 Jun 2021 21:36:31 GMT
lounge.bundle.c1bff69470c1c3db88f177e778afdc25.js
c.disquscdn.com/next/embed/ 		0
109 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://c.disquscdn.com/next/embed/lounge.bundle.c1bff69470c1c3db88f177e778afdc25.js
Requested by
Host: malwarebytesunpacked.disqus.com
URL: https://malwarebytesunpacked.disqus.com/embed.js?_=1592944840183
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:a913 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=300; includeSubdomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 23 Jun 2020 20:40:42 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
83050
status
200
strict-transport-security
max-age=300; includeSubdomains
content-length
111580
x-xss-protection
1; mode=block
timing-allow-origin
*
last-modified
Mon, 22 Jun 2020 21:29:41 GMT
server
cloudflare
etag
"5ef122c5-1b3dc"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000, public, immutable, no-transform
cf-request-id
0384826d630000d6bde4378200000001
accept-ranges
bytes
cf-ray
5a81068f0cacd6bd-FRA
expires
Tue, 22 Jun 2021 21:36:31 GMT
config.js
disqus.com/next/ 		0
6 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://disqus.com/next/config.js
Requested by
Host: malwarebytesunpacked.disqus.com
URL: https://malwarebytesunpacked.disqus.com/embed.js?_=1592944840183
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.0.134 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=300; includeSubdomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Tue, 23 Jun 2020 20:40:42 GMT
X-Content-Type-Options
nosniff
Content-Type
application/javascript; charset=UTF-8
Server
nginx
Age
52
X-Frame-Options
SAMEORIGIN
Strict-Transport-Security
max-age=300; includeSubdomains
p3p
CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
Access-Control-Allow-Origin
*
Cache-Control
public, stale-while-revalidate=300, s-stalewhilerevalidate=3600, max-age=60
Connection
keep-alive
Timing-Allow-Origin
*
Content-Length
5961
X-XSS-Protection
1; mode=block
/
disqus.com/embed/comments/ Frame 737E 		0
0
/
disqus.com/embed/comments/ Frame F911 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://disqus.com/embed/comments/?base=default&f=malwarebytesunpacked&t_i=14942%20https%3A%2F%2Fblog.malwarebytes.com%2F%3Fp%3D14942&t_u=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-analysis%2F2016%2F10%2Ftrick-bot-dyrezas-successor%2F&t_e=Introducing%20TrickBot%2C%20Dyreza%E2%80%99s%20successor&t_d=Introducing%20TrickBot%2C%20Dyreza%27s%20successor%20-%20Malwarebytes%20Labs%20%7C%20Malwarebytes%20Labs&t_t=Introducing%20TrickBot%2C%20Dyreza%E2%80%99s%20successor&s_o=default
Requested by
Host: malwarebytesunpacked.disqus.com
URL: https://malwarebytesunpacked.disqus.com/embed.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.0.134 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
Security Headers
Name Value
Content-Security-Policy script-src https://*.twitter.com:* https://www.gstatic.com/recaptcha/ https://a.disquscdn.com https://c.disquscdn.com c.disquscdn.com https://*.services.disqus.com:* https://cdn.boomtrain.com/p13n/ https://apis.google.com https://cdn.syndication.twimg.com/tweets.json https://connect.facebook.net/en_US/sdk.js https://referrer.disqus.com/juggler/ 'unsafe-inline' https://com-disqus.netmng.com:* https://www.google.com/recaptcha/ https://cf.ignitionone.com:* https://disqus.com
Strict-Transport-Security max-age=300; includeSubdomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Host
disqus.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
iframe
Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/

Response headers

Connection
keep-alive
Content-Length
3556
Server
nginx
Content-Type
text/html; charset=utf-8
Content-Security-Policy
script-src https://*.twitter.com:* https://www.gstatic.com/recaptcha/ https://a.disquscdn.com https://c.disquscdn.com c.disquscdn.com https://*.services.disqus.com:* https://cdn.boomtrain.com/p13n/ https://apis.google.com https://cdn.syndication.twimg.com/tweets.json https://connect.facebook.net/en_US/sdk.js https://referrer.disqus.com/juggler/ 'unsafe-inline' https://com-disqus.netmng.com:* https://www.google.com/recaptcha/ https://cf.ignitionone.com:* https://disqus.com
Last-Modified
Tue, 13 Aug 2019 02:00:31 GMT
ETag
W/"lounge:view:5248669117.8262d56f9b4092d30dbee7c65417762d.2"
Link
<https://c.disquscdn.com>;rel=preconnect,<https://c.disquscdn.com>;rel=dns-prefetch
Cache-Control
stale-if-error=3600, s-stalewhilerevalidate=3600, stale-while-revalidate=30, no-cache, must-revalidate, public, s-maxage=5
p3p
CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
Timing-Allow-Origin
*
X-Content-Type-Options
nosniff
X-XSS-Protection
1; mode=block
Content-Encoding
gzip
Date
Tue, 23 Jun 2020 20:40:42 GMT
Age
1
Vary
Accept-Encoding
Strict-Transport-Security
max-age=300; includeSubdomains
/
www.facebook.com/tr/ 		0
110 B 		Other
General
Check archive.org
Download Go to
Full URL
https://www.facebook.com/tr/
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f12d:83:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
multipart/form-data; boundary=----WebKitFormBoundaryAFdD4Vc5rw9hx6T1

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
server
proxygen-bolt
date
Tue, 23 Jun 2020 20:40:42 GMT
status
200
content-type
text/plain
access-control-allow-origin
https://blog.malwarebytes.com
access-control-allow-credentials
true
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
disqus.com
URL
https://disqus.com/embed/comments/?base=default&f=malwarebytesunpacked&t_i=14942%20https%3A%2F%2Fblog.malwarebytes.com%2F%3Fp%3D14942&t_u=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-analysis%2F2016%2F10%2Ftrick-bot-dyrezas-successor%2F&t_e=Introducing%20TrickBot%2C%20Dyreza%E2%80%99s%20successor&t_d=Introducing%20TrickBot%2C%20Dyreza%27s%20successor%20-%20Malwarebytes%20Labs%20%7C%20Malwarebytes%20Labs&t_t=Introducing%20TrickBot%2C%20Dyreza%E2%80%99s%20successor&s_o=default

Verdicts & Comments Add Verdict or Comment

150 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate object| _wpemojiSettings function| $ function| jQuery boolean| pp_alreadyInitialized object| rlArgs number| a undefined| c function| jsonFeed object| OneTrust object| Optanon string| OnetrustActiveGroups string| OptanonActiveGroups object| dataLayer object| jQuery1113015284271912254077 function| OptanonWrapper boolean| alertFallback object| respond object| Modernizr object| html5 function| yepnope object| BackgroundCheck object| flexibility function| readCookie object| acceptCookies undefined| setCookie function| overlay function| getVariable boolean| isAdw boolean| uuid boolean| uuidParam object| uuidCookie object| cookieSettings function| EventEmitter object| eventie function| imagesLoaded object| mbamFreeValues object| mbamPremiumValues object| webpageValues undefined| midCookie object| playfairLsd boolean| midValue boolean| xsourceValue boolean| playfairValue boolean| refpage boolean| mktoLs undefined| lsCookie undefined| xsourceCookie undefined| playfairCookie function| applyXSource function| modURLParam string| urlID object| google_tag_manager function| postscribe number| hshInterval string| GoogleAnalyticsObject function| ga object| google_tag_data object| uetq function| twq object| countVars string| disqus_shortname object| embedVars string| disqus_url string| disqus_identifier string| disqus_container_id string| disqus_title undefined| disqus_config_custom function| disqus_config object| wpcom_img_zoomer object| detectZoom string| homeLink object| wp function| Spinner object| jetpackCarouselStrings function| submitSearchFooter function| submitSearchNav function| submitSearchrightrail undefined| countryError string| country undefined| xdr function| rl_view_image function| rl_hide_image boolean| doresize object| scroll_pos object| jQuery11240059529452460100885 boolean| hashtag function| closeSearchBar string| amphtml number| deviceWidth boolean| isMacLike object| preferredLanguage boolean| isMac boolean| isWindows boolean| isAndroid boolean| isiPhone boolean| isiPad boolean| isChromeOS function| showCurrentTab function| moveLabsNav undefined| jQuery1113015284271912254077_1592944840173 undefined| jQuery1113015284271912254077_1592944840175 undefined| jQuery1113015284271912254077_1592944840177 undefined| jQuery1113015284271912254077_1592944840179 object| gaplugins object| gaGlobal object| gaData function| UET object| twttr object| DISQUSWIDGETS undefined| disqus_domain object| twemoji function| gtag object| CE2 function| ttd_dom_ready function| TTDUniversalPixelApi string| fieldIds object| fields function| expandFormFields function| showAllFields function| hideFormFields function| demandbaseLoaded string| _linkedin_partner_id object| _linkedin_data_partner_ids object| DISQUS object| CE2BH function| lintrk boolean| _already_called_lintrk number| number_of_pillar_pages_to_show function| GooglemKTybQhCsO function| google_trackConversion object| GooglebQhCsO function| __extends object| Demandbase object| __db function| DBSegment undefined| demandbaseMarketoFormId string| axel boolean| cp function| fbq function| _fbq function| qp object| dotq object| YAHOO function| mktoMunchkinFunction object| Munchkin function| mktoMunchkin object| qevents object| MunchkinTracker

1 Cookies

Domain/Path Name / Value
.malwarebytes.com/ Name: OptanonConsent
Value: groups=1%3A1%2C0_165071%3A1%2C101%3A1%2C2%3A1%2C3%3A1%2C102%3A1%2C103%3A1%2C4%3A1%2C104%3A1%2C105%3A1%2C106%3A1%2C107%3A1%2C109%3A1%2C110%3A1%2C112%3A1%2C113%3A1%2C114%3A1%2C115%3A1%2C116%3A1%2C117%3A1%2C118%3A1%2C0_165051%3A1%2C0_165052%3A1%2C0_165053%3A1%2C0_165054%3A1%2C0_165055%3A1%2C0_165056%3A1%2C0_165057%3A1%2C0_165058%3A1%2C0_165059%3A1%2C0_165060%3A1%2C0_165061%3A1%2C0_165062%3A1%2C0_165063%3A1%2C0_165064%3A1%2C0_165065%3A1%2C0_165066%3A1%2C0_165067%3A1%2C0_165068%3A1%2C0_165069%3A1%2C0_165070%3A1%2C0_165072%3A1%2C0_165073%3A1%2C0_165074%3A1%2C0_168809%3A1%2C0_168810%3A1%2C0_171059%3A1%2C0_171060%3A1%2C0_171061%3A1%2C0_171062%3A1%2C0_171063%3A1%2C0_171064%3A1%2C0_172264%3A1%2C0_172327%3A1%2C0_179764%3A1%2C0_172332%3A1%2C0_172328%3A1%2C0_172329%3A1%2C108%3A1%2C111%3A1&datestamp=Tue+Jun+23+2020+22%3A40%3A41+GMT%2B0200+(Central+European+Summer+Time)&version=5.12.0

4 Console Messages

Source Level URL
Text
console-api log URL: https://blog.malwarebytes.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=1.4.1(Line 2)
Message:
JQMIGRATE: Migrate is installed, version 1.4.1
console-api log URL: https://www.malwarebytes.com/js/nav-resize.js(Line 268)
Message:
There is no hero section
console-api log URL: https://malwarebytesunpacked.disqus.com/embed.js(Line 41)
Message:
Use DISQUS.reset instead of reloading embed.js please.
console-api log URL: https://malwarebytesunpacked.disqus.com/embed.js(Line 41)
Message:
See https://help.disqus.com/customer/portal/articles/472107-using-disqus-on-ajax-sites

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
X-Frame-Options SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

5118230.fls.doubleclick.net
805-usg-300.mktoresp.com
9812475.fls.doubleclick.net
a.quora.com
ads.avct.cloud
ads.avocet.io
analytics.twitter.com
api.company-target.com
bat.bing.com
blog.malwarebytes.com
c.disquscdn.com
connect.facebook.net
disqus.com
fonts.googleapis.com
genesis.malwarebytes.com
gist.github.com
github.githubassets.com
googleads.g.doubleclick.net
insight.adsrvr.org
js.adsrvr.org
malwarebytesunpacked.disqus.com
match.prod.bidr.io
munchkin.marketo.net
optanon.blob.core.windows.net
px.ads.linkedin.com
q.quora.com
s.w.org
s.yimg.com
s0.wp.com
script.crazyegg.com
scripts.demandbase.com
secure.gravatar.com
segments.company-target.com
snap.licdn.com
sp.analytics.yahoo.com
static.ads-twitter.com
stats.g.doubleclick.net
t.co
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagmanager.com
www.linkedin.com
www.malwarebytes.com
disqus.com
104.244.42.131
104.244.42.133
13.224.198.86
13.225.87.70
130.211.198.3
140.82.118.3
143.204.241.15
143.204.94.67
151.101.0.134
151.101.112.157
151.101.113.2
151.101.12.134
172.217.18.6
172.217.23.102
172.217.23.98
185.199.108.154
192.0.77.32
192.0.77.48
192.28.144.124
212.82.100.181
2600:1f18:21ae:6700:a732:5aa:237:e3cd
2600:9000:20eb:5000:8:d3fb:39c0:93a1
2606:4700::6812:a913
2606:4700::6813:9408
2620:1ec:21::14
2620:1ec:c11::200
2a00:1288:f03d:1fa::4000
2a00:1450:4001:802::2008
2a00:1450:4001:808::2002
2a00:1450:4001:808::200a
2a00:1450:4001:809::2003
2a00:1450:4001:817::200e
2a00:1450:4001:81a::2004
2a00:1450:400c:c04::9c
2a02:26f0:10c:39e::25ea
2a03:2880:f02d:12:face:b00c:0:3
2a03:2880:f12d:83:face:b00c:0:25de
2a04:fa87:fffe::c000:4902
2a05:f500:10:101::b93f:9105
3.250.202.183
34.193.47.47
52.210.50.2
52.239.137.4
88.221.60.75
99.81.228.121
013d85b536328a8a8e3cf2cbd2be9d4a8a6ca1fe005c757fb6431f8afa5bfe89
03283b688bd5362e989c6efc0c3f31c21e06391dd8a5df3883ad8f85cb016bbc
03afa9b19fbd3f3040b89da3c264830752a3d08f6d89225444c3f7307570ba4f
05a173cb58022e81eb499529ac56df6ad7bafe1c61b8128dca8b76f300b5b60e
05ee3e141d98baa40fc2ba5f9962baf10ed5bfa702281ea07e1a8b95a24ff7d0
0615974c40d602afdbf9759533e352bc17b0458c85aad6694b1a1ad20659625b
08d8022edab174bafc3adecf2515c27de78e9894b30b8cd1f76748577a350cb4
09a743ee0c32ca57c9be64b13b29c396310d1dd309cb4d7d3be722e47db95f27
0a98a1800f0819cbb062ff6b62c8bd3ffe1d5e3789bc9c4563ba15f706b04832
0b1e3ca440f9c4ef9b1d4c83d77ffb34c977cc98765770f6e5ee608512ddea03
0ce295b662f2bc24b7bb2bb7bf86b4653d63f89424b7de82ded4090b0c7d52f6
0ed37960a59a6ec6b443f9ef043864d09a51db6fd276ae578d9166467bf986d1
0ed990c104caa18e9fb262ce1c52ce81e03a7479cbb68dcf0a3d5760c1864acc
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
1227293c9bd829507a1fadf6256dbc90e57f4b5d17fb5c3b33404c2dbfc76ef2
13253fa3b3061ad717460274d9aaa0d2bb6ce497349cf44cdc83199e12278a69
1532b16aa9cd1fef51c097aaf1abeac6cb6f239b026660e7105e49f4ae6549ff
19333622f176d68bc17e307d8df96b15447864fbb0bbaac495e507fa64d96077
1935d3f09e51b4e24027a7368ea9ecdaaab2b88f002f177647c2af81926263b7
1968ea0336742688eab80f729e2c91515b1994d8b596afe464cf51878f717fa1
1dac9f3d73870ec06135870a6aacd82b0e48a501b95442e7f49c7fcc000f4274
1db21d816296e6939ba1f42962496e4134ae2b0081e26970864c40c6d02bb1df
1dc2b8fb26c1a74260a66519a2a5fdf37a938d1b43bbe4d8da7fcd652acc61b9
1f504f86bc8f301e4041e744f681cce164e9ac5e8e5dfacc984a012e95e1a7cd
2117cb706513f910b22546f67048c21f21257037d9ab55a885348809f4ca26a1
21566c5bf140021872a218e16bd8d32d6ee52869d918d75fca0e3f396319fa9a
22b99779db19469478b0d70ca7d04e43e0b06aedcdaea1ecdec8888b628b7f18
23a25280a35e9e4a84b3c894f542b6f848e6c26c657c2edcade33164a3322fee
319949c8c08b86e9c35ea542c0dc0c30cedaa9b8d3d3c3327a36c91aefbd8af5
31c764e147f820cc44d536562bddf519a1ba783998328390507401697e09188b
32bead89f8c7b43b3b2c3208cc570192e99b1042a151cde913074a71ba44a557
32d4b293bb7f25a21cc44e81184d4bbcb3bdd1837e026b98ed0ad85b3b1a5292
3487ef2baf0c08ba660a8a143cdeb8ebeec961eea04bccd7c49096b4eb26b875
3488532b30e5c335b871bb769212a6a09c7f1028920b88bfccc85236d5064c8d
36e1de96ae4201e358c1316721e0dd4adc04e3ffadd82aa014fc50f25efdec86
36e3052355fd8aa03431efa1940b95f1424f6ff56a06d660a1add952c9339861
36f9c1e2ccdb008580e07af17424a8fe7a6fddeadcfdf9c0fa5ceba8d69f131b
381ef0930befc411031fa4bace83c6603310cc340557e866ff4c0bcfaf68c707
383b99377cffb13c340c9ca9069826b500dd30aa01312572d659cfb9ad814389
3893f5b258efd7ce19c00e149018c5d57974b30b939c0d14d34c89d767c8b081
3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1
3ba7635dba1a7fff908feb378324a21b25bb7a401446fa948b1aed4f67e21681
3ded49ec357474ead2928b3fd9523df804b1fea51dd278f988a3ca74a8fc3c95
40112a548d4b086ce9cda90604f60ebeaa85db367107e727edf8eafecae04106
41dd5e421fe221a7d2921d6fa2b36e8b01a9f2c054aaef5fad866fe896c1d1e0
42044d2f67a563820783809582b367cf2195586acffb544fbc01d9c58787d435
425328ed7a60e35938fa92fc7ba5f5af96b53f9608bb41b8a07c0f91e8bdefcd
4823fc995bed6c3bbd18a1d9c4184b9cfd7832a277729c501331815aef6dfd02
48eb8b500ae6a38617b5738d2b3faec481922a7782246e31d2755c034a45cd5d
4b35d53624a7e2b5195860f5c9695511a277d581e45befad43b02d8913aadef2
4ed10d0d64bb1515397e8666a63f484d640dbc5678fa62574e077b7aef1c3af2
51f4cf88527819ae3950b1820aa534ebf6c2fcbc0894db427ba5ab59d9efd659
527f5743db62b7f9d19fb4b1910eb56d63f76f50b0e0180b63eb67d374642099
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
5576e25dd8a4d45e90da43e0f127c4efb4d16eebcb7a1bc55fbb66e7cf504f9d
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
58c13e24cdfb6384c26836e3eac52d17701cd9d686c56ebf93efbbe9426f8cd6
5b3d9b7563aa18f4c7ac58b6339e90e8cff1b87dca873edc15e43903deb7ed73
5b54138a1228bb354b4d200ba40bca6e8bf05c3476b3013daf8fa8162a414582
5f967fd41346c0fc1b9b44fa69c52bf1e754420c59c8017cefb0a14a764cafa4
623f80af82697dd496db7e760a88ca69b855018b8e30182fe382334ad7614b99
6429fe0ed81fca5f6bb18cb0a0aacae3bd9de79192635aeed4cbda438139d75d
6647bef5797b46447dcbeb44a211929c28694200a7e6b83fb25f8df9ee67bb97
6a632fa951c4c290e7ff6c4890ab780cd804e2d29144181dbc79eae308aa8248
6d288b7ed6ae193e96db2be7be1bc12dbcea22a302eea8f4a1aa48d96a64d3dd
6ebcda7a3a41ef97f0b4071160ceb1020e540fdc0f790079a5c2ef01ab654fe0
7102ea65a4f1546a7b0227a53cc9058a211ba97d34d563c4f0d7f99b03e79c70
72622641b79819e5c8b5c0543d105a45e30f13b1a6c0b5c3701e72de5b57e427
7357caa8cc46347f866ef2e577458981a95dbe61dd8818ac68d16c2bf824c887
73d764e56e8727bfd3de86dbe1c52f5105b4d6d0c41dbf91565e719e7cd74aed
75f9768f79e42df5aa6183372a4b067f02682606cca5f242e06d1e07f3614c94
77ba68609568d437390cbb65544587932427e90e34ca01b3b083147f4a5f66a3
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
84415c35f6869b6b17590d6ba8f3115751f14d54adecbb27123008c416e4556d
8640d0e61015cd2786a76e6317fad368852aa017a9333c187a5053b7a192f758
886f70c3e30343eb48a987ba13f995c122f17d8cd5b90094369cbe42924c3e91
891984080706aacfab48441baf7388530c10ee60074f75f33646498ab7eaf1ce
891a15df4ca8bfbd1ed08a7af08e5677fbf0b82c6163eb3f19f0506721f791de
8c20518cd7e51066b82e8a8a1e8035210741cf808c02268915747960f531061c
8f796d398e512c5d19a2fecc943d19a204927ff3cf9ec2cb3f75a025535268cd
95a2c350aabb2955eaaf7a8bbfb494c2533cc20207ac4a026a0100dbac0a554a
95cb7d08e289a0501243c287e90223acfd72b6e4adb60a7d34a2c8fb6abc07ab
964cdc4bf872d0a1efede6b1fd8485d7427e6f867976c90de730a1c262ed260f
96d33f532112177ede6bf262dcf6d0140dbe29f05a4595d17b0be4743205b5ea
99565415652f9f00b619d24f960c902563e1003ab9ae1d36c3cb057d8b657f61
9bdc657519dc292a54f52b72302d19cb007eb8a091617559a1fac2628eac8c1f
9fcb181721162ce0d395b7b9b1e5bb5ca82c5f79bde749d4d0467ec2e65fcb4a
a182e45f051c3b540f4e10ea2b38b08db2ba43d38ff33686de11b23e56df7a1b
a2b3f57762f2932505c6fa9b43932cb13856966074febc5bb048052f17100bf6
a2e87f86272d2eded76241950ce4fde80728352b3a8b69321a8cf961b0080489
a3d902fafe16ae4bed4e1b9054090d7e6e93f5fbc14bffdfc470fad8c536775e
a50adbd525500a60b4ac0f23ab7a13471bfb3ef5739892e22c46301879115feb
a52bbdb7b132e850fdaf5740012fcc0bc3f6ef0be520bc4b987d8761d40d015a
a6a97c4046257c7e4e063c9f76434c7ce2c1f105e46b07424fabfc054f2d4d24
aa06051b1c939145f22a163564c3b9d5a3e5b95151c11d675fee25a5ac272a18
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
ad2cc26b0fdde8f4eb637ed12b25364e85af0bfba227dad42cb997ff4ad23eeb
b10a8b01476da3fc060041be45e92a42f65c24115f1c64eff444735de47f2a54
b28678c51b4397abc7951fe8a69a8aec0fa299159d5eb4ced487aabbb89f44b5
b4e6efb587f3fdfb8155148201d0c51ac95d249a6727e8256acdfe624ade69af
b6f7b31210a709daca9760b215660b2cbe719757df3059364beeda005fca2dbe
bca7af0b45b6fc6a2064e8e7a34f2041f3e77261e63f0257209bcde6bc40545d
bde19b29400b82f718bd8499b76d048496c30ad0959412749c36d36dec875ad1
bf9c8e4fb4633bc4ac3c201cc118c1501d7a688813ad0e229f098476b0f82824
c21ce2ab751ba8a0d5c983b35899437f95e4a60833b6aa1d13bc15ff038e8764
c2a416d323532adec9aa1ad3a8b35a3bf2e01449fa2bba9a28a7547b8ef8d36e
c2e823886bd708e2443ba3dd64630cd064e15e2eaa7580c03fea9fdd5cd2838d
c7d7214a0b940c1ffcbd64689a576c5847b42e886da3ad9ea45bc4cda214bac8
c9f307444a42dfd6133d57be12bdecfe1849abff813efeeb206652264b22c266
cb1ab3021b66ae828f0da4d8eb6470e5dad1a004b82b644dd2aeec20d2d28861
cc8c1e7c194419a2336183eabfca7a84ae7ffb9f371c27105809f8fbf9c1d7c7
cea0a05c5af6e21a409875328ed2e3dba79131b7c41f8ea07d0e0e02c7b7b59e
cf4f7af10cd2676b0cff793e9525301fa24cc2de65bad0658380a4f6661dc3d2
d1459acec6ea83b5908eff2f351da55ceedecdea59cee3fdf785d9e15fe1629b
da1c1ad273854673c3a3f7e8f76aae5d7c9c73f3ebd224c2be1f93106680b1d4
da819542692b3f1c2a667ba34eff3465a82d9756953a1446ab7d0772f9b1edd5
dc568bb8616eed9a8c3c3c94834cfa2260743720fd2af3ffb6edf7fa1e32ebb5
df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf
df73bd6bed3e91e18f6100fbfbf4324ec49aadfc49681facb35d700f0f5bb893
e1cb886dfcdd5fe6412e646b3e1ce78d59c847844dc51c13597e549e6ea8ea4d
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e5087adff56cd9077a7b21a01d78e2a97177cbf4872935bbf3049d06ee884826
e9b576dd8344739f0371e137b8d6ca523ada54634d19e9c3826a432c9845df38
eaf309f92dd9c3da7034bd1cdb83768c149fc93b21e284e8c4580924e5ffc813
ecb916133a9376911f10bc5c659952eb0031e457f5df367cde560edbfba38fb8
ece8b895d39bc9c6fbcb407610bfca4900ef6e99cee5bac71f2bb5512bd13603
ed2491fc7526ff0b5cfec3fe6f4cf8153796520fc845b735286b0f42183da98a
edda03990c5d77149008225a15938e07aa1998d2cdff56f693273a498214d600
ee296f5bdbfc73c788b0f1e9c8900bc288f08203ce9959ca85faad545d426041
ee990b34a0d12a9e15b74e02a2d90385e9c5ccb3fd45b4f40de9e7cbd44f0357
eef6488d5a9ff6366ce09960198bf3b2d23df800b0b4f250a6ca87d3c786a304
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
ef6de6beb1cf5bf809eccfe10f99aea0e0969c71d4eab5446410fef72695679f
f055e217bde76d711bd8b42af773f9f99b8a29d81ad9ed10b6379cc7e6c60452
f32d41f2099a0be20e6b57c5e0d1b71c079d3e1345827b0f5c5b97c6e5e3f78d
f6c0eb9904255cc5ab53dd2c0b8207caff3ce91bb212f36ff8d84514a1f9ed8e
fd361b57998c76f86335afa28b8a62527d88a8200fb5c428d6f0fff73383e955